MyMassGov IDP RFI_Final_9.2.2026.docx

EOTSS RFI (7.1.2026)

Commonwealth of Massachusetts The Executive Office of Technology Services and Security

Commonwealth of Massachusetts Executive Office of Technology Services and Security

Request for Information EOTSS RFI 27-05475 for MyMassGov IDP COMMBUYS Bid Number: BD-27-1060-ITD00-ITD00-132869

September 2, 2026

Respondents to this Request for Information (RFI) are invited to respond to any or all of the questions in this document. Responses to this RFI shall serve solely to assist the Commonwealth in understanding the current state of the marketplace with regards to the solicited information or to inform the development of a possible solicitation for a Request for Responses (RFR) or Request for Quotes (RFQ) in the future. This RFI does not in any way obligate the Commonwealth to issue or amend a solicitation or to include any of the RFI provisions or responses in any solicitation. Responding to this RFI is entirely voluntary, and will in no way affect the Commonwealth’s consideration of any proposal submitted in response to any subsequent solicitation, nor will it serve as an advantage or disadvantage to the respondent in the course of any RFR or RFQ that may be subsequently issued or amended.

IN ACCORDANCE WITH M.G.L. C. 66 AND M.G.L. C. 4, § 7 (26), THIS RFI AND ALL RESPONSES HERETO INCLUDING THE WINNING BID SHALL BECOME PUBLIC RECORD, AND CAN BE OBTAINED FROM THE EXECUTIVE OFFICE OF TECHNOLOGY SERVICES AND SECURITY BY SUBMITTING A REQUEST AT https://www.mass.gov/executive-office-of-technology-services-and-security-prr. ANY PORTIONS OF A RESPONSE THAT ARE LABELED AS CONFIDENTIAL WILL STILL BE CONSIDERED PUBLIC RECORD.

General Procurement Information

General Information

Purchasing Entity: Executive Office of Technology Services and Security (“EOTSS”) or (“Agency”)

Address: One Ashburton Place, Eighth Floor, Boston, MA 02108

Procurement Contact: Sara Middleton

Telephone: 617-626-4400

E-Mail Address: sara.i.middleton@mass.gov

RFI File Number and Title: EOTSS RFI 27-05475 for MyMassGov IDP

Attachments: Attachment A – COMMBUYS Instructions

This Request for Information (“RFI”) does not commit the Commonwealth of Massachusetts (“Commonwealth”) or Agency to pay any costs incurred in the preparation of a Bidder’s response to this RFI or to purchase any products or services. The purpose of this RFI is to elicit the advice and best analysis of knowledgeable persons in the vendor community to enable the Commonwealth to craft a potential future solicitation for a MyMassGov Identity Provider (IDP). Responses to this RFI should include information that will be useful to the Commonwealth in subsequently drafting more detailed procurement solicitation(s) related to an Identify Provider (IDP).

The Agency may amend this RFI at any time prior to the date the responses are due. Any such amendment will be posted to the Commonwealth’s procurement website, CommBUYS (www.commbuys.com).

Bidders must submit their bids through the Commonwealth’s online procurement system, COMMBUYS, as detailed in Attachment A. Bidders are advised to check this site regularly, as this will be the sole method used for notification of changes.

Eligible Bidders

This RFI is restricted to Bidders on the following Statewide Contracts:

_ This RFI is open to any Bidders willing to respond.

Event Calendar

All times in this RFI are in prevailing Eastern Time. Responses must be received no later than the response due date and time indicated below or they will not be evaluated. Bidders must have their responses fully loaded and accepted in COMMBUYS prior to the RFI Response Due date and time listed below. Bidders are urged to allow sufficient time to upload their entire response.

