ITS DP C000999 NYS Salesforce Integration Modernizatrion for OASAS.pdf

KATHY HOCHUL

Governor

DRU RAI

NYS Chief Information Officer

Discretionary Procurement # C000999 NYS Salesforce Integration Modernization for

OASAS

Agency: New York State Office of Information Technology Services Contract Number: C000999 Contract term: 2 Years Procurement Title: OASAS Salesforce Integration Modernization Work Location: Albany, NY

EVENTS DATE

Solicitation Release Date July 3, 2026 by 2:30 PM

Vendor Questions Due Date July 17, 2026 by 2:30 PM

ITS Response to Bidder Questions Date July 31, 2026 by 2:30 PM

Bid Due Date August 14, 2026 by 2:30 PM

ALL RESPONSES MUST BE SUBMITTED ELECTRONICALLY VIA E-MAIL:

its.sm.MAT.Solicitations@its.ny.gov

The points of contact for this Discretionary Procurement is:

Primary Contact: Katherine Olsen, Contract Manager Secondary Contact: Laura Crammond, Contract Manager

No other method of inquiries will be accepted.

Procurement Lobbying Law/Restricted Period is in effect for this Solicitation.

Under the requirements of the Procurement Lobbying Act, all communications regarding advertised Procurements are to be channeled only through the primary contact identified herein.

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 2 | P a g e

1. INTRODUCTION

2. PROCUREMENT BACKGROUND

3 . MINIMUM QUALIFICATIONS & ELIGIBILITY CRITERIA

4. CURRENT STATE OVERVIEW

5. APPLICATION COMPLEXITY CLASSIFICATION

6. STRATEGIC DIRECTION

7. SCOPE OF WORK

7.1 Program Objectives

7.2 Scope Phase 1 — Assessment & As-Is Documentation

7.2.1 Application Portfolio Assessment

7.2.2 As-Is Process Documentation

7.2.3 As-Is Architecture Documentation

7.2.4 Data Analysis & Profiling

7.2.5 Reporting Inventory

7.2.6 Modernization Roadmap

7.3 Scope Phase 2 — Modernization Design & Roadmap

7.3.1 Modernization Strategy per Application

7.3.2 To-Be Architecture Design

7.3.3 Security Model

7.3.4 Data Migration Strategy

7.3.5 Salesforce Internal Applications — Review & Readiness

7.4 Scope Phase 3 - Develop, Test, Pilot, Deploy and Operationalize All Applications

7.4.1 Development & Configuration

7.4.2 Testing

7.4.3 User Acceptance Testing & Pilot

7.4.4 Data Migration Execution

7.4.5 Deployment & Cutover

7.4.5 Training & Change Management

7.4.6 Operationalization & Knowledge Transfer

8. DELIVERABLES

8.1 Program Governance & Delivery Management - Program Initiation Deliverables

8.2 Ongoing Program Management Deliverables

8.3 Phase 1 – Current-State Assessment & As-IS Documentation

8.3.1 Enterprise Application Portfolio Assessment Deliverables

8.3.2 Current-State Business Process Documentation

8.3.3 Current-State Technical Architecture Documentation

8.3.4 Enterprise Data Assessment & Profiling Deliverables

8.3.5 Reporting & Analytics Assessment Deliverables

8.3.6 Enterprise Modernization Roadmap Deliverables

8.4 Phase 2 — Modernization Strategy & Future-State Design

8.4.1 Application Modernization Strategy Deliverables

8.4.2 Future-State Salesforce Architecture Deliverables

8.4.3 Security, Identity & Compliance Architecture Deliverables

8.4.4 Salesforce Internal Applications (14 & 15) Architecture & Security Review Deliverables

8.4.5 Enterprise Data Migration Strategy Deliverables

8.5 Phase 3 - Requirements, Design, Development, Testing, Pilot & Deployment Deliverables

8.5.1 Build & Configuration Deliverables

8.5.2 Refactoring Salesforce & Production Readiness Deliverables (14, 15)

8.5.3 Testing & Validation Deliverables

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 3 | P a g e

8.5.4 Pilot, Deployment & Transition Deliverables

8.5.5 Organizational Change Management, Training & Knowledge Transfer Deliverables – all applications

8.5.6 Final Closeout & Transition Deliverables

9. TECHICAL APPROACH & METHODOLGY

10. SALESFORCE CREDENTIALS & PARTNERSHIP

11. PROPOSED TEAM

12. REFERENCES

13. PROJECT TIMELINE

14. EQUAL EMPLOYMENT OPPORTUNITY AND SUPPLIER DIVERSITY REQUIREMENTS

15. HOW TO RESPOND

16. ADMINISTRATIVE VENDOR SUBMISSION REQUIREMENTS....... ERROR! BOOKMARK NOT

DEFINED.

17. VENDOR QUESTIONS

18. EVALUATION PROCESS

19. METHOD OF PAYMENT

20. ITS RESERVED RIGHTS

21. TERM OF CONTRACT

22. CONTRACT DOCUMENTS

23. CONTACT INFORMATION

Solicitation Attachments:

Attachment 1 – Letter of Interest Attachment 2 – Financial Bid Workbook Attachment 3 – Vendor Questions Form

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 4 | P a g e

1. INTRODUCTION

The New York State Office of Information Technology (ITS) of behalf of the Office of Addiction Services and Supports (OASAS), is announcing this Discretionary Procurement to seek a responsive and responsible vendor to modernize multiple business processes currently supported by outdated departmental tools (Excel, Access, Outlook, ColdFusion) that no longer meet NYS technology, security, or operational standards. The objective is to transition to a scalable, secure, Salesforce-based platform that improves efficiency, automation, reporting, and compliance as described in this solicitation document.

