QA Addendum Housing Locator RFP Reissue.docx

Q&A Addendum: Housing Locator RFP Reissue (FINAN-B-53072)

1. Can the list of who bid previously be provided?

A list of those who previously bid will not be posted at this time.

2. Since there is no pre-bid conference, is there a mechanism whereby IHDA can connect possible BEP subcontractors to potential prime contractors?

The NIGP Codes for this solicitation found in BidBuy are 915-22 and 915-96. Vendors should utilize the Supplier Diversity Portal at https://supplierdiversitymanagementportal.illinois.gov/home.aspx to identify any potential BEP subcontractors registered under those same NIGP Codes. Please refer to section C.9 in the RFP document.

3. Because SOC 2 Type 2 requires a 90-day observation period, it's physically impossible to become SOC 2 Type II certified between 6/24/26 and the bid opening date of 7/27/26. However, by 7/27, our firm will be SOC 2 Type I certified with an engagement letter or bridge letter from the auditor confirming that our controls are still in place, although the Type II observation period will still be in progress.

If we submit those two things, will that be sufficient to meet the requirements of F.2.3? We guarantee we will be Type II certified by October 2026, prior to the award and contract execution date planned in the RFP.

To meet the mandatory F.2.3., the vendor must provide their SOC II Certification letter. This mandatory has to be met at the time of submission so the appropriate evidence can be provided with the proposal.

4. Do all subcontractors need to be SOC 2 Type 2 certified, or is it just the prime that needs SOC 2 Type 2 certification?

Only the prime vendor needs to be SOC 2 Type 2 certified.

5. F.2.3 requires that the vendor be SOC 2 Type 2 Certified and provide a copy of its most recent certification letter.

Many government-facing SaaS solutions are deployed on enterprise cloud infrastructure providers — such as Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform, Heroku, Cloudflare, and similar platforms — each of which independently holds current SOC 2 Type 2 certification covering infrastructure-layer controls including physical security, availability, processing integrity, and data confidentiality. Under the industry-standard shared responsibility model, the cloud provider's SOC 2 Type 2 certification documents the security controls at the infrastructure layer, while the application vendor maintains and documents controls at the application layer. Providing the cloud infrastructure provider's current SOC 2 Type 2 certification report alongside application-layer security documentation is standard practice for SaaS vendors building on certified platforms.

Please confirm whether operating the proposed solution exclusively on enterprise cloud infrastructure that independently holds current SOC 2 Type 2 certification — and providing that certification documentation as evidence — satisfies the F.2.3 requirement.

The prime vendor needs their own SOC2 certification. Being on a platform that is SOC2 compliant does not mean that their implementation would be.

Project Delivery

6. Does IHDA expect a phased rollout of the platform, or should all functionality be deployed simultaneously by August 1, 2028?

Per section A.3 of the RFP, “All key elements must be developed and operating no later than August 1, 2028.”

7. Will acceptance testing be conducted by IHDA alone, or will participating state agencies also be involved?

IHDA and participating agencies are expected to be involved in acceptance testing.

8. What level of dedicated participation should vendors expect from IHDA subject matter experts throughout discovery, requirements gathering, user acceptance testing, and implementation?

Vendors can expect strong coordination with IHDA staff at each step of site development.

Commercial & Proposal

9. Is there an estimated budget, funding range, or anticipated annual operating budget established for this procurement?

At this time, IHDA will not be sharing the approved budget or range allocated for this project.

10. Will demonstrations be expected to showcase a vendor's existing commercial platform, or will conceptual mockups satisfy portions of the demonstration requirements?

Please refer to the vendor demonstration section (F.5.) of the RFP. This has the agenda of how the demonstration will be conducted and what IHDA will be evaluating.

11. Will vendors be permitted to leverage established commercial products or configurable SaaS platforms, provided all functional requirements are met, or is IHDA seeking a fully custom-built solution?

It is up to the vendor to provide a solution that best meets the requirements of the RFP.

12. What are the primary factors that will distinguish highly competitive proposals beyond the published scoring criteria?

IHDA will evaluate based on the technical elements and demonstrations that are set to take place.

13. Can IHDA clarify whether ongoing enhancements requested after go-live are expected to be included within the annual operational cost or managed through a separate change request process?

Please refer to the pricing structure in the Bidbuy items tab for what IHDA intends to have included in the cost of each term. Outside of what is referred to in the items tab, may be decided upon during contract negotiations with the awarded vendor.

Existing Platform & Data Migration

14. Will the selected vendor receive full access to the current housing locator platform, database schema, and waitlist management system for discovery and migration planning?

IHDA will work with the current vendor to make Authority-owned data fully accessible for purposes of discovery and migration. However, IHDA cannot guarantee access to the software system, and any of its components, due to proprietary reasons.

15. Can IHDA provide additional information regarding the current technology stack, hosting environment, database structure, and any available system documentation?

Please see answer to question 14.

16. Approximately how much historical data is expected to be migrated versus archived?

IHDA will work with the selected vendor to determine the necessary parameters and timeframe for migrating existing data. To date, approximately over 8,320 landlords have registered more than 152,625 units. Over 5,293 people on the Section 811 waiting list and over 14,360 people on the SRN waiting list. Please see Question 21 for number for user data.

