ITS86_Veterans Cemetery Digital Services Portal~8.pdf

Services RFQ (5.19.2026)

Commonwealth of Massachusetts

Executive Office of Veterans Services

Request for Quotation

Appian Implementation Services for the Veterans Cemetery Digital Services Portal

COMMBUYS Bid Number: BD-27-1110-1110C-1110L-134139

September 28, 2026

IN ACCORDANCE WITH M.G.L. C. 66 AND M.G.L. C. 4, § 7 (26), THIS RFQ AND ALL RESPONSES HERETO

INCLUDING THE WINNING BID SHALL BECOME PUBLIC RECORD, AND CAN BE OBTAINED FROM THE

EXECUTIVE OFFICE OF TECHNOLOGY SERVICES AND SECURITY BY SUBMITTING A REQUEST AT

https://www.mass.gov/executive-office-of-technology-services-and-security-prr. ANY PORTIONS OF A RESPONSE THAT

ARE LABELED AS CONFIDENTIAL WILL STILL BE CONSIDERED PUBLIC RECORD.

https://www.mass.gov/executive-office-of-technology-services-and-security-prr

Contents

1. General Procurement Information

1.1 General Information

1.2 Eligible Bidders

1.3 Event Calendar

1.4 Purchasing Agency

2. Description and Purpose of Procurement

2.1 Background

2.2 Description of Solution and Services

2.3 EOVS Project Requirements

2.4 Goals and Objectives

3. Scope of Work

3.1 Discovery and Requirements Validation

3.2 Family / Public Portal

3.3 EOVS and Cemetery Staff Workspace

3.4 Document Management

3.5 Eligibility and DD214 Processing

4. Payments

5. Communications

6. Reporting

7. Functional Requirements

8. Technical, Security, Accessibility, and Integration Requirements

8.1 Appian Platform

8.2 Security and Privacy

8.3 Accessibility

8.4 Identity and Access

8.5 Integrations

9. Environment and Deployment

10. Implementation Approach and Deliverables

10.1 Required Deliverables

10.2 Vendor Qualifications and Key Personnel

11. Assumptions, Dependencies, and Risks

12. Estimated Term

13. Order of Precedence

14. Data Classification and the Use of Generative Artificial Intelligence (GenAI)

14.1 Data Classification

14.2 Use of Generative AI

14.2.1 Use of GenAI Conditioned on Compliance with these Terms

14.2.2 Use and Deletion of Agency Data

14.2.3 Intellectual Property, Accuracy, Bias, Discrimination, Mitigation and Quality Control of

GenAI 14

14.2.4 Breach and Termination

14.2.5 Amendments to GenAI Terms

14.2.6 Provision of Evaluative Information

14.2.7 Order of Precedence

14.2.8 Updates to the Model/Platform

14.2.9 Audit

14.2.10 Control

14.2.11 Disentanglement

14.2.12 Right to Use

14.2.13 Localization

14.2.14 Representations

15. Additional Requirements

15.1 Enterprise Information Security Standards and Policies

15.2 Accessibility for IT Solutions Contract Language

15.3 Contract Negotiation and Amendments

15.4 Promotional Materials

15.5 Pending Litigation

15.6 Oral Presentations and Demonstrations

15.7 Review Rights

15.8 Permitted Copies

15.9 Risk Management

15.10 Warranties

16. EOTSS GenAI Policy

17. Post-Quantum Cryptography (PQC)

18. Bidder Responses

1. General Procurement Information

1.1 General Information

Purchasing Entity: Executive Office of Veterans Services

Address: One Bowdoin Square

Suite 400

Boston, MA 02114

Procurement Contact: Erin Veilleux

Telephone: (617) 821-5126

E-Mail Address: erin.veilleux@mass.gov

RFQ File Number and Title: BD-27-1110-1110C-1110L-134139

Veterans Cemetery Digital Portal

Attachments: Attachment A – COMMBUYS Instructions

Forms: Form 1 – RFQ Response Form

Form 2 – Cloud Terms Table

Form 3 – Statement of Work Template

Form 4 – Risk Management Terms

This Request for Quotes (“RFQ”) does not commit the Commonwealth of Massachusetts

(“Commonwealth”) or Agency to pay any costs incurred in the preparation of a Bidder’s response to this

RFQ or to purchase any products or services. The Agency may: (i) accept or reject any and all bids received as a result of this RFQ; (ii) contract for some, all, or none of the products and services offered by

Bidders in response to this RFQ; (iii) negotiate with one or more qualified Bidders; or (iv) cancel, in part or in its entirety, this RFQ if it is in the best interest of the Commonwealth to do so.

The Agency may amend this RFQ at any time prior to the date the responses are due. Any such amendment will be posted to the Commonwealth’s procurement website, COMMBUYS

(www.commbuys.com).

Bidders must submit their bids through the Commonwealth’s online procurement system, COMMBUYS, as detailed in Attachment A. Bidders are advised to check this site regularly, as this will be the sole method used for notification of changes.

1.2 Eligible Bidders

This RFQ is restricted to Bidders on the following Statewide Contracts:

ITS86

1.3 Event Calendar

All times in this RFQ are in prevailing Eastern Time. Responses must be received no later than the response due date and time indicated below or they will not be evaluated. Bidders must have their responses fully loaded and accepted in COMMBUYS prior to the RFQ Response Due date and time listed below. Bidders are urged to allow sufficient time to upload their entire response.