The purpose of this solicitation is to invite any eligible and interested entities that believe they can meet the eligibility criteria to inform ITS by completing Attachment 1 - Letter of Interest (LOI).

To be considered responsive, your organization’s bid should be received no later than the Bid Due Date specified in the Events Table on the first page of this announcement. Section 15 - HOW TO RESPOND, outlines additional information and guidance for responding to this solicitation, including all required forms.

This procurement is authorized under Section 163 of State Finance Law as a Discretionary Purchase, allowing ITS to contract without a formal competitive process in certain circumstances. This opportunity is limited to purchases up to the Discretionary Buying Threshold from respondent organizations qualified as:

a. NYS certified Minority and/or Women-owned Business Enterprises (MWBEs), or

b. NYS certified Service-Disabled Veteran-Owned Businesses (SDVOBs)

NYS certified MWBE and SDVOB are qualified pursuant to Article 15-A of State Executive Law and Article 3 of Veterans’ Services Law, respectively.

2. PROCUREMENT BACKGROUND

ITS/OASAS seeks to modernize multiple business processes currently supported by outdated departmental tools (Excel, Access, Outlook, ColdFusion) that no longer meet NYS technology, security, or operational standards. The objective is to transition to a scalable, secure, Salesforce-based platform that improves efficiency, automation, reporting, and compliance.

ITS/OASAS has undertaken a business modernization program with the following objectives for this initiative:

Create a portal for all identified interactions

Unify data across systems

Provide a single source of truth for data

Integrate with core Target User data sources

Increase Target User’s services provided online

Increase usage of Target User’s online services

Include functionality from current systems

Include additional planned functionality for systems

Transition to the Target User’s development staff after implementation

Streamline staff interactions with Target User’s end users

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 5 | P a g e

Mitigate or replace aging applications

Upon completion end users should see a reduction in application processing time, while staff will be able to prioritize value-added activities. ITS/OASAS has selected Salesforce’s Public Sector Solutions for this select business modernization activity.

3 . MINIMUM QUALIFICATIONS & ELIGIBILITY CRITERIA

Vendors must meet all the following minimum qualifications to be eligible to respond.

1. Agree to provide the services outlined in Section 7.0 – Scope of Work.

2. Are either a NYS-certified Minority-Owned Business Enterprise (MBE), NYS-certified Woman-Owned Business Enterprise (WBE), or NYS-certified SDVOB as defined in Section 1.

3. Are properly licensed to conduct business in the State of New York or provide a commitment to become properly licensed to conduct business in the State of New York within 30 calendar days of the date of the award letter, if selected for the award.

4. Salesforce Partnership Requirements

Must be an active Salesforce Registered, Silver, Gold, Platinum, or Ridge Partner at time of proposal submission.

Must demonstrate a minimum of three (3) Salesforce-certified professionals available for assignment to this engagement.

Must hold relevant Salesforce certifications including but not limited to: Salesforce Certified Technical Architect, Application Architect, System Architect, Platform Developer

5. Experience Requirements

Minimum [3] years of experience delivering Salesforce implementation projects.

Minimum [2] completed legacy application modernization engagements migrated to Salesforce.

Demonstrated experience with legacy technologies including ColdFusion, MS

Access, and Excel migration.

Demonstrated experience with data migration from heterogeneous sources into

Salesforce.

Demonstrated experience with data migration from heterogeneous sources into

Salesforce, including data profiling, ETL/ELT pipeline design, and data validation.

Demonstrated experience with Salesforce security model design in regulated environments (HIPAA, NIST, FISMA Moderate, CFR42, or equivalent).

Bidders not meeting the Minimum Qualifications will be disqualified.

4. CURRENT STATE OVERVIEW

OASAS currently operates a portfolio of legacy business applications spanning multiple technologies, as summarized below:

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 6 | P a g e

# Application Name

No of Screens

If Access # Tables

Data Feed From/To

Validation Type

Frequency Compl exity

Data Volume

Size

(MB)

Comments

ColdFusion

1 Provider and Program Search

OASAS

Provider and Program Search

3 - View Page

From PDS SQL Server Low 32728 3.12 Low- Data Volume Medium- Data Traffic

2 Training Catalog offered by OASAS and its Certified Education and Training Providers, which is acceptable toward satisfying initial core educational requirements to obtain credential.

10-Data Entry

4 - Display

From Certification

SQL Server Direct Connection

Low 173345 16.53

3 Program Review Reviewing or Recertification of the Certified Programs.

Maintenance of Scores, CAPS and Red Flag information.

6 From PDS From

Certification

SQL Server Every Night/Direct Connection

Low 155301 14.81

4 Certifications Program Certification

14 To PDS SQL Server Daily - Every Night

Low 304699 29.06 HCS and

NYSECON

process to be included in assessment

5 Fiscal Audit and Review Fiscal for

OASAS-

Funded Providers Audit and Review, who receive funding to operate services.

8 Data Entry and Data Load once in a year.

Low 141105 13.46

6 Learning and Development Tracking provides, sponsors, and approves additional learning opportunities for the on-going professional development of

6 From PDS Every Night/Direct Connection

Low 123752 11.80 L&D Forms.

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 7 | P a g e credentialed individuals.

Excel /Access Databases

Supportive Housing

MS access to

Sql Server

Low 20000

1.91 Loading 6

tables from MS Access to SQL Server.

