ITN-23-038 OBIS Modernization - FINAL.pdf

Invitation to Negotiate (ITN)

Offender-Based Information System (OBIS) Modernization

FDC ITN-23-038

Esther Chung Procurement Officer Florida Department of Corrections 501 S. Calhoun Street Tallahassee, FL 32399

Page 2 of 302 FDC ITN-23-038

TABLE OF CONTENTS

TIMELINE

SECTION 1 – DEFINITIONS

SECTION 2 – INTRODUCTION

2.1 Background

2.2 Statement of Purpose

2.3 Procurement Overview

2.4 Service Implementation and Transition

2.5 Term of Contract

2.6 Pricing Methodology

2.7 Value-Added Services

2.8 Resource Library

SECTION 3 – SCOPE OF WORK

3.1 General Description of Services

3.2 Current Processes

3.3 Stakeholders

3.4 Rules, Regulations, and Governance

3.5 Service Locations

3.6 Functional Requirements

3.7 Service Area Requirements

3.8 Contract Monitoring

3.9 Success Criteria

3.10 Deliverables

3.11 General Reporting Requirements

3.12 Performance Measures

3.13 Financial Consequences

3.14 Future Transitions and Contract Termination Task

SECTION 4 – PROCUREMENT RULES AND INFORMATION

4.1 General Instructions to Vendors

4.2 Procurement Officer

4.3 Questions

4.4 Mandatory Pre-Reply Conference

4.5 Special Accommodations

4.6 Alternate Provisions and Conditions

4.7 Reply Bond

4.8 Performance Bond

4.9 Source Code Escrow Account

4.10 Pass/Fail Mandatory Responsiveness Requirements

4.11 Submission of Replies

4.12 Contents of Reply Submittals

4.13 Reply Opening

4.14 Costs of Preparing Reply

4.15 Disposal of Replies

4.16 Right to Withdraw

4.17 Right to Reject Reply Submissions and Waiver of Minor Irregularities

4.18 Addenda

Page 3 of 302 FDC ITN-23-038

4.19 Reply Evaluation Criteria

4.20 Reply Evaluation and Negotiation Process

4.21 No Prior Involvement and Conflicts of Interest

4.22 State Licensing Requirements

4.23 MyFloridaMarketPlace Vendor Registration

4.24 Unauthorized Employment of Alien Workers

4.25 Confidential, Proprietary, or Trade Secret Material

4.26 Substitute W-9

4.27 Scrutinized Company Certification

4.28 Disclosure of Reply Submittal Contents

4.29 Advertising Notice of Agency Decision

4.30 Protest Procedures

SECTION 5 – CONTRACT TERMS AND CONDITIONS

5.1 General Contract Conditions

5.2 Travel Expenses

5.3 E-Verify

5.4 State Initiatives

5.5 Subcontracts

5.6 Insurance

5.7 Intellectual Property

5.8 Independent Contractor Status

5.9 Assignment

5.10 Use of Funds for Lobbying Prohibited

5.11 Reservation of Rights

5.12 Taxes

5.13 Safety Standards

5.14 Americans with Disabilities Act

5.15 HIPAA Business Associate Agreement

5.16 Employment of Department Personnel

5.17 Legal Requirements

5.18 Conflict of Law and Controlling Provisions

5.19 Prison Rape Elimination Act (PREA)

5.20 Contract Modifications

5.21 Rights to Examine, Audit, and Administer Resources

5.22 Default

5.23 Termination

5.24 Retention of Records

5.25 Audit Records

5.26 Indemnification

5.27 Cooperation with the Inspector General

5.28 Cooperation with the Florida Senate and Florida House of Representatives

5.29 Security Requirements

5.30 Disputes

ATTACHMENT I – PRICE INFORMATION SHEET

ATTACHMENT II – NONDISCLOSURE AGREEMENT FOR RESTRICTED INFORMATION

ATTACHMENT III – SERVICE LOCATIONS

ATTACHMENT IV – REPLY BOND FORM

Page 4 of 302 FDC ITN-23-038

ATTACHMENT V – PASS/FAIL REQUIREMENT CERTIFICATION AND NON-COLLUSION

CERTIFICATION

ATTACHMENT VI – VENDOR’S CONTACT INFORMATION AND CERTIFICATION

ATTACHMENT VII – NOTICE OF CONFLICT OF INTEREST

ATTACHMENT VIII – CERTIFICATION OF DRUG FREE WORKPLACE PROGRAM

ATTACHMENT IX – VENDOR’S REFERENCE FORM

ATTACHMENT X – SUBCONTRACTING FORM

ATTACHMENT XI – REPLY REFERENCE SHEET

ATTACHMENT XII – BUSINESS ASSOCIATE AGREEMENT FOR HIPAA

ATTACHMENT XIII – SECURITY REQUIREMENTS FOR CONTRACTORS

[REMAINDER OF PAGE INTENTIONALLY LEFT BLANK]

Page 5 of 302 FDC ITN-23-038

TIMELINE

FDC ITN-23-038

EVENT DATE LOCATION

Release of ITN June 23, 2023 Vendor Information Portal (VIP):

https://vendor.myfloridamarketplace.com/

Mandatory Pre-Reply Conference

July 21, 2023, at 8:00 a.m., Eastern Time

Meeting Location:

Wakulla Correctional Institution Harry K. Singletary Training Building 110 Melaleuca Drive Crawfordville, Florida 32327

Last Day for Written Inquiries to be Received by the Department

August 04, 2023, by 5:00 p.m., Eastern Time

Submit Inquiries to:

Florida Department of Corrections Bureau of Procurement Email: purchasing@fdc.myflorida.com Subject Line Should Read: FDC ITN-23-038

Anticipated Posting of Written Responses to

Written Inquiries September 27, 2023

Vendor Information Portal (VIP):

https://vendor.myfloridamarketplace.com/

Sealed Replies Due and Opened

October 25, 2023, at 2:00 p.m., Eastern Time

Replies Should be Addressed to:

Attn: Esther Chung, Procurement Officer Florida Department of Corrections Bureau of Procurement 501 South Calhoun Street Tallahassee, Florida 32399

Anticipated Evaluation Team Meeting

November 08, 2023, at 2:00 p.m., Eastern Time

Meeting Location:

Florida Department of Corrections Bureau of Procurement 501 South Calhoun Street Tallahassee, Florida 32399

Anticipated Negotiations January 2024 –

March 2024

Meeting Location:

Florida Department of Corrections Bureau of Procurement 501 South Calhoun Street Tallahassee, Florida 32399

Anticipated Award Recommendation Meeting

May 2024

Meeting Location:

Florida Department of Corrections Bureau of Procurement 501 South Calhoun Street Tallahassee, Florida 32399

Anticipated Posting of Intent to Award

June 2024 Vendor Information Portal (VIP):

https://vendor.myfloridamarketplace.com/

Page 6 of 302 FDC ITN-23-038

SECTION 1 – DEFINITIONS

The following terms used in this Invitation to Negotiate (ITN), unless the context otherwise clearly requires a different construction and interpretation, have the following meanings:

1.1 American Correctional Association (ACA): An international accreditation entity that establishes national standards for, and conducts audits of, correctional programs, in order to assess their administration and management, the facilities, operations and services, Inmate programs, staff training, medical services, sanitation, use of segregation and detention, incidents of violence, crowding, Offender activity levels, and provision of basic services which may impact the life, safety, and health of Inmates and staff.

1.2 Breach of Contract: Failure by the Contractor to fulfill their obligations under any contract which may result from this ITN.

1.3 Business Day: Monday through Friday, excluding State holidays or other official closures.

1.4 Business Hours: 8:00 a.m. to 5:00 p.m., Eastern Time (ET), each Business Day.

1.5 Common Business Oriented Language (COBOL): Computer programming language used by OBIS.

1.6 Contract: A formal written agreement, resulting from this ITN, that contains or incorporates the terms and conditions that apply to the purchase to be made pursuant to this ITN, executed between the Department and the Contractor that is mandatory for use by the entire Department and under which Purchase Orders (PO) shall be issued.

1.7 Contractor: The organization or individual providing services to the Department, in accordance with the terms and conditions of the Contract.

1.8 Contract Administrator: The Department employee, or his/her designee, who serves as the liaison between the Contract Manager and the Department.

1.9 Contract Manager: The Department employee, or his/her designee, responsible for performance oversight and operational management of the Contract. The Contract Manager will be designated in the Contract.

1.10 Correctional Institution (CI or Institution or Facility): Any prison or other correctional facility, temporary or permanent, in which Inmates are housed under the custody of the Department.

1.11 Correctional Integrated Needs Assessment System (CINAS): An advanced web-based system designed to predict an Inmate’s likelihood to return to prison upon release from incarceration and uses that prediction, along with a multitude of other factors, to determine which Inmates should be given priority to core programs and what criminogenic needs the Offender possesses. CINAS is based on a Risk-Needs Responsively Model that attempts to address the specific multiple needs of Offenders to reduce their probability of returning to prison.

1.12 Cost Reply: The portion of the Vendor’s Reply relating to costs, which must include the completion of Attachment I, Price Information Sheet.

Page 7 of 302 FDC ITN-23-038

1.13 Criminal Justice Estimating Conference (CJEC): Conference principals and participants are designated through general statutory authority as provided in Sections

216.133 through 216.138, Florida Statutes (F.S.), which specifies the duties of each conference. This is one (1) of 10 conferences that estimate economic, demographic, resource-demand and revenue forecasts for a variety of governmental planning and budgeting functions. CJEC estimates the forecast of prison admissions and population.

1.14 Criminal Justice Information (CJI): All of the Federal Bureau of Investigation’s (FBI)

Criminal Justice Information Services (CJIS) data necessary for law enforcement and associated civil agencies to perform their designated missions. This data includes, but is not limited to biometrics, identity history, demographics, property, and case/incident history data, as defined by the CJIS Policy published by the U.S. Department of Justice.

This is in accordance with Section 943.045(12), F.S.

1.15 Criminal Justice Information Services (CJIS): The FBI’s division that provides tools and services to law enforcement and the general public.

1.16 Criminal Justice Network (CJNET): An extranet that includes the Florida Department of

Law Enforcement, Florida Department of Corrections, and other Florida law enforcement agencies.