Procurement Step Due Date Time

RFQ Posted 10/05/2026 3:00pm

RFQ Response Due 10/26/2026 3:00pm

Notice of Apparent Successful Bidder(s) posted (estimated date) 11/2/2026 3:00pm

1.4 Purchasing Agency

The Executive Office of Technology Services and Security is responsible for the development of IT policy and implementation and oversight of all information technology investments for the

Commonwealth and its respective agencies. EOTSS has broad statutory authority to effectuate the goals prompting IT consolidation in Chapter 64 of the Acts of 2017, as memorialized and articulated in M.G.L.

c. 6A, s. 7A and M.G.L. c. 7D. As the lead enterprise IT and cybersecurity organization for the Executive

Branch, EOTSS provides responsive digital and security services, and oversees and manages the enterprise technology and digital infrastructure and services for over 125 state agencies and over 43,000 state employees. EOTSS provides Enterprise Cybersecurity and Risk Management services, Infrastructure and Network services, End-User Support and IT services, Digital and Data services, Strategy

Management and Consulting services, and additional IT-focused services to the Executive Branch and other Commonwealth users.

☐ If checked, the contract resulting from this RFQ will be made available to other Executive Department entities for the purchase of products or services. EOTSS may, in its option, require its prior approval for such entities to purchase products or services.

2. Description and Purpose of Procurement

2.1 Background

EOVS operates Massachusetts veterans cemeteries and administers services that require coordination among veterans, surviving family members, funeral homes and other representatives, EOVS staff, and cemetery staff. The current-state process includes paper forms, email, telephone coordination, document exchange, eligibility review, payment-related activity, and manual case tracking. The desired future state is a secure digital workflow in which a family can initiate a request, provide supporting information and documents, receive status updates, complete required steps, and communicate with EOVS/cemetery staff without relying on disconnected paper and email processes. Staff should have a single application record with associated documents, eligibility workflow, notes, tasks, activity history, and operational reporting.

2.2 Description of Solution and Services

The Massachusetts Executive Office of Veterans Services (EOVS) is seeking responses from qualified vendors with demonstrated Appian implementation expertise to design, configure, test, deploy, and support a Veterans Cemetery Digital Services Portal. The solution will provide a modern digital front door for veterans and their families and a centralized case-management workspace for EOVS and cemetery staff. EOVS intends to use Base Implementation from its existing cemetery capability breakdown as the initial implementation baseline. The Commonwealth also wants the resulting architecture to support future expansion into authenticated family self-service, two-way secure messaging, payment processor integration, identity services, enterprise content management, and additional case-management capabilities. The selected bidder will be responsible for a complete implementation, including discovery and requirements validation, solution design, Appian configuration, interfaces and integrations within the awarded scope, testing, training, deployment, documentation, and post-go-live stabilization.

3. EOVS Project Requirements https://malegislature.gov/Laws/SessionLaws/Acts/2017/Chapter64 https://malegislature.gov/Laws/GeneralLaws/PartI/TitleII/Chapter6a/Section7a https://malegislature.gov/Laws/GeneralLaws/PartI/TitleII/Chapter6a/Section7a https://malegislature.gov/Laws/GeneralLaws/PartI/TitleII/Chapter7D

3.1 Goals and Objectives

a. Provide a simple, accessible public portal for burial and interment service requests.

b. Modernize cemetery forms by converting appropriate transactions to accessible Appian digital forms while supporting upload of paper/PDF forms where digital conversion is not appropriate; inventory and rationalize existing Mass.gov forms and pages as part of discovery.

c. Create a centralized application/case record for each request.

d. Reduce paper-based and email-based processing.

e. Enable secure document submission and controlled document management.

f. Provide guided eligibility review workflows for EOVS staff.

g. Allow EOVS staff to submit or update applications on behalf of families.

h. Provide clear status visibility and activity tracking.

i. Provide a foundation for online payments and future payment processor integration.

j. Provide operational dashboards and reporting for EOVS leadership and cemetery operations.

k. Create an architecture that can support future authentication, messaging, task management, enterprise content management, and system integrations.

4. Scope of Work

4.1 Discovery and Requirements Validation

a. Conduct kickoff and discovery workshops with EOVS stakeholders, including cemetery operations, program staff, technology/security/accessibility stakeholders, and procurement/contract management as appropriate.

b. Validate the cemetery capability baseline and conduct a forms inventory covering existing paper/PDF forms, Mass.gov forms/pages, digital intake requirements, document templates, and opportunities for conversion to native Appian forms. The

Contractor shall identify gaps, dependencies, assumptions, and decisions required for implementation.

c. Document current-state and future-state workflows for pre-planning and interment applications.

d. Develop a prioritized product backlog and implementation plan approved by EOVS.

e. Appian Solution Design and Configuration

f. Configure the application in the Commonwealth Appian environment using maintainable, reusable Appian objects and established Appian development practices.

g. Create public-facing and staff-facing interfaces appropriate to the Commonwealth environment.

h. Implement workflow, rules, records, tasks, notifications, document handling, dashboards, and reporting within the awarded scope.

i. Provide appropriate configuration and documentation for administrator support and future enhancements.

