RFI Aeronautics Airport Badging - 9-4-2026.docx

COMMONWEALTH OF MASSACHUSETTS

MASSACHUSETTS DEPARTMENT OF TRANSPORTATION

Request for Information (RFI) For Airport Badging

COMMBUYS Bid Number: BD-27-1030-0P100-0P110-133278

Table of Contents

1. Introduction and Purpose

Respondents to this Request for Information (RFI) are invited to respond to any or all the questions in this document. Responses to this RFI shall serve solely to assist the Massachusetts Department of Transportation (MassDOT) in understanding the current state of the marketplace with regards to the solicited information and/or to inform the development of a possible solicitation for a Request for Responses (RFR), Request for Proposals (RFP) or Request for Quotes (RFQ) in the future.

This RFI does not in any way obligate MassDOT to issue or amend a solicitation or to include any of the RFI provisions or responses in any solicitation. Responding to this RFI is entirely voluntary and will in no way affect MassDOT’s consideration of any proposal submitted in response to any subsequent solicitation, nor will it serve as an advantage or disadvantage to the Respondent during any RFR, RFP or RFQ that may be subsequently issued or amended.

· The purpose of this RFI is to elicit the advice and best analysis of knowledgeable people in the vendor community related to the administration of airport identification badge programs to inform the development of a possible solicitation for the MassDOT Aeronautics Group.

· MassDOT is searching for information for a Cloud Software-as-a-Service (SaaS) software solution for the above group.

· This RFI seeks responses from vendors who can offer information pertaining to ideas, high-level concepts, design issues and practical knowledge management system initiatives. This includes information regarding current and emerging technologies, approaches to processing, as well as supporting data analysis and reporting.

· This RFI is being issued to conduct research to identify vendors and systems capable of providing administration, services, or system solutions to MassDOT.

· The objective of this RFI is to gather information from qualified parties to assist in formulating a strategy.

· This RFI does not constitute a solicitation for bids or proposals and will not result in contract award for these services based on information provided in response to this request.

· Sections 2 and 3 in this document contain MassDOT current business and technical considerations for Respondents to review. Respondents are encouraged to provide alternative specifications/solutions to these considerations, which may be used to develop a needs requirement upon which a future procurement might be based.

· The provider should describe their pricing approach, including licensing models, subscription options, and scalable multi-level service plans. Actual cost and fee information should not be provided.

1.1 Background

· The purpose of this Request for Information (RFI) is to gather background information regarding current practices, systems, and capabilities related to the administration of airport identification badge programs, including applicant processing, identity verification, security threat assessment coordination, badge issuance, access control, renewals, and badge lifecycle management.

· MassDOT Aeronautics seeks to better understand available technologies, processes, and industry best practices that support secure, efficient, and compliant airport badging operations. This includes solutions that streamline applicants onboarding, manage training and credentialing requirements, track badge status, and integrate with physical access control and security systems.

· Information received will help inform future planning by providing insight into how airport operators and organizations manage badging workflows, maintain regulatory compliance with applicable Transportation Security Administration (TSA) requirements, administer access privileges, and integrate badging systems with identity management, access control, and other airport operational systems.

· This RFI is issued for informational and planning purposes only and does not constitute a commitment to procure products or services.

· MassDOT is seeking information on Cloud Software-as-a-Service (SaaS) solutions with no customization and minimal configuration.

1.2 Business Impact

· MassDOT Aeronautics requires the ability to effectively manage and monitor airport badging operations through real-time tracking, reporting, and analytics. The Division seeks solutions that provide visibility into, support, and reporting capabilities for, but are not limited to, the following functional areas:

· Aeronautics Department

· Airport Managers

· Aircraft Inspectors

· Airport Tenants

· Contractors – Vendors, construction, service providers

· Emergency responders

1.3 Business Solution

Appendix A provides a high-level MassDOT Aeronautics' current airport badging operations process flow.

When responding to the following questions, please reference the information provided in Appendix A and explain how your proposed solution addresses the identified processes, requirements, and operational challenges.

For each question below, please describe how your solution supports MassDOT Aeronautics' business objectives for airport badging by enhancing airport security, modernizing badge issuance processes, improving operational efficiency, increasing compliance and audit readiness, integrating with security systems, improving the user experience, strengthening access governance, and supporting future growth and scalability.