1.17 Day: A calendar day, unless otherwise stated.

1.18 Department (FDC): The State of Florida, Department of Corrections.

1.19 Facility Access Secure Tracking (FAST): A computer program designed to enhance facility security by storing information connected to bio-metric identification of visitors’ and volunteers’ hands. The system records times of arrival and departure, and other pertinent information related to the security and operation of the facility.

1.20 Financial Stability: A Vendor’s ability to maintain adequate income and capital and the capacity to efficiently allocate resources, assess financial risks, and maintain financial soundness through the term of the Contract.

1.21 Florida Commission on Offender Review (FCOR or COR): Commission which presides over weekly hearings, makes determinations regarding post-release supervision, executes warrants, and prepares clemency cases.

1.22 Gain-Time: Authorized earned days deducted from an Inmate’s sentence in order to encourage satisfactory prison behavior, incentivize Inmates to participate in productive activities, and reward Inmates who perform outstanding deeds or services.

1.23 Graphical User Interface (GUI): A computer program that enables a person to communicate with a computer through the use of symbols, visual metaphors, and pointing devices.

1.24 HIPAA: The federal law known as the Health Insurance Portability and Accountability Act of 1996 (HIPAA, Title II), which established standards for the security and privacy of health data, and related rules.

Page 8 of 302 FDC ITN-23-038

1.25 HITECH Act: The Health Information Technology for Economic and Clinical Health Act, enacted as part of the American Recovery and Reinvestment Act of 2009 and related rules. HITECH generally establishes new requirements for notification of protected health information breaches, makes business associates directly liable for compliance with HIPAA security and privacy requirements, modifies disclosure accounting rules and enhances the civil and criminal enforcement of HIPAA.

1.26 Incentives: Earned achievement days deducted from an Offender’s sentence during the term of supervision in order to incentivize stable employment and education.

1.27 Independent Verification and Validation (IV&V) Vendor: An entity which provides a review of the project plans and other project artifacts by an independent third party. The primary objective of an IV&V is to provide an objective assessment of products and processes throughout the project management lifecycle. In addition, IV&V will facilitate early detection and correction of issues, enhance management insight into risks, and ensure compliance with project performance, schedule, and budget requirements. The IV&V entity must have no technical, managerial, or financial interest in the project and will not have any responsibility for, or participation in, any other aspect of the project. The Vendor shall have no interest and shall not acquire any interest that shall conflict in any manner or degree with the performance of the services required under this Contract.

1.28 Inmate(s): An individual who is committed, under sentence to, or confined in a

Correctional Institution.

1.29 Inmate Risk Management System (IRMS): The Department’s risk assessment system that determines an Inmate’s internal classification risk to the public, staff, institutional security, and Inmates.

1.30 Mandatory Responsiveness Requirement(s): Terms, conditions, and requirements that must be met by the Vendor to be considered responsive to this ITN.

1.31 Material Deviations: A deviation from the requirements and specifications of this ITN, which the Department, at its sole discretion, has determined is not in of substantial accord with this ITN, provides a significant competitive advantage to one (1) Vendor over other Vendors, or has a potentially significant effect on either the quantity or quality of the services sought, or on the cost to the Department.

1.32 Minor Irregularity: A variation from requirements and specifications of this ITN that does not give the Vendor a significant competitive advantage or benefit not enjoyed by other Vendors and does not adversely impact the interests of the Department.

1.33 Offender: An adult person under community supervision of the Department for a criminal offense.

1.34 Offender-Based Information System (OBIS or System): The Department’s mainframe-driven electronic data repository that serves as the Department’s official record keeping system of all Inmates and Offenders.

1.35 Prison Rape Elimination Act (PREA): Refers to Part 115 of Title 28 of the Code of

Federal Regulations (C.F.R.), National Standards to Prevent, Detect, and Respond to Prison Rape, under the “Prison Rape Elimination Act of 2003.” The Act provides for

Page 9 of 302 FDC ITN-23-038 analysis of the incidence and effects of prison rape in federal, state, and local institutions, and for information, resources, recommendations, and funding to protect individuals from prison rape.

1.36 Program Manager: A contracted position identified as the individual responsible for managing the overall Project.

1.37 Program or Project: OBIS modernization.

1.38 Recovery Point Objective (RPO): The interval of time that might pass during a disruption before the quantity of data lost during that period exceeds the business continuity plan’s maximum allowable threshold or tolerance.

1.39 Recovery Time Objective (RTO): The duration of time and a service level within which a business process must be restored after a disruption (e.g., outage, failure). RTO includes the time for investigation, recovery, and testing of the restored process. RTO reflects the maximum tolerable downtime for a given process, system, or application.

1.40 Reply: A Vendor’s written response submitted as an answer to this ITN.

1.41 Responsible Vendor(s): A Vendor who has the capability in all respects to fully perform the Contract requirements, and the integrity and reliability that will assure good faith performance

1.42 Responsive Reply(ies): A Reply, submitted by a Responsive and Responsible Vendor that conforms in all material respects to this solicitation.

