NIA1 25_851 Award Recommendation and Evaluation Synopsis.docx

Michigan.gov/MiProcurement

Michigan.gov/MiProcurement

AWARD RECOMMENDATION

The Department of Treasury has completed the evaluation of RFP 250000002120 Qualified Security Assessor Services and has recommended an award to Online Enterprises Inc. dba Online Business Systems in the amount of $348,275, pending State Administrative Board approval, if applicable. More information on the State Administrative Board can be found at: State Administrative Board.

Bidders who were not recommended for the award are encouraged to schedule a debriefing session with the Solicitation Manager. The debriefing session will provide the bidder with the State’s rationale on why the bidder was not recommended for the award. The Solicitation Manager may be contacted as follows:

Adam Zanetti, Solicitation Manager.

Zanettia@michigan.gov 517-667-1465 Background Information:

This Request for Proposal (RFP) was to solicit responses for selection of a Contractor to provide Qualified Security Assessor Services to assist the State with maintaining Payment Card Industry (PCI) compliance. The term of this contract is 3 years, with up to 3, 1-year renewal options.

Bidders:

The RFP was posted on SIGMA VSS on Monday, April 21, 2025, for 29 calendar days. The following bidders submitted proposals by the published due date of Monday, May 19, 2025.

Bloomington, Minnesota, 55437

*SDVOB: Service-Disabled Veteran Owned Business **GDBE: Geographically Disadvantaged Business Enterprise

EVALUATION SYNOPSIS

I. Evaluation Process A Responsible Vendor is a vendor that demonstrates it has the ability to successfully perform the duties identified by the solicitation. A Responsive proposal is one that is submitted in accordance with the solicitation instructions and meets all mandatory requirements identified in the solicitation.

Proposal Instructions: Mandatory Minimum Requirements The Bidder must attest that they are a certified Qualified Security Assessor (QSA) approved by the PCI Security Standards Council as of the submission of their proposal. Bidder must be certified to perform on-site PCI Data Security Assessments for Level 1 & 2 Merchants and Level 1, 2, or 3 Service Providers. Proof of certification must be submitted with the proposal.

https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors Proposal Instructions: Evaluation Process The State evaluated each proposal based on the following factors:

Proposals receiving 80 or more technical evaluation points will have pricing evaluated and considered for award.

The full evaluation process is stated in the RFP Proposal Instructions.

II. Evaluation Method Responses to this solicitation were reviewed by a Joint Evaluation Committee, which consisted of the following individuals:

Karissa Stoecker, Financial Manager Treasury/Bureau of Financial and Accounting Services - Financial Services Division Daniel Romanek, Departmental Specialist Treasury/Bureau of Financial and Accounting Services - Financial Services Division

Adam Zanetti, Buyer Treasury/Bureau of Enterprise Services-Budget and Purchasing Division Mark Lawrence, Security Architect, PCI & IRS Safeguard Tech Lead Technology, Management & Budget/Agency Services

III. Evaluation Results A. Coalfire Systems Inc.

The Evaluation Team determined that Coalfire Systems Inc., based on a score of 80, did meet the requirements of this RFP. This determination was accomplished by evaluating their responses to the Technical Evaluation Criteria.

1. Schedule A, Statement of Work, Sections 1.1 B - I; 1.2 – 1.3 The Evaluation Team determined that overall, the responses were mostly satisfactory, but the following deficiencies were noted:

a. Section 1.1 C: Bidder did not describe how they would comply with the requirement. Although Bidder referred to a previous answer as being similar, details were not sufficient to draw a conclusion as to how the requirement would be met.

b. Section 1.1 G: The description provided does not address how the requirement would be met.

c. Section 1.1 H: The description provided does not address how the requirement would be met.

2. Schedule A, Statement of Work– Section 4 (Staffing) The Evaluation Team determined that overall, the responses were mostly satisfactory, but the following deficiencies were noted:

a. Section 4.1 Project Manager: Bidder did not provide a Project Manager.

b. Section 4.2 Customer Service Number: Bidder did not provide contact information for the Project Manager.

c. Section 4.3 Technical Support: Bidder did not provide contact information for Technical Support.

d. Section 4.5 Key Personnel: Bidder did not describe how they would comply with the requirement. Four resumes were provided but did not indicate who would be assigned the two required Key Personnel roles.