DW is using the application.

23 Tables

8 For Profit - Certification

3 PDS/Certification

Low 500

0.05 3 Tables (Less than 500) 9 Application

Tracker - Certification

15 PDS/Certification

Low 10000

0.95 15 tables

(Less than 10000)

Email/Access

10 PICM (Practice Innovation and Care Management) Mailboxes

11 SOTA (State

Opioid Treatment Authority) Mailboxes

Forms/Excel sheets

12 Designations List

Low

Relates to Provider services certifications (e.g., LBGTQ, Gambling)

13 Harm Reduction

Street Outreach Facility Outreach Order Fulfillment Currently paper process needs screens and workflow defined

Salesforce Sandbox

14 Criminal Justice Salesforce 2.0

6 Low Currently v1 SF designed need enhancements and promotion

15 Recovery Centers 2.0 Salesforce 10

Currently v1 SF designed need enhancements and promotion

Note: Salesforce internal applications (14 & 15) have been internally developed by OASAS staff and are currently functional in the Salesforce Sandbox environment. These applications are not legacy migrations; they are Sandbox builds that require an independent best-practice and security review, gap identification, refactoring recommendations, and coordinated deployment

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 8 | P a g e to the Production environment.

5. APPLICATION COMPLEXITY CLASSIFICATION

OASAS has pre-classified all 15 in-scope applications. The 13 legacy departmental applications are rated low complexity. (ColdFusion, Access, Excel, Outlook.) including 2 applications in Salesforce Sandbox.

Complexity Tier Definition Number of

Applications

Simple Single-purpose apps, minimal integrations, small data sets, limited business rules

15 Applications

Medium Multi-function apps, moderate integrations, moderate data volume, defined business rules

0 Applications

Complex Multi-system integrations, large data volumes, complex business logic, regulatory requirements

0 Applications

TOTAL 15 Applications

6. STRATEGIC DIRECTION

OASAS has made a strategic decision to consolidate/ modernize these low complexity business applications/processes onto the Salesforce platform. This decision is designed in conformance with OASAS’ strategic plan and is driven by the need to:

• Eliminate technical debt and reduce operational risk from legacy systems

• Standardize on a modern, scalable, cloud-native platform

• Improve data quality, visibility, and reporting capabilities

• Enhance security posture and ensure regulatory compliance (HIPAA, NIST, FISMA

Moderate, CFR42)

• Reduce total cost of ownership across the application portfolio

• Enable future digital transformation initiatives

7. SCOPE OF WORK

7.1 Program Objectives

The primary objectives of this engagement are:

• Conduct a comprehensive assessment of all 13 legacy departmental and supporting end-user applications (Access/Email, Excel) and processes

• Document the current state (As-Is) architecture, processes, and data landscape

• Design the target state (To-Be) architecture on the Salesforce platform

• Develop a detailed, prioritized modernization roadmap

• Define the security model for the modernized Salesforce environment

• Develop a data migration strategy and execution plan

• Build, test and roll out new applications

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 9 | P a g e

• Review, refactor (refine development approach and include minimum new requirements as needed), test and promote the two (2) internal Salesforce Sandbox applications to Production

7.2 Scope Phase 1 — Assessment & As-Is Documentation

The selected vendor shall perform the following activities:

7.2.1 Application Portfolio Assessment

• Refine inventory and cataloging of identified applications

• Business function mapping per application

• User base analysis — departments, user counts, usage frequency

• Integration dependency mapping across all applications

• Technology risk assessment — end-of-life platforms, unsupported frameworks

7.2.2 As-Is Process Documentation

• Business process mapping for each application utilizing SSDLC methodology

• Swimlane diagrams showing roles, responsibilities, and workflow steps

• Identification of manual workarounds, paper-based processes, and shadow IT

• Pain point and inefficiency analysis

• Business rules documentation

7.2.3 As-Is Architecture Documentation

• Application architecture diagrams per system

• Infrastructure and hosting environment documentation

• Integration architecture — APIs, file transfers, database links

• Database schema diagrams and data store inventory

• Security posture assessment per application

7.2.4 Data Analysis & Profiling

• Complete data inventory across all applications

• Data profiling — volume, completeness, duplication, quality scoring

• Data relationship mapping across applications

• Sensitive and regulated data identification (PII, PPSI, financial, compliance)

• Master data identification and golden record analysis

• Data retention and archival requirements

7.2.5 Reporting Inventory

• Catalog of all existing reports and data import/exports

• Maximize opportunity for visualizations / find features and determine /eliminate redundant/unnecessary reports

• Consumer and frequency analysis per report

• Data lineage documentation for key reports

7.2.6 Modernization Roadmap

• Prioritized, sequenced roadmap across three horizons: 0-6 months, 6-18 months, 18-24 months

• SSDLC process and milestones (i.e., design, develop, test, implement)

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 10 | P a g e

• Dependency mapping between initiatives

• Risk registers and mitigation strategies

• Change management and training plan outline

7.3 Scope Phase 2 — Modernization Design & Roadmap

Based on Phase 1 findings, the selected vendor shall deliver:

7.3.1 Modernization Strategy per Application

• Application disposition recommendation using the 6R framework: Retain, Retire, Replace, Rehost, Replatform, or Refactor

• Salesforce cloud and product mapping per application

7.3.2 To-Be Architecture Design

• Target Salesforce architecture — clouds, orgs, products, and integrations

• Integration architecture — Salesforce base no code functionality, API strategy, MuleSoft or equivalent middleware