4.2 Family / Public Portal

a. Responsive public portal for application initiation and status interaction.

b. Guided, multi-step forms for burial interment requests.

c. Inventory, redesign, and configure applicable cemetery forms as accessible digital

Appian forms, while retaining secure upload workflows for forms that remain paper/PDF-based. Existing Mass.gov forms/pages shall be assessed for integration, replacement, consolidation, or redirection.

d. Secure upload of supporting documentation, including DD214 and other required evidence.

e. Clear instructions, validation, save/resume behavior where supported by the approved design, and accessibility accommodations.

f. Status and next-step visibility for applicants consistent with EOVS privacy and security requirements.

4.3 EOVS and Cemetery Staff Workspace

a. Staff dashboard(s) and work queues.

b. Application record view with applicant, service request, status, workflow, documents, notes, and activity information.

c. Staff ability to create or update applications on behalf of families based on information received by phone, email, or other authorized channels.

d. Assignment and reassignment of applications.

e. Eligibility review, approval, request-for-information, and denial workflows.

f. Case notes and activity tracking.

g. Action-item/checklist capability designed so future task-management capabilities can be added without redesigning the underlying case model.

4.4 Document Management

a. Secure association of documents to the application/case record.

b. Document metadata and document type classification.

c. Controlled viewing, downloading, replacement/version handling, and retention behavior consistent with EOVS requirements.

d. Integrate with the Commonwealth's existing OnBase environment as part of the base implementation for official cemetery document storage and retrieval. Appian shall function as the case/workflow system of engagement, while OnBase remains the enterprise content repository for official records, subject to Commonwealth records-management requirements. The Contractor shall describe document metadata, identifiers, security, audit history, retrieval, and association of existing OnBase documents with Appian cases.

4.5 Eligibility and DD214 Processing

a. Implement the specified eligibility rules as configurable Appian rules where feasible.

b. Provide staff interfaces that guide eligibility determinations and capture the determination and rationale.

c. Implement DD214 ingestion / IDP extraction within the awarded baseline, with appropriate exception handling and manual review.

d. Separate extracted data from verified data so staff can confirm or correct information before it drives a determination.

5. Payments

The base implementation includes payment workflow/tracking with a stubbed payment-processing capability. Because production payment acceptance is a stated business objective, bidders shall provide a separate price and implementation approach for integration with a Commonwealth-approved payment processor such as Stripe, nCourt, or another approved service. The production payment option should include transaction status, receipts, reconciliation considerations, error handling, audit logging, and secure handling of payment-related information without storing prohibited payment credentials in Appian.

6. Communications

The base implementation shall support email-based notifications and case-associated correspondence in addition to case notes and activity tracking. The solution shall associate relevant inbound and outbound correspondence with the appropriate application/case record and retain it in accordance with Commonwealth records and security requirements. Bidders shall provide a separate price and implementation approach for enhanced secure two-way portal messaging between families and cemetery staff, including message threading, attachments, notifications, templates, audit history, and case association. The base solution shall support this future capability without material rework.

7. Reporting

a. Real-time operational reporting and dashboards.

b. KPIs and trends, including application volume, status, processing times, workload, and other EOVS-defined measures.

c. Filtering by date range and cemetery where appropriate.

d. Export capability subject to security and data-handling requirements.

e. Design for future reporting expansion without redesigning core records.

8. Functional Requirements

Requirement Priority

Public portal supports interment application submission. Required

Application supports secure document upload including DD214. Required

Staff can create/update applications on behalf of families. Required

Application record provides a centralized view of case data and associated documents. Required

Eligibility workflow supports approve / request information / deny outcomes and assignment.

Required

Eligibility rules are configurable and documented. Required

DD214 extraction/ingestion capability with staff validation. Required

Case notes, inbound/outbound email correspondence, and manual communication/activity tracking are associated with the case record.

Required

Activity timeline provides clear application progression/status. Required

Operational dashboards and metrics are provided. Required

Payment workflow/tracking is included; production payment processor integration is priced separately.

Required +

Add Alternate

Two-way secure applicant/staff portal messaging is priced as an add alternate. Add Alternate

Architecture supports future authenticated portal / SSO / MyMassGov integration. Required

Architecture supports future BOSS eligibility integration. Required

Initial OnBase integration is required so official cemetery documents can be stored and retrieved through the Appian case experience.

Required

Requirement Priority

The solution shall support an inventory and conversion strategy for cemetery forms, including native Appian forms, paper/PDF uploads, and assessment of existing Mass.gov forms/pages.

Required

The solution shall support secure inbound/outbound email notifications and case-associated correspondence, with appropriate retention, auditability, and security.

Required

The solution shall support accessible digital forms and form workflows that comply with

Commonwealth digital accessibility requirements.

Required

9. Technical, Security, Accessibility, and Integration Requirements

9.1 Appian Platform

▪ Use the Commonwealth-provided or Commonwealth-approved Appian platform and environments.

▪ Use Appian native capabilities wherever practical and minimize custom code.

▪ Follow Appian development, architecture, deployment, and version-management practices applicable to the Commonwealth environment.

▪ Provide a logical architecture and object inventory sufficient for EOVS operations and future enhancement work.

9.2 Security and Privacy

▪ Comply with applicable Commonwealth security, privacy, records, and information-classification requirements.

▪ Apply least-privilege access and role-based security.

▪ Protect documents and applicant information in transit and at rest as required by

Commonwealth standards.

▪ Log material user and workflow activity required for auditability.

