OMV Licensing Credentialing Solution RFI.docx

Office of Technology Services Request for Information related to the Implementation of a Motor Vehicle Driver’s License Credentialing Solution for LA OMV

RFI# 3000026348

State of Louisiana Division of Administration / Office of Technology Services

Request for Information (RFI) related to the Implementation of a Motor Vehicle Driver’s Licensing Credentialing Solution for Louisiana Office of Motor Vehicles

RFI # 3000026348

This Request for Information (RFI) is for planning purposes only and should not be construed as a Request for Proposal (RFP). This is not a solicitation for offers. This information will be reviewed and discussed by the State agency and may result in the advertisement of a formal and competitive Request for Proposal for the services included in this RFI.

Overview

1.0 Purpose of the Request for Information

The Office of Technology Services (OTS), on behalf of Louisiana Department of Public Safety and Corrections (DPS), through its Office of Motor Vehicles (OMV), collectively referred to throughout this document as “State”, is issuing this Request for Information (RFI) to identify qualified vendors capable of providing a turnkey Credential Issuance Solution for the State of Louisiana. The OMV administers driver’s licensing and identification laws across all 64 parishes, operating at approximately 180 field locations and issuing approximately 1.5 million credentials annually across more than 75 credential formats; a number that may grow to 100 or more over the course of a contract.

The solution must support:

A. Over-the-counter credential issuance at the Customer Service Center (CSC), the Public Tag Agent (PTA), and Department of Corrections (DOC)/Office of Juvenile Justice (OJJ) field locations B. A central issuance process for credentials issued through mail and internet renewal channels.

OTS seeks a commercially available and configurable solution with a proven record of successful deployment. The solution must meet all applicable American Association of Motor Vehicle Administrators (AAMVA) standards, and deliver a secure, durable credential.

2.0 Objectives of the Request for Information

· Understand the level of interest and availability of potential vendors that could provide a Commercial-Off-The-Shelf (COTS) or Software as a Service (SaaS) driver’s license credential issuance solution to the State

· Gain a comprehensive understanding of business models and industry best practices related to driver’s license credential issuance solution implementation

· Identify issues, roadblocks, and barriers to a successful driver’s license credentialing implementation

· Obtain information regarding deployment timelines, support models, and ongoing maintenance services

3.0 RFI Coordinator

RFI responses must be directed to the RFI coordinator:

Charmetra Wells Office of Technology Services P.O. Box 94095 Baton Rouge, LA 70804-9095 Phone: 225-342-9186 Email: pmo@la.gov

All communication relating to this RFI must be directed to the RFI Coordinator named above. All communication between respondents and State staff members, other than the RFI Coordinator, concerning this RFI are strictly prohibited.

4.0 Schedule of Events

The State reserves the right to revise this Schedule of Events.

5.0 Response Preparation Cost

The State will not pay for the preparation of any information or response submitted in reference to this RFI, nor will it pay for any use of response information. The respondent assumes sole responsibility for any and all costs and incidental expenses associated with the preparation and reproduction of any materials submitted in response to this RFI. This includes preparations for approved discussions, demonstrations, or vendor marketing materials.

6.0 RFI Addenda/Cancellation

The State reserves the right to revise any part of this RFI by issuing an addendum to this RFI at any time. Issuance of this RFI, or subsequent addendum (if any), does not constitute a commitment by the State to issue an RFP or any other process resulting in award of a contract of any type or form. In addition, the State may cancel this informal process at any time, without penalty or prior notice.

7.0 Proprietary and/or Confidential Information

Pursuant to the Louisiana Public Records Act (La. R.S. 44:1 et. seq.), all public proceedings, records, contracts, and other public documents relating to this RFI shall be open to public inspection. Respondents should refer to the Louisiana Public Records Act for further clarification, including protections sought for proprietary and/or trade secret information. Respondents are reminded that any material within a response to this RFI identified as confidential or proprietary must be clearly marked. Any response marked as confidential or proprietary in its entirety may be rejected without further consideration or recourse.

8.0 Written Inquiry/State Response Process

Respondents may submit written inquiries to the RFI Coordinator via email according to the Schedule of Events herein. Inquiry emails should use the following subject line format: RFI # 3000026348 - QUESTION - <Vendor Name>.

The State shall provide responses to all written inquiries, according to the Schedule of Events, in the form of an RFI addendum, posted to the LaPAC at https://wwwcfprd.doa.louisiana.gov/osp/lapac/pubMain.cfm.

9.0 Response Submission

All responses to this RFI must be received by the due date and time indicated on the Schedule of Events. Responses received after the due date and time will not be considered. It is the sole responsibility of each respondent to assure that its response is delivered at the specified location prior to the deadline. Responses which, for any reason, are not so delivered will not be considered.