• Data architecture — Salesforce data model, external data sources, data lake strategy

• DevOps and release management architecture

• Reporting and analytics architecture — inherent SF dashboards, Tableau or equivalent

7.3.3 Security Model

• Identity and Access Management — SSO, MFA, role-based access control

• Salesforce security model — profiles, permission sets, sharing rules

• Data security — field-level security, encryption, data masking

• Compliance framework mapping — NYS information Security Policy, CFR42, HIPAA, NIST, FISMA Moderate, SOC 2, or applicable standards

• Security monitoring and audit logging strategy

7.3.4 Data Migration Strategy

• Migration approach recommendation — Big Bang, phased, or parallel run

• Data cleansing and transformation rules

• Source-to-target field mapping for all migrating applications

• ETL/ELT pipeline design

• Data validation and reconciliation approach

• Rollback and contingency plan

7.3.5 Salesforce Internal Applications — Review & Readiness

Applications 14 and 15 are Salesforce applications developed by OASAS team, currently in the Sandbox environment only. The selected vendor shall perform the following activities for both applications:

Review existing Salesforce configuration and custom code against current Salesforce best practices (Salesforce Well-Architected Framework)

Assess compliance with OASAS’s Salesforce security model standards — profiles, permission sets, sharing rules, FLS, and OWD

Identify technical debt, anti-patterns, and security gaps

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 11 | P a g e

Provide a prioritized remediation and refactoring recommendation report per application Execute approved refactoring changes in the Sandbox environment Develop and execute a deployment plan for migration to the Production environment

7.4 Scope Phase 3 - Develop, Test, Pilot, Deploy and Operationalize All Applications The modernization effort will progress from approved requirements into detailed solution design, incorporating current-state (“as-is”) analysis, target architecture, data architecture, identity assurance, and security models. Following design completion, the solution will move into pilot development and testing to validate functionality, integration, governance, and user workflows prior to phased deployment and operational rollout.

This includes:

• Finalize and approve business and technical requirements

• Complete modernization design, including:

Current-state (“as-is”) assessment Target architecture Data architecture Identity assurance and security model

Develop pilot implementation and test scenarios

• Validate functionality, integrations, and operational readiness

• Promote the Solution into Higher Environments (TST, QA, STG)

• Execute phased deployment and transition to OASAS/ITS production support team

7.4.1 Development & Configuration

The selected vendor shall design, build, and configure all Salesforce solutions in accordance with Phase 2 approved designs, applying Salesforce Well-Architected Framework principles throughout. The following sub-tasks are required:

• Configure Salesforce Public Sector Solutions, objects, fields, page layouts, record types, and validation rules per the approved data model for each application.

• Build automation using Omni Studio components, Lightning Flows (Screen Flow, Record- Triggered Flow, Scheduled Flow) to replace manual processes identified in Phase 1, Apex triggers and classes where declarative tools are insufficient

• Configure & Develop UI requirements using Omni Scripts, Flex Cards, Lightning Web Components (LWC) for custom where standard Salesforce UI cannot satisfy business needs identified in Phase 1 process documentation

• Establish and maintain a Salesforce DevOps pipeline, version control (Git or equivalent), scratch org strategy, CI/CD automation using Salesforce DX, Copado, Gearset, or equivalent tooling

• Conduct peer code review and static analysis against Salesforce code quality standards (PMD, Checkmark, or equivalent) for all custom Apex and LWC components

• Implement the approved integration architecture, API-based integrations, MuleSoft or equivalent middleware connections, file-based data exchanges, and real-time event integrations per Phase 2 integration design

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 12 | P a g e

• Build and configure the data migration pipelines (ETL/ELT) for all 13 applications per the approved source-to-target field mappings and transformation rules from Phase 2

• Implement the Salesforce security model as designed in Phase 2, profiles, permission sets, permission set groups, sharing rules, role hierarchy, field-level security (FLS), and organization-wide defaults (OWD)

• Configure identity and access management, SSO integration with OASAS's identity provider (NY.Gov), MFA enforcement, and session security policies

• Build all reports, dashboards, and list views required to replace and enhance the reporting inventory cataloged in Phase 1, configure Salesforce Analytics where applicable

7.4.2 Testing

The selected vendor is responsible for the full test lifecycle across all applications and integration points. All test plans, scripts, results, and defect logs must be submitted as formal deliverables.

• Unit Testing, develop and execute Apex unit tests achieving a minimum of 95% code coverage across all custom Apex classes and triggers; document test results per class

• System Integration Testing (SIT), design and execute end-to-end test scenarios covering all integration touchpoints between Salesforce and external systems, validate data fidelity across integration boundaries

• Data Migration Testing, execute a minimum of two (2) full dry-run data migration loads prior to production cutover; validate record counts, field-level accuracy, and referential integrity against source systems, document and remediate all reconciliation exceptions

• Security & Access Control Testing, validate that all user profiles, permission sets, sharing rules, FLS configurations, and OWD settings enforce the intended access model; test all regulatory compliance controls (HIPAA, NIST, FISMA Moderate, CFR42 as applicable)

• Regression Testing, execute a full regression test suite prior to each production release to verify that new changes have not introduced defects in previously validated functionality

• Performance & Load Testing, conduct load and performance testing simulating peak concurrent user loads and high-volume data processing scenarios are not exceeded under expected operational loads

• Defect Management, log, triage, prioritize, and track all defects to resolution using an agreed defect tracking tool; provide weekly defect status reports to OASAS throughout the testing phase

7.4.3 User Acceptance Testing & Pilot

The selected vendor shall plan, facilitate, and support a structured UAT program and pilot deployment involving OASAS business users and key stakeholders.