▪ Support security testing, penetration testing, vulnerability remediation, and other controls required for production authorization.

▪ Do not store sensitive payment card data in Appian; use approved payment-provider patterns.

9.3 Accessibility

▪ Design and configure the public portal and staff interfaces to meet WCAG 2.2 AA as required by the Commonwealth.

▪ Support keyboard navigation, screen readers, appropriate labels and validation messages, color-independent meaning, and responsive presentation.

▪ Participate in Commonwealth accessibility review/testing and remediate identified issues before production release.

▪ As part of the solicitation and implementation, the Contractor shall provide the

Commonwealth Vendor Digital Accessibility Questionnaire, a current Accessibility

Conformance Report (ACR/VPAT) where applicable, a Digital Accessibility Roadmap for known accessibility violations where applicable, and reasonable participation in a

Vendor Demonstration of Accessibility and Commonwealth accessibility testing. The

Contractor shall perform required manual accessibility testing and provide testing/remediation evidence upon request.

9.4 Identity and Access

▪ Support EOVS staff authentication using Commonwealth-approved identity services.

▪ Design for future MyMassGov / external-user identity integration.

▪ Do not create a separate identity store when a Commonwealth-approved identity service is available and appropriate.

9.5 Integrations

Integration Baseline / Future Bidder Response

OnBase Required in Base

Implementation

Describe architecture, metadata mapping, security, document storage/retrieval, existing-document association, assumptions, and implementation approach.

EOVS SSO / MyMassGov Future-ready; identify dependencies.

Describe approach and estimated effort.

BOSS

Future-ready;

eligibility verification integration.

Describe approach, interface assumptions, and price if offered.

Payment Processor

Option; production integration requested as an add alternate.

Identify supported processor, approach, security model, and price.

Email / Notification Services Base

Identify Commonwealth email/notification services, inbound/outbound correspondence approach, case association, retention, and security assumptions.

10. Environment and Deployment

▪ Promote changes through Commonwealth-approved development, test, and production environments.

▪ Provide deployment/runbook documentation.

▪ Support release management, rollback planning, configuration management, and defect remediation.

11. Implementation Approach and Deliverables

Phase Indicative

Timing Key Deliverables

1. Mobilization &

Discovery Weeks 1-2

Kickoff, stakeholder map, confirmed requirements, backlog, risks/dependencies, implementation plan

2. Solution Design Weeks 2-4 Solution architecture, process designs, UX approach, data model, integration/security/accessibility decisions

3. Build / Configure Weeks 4-10 Configured Appian application, forms, workflows, records, documents, rules, DD214 capability, dashboards

4. System / Integration

Testing Weeks 9-12

Test plan/scripts, defect log, integration testing, security/accessibility remediation support

Phase Indicative

Timing Key Deliverables

5. UAT & Training Weeks 12-15 UAT support, training materials, administrator guide, user enablement

6. Production Readiness

& Go-Live Weeks 15-17

Go-live checklist, deployment, production validation, knowledge transfer, hypercare plan

11.1 Required Deliverables

▪ Project charter / implementation plan

▪ Requirements and traceability matrix

▪ Solution architecture and design documentation

▪ Configured Appian application and source/configuration artifacts as appropriate to the

Commonwealth environment

▪ Test strategy, test scripts, results, and defect disposition

▪ Accessibility and security remediation support artifacts

▪ Operational runbooks and administrator documentation

▪ Training materials and knowledge-transfer sessions

▪ Go-live readiness checklist and deployment plan

▪ Post-go-live stabilization / hypercare report

11.2 Vendor Qualifications and Key Personnel

Bidders shall demonstrate the organizational and personnel capacity to perform the services described in this RFR. Responses should provide specific evidence rather than general marketing material.

▪ At least three comparable Appian implementations, with at least one citizen-facing or public-sector implementation preferred.

▪ Demonstrated experience designing workflow/case-management solutions on Appian.

▪ Experience with government security, accessibility, and production authorization processes.

▪ Experience with document management, identity, payment, or similar enterprise integrations.

▪ Availability of certified Appian resources appropriate to the proposed solution.

▪ Ability to provide post-go-live support and knowledge transfer to Commonwealth staff.

Role Minimum Expectation Bidder Proposed

Resource

Project Manager Experience managing enterprise Appian implementations. Name / qualifications

Appian Solution Architect Appian architecture and integration experience. Name / qualifications

Lead Appian Developer Strong Appian configuration/development experience. Name / qualifications

Business Analyst /

Product Lead Workflow discovery and requirements traceability. Name / qualifications

QA / Test Lead System, integration, UAT coordination. Name / qualifications

Security / Accessibility

Support

Experience with Commonwealth or comparable public-sector controls.

Name / qualifications

12. Assumptions, Dependencies, and Risks

Item Draft Assumption / Dependency

Appian Platform EOVS / Commonwealth will provide or authorize the required Appian environment, licensing, and access.

Commonwealth

Systems

Required interfaces and credentials will be made available subject to security/architecture review.

Payment Processing A Commonwealth-approved payment processor and business process will be confirmed before production payment integration.

Identity External family identity / MyMassGov integration is dependent on Commonwealth identity architecture and onboarding requirements.

OnBase / BOSS

OnBase is required for the base implementation; detailed interface specifications and technical contacts will be made available. BOSS remains a future integration unless exercised as an add alternate.