Electronic Submissions Electronic submissions are the preferred format. Electronic submissions may be made using the Dropbox File Request system via the following link. Electronically submitted responses should be in Microsoft Word and/or PDF format.

https://www.dropbox.com/request/cydehbq7xodb4cejuqkp

No submissions will be accepted via email.

Hard Copy Submissions Hard copy response submissions, which should include at least one (1) hard-copy and one (1) digital (flash drive) copy, may be submitted via the U.S. Mail, courier, or hand-delivered:

If courier mail or hand-delivered

Charmetra Wells Office of Technology Services Galvez Building 602 N. 5th St., 2nd Floor Office 225 Baton Rouge, LA 70802

If delivered by U.S. Mail

Charmetra Wells Office of Technology Services P.O. Box 94095 Baton Rouge, LA 70804-9095

10.0 Ownership of Responses

All materials submitted become the property of the State and will not be returned to the respondent. The State retains the right to use any and all ideas or adaptations of ideas contained in any response received through this RFI process.

11.0 Format of Response

All responses shall be submitted in hard-copy or digital format (PDF or Word is preferred), not to exceed 50 pages, in 10pt. font or larger according to the following outline:

Corporate Background and Experience Respondents shall provide a brief description of the company, including a brief history, corporate structure, and organization and the number of years in business.

Business Model for Contracting of Services Respondent shall describe its approach to a contract for its services should it be awarded a contract (via RFP or non-competitive contract). Respondents should describe its pricing model structure, including whether pricing is based on a per-credential, per-seat, subscription, or other model, and identify which cost components are fixed, variable, or usage-based. No specific pricing figures, rates, or cost estimates shall be included in this response.

If a Commercial-Off-the-Shelf or Software-as-a-Service solution is proposed, the respondent should indicate if proposed products are available through NASPO ValuePoint or similar cooperative purchasing agreements.

Approach and Methodology Respondents shall describe its proposed solution and approach for delivery of services, specifically identifying the use of specific delivery methodologies, or other methods to address evolving system needs.

Implementation Timeframe of Solution Respondents shall indicate the minimum time frame from contract execution for full implementation of its solution, inclusive of equipment acquisition, configuration, and testing.

Technical System Implementation Requirements and Questionnaire Respondents should be aware of the following requirement for Contractors:

Contractor shall adhere to the State’s Information Security Policy (ISP) - https://www.doa.la.gov/doa/ots/policies-and-forms/

RFI Response Guidance and Questions Purpose The State is requesting information to better understand available solutions, services, implementation approaches, risks, costs, technical capabilities, security posture, accessibility, operational support, and alignment with State technology expectations.

These questions are intended to apply broadly across different response types, including SaaS, COTS, custom development, implementation services, managed services, State-hosted solutions, vendor-hosted solutions, and hybrid approaches.

Response Instructions Respondents should answer each question based on the proposed solution, service, or delivery model. Not every question will apply to every response.

If a question does not apply, state “Not applicable” and briefly explain why. Where possible, provide the closest relevant equivalent. For example, if the State would not receive source code for a SaaS solution, describe the vendor’s release management process, security testing practices, customer notification process, and available audit evidence instead.

Responses should distinguish between capabilities that are:

· Currently available

· Configurable

· Custom-developed

· Partner-provided

· Available through an optional module

· Planned for a future release If documentation, audit reports, architecture diagrams, screenshots, or other artifacts cannot be provided during the RFI stage, describe what can be made available later in the procurement process, under NDA, during security review, or during contract negotiation.

State Technology Detail and Security Disclosure Respondents should not assume that the State will disclose detailed internal technology implementation information during the RFI stage. This includes specific product names, vendor names, tenant details, network diagrams, IP ranges, firewall configurations, identity provider configuration, monitoring platform configuration, security tool configuration, vulnerability information, or other internal infrastructure details.

Respondents should answer based on supported standards, protocols, configuration options, security controls, and integration capabilities.

If additional State-specific technical details would be required later, identify:

1. The category of information needed.

2. Why the information is needed.

3. When it would be required.

4. Whether it is needed for procurement, contracting, implementation, or operational support.

The State may decline to answer questions that request sensitive internal implementation details or information not necessary to respond to the RFI. In those cases, the State may instead provide the applicable standard, requirement, protocol, or desired capability.

Questions

Solution Overview and Business Fit

1. Describe the proposed solution or service. Include whether it is SaaS, COTS, custom development, implementation services, managed services, State-hosted, vendor-hosted, or a hybrid approach.

2. Provide examples of comparable implementations, preferably in the public sector. Include scope, timeline, customer type, implementation approach, and measured results where available.

3. Identify the major capabilities of your solution or service. Clearly distinguish between capabilities that are available today, configurable, custom-developed, partner-provided, optional, or planned for a future release.