• Develop a UAT Strategy and Plan: Define UAT scope, entry and exit criteria, testing environments, participant roles, schedule, and escalation procedures, obtain OASAS approval prior to UAT commencement

• Develop UAT test scripts per business process, based on the Phase 1 As-Is process documentation and Phase 2 To-Be design, scripts must be written in plain language accessible to business users with no technical background

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 13 | P a g e

• Facilitate UAT execution sessions, schedule and run structured UAT workshops with designated OASAS business users; provide a vendor Business Analyst to support testers and capture defects in real time

• Track and resolve UAT defects log, prioritize, and remediate all defects raised during UAT; re-test remediated items, maintain a UAT defect log with status visible to OASAS throughout

• Obtain formal UAT sign-off, present UAT results to OASAS stakeholders and obtain written sign-off per application or application group before proceeding to pilot or production deployment

• Go / No-Go Readiness Assessment — prepare and present a formal Go/No-Go recommendation to OASAS leadership for each application release, incorporating UAT sign-off status, pilot results, data migration dry-run results, and outstanding defect counts against agreed entry criteria

7.4.4 Data Migration Execution

The selected vendor shall execute the approved data migration strategy for all 15 legacy applications in coordination with OASAS’s data owners and technical staff.

• Pre-Migration Data Cleansing, execute approved data cleansing and deduplication rules against source system data prior to each migration run; document all records modified, excluded, or flagged during cleansing

• Data Freeze Coordination, coordinate with OASAS to define and enforce a data freeze window for each source application prior to final cutover migration; document data freeze procedures and communicate to affected users

• Dry-Run Migration Execution (minimum 2 runs per application), execute full extract-transform-load pipeline runs in the Salesforce pre-production environment; validate record counts, field mapping accuracy, and data integrity against source system baselines

• Production Migration Execution, execute the final production data migration run during the approved cutover window; monitor pipeline execution in real time and provide status updates to OASAS at agreed intervals

• Post-Migration Validation, execute the full data validation and reconciliation checklist against the production Salesforce environment immediately following migration; resolve all critical discrepancies before declaring migration complete

• Rollback Execution (if triggered), if the post-migration validation fails against agreed acceptance criteria, execute the pre-approved rollback plan; notify OASAS immediately;

document rollback cause and corrective action plan

7.4.5 Deployment & Cutover

The selected vendor shall manage all production deployments in coordination with OASAS’s IT operations team, following a documented and OASAS-approved deployment runbook.

• Deployment Runbook Development, develop a detailed production deployment runbook for each application release covering: pre-deployment checklist, deployment sequence and commands, rollback triggers and procedures, post-deployment smoke test scripts, and stakeholder notification plan

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 14 | P a g e

• Change Advisory Board (CAB) Participation, participate in OASAS's change management or CAB process for all production deployments; prepare and present change request documentation as required

• Pre-Deployment Environment Validation, validate that the Salesforce production environment meets all prerequisites (governor limits, storage, connected apps, SSO configuration) prior to each deployment

• Production Deployment Execution, execute deployments using approved DevOps tooling (Salesforce DX, Copado, Gearset, or equivalent); follow the approved runbook step by step; maintain a deployment log with timestamps and outcomes

• Post-Deployment Smoke Testing, execute the agreed post-deployment smoke test checklist immediately after each production deployment to confirm critical functionality is operational before releasing to users

• Hypercare Support, provide a structured hyper-care support period of no fewer than 30 calendar days following each production go-live, during hyper-care, vendor must maintain a dedicated support resource available to OASAS within a four (4) business-hour response SLA for production issues

7.4.5 Training & Change Management

The selected vendor shall design and deliver a comprehensive training and change management program to ensure successful adoption of the Salesforce platform across all affected user groups.

• Training Needs Assessment, conduct a training needs assessment identifying all user roles, their current digital literacy baseline, the new tasks they will perform in Salesforce, and the appropriate training modality (instructor-led, self-paced eLearning, job aids, or a combination)

• Training Material Development, develop role-based training materials for all user groups, end users, staff, system administrators, and OASAS's internal development team;

materials must be tailored to actual Salesforce configuration, not generic platform training

• Training Delivery, facilitate training sessions per the approved training plan; for instructor-led sessions, provide a qualified Salesforce trainer with application-specific knowledge, coordinate scheduling and logistics with OASAS

• Super-User Enablement, identify and train a cohort of OASAS super-users (power users) who will serve as first-line support contacts for their departments post-go-live; provide super-users with additional hands-on training beyond general end-user training

• Train-the-Trainer, deliver a train-the-trainer program enabling OASAS's designated staff to independently deliver training to new users after vendor engagement concludes

• Training Effectiveness Measurement, collect post-training feedback and assess training effectiveness using pre-agreed metrics; provide a training completion report to OASAS.

7.4.6 Operationalization & Knowledge Transfer

The selected vendor shall ensure that OASAS's internal development and operations staff are fully equipped to own, maintain, and evolve the Salesforce platform independently upon engagement conclusion.