Production

Authorization

Security, accessibility, domain, and production authorization activities may require

Commonwealth review timelines beyond vendor control.

Data Migration No bulk historical migration is assumed in the Base Implementation baseline unless specifically identified during discovery and priced/authorized.

Content EOVS will provide policy/content language, forms, eligibility rules, fee schedules, and business decisions needed for configuration.

Change Control New requirements discovered after baseline approval will be managed through agreed change-control procedures.

13. Estimated Term

The estimated term of any contract entered into under this RFQ shall consist of an initial 36-month term and may be renewed or extended upon written agreement by the awarded Bidder and the Agency. The initial term and all renewals or extensions shall be referred to collectively as the “Term.” The maximum

Term length will be governed by the applicable Statewide Contract.

14. Order of Precedence

The agreement resulting from this RFQ shall consist of the following documents in the following order of precedence:

a. the Commonwealth Terms and Conditions or the Commonwealth Terms and Conditions for

Information Technology Contracts, as applicable;

b. the Commonwealth Standard Contract Form;

c. the applicable Statewide Contract RFR;

d. the Bidder’s response thereto;

e. this RFQ [RFQ NUMBER and RFQ NAME](including all amendments, and clarifications hereto);

f. any agreement negotiated between and executed by the parties; and

g. the Bidder’s response to this RFQ (including all amendments, clarifications, and best and final offers)

15. Data Classification and the Use of Generative Artificial Intelligence (GenAI)

15.1 Data Classification

The Commonwealth of Massachusetts collects, manages, and stores information to support its business operations. The Commonwealth is committed to preserving the confidentiality, integrity, and availability of its information assets. Such information assets may include, without limitation, personal information, confidential information, and information protected under applicable law. Bidder agrees and acknowledges that its access, or potential access, to certain information assets may require certifications, background checks, or other additional requirements. Agency anticipates that the awarded Bidder will have access, or potential access, to the following data types as a result of providing services/products to

Agency under this RFQ.

Data Type Applicable Laws and Regulations Additional Requirements

☐ Personally Identifiable

Information

M.G.L. c. 93H

M. G. L. c. 66A

☐ Payment Card Information PCI Standards

☐ Family Educational Rights and Privacy Act data

Family Educational Rights and

Privacy Act

☐ Protected Health

Information

Health Insurance Portability and

Accountability Act of 1996

-Commonwealth of

Massachusetts Data

Management and

Confidentiality Agreement

☐ Federal Tax Return

Information

Publication 1075 -Publication 1075 Exhibit 7

-Commonwealth of

Massachusetts Dept. of

Revenue background check

☐ Criminal Offender Record

Information

FBI Security Addendum

NCIC 2000 Operating Manual

CJIS Security Policy

Title 28, CFR Part 20

-Dept. of Criminal Justice

Information certification

-background check

☐ Criminal Justice

Information

FBI Security Addendum

NCIC 2000 Operating Manual

CJIS Security Policy

Title 28, CFR Part 20

-Dept. of Criminal Justice

Information certification

-background check

☐ Social Security

Administration Data

Privacy Act

5 U.S.C. 552a s. 1106

-background check

☐ Other

☐ None/Not Applicable

Bidder certifies that its products or services, as offered in its RFQ response, meet all applicable legal and regulatory requirements pertaining to the identified data types indicated above. Bidder also agrees to enter into additional agreement(s), as reasonably requested by the Commonwealth prior to gaining access, or potential access, to Commonwealth information assets. Bidder acknowledges that the list above is not exhaustive, and Agency may designate additional data types, applicable laws and regulations, and additional required documentation in the contract resulting from this RFQ or any amendment thereto.

15.2 Use of Generative AI

The following provisions apply both to Generative AI (“GenAI”) that the Contractor proposes to use or will use to fulfill its obligations under a contract, and to GenAI tools that Contractor will provide directly to the Agency for its own use.

15.2.1 Use of GenAI Conditioned on Compliance with these Terms

Contractor shall not use GenAI to fulfill any obligations under the contract with the Agency or provide any GenAI tools to the Agency unless the contract includes terms consistent with this section, “Use of

Generative AI”.

15.2.2 Use and Deletion of Agency Data

Contractor shall not use Agency Data (defined as data provided by Agency and any data derived therefrom, including metadata (collectively, the “Agency Data”) for training, tuning, or testing the GenAI model unless required for the performance of Services and where the Agency has provided written consent for both the use of the GenAI tool and the Agency Data. Any permitted Agency Data inputs will be strictly limited to the data and inputs provided under this Agreement and will not extend to other

Agency intellectual property. If the GenAI system/solution or Contractor’s provision of other services under the Contract require the use of Agency Data as GenAI training data, Contractor shall only use

Agency Data as strictly necessary to provide the Services. Both the Contractor and Agency shall retain control over their data and have the ability to delete their data. Contractor shall delete all Agency Data within 30 days of receiving written notification from the Agency and shall confirm in writing that all

Agency Data has been deleted.

15.2.3 Intellectual Property, Accuracy, Bias, Discrimination, Mitigation and Quality

Control of GenAI

Contractor’s use of GenAI will be specifically limited to the automated creation of the material expressly defined in this Agreement’s scope. All GenAI usage will be configured to strictly align with the Agency’s brand guidelines. Contractor will implement robust quality control measures to review and approve, through non-automated means, all content generated by the GenAI tool before it is published, distributed or used in any business context. The review process must occur prior to any content being deployed or utilized in business operations, and every month thereafter, and must ensure that the content aligns with all the relevant policies, regulations and quality expectations. Additionally, the Contractor must identify, document and mitigate any biases, discrimination or otherwise unlawful outcomes based on race, color, religion, sex, national origin, disability, age, genetic information, or any other protected characteristic under applicable law in the AI solution or services.