Implementation and Delivery

4. Describe your recommended implementation approach. Include major phases, milestones, decision points, dependencies, risks, estimated timeline, and what must be true before moving between phases.

5. Describe expected roles and responsibilities. Include what would be expected from the State, OTS, the customer agency, the vendor, subcontractors, and any third-party partners.

6. Describe your approach to project governance, status reporting, issue escalation, risk management, training, knowledge transfer, and operational readiness. Include examples of artifacts that would be provided.

Architecture, Integration, and Interoperability

7. Describe your reference architecture. Include major components, hosting boundaries, trust boundaries, data flows, integrations, administrative functions, and user access paths.

8. Describe how your solution integrates with external systems. Include supported APIs, webhooks, file exchanges, batch processes, eventing, authentication patterns, data formats, rate limits, error handling, retry logic, and available documentation.

9. Identify any infrastructure, network, hosting, middleware, agent, certificate, privileged access, or environment requirements. If this does not apply because the solution is fully vendor-hosted or self-contained, state that and describe any import, export, reporting, or data access options.

Identity, Security, Data, and Compliance

10. Describe your identity and access management capabilities. Include SSO, MFA, role-based access control, privileged access, user provisioning and deprovisioning, session management, audit logging, delegated administration, and periodic access review.

11. Describe what State data your solution would store, process, transmit, generate, or access. Identify whether the solution may involve PII, PHI, FTI, CJIS, PCI, education records, payroll records, tax data, credentials, source code, audit findings, or other regulated or sensitive data.

12. Describe how data is protected and governed. Include data ownership, data residency, encryption in transit and at rest, backup protection, retention, export, deletion, destruction, tenant segregation, and post-termination data handling.

13. Describe your security posture and available security evidence. Include certifications, attestations, SOC reports, FedRAMP/GovRAMP status, penetration testing, vulnerability management, dependency scanning, SBOM availability, remediation timelines, incident response, breach notification, customer coordination, and audit evidence.

Accessibility and User Experience

14. Describe the accessibility and user experience capabilities of your solution. Include WCAG conformance level, accessibility testing practices, known limitations, remediation process, mobile responsiveness, available Accessibility Conformance Reports, and any third-party accessibility audits.

15. If the solution includes custom-developed or highly configurable user interfaces, describe how it can align with the State’s design system, branding, reusable components, content standards, and accessibility expectations. If the solution is SaaS or proprietary COTS and cannot fully adopt State design system components, describe what configuration is available.

Operations, Support, and Reliability

16. Describe how the solution is operated and supported after go-live. Include service levels, uptime commitments, support tiers, response times, escalation paths, maintenance windows, release notifications, rollback processes, backup, restore, disaster recovery, RTO, RPO, and business continuity.

17. Describe what operational visibility is available. Include health checks, logs, metrics, traces, alerts, dashboards, audit trails, reports, APIs, exports, customer portals, and options for integrating with external monitoring or ticketing systems.

Source Code, Release Management, and Technical Artifacts

18. Describe your approach to source code, configuration, release management, and technical documentation. If the State would receive custom code, scripts, infrastructure as code, configuration as code, or other technical deliverables, describe source control, branching, code review, CI/CD, testing, security scanning, dependency scanning, documentation, and handoff. If the State would not receive source code, describe your product release process, customer testing options, security testing, release notes, update cadence, rollback process, and customer notification practices.

AI, Automation, and Decision Support

19. Identify any AI, machine learning, automated decisioning, generative AI, chatbot, summarization, recommendation, classification, transcription, notetaking, content-generation, or similar features included in the solution. For each feature, describe whether it is required, optional, enabled by default, configurable, available through an optional module, or can be disabled. Also describe input data, outputs, human review, use of State data for training or model improvement, opt-out controls, safeguards against hallucinations or misuse, and whether the output could influence consequential decisions such as eligibility, enrollment, employment, finances, legal or regulatory compliance, law enforcement, or welfare.

No cost and/or marketing information shall be included in this RFI response.

12.0 Optional Discussion

To solicit feedback and ask follow-up questions based upon vendor RFI responses, the State reserves the right at its sole discretion to conduct a structured discussion for respondents to this RFI only. If discussions are scheduled, an agenda, specific questions and other expected topics for discussion will be provided prior to the discussion.

The State is not under any obligation to conduct discussions with any respondent to this RFI.

Scope of Services

SYSTEM FUNCTIONALITY & RESPONSIBILITIES

The State requires a turnkey Credential Issuance Solution that addresses the following key business objectives. Respondents should describe their capabilities in each area rather than outlining a specific implementation approach.