· How does your solution specifically address the key challenges and operational inefficiencies identified in our current airport badging processes?

· Can you map each of our requirements into the features, functionality, or process improvements provided by your solution?

· How does your solution resolve or improve our requirements?

· What similar airport badging or credential management challenges have you solved for other airport operators or transportation agencies, and what measurable results were achieved?

· How will your solution improve the efficiency and effectiveness of applicant processing, identity verification, security vetting, badge issuance, renewals, badge returns, and badge lifecycle management?

· How will your system improve visibility into badge application status, applicant eligibility, training completion, access privileges, and regulatory compliance compared to our current processes?

· How do you measure implementation success, and what key performance indicators (KPIs) or operational improvements follow deployment?

· How does your software align with or enhance our existing airport badging workflow?

· How will your solution change or improve the day-to-day activities of badging office staff, airport administrators, security personnel, and badge holders?

· Which manual tasks or administrative processes will be reduced or eliminated through implementation of your solution?

· How does your solution improve real-time operational visibility, reporting, and decision-making for airport badging and access management?

· What controls, automation, validation, or standardized workflows does your system provide to improve consistency, enhance security, and reduce processing errors?

· What measurable operational improvements (such as application processing time, badge issuance time, compliance rates, staff productivity, or reporting accuracy) should be expected, and how quickly can these benefits be realized?

· How does your software manage and streamline the complete airport badging lifecycle, including application intake, document management, identity verification, training, badge issuance, renewals, access modifications, badge suspension, and badge deactivation?

· Can you explain how your solution supports and optimizes the end-to-end airport badging process while maintaining compliance with applicable FAA airport security requirements?

· Can you describe how your solution integrates with existing airport systems, including physical access control systems (PACS), identity management systems, visitor management systems, learning management systems (LMS), and other operational applications?

2. Business Objectives Considerations

MassDOT Aeronautics has established the following objectives for an airport badging management solution. Please describe how your software supports these business objectives by improving the efficiency, accuracy, security, and regulatory compliance of airport badging operations in the following areas:

· Implement a secure, cloud-based Software-as-a-Service (SaaS) airport badging management solution that is commercially available by Q2 of Fiscal Year 2027.

· Establish a centralized platform to manage the complete airport badging lifecycle, including applicant registration, identity verification, security vetting, training, badge issuance, renewals, access modifications, badge suspension, and badge deactivation.

· Enhance airport security through stronger identity verification, credential management, access authorization, and badge accountability, while strengthening access governance through controlled management of badge holder access privileges and changes.

· Modernize airport badging operations by automating workflows, supporting electronic forms and approvals, enabling appointment scheduling, and providing self-service capabilities.

· Improve operational efficiency by reducing manual processes, minimizing data entry, and streamlining badge administration and processing.

· Increase operational visibility into badge holder status, application progress, access privileges, training completion, badge inventory, and security compliance through real-time reporting and dashboards.

· Strengthening compliance with TSA and FAA regulations, airport security requirements, and organizational policies while improving audit readiness.

· Provide comprehensive reporting, dashboards, alerts, and analytics to support operational oversight, regulatory reporting, performance monitoring, and informed decision-making.

· Improve transparency and accountability by maintaining complete audit trails of badge holder activities, access changes, approvals, administrative actions, and system events.

· Improve data quality and operational consistency through workflow automation, standardized processes, validation controls, and error reduction.

· Support end-to-end badge lifecycle management through automated notifications, renewals, certification tracking, badge returns, and credential expiration management.

· Improve the user experience for applicants, badge holders, airport tenants, and badging administrators by providing intuitive, efficient, and accessible workflows.

· Integrate security systems and related airport technologies to support coordinated identity verification, credential management, access authorization, and badge administration.

· Support multiple airports, evolving security policies, organizational growth, and changing regulatory requirements through a flexible and configurable solution.

· Deliver a scalable, future-ready platform with a clear product roadmap that supports MassDOT Aeronautics' long-term airport security, operational, and technology objectives.