• System Administration Guide, develop a comprehensive Salesforce system administration guide covering user management, profiles and permission sets, data

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 15 | P a g e management, storage monitoring, scheduled jobs, connected apps, SSO administration, and routine platform maintenance tasks

• Configuration & Customization Documentation, deliver a complete configuration workbook documenting all custom objects, fields, page layouts, record types, validation rules, flows, triggers, Apex classes, and LWC components; documentation must be sufficient for OASAS's internal developers to maintain and extend without vendor assistance

• Integration Runbook & API Documentation, document all active integrations, including API endpoint details, authentication mechanisms, data payloads, error handling procedures, and steps to monitor, restart, or troubleshoot each integration

• Operational Runbooks & SOPs, develop standard operating procedures for all recurring operational tasks: data migration re-runs, report refreshes, scheduled batch job monitoring, user provisioning and deprovisioning, and integration health checks

• Platform Monitoring Setup, configure Event Monitoring, or equivalent platform monitoring tools define alerting thresholds, integration failures, login anomalies, and storage capacity; document monitoring procedures for OASAS operations team

• Structured Knowledge Transfer Sessions, conduct a minimum of six (6) structured knowledge transfer sessions with OASAS's internal development team during Phase 3 sessions must cover platform architecture, custom code walkthrough, integration design, security model, DevOps pipeline operation, and data model maintenance

• Hands-On Sandbox Practice, allocate dedicated sandbox time and vendor-guided lab exercises for OASAS's developers to practice configuration, deployment, and administrative tasks under vendor supervision before the vendor engagement concludes

• Lessons Learned & Post-Implementation Review (PIR) facilitate a formal PIR session with OASAS stakeholders upon engagement conclusion; document lessons learned, platform performance against original objectives, outstanding enhancement opportunities, and recommended future roadmap items

• Knowledge Transfer Sign-Off, obtain formal written sign-off from OASAS's IT leadership confirming that knowledge transfer objectives have been met and that OASAS is prepared to independently operate and maintain the Salesforce platform

8. DELIVERABLES

The vendor shall document and present the timeline, milestones to include all deliverables articulated in this document. OASAS/ITS will provide written acceptance or documented revision requests for each deliverable. Below is a list of minimum deliverables to be addressed.

8.1 Program Governance & Delivery Management - Program Initiation Deliverables

• Project Charter

• Integrated Master Project Plan

• Governance Framework and Decision Matrix

• Program Communication Plan

• Stakeholder Engagement and Escalation Plan

• Attest to conformance with NYS/ITS OASAS SSDLC Governance Framework

• Quality Management Plan (Agile/Jira)

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 16 | P a g e

• Resource and Staffing Plan

8.2 Ongoing Program Management Deliverables

• Weekly Status Reports

• Executive Steering Committee Briefings

• RAID Log (Risks, Assumptions, Issues, Dependencies)

• Change Control Log

• Action Item Tracker

• Financial/Budget Tracking Reports

• Schedule and Milestone Tracking

8.3 Phase 1 – Current-State Assessment & As-IS Documentation

8.3.1 Enterprise Application Portfolio Assessment Deliverables

End-user/departmental applications Classification Matrix (CIA) Departmental /End-user computing (Access, Excel, Email-driven) User Community and Usage Analysis

8.3.2 Current-State Business Process Documentation

• Current-State Business Process Repository

• SSDLC-Aligned Workflow Documentation

• Swimlane Process Diagrams

• Operational Workflow Maps

• Manual Workaround Assessment

• Shadow Process Identification

• Business Rules Catalog

8.3.3 Current-State Technical Architecture Documentation

• Current-State Enterprise Architecture Diagrams

• Application Architecture Documentation

• Environment Inventory (Production, Test, Development)

• Integration Architecture and Interface Inventory

• API and File Transfer Documentation

• Entity Relationship Diagrams (ERDs)

• Current Security Architecture Assessment

• Authentication and Access Control Review

8.3.4 Enterprise Data Assessment & Profiling Deliverables

Data Inventory Data Profiling and Quality Assessment Report Duplicate and Redundant Data Analysis Sensitive Data Identification and Classification o PII o PPSI o HIPAA-regulated data o Financial and compliance-related data

Data Retention and Archival Assessment Data Governance Findings and Recommendations

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 17 | P a g e

8.3.5 Reporting & Analytics Assessment Deliverables

Reporting Inventory As-is To-be Recommendations Data Export/Import Assessment Reporting Redundancy and Rationalization Analysis Visualization and Dashboard Opportunity and Design

8.3.6 Enterprise Modernization Roadmap Deliverables

Enterprise Modernization Roadmap Multi-Horizon Implementation Plan o 0–6 Months o 6–18 Months o 18–24 Months

Initiative Prioritization Framework SSDLC Phase and Milestone Plan Dependency and Critical Path Analysis Resource Capacity Planning Organizational Change Management Strategy Training and Adoption Strategy Operational Readiness Strategy Risk Register and Mitigation Plan Budgetary and Cost Estimation Model

8.4 Phase 2 — Modernization Strategy & Future-State Design

8.4.1 Application Modernization Strategy Deliverables

Application Modernization Assessment Report 6R Disposition Analysis per Application (Retain, Retire, Replace, Rehost, Re-platform, Refactor) Business Value and Complexity Scoring Matrix Modernization Prioritization Matrix

8.4.2 Future-State Salesforce Architecture Deliverables

Target-State Enterprise Architecture Blueprint Salesforce Org and Environment Strategy API and Event-Driven Architecture Strategy Middleware Architecture Design (MuleSoft or equivalent) Canonical Data Model External System Connectivity Strategy DevOps / CI-CD Architecture Reporting and Analytics Architecture Tableau / CRM Analytics Strategy Scalability and Performance Design Considerations

