RFI 2026017 - PR Search & Case Mngt Solution.pdf

Request for Information

Public Records Search & Case Management Solution

RFI #2026017

RFI #2026017 1 of 17 (Revised 04.25.22)

REQUEST FOR INFORMATION

Public Records Search & Case Management Solution DEP Posting Number: RFI #2026017

The Florida Department of Environmental Protection (“Department”) is issuing this Request for Information (RFI), as defined in Section 287.012(22), Florida Statutes (F.S.), to Interested Entities concerning certain commodities and services relating to Public Records Search & Case Management Solution. Please note that under Section 287.012(22), F.S., responses to this request are not offers and will not be accepted by the Department to form a binding contract.

Interested Entities can view and download this RFI from the Vendor Information Portal (VIP) website at https://vendor.myfloridamarketplace.com/. Once at this site, the steps listed below should be followed to access the VIP.

• Click “Search Advertisements”

• Under the “Organization” search field, select the “Department of Environmental

Protection”

• Scroll down and click on “Search”

• Click on the applicable RFI number https://vendor.myfloridamarketplace.com/

DEP RFI No. RFI #2026017 Page 2 of 17

TABLE OF CONTENTS

SCHEDULE OF EVENTS

Section 1.00 – INTRODUCTION

1.01. Purpose and Scope

1.02. Procurement Officer

1.03. Questions

1.04. Addenda

1.05. Submittal of Response

1.06. Public Records

1.07. RFI Process

APPENDIX A – REQUIREMENTS

A. Access Control & Authorization B. Search Scope & Query Precision C. Case Management & Auditability D. Advanced Features E. Integration with Records Systems F. System Reliability & Support G. Compliance & Legal Readiness H. Non-Functional Requirements (NFRs) I. Implementation & Migration

APPENDIX B – VENDOR CONTACT INFORMATION

APPENDIX C – COST INFORMATION

DEP RFI No. RFI #2026017 Page 3 of 17

SCHEDULE OF EVENTS

The following schedule will be strictly adhered to in all actions relative to this posting. The Department reserves the right to make adjustments to this schedule and will notify Interested Entities in the request by posting an addendum on the VIP. It is the responsibility of the Interested Entity to check VIP on a regular basis for such updates.

DATES EVENTS METHOD

March 25, 2026

RFI Advertised Vendor Information Portal

April 1, 2026 at 5:00 PM

Questions Submitted in Writing

Submit via email:

Attn: Sabina Flanagan, Procurement Officer E-mail: sabina.flanagan@FloridaDEP.gov

RFI NUMBER MUST BE IN SUBJECT LINE OF EMAIL

On or about, April 3, 2026

Answers to Questions Posted

Vendor Information Portal

April 10, 2026 at 5:00 PM

Response Due

Submit via email:

Attn: Sabina Flanagan, Procurement Officer E-mail: sabina.flanagan@FloridaDEP.gov

RFI NUMBER MUST BE IN SUBJECT LINE OF EMAIL

– Remainder of Page Intentionally Left Blank – mailto:XXXXXXXXX@FloridaDEP.gov

DEP RFI No. RFI #2026017 Page 4 of 17

Section 1.00 – INTRODUCTION

1.01. Purpose and Scope. The Florida Department of Environment Protection (“Department”) is requesting information from Interested Entities with proven, verifiable, and documented expertise in Public Records Search & Case Management Solution. The Department is interested in learning about solutions available on the market that provides a secure, precise search across Microsoft O365 records (with emphasis on Exchange Online and Office 365), robust case management, auditability, deduplication, redaction, and deep integration with Azure and Azure enterprise systems. The solution must be designed for Azure-hosted deployments, scale to ~6,000 mailboxes, and comply with CJIS, HIPAA, and PII handling obligations, with SLA-backed reliability.

This Request for Information (RFI) is being issued strictly for the purpose of gaining knowledge of the products and services available on the market.

THIS IS NOT A REQUEST OR INVITATION FOR COMPETETIVE BIDS, PROPOSALS OR REPLIES, AND NO

CONTRACT WILL BE AWARDED IN RESPONSE TO SUBMISSIONS.

If, as a result of the RFI, the Department decides to pursue contract(s) to provide any of the services mentioned and Interested Entities capable of providing such services are identified, a competitive procurement package may be developed and issued at a later date.

1.02. Procurement Officer.

Sabina Flanagan, Procurement Officer Procurement Section, Carr Building, Room 215 Florida Department of Environmental Protection 3800 Commonwealth Boulevard, MS#93 Tallahassee, Florida 32399-3000 Telephone Number: (850) 245-2187 sabina.flanagan@FloridaDEP.gov

1.03. Questions. Any questions from vendors concerning this RFI shall be submitted in writing, identifying the submitter and RFI number, to the Procurement Officer no later than the time and date specified in the Schedule of Events. All inquiries must be submitted by E-mail. All questions and answers will be posted on the VIP. It is the Vendor’s responsibility to periodically check the VIP. The Department bears no responsibility for any delays, or resulting impacts, associated with a Vendor’s failure to obtain the information made available through the VIP.

