ITN-2601 - Addenda Number #2.pdf

DATE: August 29, 2025

SOLICITATION NUMBER: FDLE ITN 2601

SOLICITATION TITLE: Information Technology Services Management Solution

REPLY OPENING: September 16, 2025

ADDENDA NUMBER: 2

This addendum serves as notice of FDLE responses to questions received from potential Vendors that were inadvertently left off of Addendum #1.

Insert: Attach additional pages of the FDLE Responses to Vendor Questions (#174-#193) of the Invitation to Negotiate FDLE Response document.

All other terms and conditions of the ITN remain unchanged.

THIS ADDENDUM NOW BECOMES PART OF YOUR PROPOSAL RESPONSE.

THE ADDENDA ACKNOWLEDGEMENT FORM SHALL BE SIGNED BY AN AUTHORIZED COMPANY REPRESENTATIVE, DATED AND RETURNED WITH THE ITN RESPONSE.

ADDENDA ACKNOWLEDGEMENT

COMPANY NAME:

ADDRESS:

CITY: STATE: ZIP:

AUTHORIZED REPRESENTATIVE: TITLE:

AUTHORIZED SIGNATURE: DATE:

PHONE: EMAIL:

FAILURE TO FILE A PROTEST WITHIN THE TIME PRESCRIBED IN FLORIDA STATUTE 120.57(3) OR FAILURE TO FILE A BOND OR OTHER SECURITY WITHIN THE TIME ALLOWED FOR FILING A BOND SHALL CONSTITUTE A WAIVER OF

PROCEEDINGS UNDER CHAPTER 120 FLORIDA STATUTES.

Q u es ti o n

Q u es ti o n

FD

LE

R es p o n se

Th e

IT

N pr oh ib its

“t hi rd p ar ty in te gr at io ns

C an F

DL

E cl ar ify w he th er th is a pp lie s o nl y t o su bc on tra ct ed h os tin g p ro vid er s, o r al so to o ut

-o f-t he -b ox in te gr at io ns w ith st an da rd e nt er pr is e ap pl ic at io ns (e

.g

M ic ro so ft Te am s, e m ai l, m on ito rin g t oo ls

Se e

A n sw er

Is th e in iti al fi ve

-y ea r c on tra ct te rm e xp ec te d to b eg in im m ed ia te ly a fte r a w ar d, o r w ill th er e be a tra ns iti on /im pl em en ta tio n pe rio d pr io r t o th e st ar t o f op er at io ns

Se e

A n sw er

W e re qu es t F

DL

E to e xt en d th e du e da te b y t w o

(2 ) w ee ks to su bm it a co m pr eh en si ve a nd c om pe tit iv e bi d.

N o

W ill

F

DL

E co ns id er e xt en di ng th e

Se pt em be r 1 2, su bm is si on d ea dl in e if si gn ifi ca nt c la rif ic at io ns o r a dd en da a re le as ed c lo se to th e du e da te

N o

Ar e th er e lim its o n th e pe rc en ta ge o f w or k t ha t c an b e su bc on tra ct ed , o r w ill

F

DL

E on ly re qu ire d is cl os ur e an d pr io r ap pr ov al o f s ub co nt ra ct or s?

FD

LE

r eq u ir es p re ap p ro va l o f al l s ta ff a ss ig n ed t o t h e p ro je ct a lo n g w it h co p le ti o n o f a su cc e ss fu l b ac kg ro u n d in ve st ig at io n s.

A b ac kg ro u n d ve st ig at io n s h al l b e co n d u ct ed o n a ll

C o n tr ac to r em p lo ye es a

Su b co n tr ac to rs w h o a re d ir ec tl y as si gn ed t o t h e p ro je ct p ri o r e p e n d e n t w o rk b e gi n n in g.

Ex pe rie nc e (1 p oi nt

s) a nd Te ch ni ca l ( po in ts ) a re sc or ed

Ca n

FD

LE

c la rif y h ow p ric e w ill b e fa ct or ed in to a w ar d de ci si on s si nc e it is n ot a ss ig ne d po in ts

P ri ce w ill b e co n si d er ed d u ri n g n eg o ti at io n s.