Issuing Agency

The Executive Office of Technology Services and Security is responsible for the development of IT policy and implementation and oversight of all information technology investments for the Commonwealth and its respective agencies. EOTSS has broad statutory authority to effectuate the goals prompting IT consolidation in Chapter 64 of the Acts of 2017, as memorialized and articulated in M.G.L. c. 6A, s. 7A and M.G.L. c. 7D. As the lead enterprise IT and cybersecurity organization for the Executive Branch, EOTSS provides responsive digital and security services, and oversees and manages the enterprise technology and digital infrastructure and services for over 125 state agencies and over 43,000 state employees. EOTSS provides Enterprise Cybersecurity and Risk Management services, Infrastructure and Network services, End-User Support and IT services, Digital and Data services, Strategy Management and Consulting services, and additional IT-focused services to the Executive Branch and other Commonwealth users.

Description and Purpose of the RFI

Purpose

The purpose of MyMassGov is to support the Commonwealth’s centralized digital identity platform for residents and other external users accessing Commonwealth applications and services. Through this Request for Information (RFI), the Commonwealth seeks information from vendors regarding Customer Identity and Access Management (CIAM), Identity Provider (IdP), Business-to-Consumer (B2C) identity, and Single Sign-On (SSO) solutions. The purpose of this RFI is to better understand the capabilities available in the marketplace, emerging technologies, implementation approaches, commercial models, and industry best practices that could support the continued evolution of the MyMassGov platform.

The Commonwealth is particularly interested in information regarding solutions that can support secure authentication, authorization, federation, user lifecycle management, self-service account management, accessibility, privacy, scalability, and enterprise administration, and other capabilities relevant to a statewide digital identity platform. Responses will help inform the Commonwealth’s future planning and potential procurement strategy and should not be interpreted as a commitment to issue a subsequent procurement or award a contract.

Information Solicited

Background.

MyMassGov serves as the Commonwealth’s centralized digital identity platform for residents and other external users accessing digital services across state organizations. As the Commonwealth continues to expand digital services and modernize constituent-facing applications, EOTSS seeks information regarding identity platforms capable of supporting current and future business, security, accessibility, and operational requirements for MyMassGov. The current IDP used for MyMassGov is a CIAM product which EOTSS will need to replace with a modern product to enable a future vision of how constituents access and interact with state organizations.

MyMassGov today holds over 4 million registered accounts, with approximately 1.2 million monthly active users (AMU) accessing over 120 Commonwealth applications and services. Given the platform’s existing scale and broad adoption, the Commonwealth is particularly interested in understanding approaches for migrating from the current CIAM product while minimizing disruption to users, applications, and operations. EOTSS also places a high priority on providing a best-in-class user experience for constituents and other external users, often requiring UI customization based on research with and feedback from Massachusetts constituents.

Questions.

In its answer to this RFI, each Respondent should address the following:

1. Company and Solution Overview:

a. Provide a brief overview of your organization, including experience delivering Customer Identity and Access Management solutions for government or other large-scale organizations.

b. Describe how the proposed solution would support MyMassGov as a centralized digital identity platform serving residents and other external users across multiple Commonwealth agencies, applications, and programs.

c. Describe the deployment model(s) available for the solution (e.g., SaaS, cloud-hosted, hybrid, customer-managed) including supported cloud providers, hosting options, data residency capabilities, and a high-level overview of the solution architecture.

d. Identify any significant third-party products, services, or partnerships that are required or commonly used with the solution, including identity verification, fraud prevention, digital credential, or authentication services.

e. Provide examples of state, provincial, national, or large public-sector identity implementations, including scale metrics where shareable.

f. Describe your organization’s experience supporting migrations from existing enterprise CIAM platforms. Include examples of migrations involving large user populations and summarize the migration approach, coexistence strategy, user impact, and any lessons learned.

g. Include any published scalability limits, performance benchmarks, or architectural considerations relevant to deployments comparable in size to MyMassGov.