1.43 Security Threat Group (STG): Formal or informal ongoing Inmate/Offender groups, gangs, organizations, or associations consisting of three (3) or more members who have:

(a) a common name or common identifying signs, colors, or symbols; (b) members or associates who individually or collectively engage in or have engaged in a pattern of gang activity, criminal activity, or Department rule violations; or (c) potential to act in concert to pose a threat or potential threat to the public, staff, visitors, other Inmates or Offenders, or the secure and orderly operation of an institution, probation office, other Department property, or Department activity or function.

1.44 Service-Oriented Architecture: A software development model that makes software components reusable and interoperable via service interfaces. Services use common interface standards and an architecture pattern so they can be rapidly incorporated into new applications.

1.45 Software-based Deliverables: Tangible or intangible products of a software development project that are intended to be delivered to a customer (either internal or external). They can be divided into two categories:

Software products: These are the finished software applications that are the main focus of the project.

Software documentation: This includes all the documentation that is necessary for the customer to use, maintain, and support the software products. It can include user manuals, technical specifications, training materials, and other supporting documentation.

Page 10 of 302 FDC ITN-23-038

Software-based deliverables are an important part of any software development project.

They ensure that the customer has everything they need to use and maintain the software products successfully. They also help to ensure that the project is completed on time and within budget.

1.46 Subcontractor: Another person, organization, or third-party vendor or supplier that has entered into an agreement with the Successful Vendor to perform any contractual obligation for the Successful Vendor under the terms of the Contract(s) such as software development, data migration, or quality assurance.

1.47 Successful Vendor: The Vendor who receives the award of this ITN and will be performing contractual duties as the prime Contractor under the Contract.

1.48 Technical Reply: The portion of the Reply submitted which includes all documentation submitted by the Vendor, but must not include the Attachment I, Price Information Sheet.

1.49 Tier I Data Center: A Tier I Data Center is the basic capacity level with infrastructure to support information technology for an office setting and beyond. The requirements for a Tier I Data Center include:

An uninterruptible power supply (UPS) for power sags, outages, and spikes;

An area for IT systems;

Dedicated cooling equipment that runs outside office hours; and An engine generator for power outages.

Tier I protects against disruptions from human error, but not unexpected failure or outage.

Redundant equipment includes chillers, pumps, UPS modules, and engine generators.

The Data Center will have to shut down completely for preventive maintenance and repairs, and failure to do so increases the risk of unplanned disruptions and severe consequences from system failure.

1.50 Tier II Data Center: A Tier II Data Center covers redundant capacity components for power and cooling that provide better maintenance opportunities and safety against disruptions. These components include, but are not limited to:

Engine generators;

Energy storage;

Chillers;

Cooling units;

UPS modules;

Pumps;

Heat rejection equipment;

Fuel tanks; and Fuel cells.

The distribution path of Tier II Data Center serves a critical environment, and the components can be removed without shutting it down. Like a Tier I Data Center, unexpected shutdown of a Tier II Data Center will affect the system.

1.51 Tier III Data Center: A Tier III Data Center is concurrently maintainable with redundant components as a key differentiator, with redundant distribution paths to serve the critical environment. Unlike Tier I and Tier II, these Data Centers require no shutdowns when

Page 11 of 302 FDC ITN-23-038 equipment needs maintenance or replacement. The components of Tier III are added to Tier II components so that any part can be shut down without impacting IT operation.

1.52 Tier IV Data Center: A Tier IV Data Center has several independent and physically isolated systems that act as redundant capacity components and distribution paths. The separation is necessary to prevent an event from compromising both systems. The environment will not be affected by a disruption from planned and unplanned events.

However, if the redundant components or distribution paths are shut down for maintenance, the environment may experience a higher risk of disruption if a failure occurs.

Tier IV Data Centers add fault tolerance to the Tier III topology. When a piece of equipment fails, or there is an interruption in the distribution path, IT operations will not be affected.

All of the IT equipment must have a fault-tolerant power design to be compatible. Tier IV Data Centers also require continuous cooling to make the environment stable.

1.53 Value-Added Services: Additional services and commodities the Vendor may offer the Department, at no additional cost, beyond those services and commodities expressly included in this ITN, which may be unknown to the Department at this time yet meet its overall goals.

1.54 Vendor: A legally qualified corporation, partnership, or other business entity submitting a

Reply to the Department in response to this ITN.

1.55 Veteran: A former member of the United States Armed Forces.

1.56 Warden: The employee, or their designee, responsible for the management and oversight of the daily operations of a Correctional Institution.

1.57 Warranty: A guarantee, assurance, statement or other written promise of quality provided by the Vendor. The warranty includes that the software product and service delivered will be free from defects and function as intended for a specified period, typically one year, beginning upon completion of all Stage Gates of the Project. The warranty includes remediations to repair, replace, or maintain the software product or service to ensure the promised quality due to operational or structural failures. The purpose of the warranty is to provide confidence in the quality of the software and service while holding the Vendor accountable for any issues that arise during the warranty period.

Page 12 of 302 FDC ITN-23-038

SECTION 2 – INTRODUCTION

2.1 Background

Pursuant to Chapter 945, Florida Statutes (F.S.), the Florida Department of Corrections is entrusted with the care and custody of Inmates in Florida prisons. As Florida’s largest agency, and the third-largest state prison system in the United States with an annual operating budget of approximately $2.9 billion, the Department incarcerates approximately 80,000 Inmates, and supervises nearly 145,000 Offenders in the community. As such, the Department’s operations are critical to the safety and security of the public as well as our staff.