N eg o ti at io n s ar e h el d t o e te rm in e b e st v al u e in a cc o rd an ce w it h F lo ri d a

St at u te

.0 ic h m ea n s th e h ig h es t o ve ra ll va lu e to t h e st at e b as ed o n f ac to rs t at cl u d e , b u t ar e n o t lim it e d t o , p ri ce

, q u al it y, d e si gn , a n d w o rk m an sh ip . B st va lu e w ill b e d e te rm in ed a t th e en d o f th e n e go ti at io n p ro ce ss

Fo r r ef er en ce s, m us t a ll th re e be go ve rn m en t c us to m er s, o r c an pa ra bl e pr iva te se ct or im pl em en ta tio ns b e ac ce pt ed

Th e

IT

N r eq u ir es t h re e (3 re fe re n ce s th at h av e b ee n p ro vi d ed f o r se rv ic es o f si m ila r sc o p e an d p ar am e te rs o f th o se r eq u es te d in t is so lic it at io n

. T h e

IT

N d id n o t sp ec if y th e ty p e o f cu st o m er s.

Sh ou ld ve nd or s i nc lu de o ne

-ti m e im pl em en ta tio n co st s, tra in g, a nd tr av el in th e sp re ad sh ee t, or p ro vid e th es as se pa ra te li ne it em s?

V en d o rs s h o u ld in cl u d e al l c o st s cl ea rl y it em iz ed in t h e p ri ci n g sp re ad sh ee t.

Se p ar at e lin e it em s ar e ac ce p ta b le if c o n si st e n t w it h t h e

IT

N p ri ci n g in fo rm at io n

Is

F

DL

E ex pe ct in g c ha tb ot /v irt ua l A ge nt a s p ar t o f t he so lu tio n?

Se e A n sw er

FDLE-ITN-2601 Addendum #2 08/29/2025

Q es ti o n

Q u es ti o n

FD

LE

R es p o n se

Ho w m an y u se r l ic en ce s d oe s F

DL

E re qu ire fo r t he re qu es te d so lu tio n?

Se e A n sw er

Ho w d o yo u cu rre nt ly m ea su re

IT

se rv ic e de liv er y s uc ce ss , a nd ha t m et ric s a re m os t i m po rta nt to yo u?

FD

LE

d o es n o t cu rr en tl y tr ac k fo rm al s er vi ce d el iv er y m e tr ic s.

V en d rs sh u ld p ro p o se t h e so lu ti o n t h at b e st m ee ts t h e

IT

N r eq u ir em en ts

W ha t e xis tin g s ys te m s ( e.

g.

, H

R, a ss et m an ag em en t, CM

DB

m us t t he n ew

IT

SM

p la tfo rm in te gr at e w ith

Se e A n sw er

W ha t i s y ou r v is io n fo r a ut om at io n w ith in th e ne w

IT

SM

pl at fo rm

FD

LE

v is io n is t o a u to m at e ti ck et r o u ti n g, e sc al at io n s, a n d r ep o rt in g im p ro ve e ff ic ie n cy a n d c o n si st e n cy

H ow w ill yo u ha nd le d at a m ig ra tio n fro m yo ur le ga cy sy st em th ne w p la tfo rm

Ve nd or s a re e xp ec te d to h an dl e m ig ra tio n pl an ni ng

, m ap pi ng

, a nd va lid at io or di na tio n w ith F

DL

E.

F in al ty pe s o f m ig ra tio n da ta w ill b e ne go tia te d pr io r t o co nt ra ct e xe cu tio n.