3. Schedule A, Statement of Work– Sections 2 – 3; 5 – 9 Evaluation Team determined that overall, the responses were mostly satisfactory, but the following deficiencies were noted:

a. Section 5.1 Project Plan: Project Plan provided did not include estimated timeframes and dates.

b. Section 5.3 Reporting: Bidder did not provide sample reports as required.

c. Section 5.3.1 Reporting: The description provided did not address how the requirement would be met.

d. Section 5.3.3 Reporting: The description provided did not address how the requirement would be met.

4. Vendor Questions Worksheet The Evaluation Team determined that overall, the responses were mostly satisfactory, but the following deficiencies were noted:

a. Experience 1: Experience description lacked details. Unable to determine if experience included a comparable scope to RFP.

b. Experience 2: Experience description lacked details. Unable to determine if experience included a comparable scope to RFP.

c. Experience 3: Experience description lacked details. Unable to determine if experience included a comparable scope to RFP.

d. Contract Terms: Bidder did not provide proposed changes to the Contract Terms in track changes with an explanation of the bidder’s need for each proposed change with their initial submission.

Total Score: 80/100

B. Online Enterprises Inc. dba Online Business Systems The Evaluation Team determined that Online Business Systems, based on a score of 98, did meet the requirements of this RFP. This determination was accomplished by evaluating their responses to the Technical Evaluation Criteria.

1. Schedule A, Statement of Work, Sections 1.1 B - I; 1.2 – 1.3 The Evaluation Team determined that overall, the responses were satisfactory.

2. Schedule A, Statement of Work– Section 4 (Staffing) The Evaluation Team determined that overall, the responses were mostly satisfactory, but the following deficiency was noted:

a. Section 4.3 Technical Support: Bidder did not provide contact information for Technical Support.

3. Schedule A, Statement of Work– Sections 2 – 3; 5 – 9 The Evaluation Team determined that overall, the responses were mostly satisfactory, but the following deficiency was noted:

a. Section 5.3 Reporting: Bidder did not check the corresponding box to indicate if they agree with requirement or take exceptions.

4. Vendor Questions Worksheet The Evaluation Team determined that overall, the responses were satisfactory.

Total Score: 98/100

C. RubinBrown LLP The Evaluation Team determined that RubinBrown LLP, based on a score of 95, did meet the requirements of this RFP. This determination was accomplished by evaluating their responses to the Technical Evaluation Criteria.

1. Schedule A, Statement of Work, Sections 1.1 B - I; 1.2 – 1.3 The Evaluation Team determined that overall, the responses were satisfactory.

2. Schedule A, Statement of Work– Section 4 (Staffing) The Evaluation Team determined that overall, the responses were mostly satisfactory, but the following deficiency was noted:

a. Section 4.8 Security: Bidder did not describe internal controls for security and access to State Data.

3. Schedule A, Statement of Work– Sections 2 – 3; 5 – 9 The Evaluation Team determined that overall, the responses were satisfactory.

4. Vendor Questions Worksheet The Evaluation Team determined that overall, the responses were mostly satisfactory, but the following deficiencies were noted:

a. Experience 1: The dollar value indicated experience was not within scale of the RFP and description lacked sufficient details to determine if experience was within scope of the RFP.

b. Experience 2: The dollar value and description indicated experience was not within scale or scope of RFP.

c. Experience 3: The description indicated experience was not within scale of RFP and lacked sufficient details to determine if experience was within scope.

d. Contract Terms: Bidder did not provide commentary or explanation of the need for each proposed change with their initial submission with track changes.

Total Score: 95 /100

D. True North Consulting Group, LLC The Evaluation Team determined that True North Consulting Group, LLC, based on a score of 80.5, did meet the requirements of this RFP. This determination was accomplished by evaluating their responses to the Technical Evaluation Criteria.