1.04. Addenda. If the Department finds it necessary to supplement, modify, or interpret any portion of the RFI documents, a written “Addendum” will be posted on the VIP. It is the responsibility of the Vendor to be aware of any Addenda that might have a bearing on their response.

1.05. Submittal of Response. Responses are due in accordance with VIP and Schedule of Events.

Vendors’ responses must be in writing and submitted electronically via email. Responses must be emailed to the Procurement Officer (Section 1.02). The naming convention for the subject line within your email is:

Subject Line: Your Company Name – DEP RFI No. RFI #2026017

The response package must contain:

• A cover page including the below contact information:

o Vendor/Company Name;

DEP RFI No. RFI #2026017 Page 5 of 17 o Contact Name and Title;

o Address; and o Phone Number and email address

• A completed Appendix B – Vendor Contact Information

• A completed Appendix C – Cost Information

• Any cooperative purchasing agreements with the vendor where the solution may be purchased.

Once received, all RFI responses and attachments shall become the exclusive property of the Department and will not be returned. The Department is not liable for any of the costs incurred by the Vendor in preparing and submitting a response.

To ensure a clear understanding of the products and service, the Department may use this RFI as the basis for requesting demonstrations. These demonstrations will be at the department’s discretion and at no cost to the Department.

1.06. Public Records. Any material submitted in response to this RFI will become a public record pursuant to Chapter 119, Florida Statutes (F.S.), once it is shared with the Department. Any claim of confidentiality is waived upon submission, unless addressed as set forth below.

Disclosure and Ownership of Response Contents: A Vendor’s response to this RFI shall be a public record and subject to production, disclosure, inspection and copying consistent with the requirements of Chapter 119, F.S. All information in a Vendor’s response (including, without limitation, technical and price information) will be a matter of public record, subject to the provisions of Florida’s Public Records Act, Chapter 119, F.S., regardless of copyright status. Submission of a response to this RFI shall constitute a waiver of any copyright protection which might otherwise apply to the Department’s production, disclosure, inspection and copying of such response and contract, or any part thereof, except those parts asserted to be exempt under Chapter 119, F.S. The response, upon submission shall be the property of the Department (except those parts asserted to be exempt in the manner set forth below), and the Department, in its sole discretion, shall have the right to use, reproduce, and disseminate the response. The Department reserves the right to use any and all information contained in a response received to this RFI.

Any content submitted to the Department which is asserted to be exempt under Chapter 119, F.S., shall be set forth on a page or pages separate from the rest of the response, and clearly marked “exempt,” “confidential,” or “trade secret” (as applicable), with the statutory basis for such claim of exemption, confidentiality, or trade secret specifically identified in writing on each and every such page. Failure to segregate and so identify any such content shall constitute a waiver of any claimed exemption, confidentiality, or trade secret as applied to the portion of the response or other document in which the content is set forth.

Per Section 287.012(22), F.S., “Responses to these requests are not offers and may not be accepted by the agency to form a binding contract.” Vendors submitting information to this RFI are not prohibited from responding to any related subsequent solicitation. The Department reserves the right to use or reject any information supplied in response to this RFI.

1.07. RFI Process.

The Department will review and analyze information received in response to this RFI to determine the feasibility of issuing a competitive solicitation for these products/services. Any request for cost information received will be used solely to gain a perspective of the potential budgetary magnitude.

DEP RFI No. RFI #2026017 Page 6 of 17

Responses to this RFI will be reviewed for informational purposes only and will not result in the award of a contract. Submitting a response to this RFI shall not disqualify a vendor for responding to any related subsequent solicitation.

1.08. Appendices.

• Appendix A – Requirements

• Appendix B – Vendor Contact Information

• Appendix C – Cost Information

DEP RFI No. RFI #2026017 Page 7 of 17

APPENDIX A – REQUIREMENTS

Instructions: Interested Entities shall use the compliance codes listed below to identify the requirements their proposed solution meets. Further clarification or evidence may be included in the notes column or attached with the response package. See RFI Section 1.05 for more information.