2. Identity Platform Capabilities

a. Describe the platform's identity and access management capabilities, including:

1. Authentication methods

2. Passwordless authentication

3. Passkeys and WebAuthn/FIDO2

4. Federation and single sign-on

5. User lifecycle management

6. Self-service account management

7. Account recovery and profile management

b. Describe support for identity standards and protocols, including SAML, OAuth, OpenID Connect (OIDC), SCIM, and any other relevant standards.

c. Describe support for account linking duplicate account detection, profile consolidation, and management of users who interact with multiple Commonwealth agencies or services.

d. Describe APIs, SDKs, integration patterns, and developer tooling available to application teams integrating with the platform.

e. Describe how the platform supports branding, localization, accessibility, user experience customization, and ongoing optimization of user journeys.

3. Security, Privacy, and Trust

a. Describe any capabilities that differentiate your platform from other CIAM providers in protecting resident identities.

b. Describe the security, privacy, compliance, fraud prevention, monitoring, and audit capabilities of the solution, including relevant certifications and standards.

c. Describe capabilities related to:

1. Adaptive or risk-based authentication

2. Fraud prevention

3. Credential stuffing protection

4. Bot mitigation

5. Account takeover prevention

6. Threat detection and response

d. Describe logging, monitoring, auditing, reporting, alerting, and SIEM integration capabilities.

e. Identify relevant certifications, attestations, and compliance frameworks supported by the solution, including FedRAMP, StateRAMP, SOC 2, ISO 27001, or equivalent certifications.

f. Describe how the platform supports privacy, data minimization, data portability, encryption, retention, deletion, disaster recovery, and business continuity.

4. Digital Identity and Future State Capabilities

a. Describe identity proofing and identity verification capabilities available within the platform or through integrated partners.

b. Describe support for NIST Digital Identity Guidelines and identity assurance levels, authentication assurance levels, or related trust frameworks.

c. Describe current or planned support for:

1. Digital wallets

2. W3C digital credential issuance and verification

3. User-controlled identity attributes

d. Describe your organization's perspective on how digital identity platforms are evolving over the next three to five years and how your product roadmap aligns with those changes.

5. Migration and Operations

a. Describe your recommended approach for implementing the proposed solution in a multi-agency environment.

b. Describe the largest identity platform migration your organization has completed in the last five years, including approximate user counts, application counts, and key lessons learned.

c. Describe tools, methodologies, and approaches available to support migration of:

1. User accounts

2. User attributes

3. Application integrations

4. Authentication policies

5. User journeys

d. Describe approaches for minimizing disruption to residents and application teams during migration and transition activities.

e. Describe how the platform supports:

1. Multi-agency governance

2. Centralized administration

3. Multiple environments

4. Operational monitoring

f. Describe the capabilities available to export users, configuration, policies, audit records, and related data should the Commonwealth choose to transition to another platform in the future.

6. Pricing and Product Direction

a. Describe the pricing model and primary cost drivers for the solution, including any pricing dimensions such as monthly active users, registered users, authentication volume, environments, applications, identity verification transactions, or support tiers.

b. Describe any public-sector, statewide, enterprise, or volume-based pricing programs available.

c. Describe the product roadmap for the next twenty-four to thirty-six months, including planned investments in authentication, identity verification, fraud prevention, digital credentials, artificial intelligence, automation, and related identity capabilities.

d. Identify any planned product transitions, major architectural changes, licensing changes, or deprecations that may affect customers during the next five years.

e. Describe your approach to maintaining backward compatibility during product upgrades and major platform changes. Include information regarding customer notification practices, migration assistance, release cadence, and support lifecycles.

f. Describe your organization's long-term strategy for the CIAM platform, including planned investments in innovation, interoperability, security, regulatory compliance, and support for large-scale government digital identity programs.