8.4.3 Security, Identity & Compliance Architecture Deliverables

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 18 | P a g e

Enterprise Identity and Access Management Strategy SSO and MFA Architecture Design Salesforce Security Model Blueprint Data Classification Matrix Encryption and Key Management Strategy Data Masking and Privacy Controls Audit Logging and Monitoring Strategy Compliance Controls Crosswalk o NYS Information Security Policy o HIPAA o CFR42 o NIST o FISMA Moderate o SOC 2

Security Risk Assessment Security Remediation Recommendations

8.4.4 Salesforce Internal Applications (14 & 15) Architecture & Security Review Deliverables

Salesforce Well-Architected Assessment Report Security Compliance Assessment Refactoring Recommendations Report Remediation Backlog and Prioritization Matrix

8.4.5 Enterprise Data Migration Strategy Deliverables

Enterprise Data Migration Strategy Migration Sequencing Plan Migration Approach Recommendation Big Bang vs Phased/Parallel Run Source-to-Target Mapping Specifications Data Transformation Rules ETL/ELT Architecture and Pipeline Design Data Cleansing and Standardization Plan Data Validation and Reconciliation Procedures Mock Conversion and Testing Strategy Rollback and Contingency Procedures Data Cutover Plan

8.5 Phase 3 - Requirements, Design, Development, Testing, Pilot & Deployment Deliverables

Approved Business Requirements Document (BRD) Functional Requirements Specification (FRS) Technical Requirements Specification (TRS)

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 19 | P a g e

Solution Design Document Detailed Configuration Specifications Technical Design Specifications Integration Design Specifications Non-Functional Requirements Documentation Test Strategy and Master Test Plan

8.5.1 Build & Configuration Deliverables

Configured Salesforce Applications Custom Components and Automations Workflow and Approval Configurations Integration Services and APIs Validation Rules and Business Logic Reports, Dashboards, and Analytics DevOps Pipelines and Deployment Automation Source Code Repository and Documentation

8.5.2 Refactoring Salesforce & Production Readiness Deliverables (14, 15) Refactored Sandbox Applications Updated Security Configuration Deployment Automation Scripts Production Migration Plan Release Readiness Checklist Post-Deployment Validation Results Smoke Testing Results Production Transition

8.5.3 Testing & Validation Deliverables

System Integration Testing (SIT) Plan and Results User Acceptance Testing (UAT) Plan and Scripts UAT Sign-Off Documentation Performance and Load Testing Results Security and Vulnerability Testing Results Defect Logs and Resolution Tracking Regression Testing Results Operational Readiness Validation Report

8.5.4 Pilot, Deployment & Transition Deliverables

Pilot Deployment Plan Pilot Evaluation and Findings Report Production Deployment Plan Cutover and Rollback Runbooks Go-Live Readiness Assessment

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 20 | P a g e

Production Support Transition Plan /Knowledge Transfer Sessions Operations and Support Runbooks

8.5.5 Organizational Change Management, Training & Knowledge Transfer Deliverables – all applications

Role-Based Training Curriculum o Salesforce Administrator Training Materials o End-User Training Materials o Super User Enablement Plan

Recorded Knowledge Transfer Sessions Support and Operations Runbooks Governance and Center of Excellence Recommendations

8.5.6 Final Closeout & Transition Deliverables

Final Executive Summary Report Lessons Learned Documentation Final Architecture Repository Complete Documentation Repository Final Risk and Issue Closure Report Operational Transition Sign-Off Project Closure Report

9. TECHICAL APPROACH & METHODOLGY

Describe your proposed methodology for Phase 1 and Phase 2 in sufficient detail for ITS/OASAS to evaluate the rigor and practicality of your approach. Your response must address:

Assessment methodology — how you will inventory, profile, and score legacy applications

Tools, frameworks, and accelerators proposed for assessment and documentation activities

Approach to stakeholder engagement, workshops, and interview facilitation

Methodology for the Harm Reduction net-new requirements elicitation and process design

Approach to reviewing, refactoring, and deploying the two Salesforce Sandbox applications

Knowledge transfer approach and how OASAS’s internal development staff will be engaged throughout

Risk management approach and how you will handle scope changes or discovery of undocumented complexity

10. SALESFORCE CREDENTIALS & PARTNERSHIP

Provide the following:

A copy of or link to your current Salesforce Partner Certificate or AppExchange partner profile confirming active partner status and tier.

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 21 | P a g e

A complete list of Salesforce certifications held by each proposed team member, including certification name, date obtained, and Trailhead verification link or certificate copy.

Any relevant Salesforce product specializations, consulting designations, or navigator status held by your firm.

A description of your firm's experience with Salesforce Public Sector Solutions, if applicable.

11. PROPOSED TEAM

Provide the following for each proposed team member:

• Full name, role, and seniority level

• Salesforce certifications held

• Relevant project experience (2-3 examples per person)

• Proposed allocation percentage to this engagement

Note: Key personnel named in the proposal may not be substituted without prior written approval from OASAS.

12. REFERENCES

Provide a minimum of two (2) client references for comparable legacy-to-Salesforce modernization engagements. For each reference include:

• Client organization name and industry

• Project scope and legacy technologies involved

• Salesforce clouds and products implemented

• Project duration and value

• Reference contact name, title, and contact details

13. PROJECT TIMELINE

Provide a proposed timeline including:

• Phase 1 start and completion dates

• Key milestones and deliverable submission dates

• Phase 2 and Phase 3 indicative timeline (pending Phase 1 / 2 findings)

• Overall timeline to be no longer than 24 months

14. EQUAL EMPLOYMENT OPPORTUNITY AND SUPPLIER DIVERSITY REQUIREMENTS

For the purposes of the contract resulting from this solicitation, ITS has established:

a. an overall goal of 30% participation for NYS-certified M/WBEs, 15% MBE participation, and 15% for WBE participation (based on the current availability of qualified MBEs and WBEs); and

b. an overall goal of 6% for NYS-certified SDVOBs.