1. Project Timeline & Implementation Readiness

a. Respondents should provide their proposed implementation timeline, identifying any dependencies, constraints, or phasing considerations that may affect key milestones

b. Ability to coordinate implementation activities with the State's concurrent technology initiatives, including the transition to the new Driver License Issuance and Renewal platform

2. Training & Support

a. Ability to provide comprehensive training.

b. A structured hypercare period following go-live with elevated support levels and dedicated resources for issue resolution

3. Technical Capabilities

a. Issuance Methods

i. Support for Over the Counter (OTC) credential issuance at OMV Customer Service Centers (CSC) and authorized Public Tag Agent (PTA) locations statewide

ii. Support for Central Issuance, enabling high-volume batch production and direct mail distribution of credentials to citizens

iii. Ability to support both issuance models concurrently within a unified platform

b. Portrait & Signature Capture

i. Ability to capture credential holder portraits directly within the issuance application, with automated quality validation conforming to ISO/IEC 19794-5 and REAL ID requirements

ii. Ability to capture credential holder signatures directly within the issuance application, meeting AAMVA specifications for size, scaling, and image quality

iii. Support for consistent, standardized capture workflows across all issuance locations, including automated image correction and compliance checking prior to credential production

c. Credential Appearance & Production

i. Ability to produce secure, durable credentials that fully conform to the current AAMVA DL/ID Card Design Standard (2025) and all applicable REAL ID Act requirements, with the ability to adapt to future standard revisions over the contract term

ii. Support for full-color photograph printing directly on the credential, with options for enhanced security substrates and physical anti-counterfeiting features

iii. Ability to ensure consistency between human-readable and machine-readable credential data, including 2D barcode and magnetic stripe technologies

iv. Support for mobile DL (mDL) alignment and emerging digital credential capabilities as jurisdictional and Federal requirements evolve

v. Support for all current and anticipated credential formats and orientations across all credential classes, with flexibility to accommodate changes driven by State legislation or Federal requirements

d. Data Storage & Central Database

i. Ability to securely store captured portrait images, signatures, and credential holder records within a centralized repository with encryption, role-based access controls, and comprehensive audit logging

ii. Support for migration of existing credential holder data — including portrait images and signatures — from the current vendor’s platform, with validated completeness and integrity prior to legacy system decommissioning

iii. Ability to retain and manage historical credential records throughout the contract term in compliance with State retention policies

e. Integration

i. Ability to integrate with Louisiana's current and future Driver License Issuance and Renewal platform (CHAMP/Drive 360) and other State systems as required

f. Security & Compliance

i. Comprehensive user administration capabilities including role-based access, audit logging of all credential and system activity, and support for State identity and access management (IAM/SSO) integration

ii. Adherence to current AAMVA standards, REAL ID requirements, Office of Technology Services (OTS) security requirements, and applicable State and Federal data privacy regulations

iii. Modern physical credential security features and interface-level encryption across all system components

4. Operations & Service Delivery

a. Location Capacity & Scalability

i. Ability to support deployment across all current OMV CSC and PTA locations at the time of implementation

ii. Ability to scale the solution to accommodate increases or decreases in the number of locations.

b. Data Migration & Solution Rollout

i. Ability to migrate data from a previous vendor’s card issuance platforms, including but not limited to credential holder records, portrait images, and signature data

ii. Ability to provide a documented data migration plan including but not limited to data mapping, validation procedures, rollback procedures, and acceptance testing criteria

iii. Ability to support either a phased or full cutover implementation across all locations with defined milestones, site readiness criteria, and go-live sequencing

c. Inventory & Supply Management

i. Ability to provision, replenish, and manage all credential production supplies across all issuance locations

ii. Inventory tracking and reporting capabilities to maintain defined minimum stock levels and support cost forecasting and budget management

iii. Respondents should describe their approach to tracking and reconciling non-billable failed or rejected credentials, and their procedures for secure disposal of unused or rejected credential materials

d. Hardware, Equipment & Maintenance

i. Ability to provide, deploy, and install all required credential issuance hardware and software at all OMV and authorized agent locations, including multi-equipment configurations for high-volume sites, with all equipment being new, warranted, and installed with minimal disruption to operations

ii. Defined service level agreements covering on-site response, repair, and replacement of failed equipment, with clear escalation procedures for critical issues, 24/7 support availability, and provisions for equipment replacement if downtime thresholds are exceeded

iii. Equipment shall meet standard physical, power, and security requirements for deployment across diverse OMV office environments, incorporating physical security features to protect against tampering or theft throughout the contract term

iv. Respondents should describe their approach to equipment lifecycle management, including how end-of-life hardware is identified, communicated to the State, and replaced, and what processes are in place to ensure technology currency throughout the contract term

5. Reporting & Analytics

a. Reporting & Analytics

i. Operational reporting covering credential production volumes, system activity, equipment status, and security events by location, operator, and date range

ii. Support for ad hoc and scheduled reporting accessible to State staff, with export capabilities in standard formats

6/5/2026