15.2.4 Breach and Termination

Notwithstanding any other terms to the contrary in the Solicitation, or any contract entered by Contractor, Contractor’s failure to meet any of the obligations set forth in this provision “Use of Generative AI” will constitute a breach of the contract entitling the Commonwealth to terminate the contract for cause and without penalty and to pursue damages and any other legal or equitable remedies to which it may be entitled.

15.2.5 Amendments to GenAI Terms

The Commonwealth reserves the right to negotiate an amendment incorporating additional GenAI contract provisions into the contract or terminate in whole or in part any contract that, in the sole determination of the Commonwealth, presents an unacceptable level of risk to the Commonwealth with respect to GenAI.

15.2.6 Provision of Evaluative Information

Contractor shall regularly monitor the performance of the GenAI system to detect and rectify system behavior that violates any of these provisions. Contractor shall promptly communicate the discovery of system behavior that violates any of the requirements in this ‘Use of Generative AI’ section to the

Commonwealth, including the potential impact to the services.

15.2.7 Order of Precedence

This section “Use of Generative AI” will take precedence over any conflicting GenAI contract terms provided by the Contractor to the Agency.

15.2.8 Updates to the Model/Platform

Contractor shall provide reasonable notice to the Agency of any updates to the GenAI model/platform that substantially impact the services prior to the updates taking place.

15.2.9 Audit

Contractor certifies that on an annual basis, or upon request of the Agency, its GenAI systems, models, or platforms, and related processes, training materials, training data sets, and its use and management of synthetic data, comply with the requirements of the Agreement. Contractor further certifies that it retains

GenAI audit logs consistent with the terms of Schedule F of the Commonwealth’s Records in Common

Schedule. Such certification shall be made in writing by an authorized officer of the Contractor and shall be subject to the same confidentiality protections as set forth in the Agreement, except as disclosure is required by law.

15.2.10 Control

For GenAI solutions/systems/models developed for the Agency, Contractor shall provide mechanisms through which the Agency can oversee the development and testing of the GenAI and where necessary override its functionality through human intervention.

15.2.11 Disentanglement

As of the termination date of the contract, or other date agreed upon by the Parties or determined by the

Commonwealth, the Contractor shall cease the use of Generative AI in service delivery to the Agency;

disengage Generative AI components; and comply with the transition/termination assistance obligations set forth in the contract.

15.2.12 Right to Use

During the term of the contract, Contractor shall ensure that the Agency has access to the full functionality offered by the GenAI systems/solutions used in the scope of services, including without limitation the ability to use the system, develop and test solutions, and make copies (with appropriate commercial mechanisms) without any limitations or restrictions. This clause shall survive the term of the contract if, in the contract, the Agency identifies the use of the Generative AI system as of strategic importance.

15.2.13 Localization

GenAI systems/solutions and data shall be hosted and stored in a cloud location controlled or approved by the Agency.

15.2.14 Representations

Each representation and warranty set forth in the contract applicable to information technology shall apply with equal force to GenAI solutions/systems. In addition, Contractor warrants that the GenAI that is part of the system/solution shall be accurate and generate unbiased results and, should Contractor fail to deliver on this warranty, it shall remedy, at no cost to the Agency, any such defects in the GenAI system/solution.

16. Additional Requirements

16.1 Enterprise Information Security Standards and Policies

All products and services provided to the Commonwealth must comply with all applicable policies adopted by the Agency, which shall be made available to Bidder prior to contract execution. At a minimum, all goods and services provided to the Commonwealth must comply with the Enterprise

Information Security Standards and Policies (https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards). Bidders shall provide information that demonstrates that their security practices meet the requirements detailed in these policies.

16.2 Accessibility for IT Solutions Contract Language

The Commonwealth of Massachusetts’ Enterprise Digital Accessibility Policy drives ongoing efforts to make Massachusetts’ Digital Assets, including those delivered by a third-party, accessible and usable by all persons as required by state and federal laws. Where a Deliverable includes a Digital Asset, such

Deliverable must meet the Commonwealth’s Digital Accessibility Standards.

The Commonwealth’s Digital Accessibility Standards include the Web Content Accessibility Guidelines

(WCAG) version 2.1 level A and AA developed by the World Wide Web Consortium (W3C). Bidder must comply with the digital accessibility obligations set forth in the Vendor Digital Accessibility

Contract Language and Vendor Digital Accessibility Testing Obligations and any subsequent versions or amendments.

During the bidding process and upon request, Bidder shall cooperate and provide the Commonwealth, or any third-party digital accessibility service provider procured by the Commonwealth, access to test its digital products for accessibility at no additional cost to the Commonwealth. The digital products must be available to the Commonwealth for evaluation prior to purchase and on an ongoing basis.

16.3 Contract Negotiation and Amendments

The Agency may negotiate changes to the original performance measures, quantities, Term length, and requirements identified in this RFQ at any time, provided that such changes are consistent with the scope of this RFQ. The Agency may negotiate and execute contract amendments with the awarded Bidder(s) which the Agency reasonably determines are within the scope of this RFQ and necessary to result in best value to the Commonwealth.