· Vendors must ensure that their proposed airport badging solution supports compliance with applicable FAA requirements, including 14 CFR Part 139 – Certification of Airports, 14 CFR §139.301 – Airport Certification Manual, and 14 CFR §139.327 – Self-Inspection Program.

· The solution would have the ability for all regional airports to manage and print badges.

· Key objectives include reducing badge processing times, improving data accuracy, strengthening security controls, enabling real-time access management, and providing scalable capabilities to support future airport growth. The initiative will also introduce enhanced reporting, workflow automation, and role-based access management to strengthen MassDOT Aeronautics Group oversight and improve operational efficiency across participating regional airports

· Ability for the solution to have badges access to multiple airports.

· Ability for the solution to support and manage badge credential statuses, including New/Pending Issuance, Pending Approval, Approved, Ready for Printing, Issued/Active, Expiring Soon, Expired, Suspended, Revoked, and Lost/Stolen.

· Ability for the solution to support a billing process for participating municipalities/cities, including the generation of invoices for badge-related services and fees.

· Existing card readers at regional airports to be used and not replaced

3. Business capabilities Considerations/requirements

Please describe how your software supports the below business capabilities considerations and requirements:

· Ability for the solution to provide configurable, role-based access controls with different levels of access, including Administrator, Standard Read-Only, and Standard Read-and-Modify users, and automatically deactivate badges based on employment, access status, or other applicable status changes.

· Administrator user: Administrative access.

· Standard Read-Only user: Read-only access.

· Standard Read-and-Modify user: Read and modify access.

· Ability for the solution to provide automated notifications, reminders, and alerts for badge expiration dates, workflow activities, and required administrative actions.

· Ability for the solution to comply with ADA and WCAG Version 2.1, Level A and AA accessibility standards and provide an intuitive, user-friendly interface with accessible, consistent, and standardized workflows that minimize training and manual effort.

· Ability for the solution to comply with MassDOT data backup policies and applicable state, airport, and regulatory requirements, including MA General Law 93H, and support data backup, restoration, disaster recovery, and business continuity within defined RTO and RPO requirements.

· https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards

· Ability for the solution to maintain centralized records and a single repository of badge-related artifacts for all badge holders, including employees, contractors, vendors, tenants, and authorized personnel, while providing efficient search, retrieval, analysis, and manipulation of data.

· Ability for MassDOT users create and modify dashboards and reports, including standard, ad hoc, compliance, operational, historical, and trend-analysis reports with drill-down capabilities.

· Ability for the solution to use English as the default language and support import and export of industry-standard formats, including PDF, XPS, Word, Excel, and TXT.

· Ability for the solution to be a Cloud-Based SaaS COTS product that supports software upgrades, patches, enhancements, and configuration changes with minimal interruption to MassDOT services and without requiring major code modifications.

· Ability for the solution to support the complete badge lifecycle, including issuance, renewal, suspension, revocation, application, approval, and termination, through secure, fully digital, configurable, and automated workflows.

· Ability for the solution to support electronic application processing and provide applicants and sponsors with online self-service capabilities for badge submission, appointment scheduling, and status tracking while minimizing manual data entry and processing time.

· Ability for the solution to integrate reliably with existing airport access control, identity management, HR, background check, security vetting, and other external systems using standard APIs or industry-standard data exchange formats and stable integration interfaces.

· Ability for the solution to leverage existing airport access card readers, credentials, and access control infrastructure; support industry-standard, non-proprietary credential technologies; and minimize unnecessary hardware replacement while enabling future migration and expansion.

· Ability for the solution to provide a compatibility assessment and migration plan identifying required hardware changes, technical justification, implementation risks, operational impacts, and cost considerations while minimizing disruption.

· Ability for the solution to support background check verification and credential validation workflows and ensure that only authorized personnel with approved credentials can access designated secure and sterile airport areas.

· Ability for the solution to maintain complete, traceable audit logs and historical records of all badge-related transactions, user actions, and activities from request through termination for regulatory, compliance, and operational review.

· Ability for the solution to support multi-airport and multi-location administration and future expansion to additional tenants, facilities, users, badge holders, and transaction volumes without significant system redesign.