The Department divides its operations geographically into four (4) regions: Region I (the Panhandle), Region II (North Florida), Region III (Central Florida), and Region IV (South Florida). Each region has a Regional Director of Institutions who supervises all Wardens in that region and a Regional Director of Community Corrections who supervises all Circuit Administrators in that region.

Currently, the Department relies primarily on manual, paper-based processes that are later entered into a home-grown mainframe application known as Offender-Based Information System (OBIS). Advancements in technology long surpassed the original technologies of OBIS, which no longer align with the agility and needs of an already complex core business. As a result, the Department struggles to adapt to challenges such as:

Fluctuations in Inmate/Offender populations – limits accuracy of Criminal Justice

Estimating Conference (CJEC) projections, intake and release, and corresponding staffing needs;

Changing business process needs for operational efficiencies – dependency on manual paper-based processes, redundant data entry, and unnecessary shipping of paper forms/files;

Data transparency for data-driven operational decision-making and legislative mandates – lack of real-time access to data and analytics; and

Technical support staff and subject matter expert retirement/attrition.

With all these considerations, the Department intends to re-engineer all Offender management business processes with particular emphasis on automating workflows and data interoperability to better support the overall mission and increase public safety. The Department’s goal is to have a multi-year, staggered workstream approach for OBIS modernization, with priority given to core functionality. Breaking down and prioritizing the core functional areas allows the Department to ensure appropriate support, distribute the dependence on subject matter experts, and lower overall project risk with a phased implementation.

2.2 Statement of Purpose

The Department is seeking Responsive Replies from experienced and qualified Responsible Vendors to implement OBIS modernization as described herein. Services shall be comprehensive and incorporate all components of system integration including, but not limited to, business analysis, reengineering, system design and architecture, Page 13 of 302 FDC ITN-23-038 implementation, deployment, and ongoing technical support. The result shall be a modernized OBIS using one (1) or more software products fully integrated into a single turn-key solution that meets the Department’s needs.

The Department intends to award one (1) Contract to the Responsible Vendor that offers the best value to the Department. The Department reserves the right to reject any and all Replies to this ITN.

The Department is seeking Replies from Responsible Vendors having, at a minimum, three (3) years of business and corporate experience relevant to the provision of similar services during the last five (5) years.

2.3 Procurement Overview

The Department is requesting competitive, Responsive Replies from Responsible Vendors to provide the services described herein. The requirements outlined in this ITN are based on the current System, but the Department is seeking innovative solutions from interested Vendors.

All Vendors submitting a Reply to this ITN are responsible for reading and understanding the specifications and instructions contained herein. All costs for the products and services shall be included in the Vendor’s Reply. Additional information on how services are provided today and anticipated requirements for a new Contract may be found in Section 3, Scope of Work.

2.4 Service Implementation and Transition

The Department intends to execute a Contract with the Successful Vendor shortly after the award of this ITN. The Vendor must have the capability to begin providing services no later than 30 Business Days following the execution of the Contract.

2.5 Term of Contract

The Contract's initial term shall be up to three (3) years. At its sole discretion, the Department may renew the Contract for up to three (3) additional years, or portions thereof, per Section 287.057(14), F.S., at the same prices, terms, and conditions. Any renewal shall be contingent, at minimum, on the Successful Vendor’s satisfactory performance of the Contract, as determined by the Department, and subject to the availability of funds. If the Department desires to renew the Contract, it will provide written notice to the Vendor no later than 90 Days before the Contract’s expiration. The warranty period will begin the Day after all completed Stage Gates are accepted, with an end date of 12 months after the Day of acceptance.

2.6 Pricing Methodology

The Department is seeking a solution that provides the best value to the State. As part of the best value determination, interested Vendors must submit a Cost Reply, utilizing Attachment I, Price Information Sheet, along with their Technical Reply. Vendors are encouraged to submit a Cost Reply offering the most competitive, cost-effective, and innovative solution for services and resources, as cost efficiency for the State will be a consideration in determining the best value.

Page 14 of 302 FDC ITN-23-038

Vendors shall provide the Cost Reply in accordance with the instructions provided in Section 4.11, Submission of Replies.

2.7 Value-Added Services

If accepted by the Department, any Value-Added Services offered by the Vendor will become a requirement(s) of the Contract. The Vendor’s Reply should include a detailed description of all Value-Added Services the Vendor is offering the Department, including timeframes for implementation. The Department is interested in any proposed Value- Added Services which would assist it in accomplishing the goals of this ITN.

2.8 Resource Library

The Department is providing the following link to resources necessary for Vendors to develop and propose an innovative solution and pricing that best meets the needs of the Department along with assisting the development of Vendor Replies. In order to gain a comprehensive understanding of the current services and products, Vendors are strongly encouraged to review the information regularly.

https://www.dc.state.fl.us/OBIS/resources.html

Some of FDC’s Procedures and Forms are identified as “Restricted” and are not available for public viewing. Restricted documents will be made available to interested Vendors for the development of Replies. To obtain a copy of the restricted documents, Vendors must email a signed copy of Attachment II, Nondisclosure Agreement for Restricted Information, to the Procurement Officer, along with their Express Mail (e.g., FedEx, UPS) account number to cover the cost of shipping. Once the signed agreement is received by the Procurement Officer, the Department will provide the restricted procedures on a flash drive to the Vendor, via overnight mail. Vendors having trouble accessing any documents should contact the Procurement Officer.