16.4 Promotional Materials

Bidder must not reference the Agency or the Commonwealth in any promotional or marketing materials, including but not limited to use of the Agency’s or the Commonwealth’s name or logo, without first obtaining the Agency’s prior written approval for such use. Bidder must not use the Commonwealth’s seal in any promotional or marketing materials.

Bidders are discouraged from including extraneous promotional or marketing materials in their responses to this RFQ and excessive promotional or marketing materials may detract from the Bidders’ overall score.

16.5 Pending Litigation

Bidder must affirm that there is no pending litigation involving the Bidder, Provider, or the services provided in the response, that may impair or interfere with the Agency’s right to use the services. Bidder https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards https://www.mass.gov/info-details/enterprise-digital-accessibility-policy https://www.mass.gov/info-details/enterprise-digital-accessibility-policy#6-digital-accessibility-standards https://www.mass.gov/info-details/enterprise-digital-accessibility-policy#6-digital-accessibility-standards https://www.mass.gov/info-details/vendor-digital-accessibility-contract-language https://www.mass.gov/info-details/vendor-digital-accessibility-contract-language https://www.mass.gov/info-details/vendor-digital-accessibility-testing-obligations https://www.mass.gov/info-details/vendor-digital-accessibility-testing-obligations#access-to-test-digital-products must warrant that there are no actual or threatened actions arising from, or alleged under, any intellectual property rights of any third party.

16.6 Oral Presentations and Demonstrations

In its discretion, the Agency may invite one or more Bidders whose responses have been judged competitive and responsive in the course of the evaluation to participate in a facilitated oral presentation, including a demonstration of the proposed services. The Agency may use these demonstrations and oral presentations to clarify aspects of the Bidder’s response or to inquire as to the Bidder’s approach, recommendations, and experience. The Agency may adjust its scoring of a prospective Bidder based on the Bidder’s performance during production demonstration and/or oral presentation.

The Agency reserves the right to apply restrictions to the structure and content of Bidder’s product demonstrations and oral presentations. Demonstrations and oral presentations shall not be open to the public nor to any competitors. The schedule of the demonstrations and oral presentations will be arranged directly with the Bidders selected by the Agency. Failure of a Bidder to agree to a date and time may result in rejection of the Bidder’s response.

16.7 Review Rights

Responses to this RFQ may be reviewed and evaluated by any person(s) at the discretion of the Agency including non-allied and independent consultants retained by the Agency for the sole purpose of evaluating and analyzing responses.

16.8 Permitted Copies

If applicable, Bidders must authorize the Agency to make, keep and retain a reasonable number of machine-readable copies of all licensed, core software components included in the deliverables for testing, backup or archival purposes (the “Permitted Copies”). Such authorization shall be provided to the

Agency at no additional cost.

17. Risk Management

Bidder must indicate the types of system audits or assessments (e.g. SOC 2) it conducts or engages third parties to conduct on its behalf, pertaining to the quoted products or services, and the frequency of such audits or assessments. Any time after submitting its Bid, upon Agency's request, Bidder shall provide audit or assessment reports to the Agency.

17.1 Warranties

1. Bidder shall provide all warranties listed below. Additional warranties may be agreed to in the contract resulting from this RFQ.

2. Bidder must provide all warranties required by the applicable Statewide Contract.

3. Bidder and its subcontractors will be sufficiently staffed and equipped to fulfill Bidder’s obligations under any SOW or engagement resulting from this RFQ. Bidder warrants that it shall be responsible for the actions and omissions of all subcontractors and shall ensure all subcontractors’ compliance with the terms of an agreement resulting from this RFQ.

4. Bidder’s services will be performed: (a) by appropriately qualified and trained personnel; (b) with due care and diligence and to a high standard of quality as is customary in the industry; (c) in compliance with the Milestone Schedule and the terms and conditions of this RFQ and any contract hereunder; and (d) in accordance with all applicable professional standards for the field of expertise.

5. The Deliverables will substantially conform with the Deliverable descriptions set forth in any

SOW or engagement resulting from this RFQ.

6. All media on which the Bidder provides any software shall be free from defects.

7. All software delivered by the Bidder under the applicable Statewide Contract or this RFQ shall be free of Trojan horses, back doors, and other malicious code.

8. Bidder will obtain all rights, grants, assignments, conveyances, licenses, permissions and authorizations necessary or incidental to any materials owned by third parties, including data to train Generative AI models, supplied or specified by the Bidder for incorporation in the

Deliverables to be developed under the applicable Statewide Contract.

9. Documentation to be provided by the Bidder shall be in sufficient detail so as to allow suitably skilled, trained, and educated Agency personnel to understand the operation of the Deliverables.

Bidder agrees to promptly, at no additional cost to the Agency, make corrections to any documentation that does not conform to this warranty.