7. Ability to comply with the Commonwealth’s Use of Generative AI terms

Contractor shall share in its response to the RFI whether its proposed solution complies with this section, “Use of Generative AI”.

i. Use and Deletion of Agency Data Contractor shall not use Agency Data (defined as data provided by Agency and any data derived therefrom, including metadata (collectively, the “Agency Data”) for training, tuning, or testing the GenAI model unless required for the performance of Services and where the Agency has provided written consent for both the use of the GenAI tool and the Agency Data. Any permitted Agency Data inputs will be strictly limited to the data and inputs provided under this Agreement and will not extend to other Agency intellectual property. If the GenAI system/solution or Contractor’s provision of other services under the Contract require the use of Agency Data as GenAI training data, Contractor shall only use Agency Data as strictly necessary to provide the Services. Both the Contractor and Agency shall retain control over their data and have the ability to delete their data. Contractor shall delete all Agency Data within 30 days of receiving written notification from the Agency and shall confirm in writing that all Agency Data has been deleted.

ii. Intellectual Property, Accuracy, Bias, Discrimination, Mitigation and Quality Control of GenAI Contractor’s use of GenAI will be specifically limited to the automated creation of the material expressly defined in this Agreement’s scope. All GenAI usage will be configured to strictly align with the Agency’s brand guidelines. Contractor will implement robust quality control measures to review and approve, through non-automated means, all content generated by the GenAI tool before it is published, distributed or used in any business context. The review process must occur prior to any content being deployed or utilized in business operations, and every month thereafter, and must ensure that the content aligns with all the relevant policies, regulations and quality expectations. Additionally, the Contractor must identify, document and mitigate any biases, discrimination or otherwise unlawful outcomes based on race, color, religion, sex, national origin, disability, age, genetic information, or any other protected characteristic under applicable law in the AI solution or services.

iii. Breach and Termination Notwithstanding any other terms to the contrary in the Solicitation, or any contract entered by Contractor, Contractor’s failure to meet any of the obligations set forth in this provision “Use of Generative AI” will constitute a breach of the contract entitling the Commonwealth to terminate the contract for cause and without penalty and to pursue damages and any other legal or equitable remedies to which it may be entitled.

iv. Amendments to GenAI Terms The Commonwealth reserves the right to negotiate an amendment incorporating additional GenAI contract provisions into the contract or terminate in whole or in part any contract that, in the sole determination of the Commonwealth, presents an unacceptable level of risk to the Commonwealth with respect to GenAI.

v. Provision of Evaluative Information Contractor shall regularly monitor the performance of the GenAI system to detect and rectify system behavior that violates any of these provisions. Contractor shall promptly communicate the discovery of system behavior that violates any of the requirements in this ‘Use of Generative AI’ section to the Commonwealth, including the potential impact to the services.

vi. Order of Precedence This section “Use of Generative AI” will take precedence over any conflicting GenAI contract terms provided by the Contractor to the Agency.

vii. Updates to the Model/Platform Contractor shall provide reasonable notice to the Agency of any updates to the GenAI model/platform that substantially impact the services prior to the updates taking place.

viii. Audit Contractor certifies that on an annual basis, or upon request of the Agency, its GenAI systems, models, or platforms, and related processes, training materials, training data sets, and its use and management of synthetic data, comply with the requirements of the Agreement. Contractor further certifies that it retains GenAI audit logs consistent with the terms of Schedule F of the Commonwealth’s Records in Common Schedule. Such certification shall be made in writing by an authorized officer of the Contractor and shall be subject to the same confidentiality protections as set forth in the Agreement, except as disclosure is required by law.

ix. Control For GenAI solutions/systems/models developed for the Agency, Contractor shall provide mechanisms through which the Agency can oversee the development and testing of the GenAI and where necessary override its functionality through human intervention.

x. Disentanglement As of the termination date of the contract, or other date agreed upon by the Parties or determined by the Commonwealth, the Contractor shall cease the use of Generative AI in service delivery to the Agency; disengage Generative AI components; and comply with the transition/termination assistance obligations set forth in the contract.

xi. Right to Use During the term of the contract, Contractor shall ensure that the Agency has access to the full functionality offered by the GenAI systems/solutions used in the scope of services, including without limitation the ability to use the system, develop and test solutions, and make copies (with appropriate commercial mechanisms) without any limitations or restrictions. This clause shall survive the term of the contract if, in the contract, the Agency identifies the use of the Generative AI system as of strategic importance.

xii. Localization GenAI systems/solutions and data shall be hosted and stored in a cloud location controlled or approved by the Agency.

xiii. Representations Each representation and warranty set forth in the contract applicable to information technology shall apply with equal force to GenAI solutions/systems. In addition, Contractor warrants that the GenAI that is part of the system/solution shall be accurate and generate unbiased results and, should Contractor fail to deliver on this warranty, it shall remedy, at no cost to the Agency, any such defects in the GenAI system/solution.