17. Are there any existing APIs or integrations with third-party systems that must be maintained or replaced?

The current software utilized is proprietary to the current vendor. IHDA is not able to provide these details at this time.

Integrations

18. Besides the City of Chicago housing locator integration, what additional third-party systems, state systems, identity providers, GIS services, or APIs will require integration?

At this time, the City of Chicago is the only potential database anticipated to integrate with this system.

19. Will Single Sign-On (SSO) be required with any State identity management solution (Azure AD, Okta, etc.)?

It is desired, not required, as stated in the RFP (F.3.28).

20. Are there preferred mapping providers (Google Maps, Esri, Mapbox, OpenStreetMap, etc.)?

There are no preferred mapping providers identified in the RFP, and IHDA is open to any mapping providers that the vendor identifies to provide a solution that best meets the requirements of the RFP.

User Roles & Workflows

21. Approximately how many users are expected for each account type (public users, landlords, property managers, case managers, administrators, state agencies, etc.)?

Below are the current total number of users per user account type.

· Public users- 15,000 (Up To 30,000+)

· Case Managers- 500 (Up To 2000+)

· Administrator/Waitlist Managers- 20 (Up To 50+)

· Landlords (8,324 currently registered)

22. Can IHDA provide workflow diagrams or documentation for the current waitlist and referral process?

Please refer to the current conditions and strengths in the RFP (Section B) for IHDA’s current process.

23. Are there any anticipated workflow changes from the current system that vendors should account for?

At this time, there are no anticipated workflow changes.

Hosting & Infrastructure

24. Does IHDA have a preferred cloud hosting environment (Azure, AWS, GCP), or may vendors propose their recommended hosting platform?

There are no preferred cloud hosting environments identified in the RFP, and IHDA is open to any cloud hosting environments that the vendor identifies to provide a solution that best meets the requirements of the RFP.

25. Does IHDA require the solution to reside within a specific geographic region or government cloud environment?

26. Will disaster recovery, business continuity, penetration testing, and vulnerability assessments be the responsibility of the vendor throughout the contract?

Yes, it is the responsibility of the vendor as a part of their SOC2 Report that IHDA will have the option to review (F.1.68).

Customer Support

27. Is the customer support call center expected to be fully staffed and operated by the selected vendor, or can portions of support be subcontracted?

Subcontractors are allowed in this RFP, so this can be subcontracted out.

28. What are the anticipated annual support volumes (phone calls, emails, chat requests, tickets)?

Under the current system, requests for support from backend users (such as case managers, waitlist managers, and administrators) have mainly been reported via email to the vendor. Requests are predominantly comprised of direct responses to malfunctions with the current system, but also include requests for improvements, like enhancements and increasing capability.

Under the current system, public users who require assistance predominantly contact the call center for customer support, with an average of 500-600 calls month.

29. Are there established service level expectations beyond those outlined in the RFP?

All service level expectations have been outlined in the RFP.

Marketing & Outreach

30. Should vendors include ongoing marketing campaigns, content creation, social media management, and outreach activities within pricing, or simply provide a strategy and supporting materials?

Please see section A.2.iv; and sections F.3.8-10 regarding desired outcomes and elements for Marketing.

Additionally, please see section F.6.1.1 regarding Pricing, which includes the following reminder: “Entering cost, pricing or discount information in the Alternate Description may result in disqualification.”

31. Does IHDA have an existing marketing budget separate from this contract?

The marketing budget is embedded in the contract’s pricing structure.

Additionally, please see section F.6.1.1 regarding Pricing which includes the following reminder: “Entering cost, pricing or discount information in the Alternate Description may result in disqualification.”

Design & User Experience

32. Does IHDA anticipate a complete redesign of the public website experience, or should the new solution generally resemble the current ILHousingSearch.org user experience?

IHDA is open to the vendor’s proposed solution, including design of the site. Please also see section B.3 of the RFP regarding areas of concern and challenges with the current site.

33. Are branding guidelines, design standards, and accessibility requirements beyond WCAG available?

IHDA can provide a document covering branding guidelines and design standards. Please refer to section F.1.31 of the RFP for WCAG requirements.

AI & Reporting

34. Is AI functionality expected to be included in the initial implementation, or is IHDA primarily requesting vendors disclose any AI capabilities available within their solution?

Vendors will be asked to identify how AI is built into the system and; while it is possible to propose some components can be AI built, the whole system is not expected to be.

35. Can IHDA provide examples of the custom reports currently generated or anticipated after implementation?

Yes, IHDA can provide sample reports currently generated, though may have information redacted or withheld for legal, privacy, and/or contractual purposes. IHDA will provide sample reports as needed to the awarded vendor.

36. What is acceptable evidence of Mapping Software License?

Please refer to the evidence mentioned in F.2.1. in the RFP document.

37. Could IHDA provide more context on why the website and waitlist are required to be HIPAA compliant?

The Personal Identifying Information (PII) being collected and entered into the system by service providers, who may also be healthcare providers trying to refer patients to housing, may qualify as Protected Health Information (PHI) and as Covered Entities, respectively, under HIPAA.

38. Will the vendor that gets awarded be required to include medical questions or solicit any medical information during the application process?

Medical questions and medical information is not collected as part of the application process. However, disability status, as a “yes or no” question, without disclosing specific diagnoses, is collected and; Medicaid Recipient Identification Numbers (RIN) are also collected.