15. HOW TO RESPOND

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 22 | P a g e

To be considered responsive, interested bidders should complete and submit all required documents by email in conformance with the format and content requirements as detailed in this Section. The subject line of the email submission of your response should include the following information: Discretionary Procurement # C000999 NYS Salesforce Integration Modernization for OASAS with your Vendor Name. Additionally, the vendor’s name should be in the email body and in the file names of the attached documents to ensure the submission is processed efficiently. Early submissions are encouraged, and late responses may be subject to rejection.

No extraneous terms shall be incorporated into the ITS Agreement unless expressly accepted by ITS in writing. Acceptance and/or processing of a Bid shall not constitute acceptance of extraneous terms.

Proposals must be emailed to its.sm.MAT.Solicitations@its.ny.gov by the Bid Due Date specified in the Events Table on the first page of this announcement. All files submitted must be able to be opened and reviewed without requiring additional credentials. Materials that are password-protected, encrypted, or otherwise restricted may be considered non-responsive and may result in the proposal being disqualified.

A response that does not provide all the information requested may be subject to rejection.

A complete response to this solicitation from the vendor submitting a bid includes the three (3) following required documents:

1. Attachment 1: Letter of Interest (LOI) that includes the following information:

Demonstration of how your organization meets the requirements in Section 3

Minimum Qualifications & Eligibility Criteria, containing sufficient detail to verify this determination.

2. Attach a copy of/proof of the vendor’s certification from New York State that identifies the vendor as a Service-Disabled Veteran-Owned Business (SDVOB), or NYS certified Minority and/or Women-owned Business Enterprises (M/WBE) showing how your organization meets the requirements in Section 3 Minimum Qualifications & Eligibility, Criteria containing sufficient detail to verify this determination.

3. Attachment 2: Financial Bid Worksheet: Must be inclusive of all proposed labor, equipment, materials, supplies, travel, administration, delivery, profit, and other ancillary costs. Any deviations, alterations, qualifiers, ranges, etc., included in the financial bid worksheet may result in the Bid being rejected.

Please limit your Letter of Interest to a maximum of two (2) pages, arial 12-point font, single line spacing, and one-inch margins.

16. ADDITIONAL DOCUMENTATION

Upon request by ITS, additional documents may be required to be completed as part of the contract development process. Information regarding these documents will be provided by ITS during the evaluation phase, and the documents include, but are not limited to the following:

a. New York State Required Certifications (nys-its-required-forms.pdf)

Discretionary Procurement C000999 NYS Salesforce Integration Modernization for OASAS 23 | P a g e

b. Confidentiality and Non-Disclosure Agreement

c. AC 3271-S Consultant Services Contractors Planned Employment Form

d. Vendor Responsibility Questionnaire (Proof of online VendRep certification)

e. Proof of Workers’ Compensation Insurance (if applicable)

f. Proof of Disability Benefits Coverage (if applicable)

g. ST-220-CA Contractor Certification to Covered Agency (if applicable)

h. Equal Employment Opportunity (EEO) Staffing Plan

i. MWBE Utilization Plan Form (if applicable)

j. Service-Disabled Veteran-Owned Business Utilization Plan (if applicable)

k. MWBE and/or SDVOB Quarterly Compliance Reports (Required during contract term)

l. EEO and MWBE Policy Statement

17. VENDOR QUESTIONS

Questions should be submitted on Attachment 3 – Vendor Questions Form via email to its.sm.MAT.Solicitations@its.ny.gov by the Vendor Questions Due Date specified within the Events Table on the first page of this announcement.. The subject line of the email should include the following information: Discretionary Procurement # C000999 NYS Salesforce Integration Modernization for OASAS. Questions received after the due date may be addressed at the discretion of ITS.

Under the requirements of the Procurement Lobbying Act, all communications regarding advertised Procurements are to be channeled only through the primary contact identified herein.

18. EVALUATION PROCESS

All Bid Responses received in a timely manner will be reviewed to determine if they meet the Bid Response submission requirements. After the Bid Response opening, each Bid will be screened for completeness and conformance with the Discretionary Procurement requirements. Bids that do not meet the Discretionary Procurement requirements may be deemed non-responsive, removed from further consideration, and the Bidder notified accordingly.

The Bid Response Completeness Review is evaluated on a pass/fail basis and will determine if Bidders have met all participation and submission requirements of this Discretionary Procurement, such as providing mandatory compliance-related documents.

ITS may require additional information from the Bidder before deciding whether the Bidder is eligible and can supply the requested goods or services. If ITS requests additional information, it must be provided within five (5) business days of the request or as otherwise directed. Failure to provide the requested information within five (5) business days may result in the Bidder being found non-responsive and no longer considered for an award.

An award will be made to the responsive and responsible Bidder that best meets the programmatic needs. Awards are contingent upon the vendor maintaining and certifying a Vendor Responsibility Questionnaire through the New York State VendRep System. Vendors must be found responsible and cannot be listed on the OGS prohibited vendors list. Vendors must provide their New York State vendor identification number when enrolling. To request a vendor identification number or for direct VendRep System user assistance, contact the OSC Help Desk

Discretionary Procurement C000999 NYS Salesforce Integration…