Note: All possible effort has been made to ensure the information contained in the

Resource Library is accurate, complete, and current.

Page 15 of 302 FDC ITN-23-038

SECTION 3 – SCOPE OF WORK

All services or products provided by, or under the direction of, the Successful Vendor shall meet or exceed the minimum requirements outlined in this ITN and be perform or supplied in strict compliance with the finalized requirements, and regulations of the Contract, including terms and conditions finalized during the Negotiation Phase of this ITN.

3.1 General Description of Services

The Vendor shall provide all products and services to modernize OBIS, including software licensing, software as a service, platform as a service, and contracted services to act as the single system integrator for the entire scope of this Project.

Contracted services shall include, but not be limited to, project management, business requirements analysis, process reengineering, system design and architecture, quality assurance, implementation, deployment, and ongoing technical support. The result shall be a modernized solution OBIS using one (1) or more software products and services that are fully integrated into a single turn-key solution and that meets the Department’s business needs that include consideration of the State’s Cloud-First Initiative, in accordance with Section 282.206, F.S.

The Vendor shall propose a solution strategy that it considers to be optimally effective and in the best interest of the Department. The strategy may include various solutions, including, but not limited to, cloud-based and integrated to provide the least total cost of ownership over 10 years.

3.1.1 Business Needs

Since 1978, the Department has used OBIS to create, store, share, and archive data, generate reports, and support its critical decision-making processes. OBIS is used for Inmate and Offender management, classification, work assignments, health grades, disciplinary information, and custody status. Due to its extensive use, OBIS is indispensable to the mission and operational performance of the Department. The major areas of functional support within OBIS include the following:

Inmate Custody Tracking Inmate Classification Tracking Inmate Banking with Interface to Canteen (operated by Contractor) Inmate Housing Assignment Tracking Facility Population Tracking Transportation Scheduling Inmate Movement Tracking Release Date Computation Probation and Parole Supervision Court-Ordered Payments System (COPS) Field Investigation Tracking Collection and Reporting of Health Services Statistics Commission Post-Release Supervision, Clemency, and Revocation

Page 16 of 302 FDC ITN-23-038

OBIS is more than 40 years old and has had continual updates and revisions over the past four (4) decades. OBIS is a mainframe-based application maintained locally by Department full-time employees and contracted staff. The options for enhancement are limited, and the pool of skilled resources needed to continue supporting OBIS is shrinking. As a result, it requires modernization to better serve the increasing informational needs of internal and external stakeholders.

3.1.2 Objectives

Through internal analysis and self-assessment, the Department established and prioritized the following objectives for the solution. The Vendor shall meet all requirements, performance measures, and provide all required reports relating to the objective identified. The following sections discuss these objectives in greater detail. The objectives include the following:

3.1.2.1 Objective 1: Provide a mobile-enabled web-based system that comports with current technology platforms, improving usability for the Department.

While the Department has, over time, web-enabled discrete functionality in OBIS, e.g., Correctional Integrated Needs Assessment System (CINAS) and Inmate Risk Management System (IRMS), the vast majority of the core OBIS application operates in a green screen environment lacking what is considered today to be a standard presentation layer: a responsive browser-based Graphical User Interface (GUI) with the look and feel of today’s modern characteristics, e.g., mouse-enabled pull-down menus and checkboxes promotes ease of use and dynamically adapts to the screen size of the device being used. If OBIS is modernized with a web-based GUI, the collection of multiple green screens can be optimized for data entry functions with logic to integrate workflows, minimize data entry errors, and perform error correction checks before data is submitted.

Additionally, a web-enabled system allows authorized users to access OBIS using a wide-range of supported browsers. The few web-enabled applications currently part of OBIS rely upon the same underlying legacy architecture (mainframe-based, Db2). Modernizing OBIS includes updating the architectural design to leverage cloud service providers and provide the advantages of maintainability and interoperability.

3.1.2.2 Objective 2: Provide a sustainable and scalable architecture that supports dynamic process modification resulting from legislative mandates and changes.

OBIS is written in Common Business Oriented Language (COBOL), and the data resides in an IBM Db2 database. Although the current System is functional and stable, modifications to the code base are difficult and often introduce technical risks when implementing changes imposed by executive, legislative, or judicial decisions.

Page 17 of 302 FDC ITN-23-038

In some cases, the risk is imposed by the code base itself, which has been modified, repaired, and enhanced over several decades. The accumulation of past modifications is reaching critical levels of complexity and will become unsustainable if the trend continues.

Legislative and business requirements for OBIS continue to evolve while the pool of available skilled development resources shrinks, adding to the risk of overall sustainability. COBOL has not been at the forefront of application development for decades due to organizations migrating to new platforms and rewriting applications in modern languages. Finally, resources with OBIS-specific knowledge are diminishing due to retirement and normal attrition.