10. Bidder warrants that any systems that Bidder creates or modifies will operate in conformance with the Specifications for the system or modifications for six (6) months after acceptance

(“Warranty Period”). As used in this RFQ, “Specifications” means (i) the requirements set forth in this RFQ, (ii) the functional, performance, and interoperability requirements set forth in any agreement entered hereunder; and (iii) the functionality and description provided in Bidder’s response to this RFQ. If EOTSS discovers a non-conformity during the Warranty Period, then the Bidder shall use commercially reasonable efforts to correct the non-conformity or provide a work around that is acceptable to the Agency (a “Fix”). If Bidder is unable to remedy a non-conformity or to provide a Fix that is acceptable to the Agency within a reasonable period of time, then the Agency may terminate any agreement effective immediately upon written notice to

Bidder. Any replacement or error correction will not extend the original Warranty Period. During the Warranty Period, Bidder will not charge the Agency for services, parts, labor, or transportation

11. All content that may be created by GenAI is a work made for hire under U.S. Copyright law. To the extent any GenAI content may not be considered a work made for hire under applicable law, as part of the Contract, Contractor assigns to Agency, in perpetuity, all right and interest to such

GenAI content without the need for further consideration. In addition, content created from the

Commonwealth provided prompt is not a derivative work of the GenAI training data.

Notwithstanding the preceding sentence, in the event a court of competent jurisdiction determines that content created from a Commonwealth-provided prompt constitutes a derivative work of the

GenAI training data, Contractor agrees to grant the Commonwealth unlimited, irrevocable, worldwide, perpetual, royalty-free, non-exclusive right, and license to use, modify, reproduce, perform, release, display, create derivative works from, and disclose the content for any

Commonwealth business.

18. EOTSS GenAI Policy

The Commonwealth consistently seeks to realize the benefits of new technology, in particular generative artificial intelligence (AI). Contractor must comply with the Enterprise Use and Development of

Generative Artificial Intelligence Policy issued by EOTSS on January 31, 2025, as it may be amended from time to time. Please follow this link to the policy: www.mass.gov/doc/enterprise-use-and-development-of-generative-artificial-intelligence-policy/download.

19. Post-Quantum Cryptography (PQC)

Contractor solutions should support migration to post-quantum cryptographic standards approved or recommended by NIST or other recognized industry, governmental, or international standards bodies, and maintain cryptographic agility without requiring complete system replacement. If complete system replacement is necessary to support such migration, the transition shall be performed at no additional cost to the Commonwealth.

https://www.mass.gov/doc/enterprise-use-and-development-of-generative-artificial-intelligence-policy/download https://www.mass.gov/doc/enterprise-use-and-development-of-generative-artificial-intelligence-policy/download

20. Bidder Responses

Bidders must complete the attached RFQ Response Form (Form 1) and a Template Statement of Work

(Form 2).

The responses to this RFQ will be evaluated based on the criteria listed below, in descending order of importance with the most important criteria listed first. The procurement management team may remove from further consideration non-responsive bids and bids that do not include all required items listed in

Section VII (Bidder Responses). Prior to such an exclusion, the Agency may request one or more clarification(s) from Bidder. A Bidder’s response may be excluded for failure to meet the Agency’s budgetary thresholds. Should this RFQ result in a contract with an annual spend amount of less than

$250,000, bids from certified small businesses are highly desired, in accordance with ReOrg Plan S.2937

“An Act to Elevate the Supplier Diversity Office to Ensure Equal Opportunity in State Contracting,” and

Agency will follow guidance provided by the Supplier Diversity Office in evaluating Bidder responses.

Evaluation Criterion Draft Weight

Technical / Functional Approach and Understanding of Need 30%

Appian Experience and Relevant Past Performance 20%

Project Team and Implementation Plan 15%

Security, Accessibility, and Commonwealth Readiness 15%

Price / Total Evaluated Cost 15%

Supplier Diversity / Other Required Commonwealth Procurement Factors 5%

EOVS reserves the right to conduct discussions, request clarifications, evaluate references, and otherwise conduct the procurement in accordance with applicable Commonwealth requirements and the final

COMMBUYS solicitation.

https://www.mass.gov/orgs/supplier-diversity-office-sdo

ATTACHMENT A – COMMBUYS Instructions

Interested Bidders must submit their response using COMMBUYS.

Useful links:

Job aid on how to submit a quote: https://www.mass.gov/doc/how-to-create-a-quote-in-commbuys/download

Webcast: How to Locate and Respond to a Bid in CommBuys, which will familiarize bidders with

CommBuys terminology, basic navigation, and provide guidance for locating bid opportunities in

CommBuys and submitting an online quote.

Bidders MUST have their complete bid fully loaded and submitted prior to the time and date listed in the calendar. COMMBUYS will not allow for bids to be submitted after the posted time.

Bidder may contact the CommBuys Help Desk at CommBuys@state.ma.us or call during normal business hours (8AM – 5PM, Monday – Friday) at 1-888-627-8283 or 617-720-3197.

Written questions via the Bid Q&A on COMMBUYS

The “Bid Q&A” provides the opportunity for Bidders to ask written questions and receive written answers from the Strategic Sourcing Team (SST) regarding this Bid. All Bidders’ questions must be submitted through the Bid Q&A found on COMMBUYS (see below for instructions). Questions may be asked only prior to the Deadline for Submission of Questions stated in the Procurement Calendar. The issuing department reserves the right not to respond to questions submitted after this date. It is the

Bidder’s responsibility to verify receipt of questions.

Please note that any questions submitted to the SST using any other medium (including those that are sent by mail, fax, email or voicemail, etc.) will not be answered. To reduce the number of redundant or duplicate questions, Bidders are asked to review all questions previously submitted to determine whether the Bidder’s question has already been posted.