1. Schedule A, Statement of Work, Sections 1.1 B - I; 1.2 – 1.3 The Evaluation Team determined that overall, the responses were mostly satisfactory, but the following deficiencies were noted:

a. Section 1.1 H: The description lacked details.

b. Section 1.4 C: Bidder indicated MiLogin integration would impact price but did not provide separate pricing as required in proposal.

2. Schedule A, Statement of Work– Section 4 (Staffing) The Evaluation Team determined that overall, the responses were mostly satisfactory, but the following deficiencies were noted:

a. Section 4.1 Project Manager: Bidder did not provide a Project Manager.

b. Section 4.2 Customer Service Number: Bidder did not provide contact information for the Project Manager.

c. Section 4.3 Technical Support: Bidder did not provide contact information for Technical Support.

d. Section 4.5 Key Personnel: Bidder did not identify two Key Personnel as required and only provided sample resumes.

e. Section 4.8 Security: Bidder did not describe how they would comply with requirements 1-4 or describe their internal controls regarding security and access to State Data.

3. Schedule A, Statement of Work– Sections 2 – 3; 5 – 9 Evaluation Team determined that overall, the responses were mostly satisfactory, but the following deficiencies were noted:

a. Section 2.1 Timeframes: Exceptions taken indicate Bidder will not agree to meet requirements outlined in 2.1.A and 2.1.B.

b. Section 5.1 Project Plan: Bidder did not describe how they would meet requirement. The Project Plan did not include detailed descriptions of milestones.

c. Section 5.3 Reporting: Bidder did not provide detailed reports as required. The Dashboard Report provided did not sufficiently meet requirements.

4. Vendor Questions Worksheet The Evaluation Team determined that overall, the responses were mostly satisfactory, but the following deficiencies were noted:

a. Company Background Information: The respective years were not provided for annual gross revenues.

b. Experience 1: Experience description lacks details.

c. Experience 2: Description of the experience lacked sufficient detail to determine if the scale of the experience was comparable to the scope of the RFP. Aspects of the scope provided were deemed not relevant to the RFP.

d. Experience 3: Experience description lacks details.

Total Score: 80.5 /100

IV. Technical Evaluation Summary

V. Oral Presentations/Demonstrations VI. Oral presentations/demonstrations were not conducted.

VII. Pricing Summary Pricing was evaluated for the bidders who passed technical evaluation. Bidders were asked to provide separate pricing if MiLogin portal integration per the Access Control and Authentication requirements (Schedule A - Section 1.4C) would impact pricing.

The following is a summary of their price proposals:

Consulting Services:

Consulting Services - Coalfire Systems Inc.

Consulting Services - Online Business Systems

Consulting Services - RubinBrown LLP

Consulting Services - True North Consulting Group, LLC

VIII. Negotiations All bidders were sent clarifications on their responses. Those who had exceptions to the State's terms and conditions were asked to withdraw them and accept the State’s terms in full; however, no Bidder agreed to this request. Bidders were also requested to provide their best and final pricing.

IX. Award Recommendation Award recommendation is made to the responsive and responsible Bidder who offers the best value to the State of Michigan. Best value is based on the proposal meeting the minimum point threshold and offering the best combination of the factors stated in the Proposal Instructions Evaluation Process section, and price.

Online Enterprises Inc. dba Online Business Systems provided the best value to the State. Best value factors for Award Recommendation include their acceptance of all terms and conditions and their streamlined, efficient processes outlined in the RFP. They agreed to all requirements without exception and provided thoroughly supported answers with relevant details crucial to Treasury’s business and technical needs. They demonstrated technical expertise and relevant experiences in scale and scope to the RFP. Additionally, they identified a Senior Auditor with significant experience with the State.

As part of the best value determination, overall economic impact to the State of Michigan was considered and is not a determinative factor in making this award.

Award Recommendation is made to Online Enterprises Inc. dba Online Business Systems in the amount of $348,275.

Version 2024-2 image1.png