The Department’s commitment to the modernization OBIS modernization demonstrates a concrete step needed to move to a more flexible and dynamic technical infrastructure and application architecture to allow it to react quickly and accurately to external and internal policy changes.

3.1.2.3 Objective 3: Provide a new system with a scalable architecture that can leverage and integrate external and internal data sources in real-time. Provide customized data views for interfaces supporting one-version-of-truth and data analytics to ensure compliance with security and safety mandates and to measure and report systemic performance across the full corrections spectrum.

The Department receives and shares tremendous amounts of data with federal, state, and local agencies. However, in many cases, data sharing is accomplished in a paper-intensive environment. An enormous amount of data is captured and generated using hundreds of paper forms manually entered into OBIS using green screens that are time-intensive and error-prone processes.

The Department uses automated fingerprint scanning technology, which supports biometric identification for Inmates and Offenders.

However, the information received from the Florida Department of Law Enforcement (FDLE) is not readily entered or updated in OBIS without human intervention; criminal history data is still manually entered by staff. There are tremendous benefits associated with moving to a more robust and automated data sharing solution, including accuracy, timeliness, and more appropriate allocation of staffing resources. Under the current architecture, electronic data sharing with external agencies involves extracting the same data multiple times with slight variations for each unique data interface, which is accomplished by resource-intensive batch jobs.

The Department has recognized for many years the importance of creating and managing a secure data sharing environment to address the needs of its employees, Inmates, Offenders, victims, and the public.

To that end, the Department created highly focused tools such as CINAS for Inmate needs assessment and IRMS for the Security Threat

Page 18 of 302 FDC ITN-23-038

Group (STG) processes, developed to manage gangs and gang activity more effectively within Institutions. Today, the STG mandate encompasses the need to effectively identify and manage threats posed by terrorism.

Real-time views of an organization’s operational profile and performance have become standard in today’s approach to information as a management tool. The ability to see and assess an organization from an enterprise perspective and drill down to illuminate discrete data and performance elements are critical for an operation with the breadth and scope of the Department.

Common techniques used to gather and report metrics include dashboards and flexible reporting tools, which allow users to create and monitor operational aspects of the business without requiring significant technical support from programmers or other IT resources. Users are empowered to identify, track, and report on key elements they define as critical to their needs and the management of the overall correctional environment.

Finally, data analytics will provide insight into a wide variety of the Department’s operational activities and effectiveness—measured by time, cost, and safety factors that are not readily visible in OBIS today.

Integrated data analytics enables the Department staff to perform “what if?” analyses using a standard toolset rather than relying on highly technical and costly IT resources. For instance, questions such as, “What would be the cost savings if the accuracy of an Inmate’s initial needs assessment were implemented?” Data analytics could be used to identify costs and risks associated with repeated Inmate moves in terms of transportation and personnel.

OBIS modernization must address the Department’s desire to capture and manage its operational profile using defined metrics and data-driven decision making.

3.1.2.4 Objective 4: Provide a new system with a workload management component to manage agency business processes effectively and efficiently.

The Department has implemented rudimentary workflow processes to manage certain aspects of its mission. The Classification Appointments Overview & Scheduling System is one such example of the Department’s need for workload management. Properly functioning workforce management systems provide organizations, like FDC, with insight into key business metrics such as the number of resources required to staff functions throughout the workday, week, or month and how to forecast effectively for operational and strategic needs. For example, using a “factory” paradigm, moving parts and pieces through an operation, adding value at each step, and creating a final product are instructive. However, another component necessary to measure operational efficiencies and effectiveness is the ability to quantify the

Page 19 of 302 FDC ITN-23-038 amount of work individual resources complete within a specific timeframe.

The Department will accommodate business process change where feasible in accordance with Florida Statute. The Department will collaborate with the Vendor to re-engineer business processes in order to ensure compatibility with the new solution. The Vendor will be responsible for facilitating and coordinating all training, education and communication on business process re-engineering efforts that are or will be needed for the new system to function efficiently and effectively.

This objective addresses the need to manage staff and equipment resources more efficiently. These are all operational questions which may be resolved more efficiently with OBIS modernization.

How many classification officers are required to manage the current and projected Inmate population?

How many and what type of Offenders can a Probation and Parole

Officer supervise?

How many buses need to be scheduled next week to transport the projected Inmate moves?

Workload management addresses the need to use available resources given a wide range of factors, which may include staffing issues. For example:

Who is out sick today or on vacation next week?

How can the new system most efficiently transfer their work to another resource?

Specific qualifications or restrictions can be included in the logic such as how many cases of a given type may a Probation Officer supervise.

Workload management will also help manage equipment resources.

For example:

The transport bus scheduled for today has broken down, so what other transport bus is available to use or must the Inmate transport be rescheduled?

Workload management will also support the Department’s mission of securely and safely housing Inmates by identifying, tracking, and allocating the appropriate bed required to meet an Inmate’s Risk and Needs profile.

Often associated only with staffing resources, automated workload management can be effectively used to address the full spectrum of an organization’s efficient use of all resources. Automation of workload management will eliminate the manual data entry of paper workflows that are error-prone and time consuming, which will enable staff to

Page 20 of 302 FDC ITN-23-038 concentrate on more productive tasks and further enhance the Department’s ability to accomplish its mission.