Ca n

FD

LE

p ro vid e an y d et ai ls re ga rd in g t he a llo ca te d bu dg et ra ng e fo r t hi s p ro je ct

Se e

A n sw er

W ill F

DL

E be w ill in g t o op en fo r o th er

IT

SM

p la tfo rm s, su ch a s Se rv ic eN ow

FD

LE

is o p en t o a n y fu lly e st ab lis h ed

S aa

S

IT

SM

p la tf o rm t h at m e et s th e

IT

N q u ir em en ts

As th e cu rre nt

C he rw el l S er vic e

M an ag em en t p ro du ct is ac hi ng E nd o f S up po rt on D ec em be r 3

1, 6, d oe s F

DL

E pl an to c on tin ue w ith th e sa m e

IT

SM

p la tfo rm , o r a re th er e pl an s t o tra ns iti on to a n al te rn at ive so lu tio n?

Th e p u rp o se o f th is

IT

N is t o t ra n si ti o n t o a n ew

S aa

S

IT

SM

p la tf o rm b ef r cu rr en t sy st em r ea ch es

E n d o f Su p p o rt

Ca n

FD

LE

p ro vid e us w ith th e at te nd ee s' lis t f or th e

FD

LE

-IT

N-p re

-p ro po sa l c on fe re nc e?

FD

LE

P ro cu re m en t O ff ic er , A n ge la G it h en s

In t h e

P D

F, A tt ac h m en t

M h as t h e w o rd

Sa m p le b lo ck in g o u t so m e o f th e t e xt in t h e q u e st io n s.

Is t h is f o rm

A tt ac h m en t M av ai la b le w it h o u t th e w rd

“S am p le

A co p y o f

A tt ac h m en t M w ith a li gh te r w at er m ar k h as b ee n a d d ed t o A d d en d u m

P le as e co n fi rm w h et h er h o st in g in a

C

JI

S-co m p lia n t U

.S

G o ve rn m e n t

C lo u d e n vi ro n m e n t (e

.g

A W

S G o vC lo u d o r

M ic ro so ft A zu re

G o ve rn m en

t) is a n a b so lu te r eq u ir em en t fo r co n si d er at io n in t h is

R

FP

It is a P as s

Fa il R eq u ir em e n t.

S ee S ec ti o n

.2

.6 r eg ar d in g P as s

Fa il

R e q u ir e m e n ts

A tt ac h m e n t I, P as s

Fa il d o cu m e n t, p ag e

FDLE-ITN-2601 Addendum #2 08/29/2025

Florida Department of Law Enforcement

CRIMINAL JUSTICE INFORMATION SERVICES

AGENCY:

VENDOR:

DATE:

Vendor Questionnaire 2331 Phillips Road Post Office Box 1489

Tallahassee, Florida 32302 850/410-7126 Phone 850/410-7125 Fax

OFFICE OF THE INFORMATION SECURITY OFFICER

07/2024

CTBS-004

CJISSECPOL v5.9.5 Sam ple

VENDOR VETTING

Has the agency performed fingerprint-based records checks on all vendor personnel with physical and/or logical access to the solution as well as appropriate sub-contractor personnel? This includes maintenance and/or custodial staff.

What personnel, other than those directly employed by the vendor, have physical or logical access to solution systems, data, encryption keys, physical location?

Has the agency ensured all vendor personnel take and maintain appropriate levels of security awareness training via CJISONLINE and NexTEST Training if applicable?

What process is in place for the vendor to notify the agency when personnel statuses change? What timeframe is this conducted in?

(This includes new employees, personnel no longer associated with the vendor, personnel arrested) Has the agency entered into a contract/service level agreement with the vendor that incorporates the Security Addendum with Appendix H of the CJISSECPOL? – Agency will need to provide a copy.

Does the agency maintain signed copies of the Security Addendum Certification Page for each vendor personnel as applicable? – Agency will need to provide documentation.

INCIDENT RESPONSE (IR) CONTROL FAMILY

Does the vendor have documented security incident, data breach response plans? Are those plans tested and reviewed? How often are the plans tested and reviewed?

Does the vendor have a documented process for informing contracting agencies of security incidents and/or breaches? Has the vendor provided that documentation to the agency? Provide a copy of that documentation with this assessment.