General Instructions

Please note that this RFI is issued solely for the purpose of obtaining information. Nothing in this RFI shall be interpreted as a commitment on the part of the Commonwealth to enter into a contract with any Respondent.

· This RFI has been posted on September 2, 2026.

· Respondent Questions. Potential Respondents who have questions regarding this RFI may submit them via COMMBUYS [Agencies other than EOTSS, may select to have the questions e-mailed to the RFI contact person] them to the contact listed in Section 1 above by September 15, 2026. Respondents may only make inquiries and request clarification concerning this RFI by written questions via e-mail. Responses to inquiries and clarification questions will be provided electronically to all interested parties via a posting on COMMBUYS.

· Informational Sessions. There will be an informational session(s) associated with this RFI on September 11, 2026 at 2:30PM.

· Response Submission. All responses to this RFI are due no later than 3:00 p.m. on September 25, 2026. Respondents should submit one (1) electronic copy via COMMBUYS. All responses must include on the first page the official name (if any) of the firm or entity submitting the response. Please consecutively number all pages of the response.

· Response Content. Vendors should include a response to each of the questions set forth in Section 5 of this RFI.

· Response Format. The Commonwealth requests that all responses be submitted with a point-by-point response to each numbered subsection set forth in Section 5. If a Respondent opts not to respond to any item(s) that subsection, please note and if possible include an explanation for the lack of response.

· Additional Information. The Commonwealth retains the right to request additional information from Respondents. The Commonwealth may, at its sole discretion, elect to request formal presentations from certain vendors and/or create an RFR or RFQ which will include the detailed requirements and key success criteria for the procurement and be based, at least in part, on the responses received from this RFI. The Commonwealth may request further explanation or clarification from any and all Respondents during the review process.

Miscellaneous

Enterprise Information Security Standards and Policies

All products and services provided to the Commonwealth must comply with all applicable policies adopted by the Agency, which shall be made available to Bidder prior to contract execution. At a minimum, all goods and services provided to the Commonwealth must comply with the Enterprise Information Security Standards and Policies (https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards). As applicable, Bidders shall provide information that demonstrates that their security practices meet the requirements detailed in these policies.

Accessibility for IT Solutions Contract Language

The Commonwealth of Massachusetts’ Enterprise Digital Accessibility Policy drives ongoing efforts to make Massachusetts’ Digital Assets, including those delivered by a third-party, accessible and usable by all persons as required by state and federal laws. Where a Deliverable includes a Digital Asset, such Deliverable must meet the Commonwealth’s Digital Accessibility Standards.

The Commonwealth’s Digital Accessibility Standards include the Web Content Accessibility Guidelines (WCAG) version 2.1 level A and AA developed by the World Wide Web Consortium (W3C). Bidder must comply with the digital accessibility obligations set forth in the Vendor Digital Accessibility Contract Language and Vendor Digital Accessibility Testing Obligations and any subsequent versions or amendments.

During the bidding process and upon request, Bidder shall cooperate and provide the Commonwealth, or any third-party digital accessibility service provider procured by the Commonwealth, access to test its digital products for accessibility at no additional cost to the Commonwealth, if applicable.

Promotional Materials

Bidder must not reference the Agency or the Commonwealth in any promotional or marketing materials, including but not limited to use of the Agency’s or the Commonwealth’s name or logo, without first obtaining the Agency’s prior written approval for such use. Bidder must not use the Commonwealth’s seal in any promotional or marketing materials.

Bidders are discouraged from including extraneous promotional or marketing materials in their responses to this RFI and excessive promotional or marketing materials may detract from the Bidders’ overall score.

