RFI_34201-02431_GMS_Amendment_3.docx

STATE OF TENNESSEE

TENNESSEE EMERGENCY MANAGEMENT AUTHORITY (TEMA)

REQUEST FOR INFORMATION # 34201-02431

AMENDMENT # 002

FOR Grants Management System (GMS)

DATE: 09/24/2026

RFI # 34201-02431 IS AMENDED AS FOLLOWS:

1. This RFI Schedule of Events updates and confirms scheduled RFI dates. Any event, time, or date containing revised or new text is highlighted.

EVENT

TIME

(Central Time Zone)

DATE

(all dates are State business days)

09/01/2026

11/06/2026

11/09/2026-11/23/2026

2. State responses to questions and comments in the table below amend and clarify this RFI.

Any restatement of RFI text in the Question/Comment column shall NOT be construed as a change in the actual wording of the RFI document.

RFI responses will not be available until after the State completes evaluation of any subsequent procurement responses. If the State does not proceed with a future procurement, the RFI responses will be considered confidential by the State. The RFI does not prescribe a separate proprietary-marking process. Respondents may identify specific information they consider proprietary, but should not mark the entire response proprietary.

This refers to the proposed system’s capability to support authenticated electronic signatures within grants-management workflows, along with timestamps, version control, and non-repudiation. Respondents should describe available signature methods, audit records, and any third-party e-signature integrations or dependencies.

Responses should be submitted electronically by email to Sara Cox at the address listed in Section 3.1 of the RFI by 3:00 p.m. Central Time on September 24, 2026.

TEMA is not providing a preliminary budget at this time.

The RFI does not establish eligibility requirements concerning existing-product experience, reseller status, Tennessee registration, insurance at the RFI-response stage, or minimum contract size. Any future solicitation may establish applicable requirements. A future contractor would be required to meet applicable State contracting requirements, including Tennessee Edison registration. Insurance requirements, if applicable, would be specified in the future contract.

TEMA will consider established commercial grants-management platforms and qualified configurable or purpose-built hosted solutions. Respondents should identify the maturity of the product, existing production deployments, configuration versus custom-development approach, implementation risk, and long-term support model.

Not addressed in RFI

May an overseas technology provider participate at the RFI stage?

The RFI does not establish a geographic eligibility restriction for submitting information. However, any future solution that accesses, processes, stores, transmits, or supports State Data must comply with applicable State security requirements. Those requirements include U.S.-based State Data handling and U.S.-based access to State Data. Vendors should disclose the location and role of all proposed personnel, subcontractors, hosting, support, and administrative resources.

Not addressed in RFI

If the procurement advances, will the prime contractor be required to have U.S. incorporation, Tennessee registration, U.S.-based staffing, data residency, or other local presence?

TEMA has not established a requirement for U.S. incorporation or a specific local staffing model at the RFI stage. A future contractor would be required to meet applicable State contracting requirements, including Tennessee Edison registration. State security policy requires all State Data, including backup data, to remain in the United States and its territories while processed, stored, transmitted, or at rest. Access to State Data must be limited to U.S.-based resources. System and application administration must be performed in the continental United States.

Not addressed in RFI

May a Canada-based vendor perform development using synthetic/test data while U.S.-based resources or subcontractors provide production hosting and privileged production administration?

Yes, subject to the following State security requirements: Any testing performed outside the United States must use fake data. Production data, or a copy of production data, may not be transmitted or used outside the United States. State Data access must be limited to U.S.-based resources. System and application administration must be performed in the continental United States. Software designed, developed, manufactured, or supplied by persons owned or controlled by, or subject to the jurisdiction or direction of, a foreign adversary is prohibited. Respondents should clearly identify the location and role of all development, testing, hosting, support, administrative, and subcontractor resources.

RFI §4;

Technical Informational Form Q14

TEMA would like the solution operational by spring, ahead of the winter/spring disaster season. This is a planning objective, not a committed go-live date. Respondents should provide a realistic implementation schedule, dependencies, and phased options.

The system must support recurring grant activity and potential disaster-response surges. Respondents should describe how their approach supports rapid program configuration, increased application volume, service availability, and operational readiness during disaster events.