· Ability for the solution to provide real-time updates to badge status and access privileges and ensure reliable processing of badge lifecycle transactions with minimal failure rates.

· Ability for the solution to provide secure authentication and data protection controls, including multi-factor authentication for administrative users, strong password policies, session controls, account lockout mechanisms, encryption of sensitive data in transit and at rest, and protection of PII in accordance with applicable security requirements.

· Ability for the solution to support high-volume transaction processing during normal and peak operating periods while maintaining defined response-time and system-responsiveness thresholds for badge searches, submissions, approvals, status updates, and other critical transactions.

· Ability for the solution to maintain high availability for continuous airport operations, including 24/7 environments where required, with minimal downtime, rapid recovery from failures, and critical functions remaining available or recoverable within acceptable timeframes.

· Ability for the solution to provide system monitoring, diagnostics, documentation, and administrative capabilities to support efficient troubleshooting, maintenance, and ongoing system support.

· Ability for the solution to support horizontal and vertical scaling to accommodate growth in users, badge holders, transactions, locations, and airport facilities without significant redesign.

4. General Request and Questions

The General Requests and Questions section lists requests and questions on subjects MassDOT is interested in learning about. This section is a supplement to the business needs, objectives, solution and requirements information found in the above sections.

The Respondent is encouraged but not required to respond to all requests and questions in this section. The outline and corresponding requests and questions provided are meant to inform the Respondent on the interest and depth of MassDOT business and technical needs. The response should provide a summary of the Respondent’s solutions capabilities that fall within the scope.

1. Company Profile Company Name

Headquarters Location

URL of Company Web Site

Contact Name

Contact Title

Contact Email Address

Contact Phone Number

Number of Years of experience in this service offering

Business Size – Annual Revenue

Primary Type of Service(s) Provided

2. Vendor Experience & Qualifications

a. Have you implemented airport badging and credential management solutions for public sector agencies, airports, or other transportation organizations? If so, please identify the organizations, describe the scope of the implementation, the services provided, and the critical success factors and outcomes achieved.

b. From your past experiences, what concerns, issues or roadblocks could cause MassDOT to fall short in the replacement/procurement of its current solution and the processes around it? How have you overcome these types of issues and/or roadblocks in the past?

c. What is the largest airport or multi-airport deployment currently supported by your solution, and approximately how many badge holders, users, and airports does it support?

d. Describe the experience your organization has supporting airport badging operations involving multiple airports, locations, badge populations, and user groups.

3. Solution Overview & Product Information

a. Do you offer a readily available SaaS solution that could be procured via a future procurement request to help MassDOT complete this project? If so, provide a high-level description of your solution, including functional capabilities, reporting and analytics capabilities, technical architecture, infrastructure requirements, system security, and protocols used to ensure data privacy.

b. What is the name of the product that you are describing in your response?

c. What is your product roadmap over the next 2–3 years, and what major enhancements are planned for your airport badging solution?

d. Does your solution leverage artificial intelligence (AI) or machine learning (ML) to improve workflow automation, document validation, fraud detection, reporting, or analytics? If so, please describe these capabilities.

e. Describe how your solution supports the complete airport badge lifecycle, including application submission, sponsorship, approvals, identity verification, background checks, training validation, badge issuance, renewals, modifications, suspension, expiration, and revocation.

f. How does your solution support automated workflows for different badge types, applicant categories (employees, contractors, vendors, tenants), and airport-specific requirements?

g. How does your solution support temporary badges, visitor credentials, escorted access, and emergency badge processing?

h. How does your solution support compliance with FAA airport security requirements and badging regulations?

i. Describe how your solution supports biometric identity verification (e.g., facial recognition, fingerprint, iris) if available. Are these capabilities optional, and how is biometric data protected?

j. Describe your document management capabilities, including storage, versioning, retention policies, electronic signatures, and support for supporting documents such as identification, leases, contracts, and authorization letters.

4. Accessibility

a. Is your solution:

i. Compliant with Commonwealth Accessibility Standards?

ii. Compliant with WCAG Version 2.1, Level A and AA?

iii. Do you have a current Accessibility Conformance Report (ACR)?

b. Do you have accessibility testing results for any pre-existing software, including third-party software, that you are describing in your response? Do you have a mitigation strategy in place based on prior accessibility testing?