3.1.2.5 Objective 5: Provide an interoperable, secure, and fully functional Offender management system (OMS) to access accurate and complete information that ensures public safety and meets the demands of a dynamic, data intensive correctional environment.

This goal represents the smallest gap between the As-Is and To-Be environments. Modernizing OBIS using interoperable technologies while re-shaping current business processes reduces manual workflows, enhances data accuracy, and offers the greatest benefit to operational efficiency and user experience.

This gap highlights the dependence on the skills and knowledge embodied by Department staff to accomplish the Department’s missions. A modernized OBIS will utilize business rules, workflow processes, workload management controls, and interoperable data sharing, enabling the Department to better achieve its mission.

3.1.2.6 Objective 6: Provide a new system that leverages modern technologies to attract and retain skilled technologists and support staff.

This objective is aimed at addressing the need for a skilled IT workforce to address rapidly increasing technology challenges. These challenges include replacing old language (i.e., COBOL) with modern programming languages and platforms. Additionally, this objective shall include being able to respond to cybersecurity threat and leverage cloud-based technologies. OBIS modernization is necessary to address the Department’s business needs relative to public health, safety and welfare, and to attract and sustain skilled technologists and support staff.

3.1.2.7 Objective 7: Provide a phased implementation plan identifying the functional strategy outlining the budgetary, resource, and procurement requirements to ensure a cost effective and realistic acquisition process.

The phased implementation plan will also include post-implementation support activities, which include, but are not limited to, testing and defect tracking, status reporting, and solution recommendations and mitigations to report defects within Service Level Agreement (SLA) operations requirements.

This is a strategy to maximize the allocation of funding and resources while considering procurement requirements and desired outcomes. A progressive implementation shall be structured into manageable work streams or Stage Gates and have the new system in place no later than May 30, 2027. The Department may renew the Contract for up to three

Page 21 of 302 FDC ITN-23-038

(3) additional years, or portions thereof, per Section 287.057(14), F.S., and Section 2.5, Term of Contract, of this ITN.

3.1.2.8 Objective 8: Provide a solution utilizing modern cybersecurity frameworks to ensure data protection against unauthorized access, transfer, modification, or destruction.

Establish a comprehensive cybersecurity plan that encompasses application security, data security, platform security, and operational security. The mandate must incorporate modern cybersecurity frameworks to ensure data protection against unauthorized access, transfer, modification, or destruction, whether accidental or intentional.

The solution must be designed to readily integrate with established data warehouse solutions.

The Vendor shall ensure that the proposed solution utilizes modern cybersecurity frameworks to protect the confidentiality, integrity, and availability of data and provides appropriate access controls, data encryption, intrusion detection and prevention systems, security event logging, and incident response procedures. The new system must also comply with all relevant industry standards and best practices, including but not limited to CJIS, National Institute of Standards and Technology (NIST) Cybersecurity Framework, and any other applicable cybersecurity standards.

The Vendor shall provide a detailed description of how the proposed solution utilizes modern cybersecurity frameworks to protect data against unauthorized access, transfer, modification, or destruction, whether accidental or intentional. The solution design and implementation plan shall incorporate these frameworks, and the Vendor shall allocate appropriate resources and timelines to ensure their successful implementation.

The Vendor must also demonstrate the solution's ability to readily integrate with established data warehouse solutions while maintaining data protection and complying with all applicable cybersecurity standards and regulations.

The cybersecurity objective shall be integrated into the overall solution design and implementation plan, with appropriate resources and timelines allocated for its successful implementation. The Vendor shall also provide training and education to Department staff on cybersecurity best practices and awareness to ensure the security of the new system is maintained in compliance with all applicable standards, regulations, and modern cybersecurity frameworks.

3.1.3 Constraints

The Department envisions a three (3) year timeframe for OBIS modernization, and Legislative Budget Requests (LBRs) are planned annually to match this timeline. The three (3) year timeline is proposed to distribute the total cost of

Page 22 of 302 FDC ITN-23-038 this project over a period of time and to manage the demand on Department resources. Regardless, the Department may consider an implementation timeframe of less time if a Vendor recommends this for technical reasons that benefit the Department. Potential Vendors may prefer to implement OBIS modernization in fewer phases over a shorter period, which may not match the approved funding model. The five (5) year legislative appropriation for this Project can be found in the Schedule IV-B for Offender Based Information System (OBIS) Modernization for Fiscal Year 2023-24, Section VI, Schedule IV-B Technology, Item D.2, Resource and Summary Level Funding Requirements for Proposed Solution, which is available in the Resource Library section of this ITN. The implementation of this Project is intended to occur in fiscal years 2024-25, 2025-26, and 2026-27. Unspent allocated funds from fiscal years 2022-23 and 2023-24 will not be available in subsequent years.

Project activities, schedules, and milestones depend on the appropriate funding.

State statutory changes, changes in administrative rules, and Department policy changes may affect the OBIS modernization Project.

Specific software tools supporting desired capabilities shall be determined based on the solution options proposed by the system integration Vendor.

There is a limit to the workload that Department staff can dedicate to OBIS modernization each year.

Current OBIS applications contain cross dependencies that will require ongoing operation of the legacy System during OBIS modernization.

During OBIS modernization a temporary bridging…