The Governor’s Response and Recovery Fund has expanded eligibility to include individuals in addition to local-government aid. The intended solution must support the grant lifecycle from application through review, award, reimbursement/payment tracking, reporting, and closeout.

Not addressed in RFI

Will the initial solution support one disaster-aid program, or multiple programs, funding sources, disaster events, and grant types over time?

TEMA anticipates that the solution should support multiple programs, funding sources, disaster events, and grant types over time. The initial implementation scope has not been finalized. Respondents should identify how their solution supports separate programs within one platform.

TEMA is primarily seeking a grants-management platform and implementation services. Respondents may identify optional business analysis, process design, policy/SOP development, or program-design services separately, including associated cost and assumptions.

A large disaster scenario could involve up to approximately 10,000 individual applicants. TEMA has not established final counts for reviewers, internal staff, administrators, or concurrent users. Respondents should identify applicable licensing, capacity, and scalability assumptions.

The first GRRF funding round following Hurricane Helene involved 108 competitive grants. A larger disaster could involve up to approximately 10,000 individual applicants. TEMA has not finalized projected volumes for awards, payments, reviewers, or concurrent users. Respondents should describe capacity assumptions and surge-management capabilities.

TEMA has not established a final annual grant volume or dollar value for this RFI. Respondents should identify assumptions used for pricing and capacity planning.

The solution must support individual applicants and local-government entities. Respondents should describe how their solution supports different applicant, recipient, reviewer, and program-administrator roles.

TEMA has not finalized its training model. Respondents should describe available administrator, power-user, train-the-trainer, applicant-facing, and end-user training options, with associated costs and assumptions.

TEMA has not determined whether the selected vendor would provide applicant/recipient Tier 1 support. Respondents should describe available support models, including support during high-volume application periods and disaster-response operations.

“Disaster-response support” refers generally to maintaining service availability and providing responsive technical support during elevated operational demand. Respondents should describe available support tiers, extended-hours options, surge capacity, service-level commitments, business-continuity capabilities, and any operational assistance offered.

Final contract terms and service levels have not been established for this RFI. Respondents should identify their standard capabilities, certifications, service commitments, and assumptions. For planning purposes, State vendor-security policy requires security controls to be considered in the future solicitation and contract according to the vendor’s risk tier, system criticality, data classification, access model, integrations, data residency, and subcontractor reliance. The minimum security baseline may include: Data residency requirements; Business-continuity requirements, including recovery time and recovery point objectives; Multi-factor authentication, as appropriate to the data type; Encryption in transit and at rest; Role-based access control and least privilege; Secure disposal of State Data; Breach notification to STS/CCC within 24 hours; and Security assurance artifacts such as FedRAMP/GovRAMP, HITRUST, an independent NIST 800-53 audit, SOC 2 Type II, or ISO 27001, as applicable. State policy also requires cloud services that host or process State Data to use security language approved by the Department of General Services, Central Procurement Office. Accessibility, insurance, final SLA, and disaster-recovery terms would be defined in a future solicitation and contract, if issued.

TEMA anticipates integration with Tennessee Edison for reimbursement-based grant payment processing, tracking, and reconciliation. Respondents should describe available approaches for Edison integration.

The intended integration should support payment-status information flowing back to the Grants Management System to support grant tracking and reconciliation. Detailed interface requirements, data elements, and workflow specifications have not yet been defined.

TEMA has not established whether Edison integration must be real-time, near-real-time, scheduled, middleware-based, or file-based. Respondents should identify supported options, recommended architecture, dependencies, and associated costs.

TEMA has not finalized other required integrations. Respondents may describe available integrations and options for identity/SSO, e-signature, document management, GIS, reporting/data warehouse platforms, and State portals, as applicable.

TEMA does not anticipate a migration from an existing grants-management system because this is a new implementation. Historic application, grant, or document records have not been identified as a defined migration scope. Respondents should identify any recommended discovery, import, retention, or archival options separately.

3. RFI Amendment Effective Date. The revisions set forth herein shall be effective upon release. All other terms and conditions of this RFI not expressly amended herein shall remain in full force and effect.

image1.jpeg