5. Implementation & Configuration

a. If you have a SaaS solution, what is the average duration of your typical implementation? Please describe prior data migration experiences and discuss best practices for implementation.

b. If you have a SaaS solution, please describe how configuration would be accomplished. Does ongoing configuration require coding, or is it a turnkey solution?

c. Can business users configure workflows, forms, notifications, reports, and business rules without vendor assistance? If not, which changes require vendor involvement?

d. Describe your approach for migrating existing badge holder records, historical data, documents, photos, and audit records from MassDOT’s current solution.

e. What data cleansing, validation, or reconciliation activities are recommended before migration?

f. What migration tools and resources are provided by your organization?

g. What training programs are provided for administrators, badging office staff, security personnel, sponsors, and applicants?

h. What documentation and self-service resources are available?

i. What change management approach do you recommend for transitioning from an existing badging system?

j. Describe your recommended project governance structure, including vendor responsibilities, customer responsibilities, milestones, and critical success factors.

6. Vendor Interest

a. What would limit your interest in participating in this project?

7. General Feedback

a. Do you have any other comments/suggestions you feel would assist in the success of this project?

8. Security

a. What type of internal and/or external processes do you have for security tests before the product ships?

b. What is the level of detail in the security advisories you would send to us?

c. On average, how long does it take you to patch vulnerabilities?

d. Please describe your security procedures/practices that would prevent clients, departments, or divisions from seeing each other's data and keeping data confidential.

e. Do you maintain any independent security certifications or audit reports (e.g., SOC 2 Type II, ISO 27001, FedRAMP, StateRAMP)? If so, please identify them.

f. Describe your disaster recovery and business continuity capabilities, including your Recovery Time Objective (RTO) and Recovery Point Objective (RPO).

g. Are penetration tests performed by an independent third party? If so, how frequently?

h. How is sensitive applicant information protected while stored and transmitted?

i. Does your solution support data encryption at rest and in transit?

j. How are privileged user activities monitored and controlled?

k. Describe your identity and access management capabilities, including support for Single Sign-On (SSO), SAML 2.0, OAuth/OpenID Connect, Multi-Factor Authentication (MFA), and role-based access control (RBAC).

l. Describe your audit logging capabilities. What user, administrative, and system events are logged? How long are logs retained, and can they be exported?

9. Product Support & Lifecycle

a. How long do you plan to support the product?

b. How frequently are software updates and feature releases deployed, and how are customers notified of planned maintenance or significant product changes?

c. Please describe your customer support model, including support hours, severity levels, response times, escalation procedures, and availability of a dedicated customer success or technical account manager.

d. Describe your process for handling customer enhancement requests, including prioritization, customer feedback mechanisms, and incorporation into the product roadmap.

10. Third-Party Components

a. Please provide an itemized list of all the third-party components and code for your product.

11. Cloud Hosting & Service Levels

a. Who is your Cloud Hosting Provider?

b. What are your SLAs for your system (Application and Database)?

c. Who owns the customer data, and what is your process for returning or exporting customer data upon contract termination? What formats are supported, and how long is data retained after termination?

d. What are your Recovery Time Objective (RTO) and Recovery Point Objective (RPO)?

e. Where is customer data hosted and processed geographically?

f. Describe your backup strategy, including backup frequency, retention periods, restoration testing, and customer recovery options.

12. Integration & Interoperability

a. How does the solution support integration and interoperability with PACS, enterprise systems, third-party platforms, and real-time access control synchronization?

13. Mobile Capabilities

a. Does your solution provide mobile capabilities for applicants, sponsors, badging office staff, or security personnel? If so, please describe the available functionality and supported platforms.

b. Does the mobile solution support offline operation for badge verification or data collection? If so, describe the capabilities and synchronization process.

14. Reporting & Analytics

a. Describe the standard reports included with the solution.

b. Can authorized users create custom reports without vendor assistance?

c. Does the solution provide dashboards and key performance indicators (KPIs)?

d. Can reports be scheduled and automatically distributed?

e. What export formats are supported (Excel, CSV, PDF, API)?