Compliance Codes:

• F = Fully Compliant (natively)

• P = Partially Compliant (config/customization)

• C = Compliant via Third-Party/Plugin

• N = Not Compliant

• E = Roadmap (include ETA)

Definitions & Acronyms

• SSO: Single Sign-On

• MFA: Multi-Factor Authentication

• RBAC: Role-Based Access Control

• AD/Azure AD: Active Directory / Microsoft Entra ID (Azure AD)

• SAML: Security Assertion Markup Language

• OIDC: OpenID Connect

• ITSM: IT Service Management

• EDMS: Electronic Document Management System

• CJIS: Criminal Justice Information Services

• HIPAA: Health Insurance Portability and Accountability Act

• PII: Personally Identifiable Information

• SLA: Service Level Agreement

A. Access Control & Authorization

Req ID Requirement Priority Compliance Notes

AC-01

Support SSO with MFA

SSO with Azure AD/Entra ID via SAML 2.0 or OIDC; enforce MFA via conditional access; works across web and desktop (if applicable).

Must Have

AC-02

Role-based access (RBAC)

Configurable roles/permissions at object/action/field level; least privilege; role change logging.

DEP RFI No. RFI #2026017 Page 8 of 17

AC-03

Integration with Active Directory and SSO/SAML

SAML 2.0/OIDC integration;

group/role mapping; automated provisioning/deprovisioning via SCIM or APIs.

AC-04

Integration with ITSM platforms

REST APIs/webhooks to create/update tickets with links to cases/searches; bidirectional status sync; vendor-agnostic (no dependency on ServiceNow/Cherwell).

Should Have

AC-05

Workflow adaptable

Admin-configurable workflows (states, escalations, approvals);

conditional routing; visual designer or JSON/YAML config.

Should Have

AC-06

Fine-grained authorization for search scope and export

Restrict visibility by role, case, department, legal hold, retention class; export controls gated by role.

Must Have

B. Search Scope & Query Precision

Req ID Requirement Priority Compliance Notes

SR-01

Granular search capabilities

Field-level (sender/recipient/date/subject), content, metadata, file type;

Boolean operators; date range filters.

Must Have

SR-02 Keyword and phrase search (exact, proximity)

DEP RFI No. RFI #2026017 Page 9 of 17

Supports quotes, proximity, stemming, wildcards; language-aware tokenization.

SR-03

Search email attachments & nested content

Index common formats

(PDF/DOCX/XLSX/PPTX/TXT/ZIP/

MSG/EML/HTML); handle embedded/archived files.

Must Have

SR-04

Search scoping by repository/custodian/ department

Filter by source (Exchange Online, Office 365 repositories), custodians, departments, retention categories.

Must Have

SR-05

Relevance tuning & saved searches

Weighting by fields; saved search templates; search sharing by role; reusable search profiles.

Should Have

SR-06

Audit-friendly query logging

Immutable logs of queries, parameters, time, and user identity; exportable for audits.

C. Case Management & Auditability

Req ID Requirement Priority Compliance Notes

CM-

Protected logging

Tamper-evident logs (WORM/immutable); chain-of-custody; time-stamped actions with user identity.

CM-

02 Case-based records Must

DEP RFI No. RFI #2026017 Page 10 of 17

Req ID Requirement Priority Compliance Notes

Create/manage cases; assign custodians; attach items and saved searches; case timelines;

role-bound access.

CM-

Export flexibility

Export to standard formats

(PST/EML/MSG/CSV/JSON/PDF);

include load files & metadata;

configurable fields.

Must Have

CM-

Legal hold management

Place/track holds; suspend disposition; notify custodians;

hold audit trails; case-level visibility.

Must Have

CM-

Reporting & dashboards

Case statuses, volumes, durations, SLA conformance;

exportable reports (CSV/PDF);

admin dashboards.

Should

D. Advanced Features

AF-01

Deduplication

Hash-based and content-aware dedupe; duplicate reporting;

configurable dedupe rules per case/export.

Must Have

AF-02

Redaction

Role-based redaction tools (text, images); annotation layers;

redaction logs; irreversible redacted export.

Must Have

AF-03 PII detection Should

DEP RFI No. RFI #2026017 Page 11 of 17

Auto-detect common PII (SSNs, addresses, DOB); suggest redactions; confidence scores and review queues.

AF-04

Bulk actions

Bulk tag, redact, export, hold;

queueing and progress tracking;

error recovery.

E. Integration with Records Systems

IN-01

Integration with Azure

Azure AD/Entra ID for identity;

optional Azure Blob/Files and Key Vault for storage & keys; private endpoints and Azure RBAC supported; US region hosting.

Must Have

IN-02

Integration with EDMS

Connectors/APIs for SharePoint Online or other EDMS; preserve metadata, retention, and versioning.

Should Have

IN-03

Email platforms

Microsoft 365/Exchange Online data sources; support journaling/eDiscovery sources;

mailbox/tenant scoping; handle ~6,000 mailboxes scale.

Must Have

IN-04

API-first architecture

REST APIs documented;

webhooks; SDK support;

pagination and rate limits; event-driven options.