Does the vendor employ any automated mechanism(s) to support incident handling processes that includes preparation, detection, analysis, containment, eradication, and recovery? Please provide a description of those mechanisms.

Does the vendor have a documented process to collect, retain, and maintain the integrity of any electronic evidence related to a security incident to support legal action? Please provide a copy of that documentation.

Has the vendor defined security roles within the organization?

Does the vendor track and document security incidents? How long is that documentation retained? Sam

AUDIT & ACCOUNTABILITY (AU) CONTROL FAMILY

Does the solution provider identify the types of events that the system is capable of logging in support of the audit function:

authentication, file use, user/group management, events sufficient to establish what occurred, the sources of events, outcomes of events, and operational transactions (e.g., NCIC, III)?

Does the solution provider coordinate the event logging function with other organizational entities requiring audit related information to guide and inform the selection criteria for events to be logged?

Does the solution provider’s system capture and log all successful and unsuccessful log-on attempts?

Does the solution provider’s system capture and log all successful and unsuccessful attempts to use, access, create, write, delete, or change permissions on a user account, file, directory, or other system resource(s)?

Does the system log successful and unsuccessful attempts to change account passwords?

Does the system log successful and unsuccessful actions performed by privileged accounts?

Does the system log successful and unsuccessful attempts to access the audit log file, modify the audit log file, and destroy the audit log file?

Does the system audit records contain information that establishes what type of event occurred, when the event occurred, where the event occurred, source of the event, outcome of the event, AND the identity of any individuals, subjects, or objects/entities associated with the event?

Does the system generate audit records containing session, connection, transaction, and activity duration?

Does the system generate audit records containing source and destination addresses?

Does the system generate audit records containing object or filename involved?

Does the system generate audit records of number of bytes received and bytes sent (for client-server transactions) for audit events identified by type, location, or subject?

Does the system limit personally identifiable information contained in audit records to the minimum PII necessary to achieve the purpose for which it is collected?

How long does the system store the audit logs for? Does the system store backups of the audit logs?

Does the criminal justice agency have access to the audit logs for all items outlined in this section?

Provide information regarding the systems capability to process, sort, and search audit records for events of interest (i.e., what options are available for search capabilities within the audit log system).

Does the system record time stamps for audit records that meet hundredths of a second (i.e., hh:mm:ss:00) interval and that use Coordinated Universal Time?

ACCESS CONTROL (AC) CONTROL FAMILY

Describe the process for account management within the system (account creation, modification, enabling, disabling, and removal actions).

Describe the account types and permissions associated with those account types that are available within the system.

Does each user of the system have their own unique account?

Do vendor personnel of the system utilize their own unique accounts for system maintenance activities?

Is the system set up to enforce users with privileged security functions (access to audit logs) to have a non-privileged user account when accessing non-security functions?

Does the system log the execution of privileged functions?

Does the system have the ability to enforce a limit of five consecutive invalid logon attempts by a user and to automatically lock the account until released by an administrator when the maximum number of invalid attempts is exceeded?

Does the system have the ability to terminate a session after a specific time has lapsed of inactivity by a user?

What remote access tool is used by the solution provider when performing maintenance on the system?

Is the remote access connection used by the solution provider FIPS 140-3 certified? Provide documentation.

IDENTIFICATION & AUTHENTICATION (IA) CONTROL FAMILY

Is the solution provider’s system web-based? If so, what MFA product is being utilized on the system? Provide the product and the authentication methods being utilized.

What MFA product is the solution provider utilizing when accessing the system for updates, maintenance, upgrades, patch management? Provide the product and the authentication methods being utilized?

Does the system require users to change their password prior to first use on the system?

Describe the login process for users (username/password requirements) that are built into the system.

Does the system require users to reauthenticate when roles, authenticators, or credentials change, security categories of systems change, or when the execution of privileged functions occur?

Does the system require users to reauthenticate every 12 hours?