Review Rights

Responses to this RFI may be reviewed and evaluated by any person(s) at the discretion of the Agency including non-allied and independent consultants retained by the Agency for the sole purpose of evaluating and analyzing responses.

No Reimbursement.

By submitting a response, Respondents agree that any cost incurred in responding to this RFI, or in support of activities associated with this RFI, shall be the sole responsibility of Respondent. The Commonwealth shall not be held responsible for any costs incurred by Respondents in preparing their respective responses to this RFI.

EOTSS GenAI Policy

The Commonwealth consistently seeks to realize the benefits of new technology, in particular generative artificial intelligence (AI). Contractor must comply with the Enterprise Use and Development of Generative Artificial Intelligence Policy issued by EOTSS on January 31, 2025, as it may be amended from time to time. Please follow this link to the policy: www.mass.gov/doc/enterprise-use-and-development-of-generative-artificial-intelligence-policy/download.

Bidder Responses

Bidders are encourage to respond thoroughly and completely to the requested information.

ATTACHMENT A – COMMBUYS Instructions

Interested Bidders must submit their response using COMMBUYS.

Useful links:

1. Job aid on how to submit a quote: https://www.mass.gov/doc/how-to-create-a-quote-in-commbuys/download

1. Webcast: How to Locate and Respond to a Bid in CommBuys, which will familiarize bidders with CommBuys terminology, basic navigation, and provide guidance for locating bid opportunities in CommBuys and submitting an online quote.

1. Bidders MUST have their complete bid fully loaded and submitted prior to the time and date listed in the calendar. COMMBUYS will not allow for bids to be submitted after the posted time.

Bidder may contact the CommBuys Help Desk at CommBuys@state.ma.us or call during normal business hours (8AM – 5PM, Monday – Friday) at 1-888-627-8283 or 617-720-3197.

Written questions via the Bid Q&A on COMMBUYS

The “Bid Q&A” provides the opportunity for Bidders to ask written questions and receive written answers from the Strategic Sourcing Team (SST) regarding this Bid. All Bidders’ questions must be submitted through the Bid Q&A found on COMMBUYS (see below for instructions). Questions may be asked only prior to the Deadline for Submission of Questions stated in the Procurement Calendar. The issuing department reserves the right not to respond to questions submitted after this date. It is the Bidder’s responsibility to verify receipt of questions.

Please note that any questions submitted to the SST using any other medium (including those that are sent by mail, fax, email or voicemail, etc.) will not be answered. To reduce the number of redundant or duplicate questions, Bidders are asked to review all questions previously submitted to determine whether the Bidder’s question has already been posted.

Bidders are responsible for entering content suitable for public viewing, since all of the questions are accessible to the public. Bidders must not include any information that could be considered personal, security sensitive, inflammatory, incorrect, collusory, or otherwise objectionable, including information about the Bidder’s company or other companies. The PMT reserves the right to edit or delete any submitted questions that raise any of these issues or that are not in the best interest of the Commonwealth or this Bid.

All answers are final when posted. Any subsequent revisions to previously provided answers will be dated.

It is the responsibility of the prospective Bidder and awarded Bidder to maintain an active registration in COMMBUYS and to keep current the email address of the Bidder’s contact person and prospective contract manager, if awarded a contract, and to monitor that email inbox for communications from the Purchasing Department, including requests for clarification. The Purchasing Department and the Commonwealth assume no responsibility if a prospective Bidder’s/awarded Bidder’s designated email address is not current, or if technical problems, including those with the prospective Bidder’s/awarded Bidder’s computer, network or internet service provider (ISP) cause email communications sent to/from the prospective Bidder/Awarded Bidder and the Purchasing Department to be lost or rejected by any means including email or spam filtering.

Locating Bid Q&A

Log into COMMBUYS, locate the Bid, acknowledge receipt of the Bid, and scroll down to the bottom of the Bid Header page. The “Bid Q&A” button allows Bidders access to the Bid Q&A page.

image1.png