5. General Instructions

Please note that this RFI is issued solely for the purpose of obtaining information. Nothing in this RFI shall be interpreted as a commitment on the part of MassDOT to procure or enter into a contract with any Respondent or other party.

This RFI will be distributed electronically by posting it on COMMBUYS.

Respondents experiencing technical problems accessing information or attachments stored on COMMBUYS should contact the COMMBUYS Helpdesk at COMMBUYS@state.ma.us or the COMMBUYS Helpline at 1-888-MA-STATE. The Helpline is staffed from 8:00 AM to 5:00 PM Monday through Friday, Eastern Standard or Daylight time, as applicable, except on federal, state and Suffolk County holidays.

A Respondent may contact the MassDOT Procurement Contact designated in Section 5.7 if the RFI is incomplete or if information is missing.

All vendors are responsible for checking COMMBUYS for any addenda or modifications made to the RFI after the initial posting on COMMBUYS.

Respondents are responsible for entering content suitable for public viewing, as all the responses and questions are accessible to the public. Respondents must not include any information that could be considered personal, security sensitive, inflammatory, incorrect, collusive, or otherwise objectionable, including information about the Respondent’s company or other companies.

5.1 Response Questions

Respondents may only make inquiries and request clarification concerning this RFI by submitting questions via COMMBUYS Q&A button under this RFI bid number.

Responses to inquiries and clarification questions will be provided electronically to all interested parties via a posting on COMMBUYS.

Respondents may not communicate directly or indirectly with any employee of MassDOT regarding this RFI, except as specified in this RFI.

5.2 Responses Submission

Respondents should submit one (1) electronic copy via COMMBUYS by the date and time in the schedule below. A late response may be disregarded.

All responses must include on the first page the official name, address and contact information of the firm or entity submitting the response, with signature provided. Please place consecutive numbers on all pages of the response.

5.3 Estimated RFI Calendar

Times are Eastern Standard/Daylight Savings (US), as displayed on the COMMBUYS system clock displayed to Respondents after logging in. If there is a conflict between the dates in this Estimated RFI Calendar and dates in the RFI’s Header, the dates in the RFI’s Header on COMMBUYS shall prevail. Respondents are responsible for checking the RFI record, including Bid Q&A, on COMMBUYS for RFI Calendar updates.

5.4 Informational Sessions and Demonstrations / Clarifications Some Respondents may be invited to provide a capability briefing or demonstration of their product/solution.

MassDOT may request additional information from Respondents, including further explanation or clarifications, during the review process.

5.5 Response Numbering/Preparation Cost

MassDOT requests that responses to this RFI are submitted following the same order and numbering scheme set forth above. Respondents should also use this same numbering scheme when asking questions. Although the responses may include supplemental materials, they should be limited to twenty (20) pages, 12-point font, single sided and focused specifically on the subjects contained in this RFI.

All costs incurred by a Respondent in the preparation and submission of a response are the sole responsibility of the Respondent. MassDOT shall not be held responsible for any costs incurred by Respondents in preparing their respective responses to this RFI.

5.6 Alternative Information

MassDOT requests that all responses be submitted with a response to each applicable question set forth in Section 4 above.

If a Respondent opts not to respond to any question, please note and if possible, include an explanation for the lack of response.

Respondents are encouraged to provide alternative specifications/solutions and the basis for their inclusion or substitution of MassDOT business and technical considerations.

5.7 MassDOT Contact Information

Please direct all communications to the following MassDOT contact:

Boston, MA 02116 Email Address: JOHN.CADORETTE@DOT.STATE.MA.US

5.8 Review Rights and Public Records

Responses to this RFI may be reviewed and evaluated by any person(s) at the discretion of MassDOT, including independent consultants retained by MassDOT now or in the future.

All responses to this RFI will be a public record under the Commonwealth’s Public Records Law, Mass. Gen. L. ch. 66 s. 10, regardless of confidentiality notices set forth on such writings to the contrary.

All responses and other documents submitted in response to this RFI become the property of MassDOT. MassDOT is under no obligation to return any documents submitted by a Respondent.

6. APPENDIX A

Fig 1

9/9/2026

9/9/2026 image1.jpeg image2.png