CONFIGURATION MANAGEMENT

Describe the solution provider’s change management process.

Does the solution provider have a documented process to configure information systems for least functionality? Describe the process.

Provide a network diagram of your service/solution that shows where CJI is processed, stored, and/or transmitted.

Describe the controls in place to protect system configuration documents from unauthorized access and modification.

How does the solution provider identify and remediate configuration drift?

MEDIA PROTECTION (MP) CONTROL FAMILY

Describe how the solution provider securely stores digital and physical media.

Does the solution provider encrypt data in transit using a NIST certified encryption module? Provide a NIST certificate number for the module.

Describe the solution providers media sanitization policy and procedures.

Describe the solution providers physical media disposal policy and procedures.

PHYSICAL & ENVIRONMENTAL PROTECTION (PE) CONTROL FAMILY

Are any hosted services that access, process, store, and/or transmit CJI hosted within a physically secure location? Describe the location and security controls in place.

Does the hosting location maintain a list of authorized personnel to the facility?

How is access to information systems monitored and controlled within the hosting facility?

Are visitors to the facility authenticated prior to allowing access?

Are the visitors escorted? By whom?

Does the solution provider authorize and control information system-related items entering and exiting the facility?

SYSTEM & COMMUNICATIONS PROTECTION (SC) CONTROL FAMILY

Describe the process in place to enforce segmentation to control the information flow between interconnected information systems.

Describe the technical security controls in place to ensure perimeter security of all networks that access, process, or store

CJI.

Is encryption being utilized when transmitting CJI outside of the secure facility? Provide the NIST certificate for the encryption module.

Is encryption being utilized when storing CJI? Provide the NIST certificate for the encryption module.

Does the solution provider’s system separate user functionality, including user interface services, from system management functionality?

Does the system prevent unauthorized and unintended information transfer via shared system resources?

Does the system define acceptable and unacceptable mobile code and mobile code technologies and authorize, monitor, and control the use of mobile code within the system?

Does the solution provider maintain a separate execution domain for each executing system process?

Does the solution provider use public cloud infrastructure for any services provided related to CJI?

Describe the solution provider’s patch management process.

Is malicious code protection implemented and kept current for all systems with internet access?

Is spam and spyware protection used and kept current?

What controls does the solution provider have in place to ensure only authorized personnel may input information into systems that access, process, or store CJI?

SYSTEM & SERVICES ACQUISITION (SA) CONTROL FAMILY

Does the solution provider replace system components when support for the components is no longer available from the developer, vendor, or manufacturer?

SYSTEM & INFORMATION INTEGRITY (SI) CONTROL FAMILY

Does the solution provider perform firmware updates using vulnerability scanning tools at least monthly?

Does the solution provider employ integrity verification tools to detect unauthorized changes to software, firmware, and information systems that contain or process CJI?

Does the solution provider perform an integrity check of software, firmware, and information systems that contain or process CJI at agency-defined transitional states or security relevant events at least weekly or in an automated fashion?

Does the solution provider check the validity of the following information inputs: all inputs to web/application servers, database servers, and any system or application input that might receive or process CJI?

Does the solution provider generate error messages that provide information necessary for corrective actions without revealing information that could be exploited?

Does the solution provider implement the following controls to protect the system memory from unauthorized code execution:

data execution prevention and address space layout randomization?

FLORIDA DEPARTMENT OF LAW ENFORCEMENT CRIMINAL

JUSTICE INFORMATION SERVICES

CLOUD IMPLEMENTATION PLAN

AGENCY:

ORI:

AGENCY CONTACT:

PROJECT NAME:

The cloud subscriber (user, agency, tenant) should be aware of security and legal requirements prior to entering into any agreement with a cloud service provider. The following questions will help frame the process of determining compliance with the existing requirements of the CJIS Security Policy. Agencies must submit an updated network diagram along with this completed form. If you need additional space for answers, please attach a separate document.