DEP RFI No. RFI #2026017 Page 12 of 17

F. System Reliability & Support

Req ID Requirement Priority Compliance Notes

RS-01

SLA-backed search speeds

SLA for indexing latency (e.g., ≤ 4– 6 hrs from ingestion), and query response (e.g., P95 ≤ 2 sec for standard queries; ≤ 5 sec complex).

Must Have

RS-02

Availability & DR

≥ 99.9% monthly uptime; geo-redundant backups; RPO ≤ 4 hrs;

RTO ≤ 8 hrs; Azure-native resilience.

Must Have

RS-03

Support

24×7 Sev-1 support (≤ 1 hour acknowledgment, workaround ≤ 4 hours) Sev -2 support (≤ 4 hours acknowledgment, resolution plan ≤ 2 business days);

defined escalation paths; ticketing integration (generic); knowledge base and release notes.

Must Have

RS-04

Performance & capacity planning

Scaling guidance; performance baselines; capacity dashboards;

ability to model load for ~6,000 mailboxes.

G. Compliance & Legal Readiness

CO-01

Align with Florida public record laws

Features supporting timely response, retention, disclosure, exemptions handling; audit trails for all disclosures.

DEP RFI No. RFI #2026017 Page 13 of 17

CO-02

Cybersecurity guidelines & best practices

Alignment with recognized frameworks (e.g., NIST CSF);

documented controls; annual assessments/pen tests.

CO-03

Align with Federal Standards

HIPAA (if PHI present—BAA available), NIST control families (e.g., SP 800-53/CSF), CJIS policy alignment (encryption, access control, audit, personnel requirements).

CO-04

Data residency & sovereignty

Host/process data in US regions;

document subcontractors and data flows; support Azure Government if required.

CO-05

Privacy & consent

DPA/BAA as applicable; support data subject requests; logging for disclosures; configurable retention/exemptions.

H. Non-Functional Requirements (NFRs)

NF-01

Security

TLS 1.2+ in transit; AES-256 at rest; key management via Azure Key Vault; vulnerability management cadence; SIEM integration.

Must Have

NF-02

Usability

Intuitive UI; role-based views;

accessible documentation; in-app help.

DEP RFI No. RFI #2026017 Page 14 of 17

NF-03

Scalability

Horizontal scaling; performance validated for enterprise dataset sizes; load/performance benchmarks at ~6,000 mailboxes.

Should Have

NF-04

Interoperability

Standard-based connectors;

vendor-neutral export formats;

clean APIs for integrations.

Must Have

NF-05

Maintainability

Configuration over customization;

versioned APIs; rollback capabilities; documented releases.

I. Implementation & Migration

IM-01

Azure-Hosted Deployment

Architecture diagrams (networking, identity, storage, HA/DR); private endpoints; Key Vault integration.

Must Have

IM-02

Phased Deployment

Pilot → Controlled rollout → Enterprise adoption.

Must Have

IM-03

Migration Support

Ingest from Exchange Online/Office 365; mapping templates; connector configuration.

Must Have

IM-04 Configuration Baselines Must

DEP RFI No. RFI #2026017 Page 15 of 17

RBAC roles, search templates, case types, workflows, export profiles.

IM-05

Training

Admin and end-user training optional; SOPs and quick guides if provided.

Could Have

IM-06

Change Management

Communication plan; adoption metrics.

DEP RFI No. RFI #2026017 Page 16 of 17

APPENDIX B – VENDOR CONTACT INFORMATION

Providers are asked to provide the following information:

CONTACTS

Primary contact regarding this submission? Name:

Email Address:

Phone:

Title or Role in Organization?

Primary contact to schedule Presentation:

(If other than contact above)

Name:

Email Address:

Phone:

Title or Role in Organization?

Company Website URL:

Type of Organization (Corporation, Partnership, etc.):

How long has your company been in this type of business?

Years:

Months:

Location of Project Manager that would serve the Department:

City:

State:

Location of Regional Sales Manager that would serve the Department:

City:

State:

DEP RFI No. RFI #2026017 Page 17 of 17

APPENDIX C – COST INFORMATION

Providers are asked to provide the following cost information:

DESCRIPTION

TIMELINE

(If Applicable)

PER/UNIT OF

MEASURE QUANTITY

ESTIMATED

DOLLAR

AMOUNT

Estimated Support Rates:

Standard vs. premium tiers

Estimated Licensing Cost:

User/case/storage/API usage/connectors

Estimated Upgrades and other Maintenance Costs per Year:

Estimated Third Party Licenses Requirement Costs:

Estimated Cost of Implementation Including:

Setup, configuration, migration, training (optional)

Length of typical implementation:

Optional Add-ons: PII detection, advanced analytics

Discounts:

Government/education pricing