Please answer the following questions:

Services

1. What cloud service provider do you plan to utilize?

2. What product(s) or service(s) does the Agency plan to use?

3. What platform(s) does the Agency plan to use? (IaaS, PaaS, SaaS)

4. Will access to the Criminal Justice Information or Criminal Justice Information System fall within the category of remote access?

Physical Site

5. Does the cloud service provider’s datacenter(s) used in the transmission, storage, or processing of CJI meet all of the requirements of a physically secure location?

a. What is the physical location(s) of the data center the CJI or CJI System will be stored in?

(Include back-up and redundant locations.)Sam

b. Has the Agency conducted a site visit of the data center location(s)?

Encryption

6. Who will be providing the encryption as required by the CJIS Security Policy (Agency, Cloud Service Provider, 3rd Party)?

7. Who will have access to the encryption/decryption keys (Agency, Cloud Service Provider, 3rd Party)?

8. Who will manage the encryption/decryption keys (Agency, Cloud Service Provider, 3rd Party)?

9. Will the data be encrypted in transit? (this includes transmission between Cloud locations/Backup Sites)

a. Provide the FIPS Certificate for the transmission product with this implementation plan.

10. Will the data be encrypted while at rest?

a. Provide the FIPS Certificate for the encryption product with this implementation plan.

Incident Response

11. Provide the Cloud Service Provider’s written incident response plan/procedures with this implementation plan.

12. Provide the 3rd Party Solution Provider’s written incident response plan/procedures with this implementation plan (if applicable).

13. Will the Agency be notified by the Cloud Service Provider of any incident?

14. Will the Agency be notified by the 3rd Party Solution Provider of any incident (if applicable)?

15. If CJI is compromised, what are the notification and response procedures?

Formal Audits

16. Will the cloud service provider allow FDLE and the FBI to conduct compliance security audits?

Audit Logging

17. How will event and content logging be handled?

18. Will the cloud service provider handle the event and content logging required by the FBI CJIS Security Policy and provide those logs upon request?

19. Will the 3rd Party Solution Provider handle the event and content logging required by the FBI CJIS Security Policy and provide those logs upon request (if applicable)?

20. Will the Agency have access to the event and content audit logs for review?

21. How long will event and content audit logs be retained?

22. How often will the Agency review the event and content audit logs?

Media Protection

23. What are the Cloud Service Provider’s responsibilities with regard to media protection?

24. What are the 3rd Party Solution Provider’s responsibilities with regard to media protection (if applicable)?

25. What process will the Cloud Service Provider utilize for media destruction?

26. What process will the 3rd Party Solution Provider utilize for media destruction (if applicable)?

Access

27. How will Agency personnel access the Cloud Provider/3rd Party Solution? (Will the Agency personnel have to connect and authenticate to the Agency network prior to being granted access to the Solution or will Agency users have the ability to access the Solution without network authentication)

28. What encryption product will Agency personnel utilize to access the Solution?

a. Provide the FIPS Certificate for the product with this implementation plan.

29. What remote access product will the Cloud Service Provider/3rd Party Solution Provider utilize to conduct updates, patch management, user assistance?

a. Provide the FIPS Certificate for the remote access product with this implementation plan.

Multi-Factor Authentication

30. What MFA product will the Cloud Service Provider/3rd Party Solution Provider utilize when accessing the environment/system?

a. Provide the authentication methods used for the MFA product.

31. What MFA product will be utilized by the Agency personnel when accessing the environment/system?

a. Provide the authentication methods used for the MFA product.

Vendor Personnel Vetting

32. Has the Agency conducted fingerprint-based records checks under the Agency’s ORI for personnel of the Cloud Service Provider/3rd Party Solution Provider?

33. Has the Agency verified that all personnel of the Cloud Service Provider/3rd Party Solution Provider have taken and maintain current Security Awareness Training?

34. Does the Agency maintain copies of signed security addendum certification pages for all Cloud Service Provider/3rd Party Solution Provider personnel?

Be sure to include all documentation as well as a network diagram showing all connections when submitting this implementation plan.