RFI - C000989 - Spring Framework Vulnerability Support.pdf

KATHY HOCHUL

Governor

DRU RAI

NYS Chief Information Officer

REQUEST FOR INFORMATION (RFI # C000989)

FOR

C000969 NYS ITS Spring Framework Vulnerability Support

POINT OF CONTACT FOR INQUIRIES AND SUBMISSIONS

The point of contact for this RFI is Vendor Sourcing and Management Organization, Heather Chrysler. All inquiries and responses related to this RFI must be submitted by electronic mail

(e-mail) to the following address:

its.sm.MAT.Solicitations@its.ny.gov

No other method of inquiries will be accepted.

This RFI is posted on the New York State Office of Information Technology Services Procurement website at https://its.ny.gov/competitive-procurement-opportunities mailto:its.sm.MAT.Solicitations@its.ny.gov https://its.ny.gov/competitive-procurement-opportunities

2 | P a g e

Table of Contents

1.0 INTRODUCTION

2.0 PERTINENT DATES

3.0 OBJECTIVE

4.0 SCOPE OF WORK

5.0 BACKGROUND

6.0 CURRENT STATE

7.0 QUESTIONS FOR VENDOR COMMUNITY

8.0 RESPONDENT QUESTIONS OF VENDOR COMMUNITY

9.0 DESIGNATED CONTACTS/WRITTEN INQUIRIES/RFI ELECTRONIC SUBMISSIONS

10.0 RFI ELECTRONIC SUBSMISSIONS

11.0 GENERAL REQUIREMENTS FOR SUBMISSIONS

12.0 MULTIPLE SUBMISSIONS

13.0 COMMUNICATION FROM NYS TO VENDORS

14.0 FREEDOM OF INFORMATION LAW AND RFI RESPONSES

15.0 NO AWARD

ATTACHMENT 1: RFI QUESTIONS for VENDOR COMMUNITY FORM

ATTACHMENT 2: VENDOR COMMUNITY QUESTIONS FORM

3 | P a g e

1.0 INTRODUCTION

The New York State Office of Information Technology Services (ITS) is seeking responses to this Request for Information (RFI) from the vendor community to solicit information for service requests for Spring Framework Spring Boot 2.7.x platform.

2.0 PERTINENT DATES

Milestone Date & Time RFI Release Date

6/10/26

Closing Date for Questions 6/24/26

Responses to Questions Posted (Estimated)

7/8/26

RFI Response Due Date 7/22/26

3.0 OBJECTIVE

This request is to solicit detailed information from qualified vendors regarding the provision of comprehensive, enterprise-grade extended support for the Spring Framework, with a specific focus on Spring Boot version 2.7.x and its related dependent projects.

The objective of this RFI is to gather insights into vendor capabilities, service offerings, and best practices that enhance the State's ability to maintain secure, robust, and well-supported applications built on the Spring ecosystem.

NYS ITS is seeking to understand how vendors can provide critical services such as proactive vulnerability management, timely security patching, access to vetted artifacts, and expert technical support to ensure the long-term stability and security posture of its Spring-based applications.

4.0 SCOPE OF WORK

NYS ITS is seeking input from vendors regarding:

3.1 Comprehensive Enterprise Support:

• Services that cover the Spring Framework

• Spring Boot (with a focus on version 2.7.x)

• Spring Security

• Other related Spring projects

3.2 Secure Artifact Management:

4 | P a g e

• The provision of access to a secure, vetted, and certified Spring Enterprise Artifact Repository, guaranteeing the integrity and compatibility of software components

3.3 Extended Lifecycle Management and Security Patching:

• Proactive management of an extended Long-Term Support (LTS) lifecycle for supported Spring projects, including the timely delivery of critical security patches and updates to maintain a strong security posture

3.4 Expert Technical Support:

• Enterprise-level technical assistance and guidance for Spring

Framework and Spring Boot, addressing complex issues and ensuring smooth operation

3.5 Operational Excellence:

• Robust support and maintenance services

• Defined support hours

• Clear response times

• Effective escalation procedures

3.6 Documentation and Transition Support:

• Provision of necessary documentation for support, installation, and upgrades

• Clear process for client onboarding and transition

3.7 Centralized Support Portal:

• Organization's approach to providing a centralized support portal for enterprise-level technical support

• Define features and functionalities for managing support tickets, accessing documentation, and tracking issue resolution for Spring Framework components

5.0 BACKGROUND

The State of New York Office of Information Technology Services (ITS) relies on a diverse range of technologies to deliver essential services to its citizens. Among these, the Spring Framework and its core components, particularly Spring Boot, are fundamental to numerous critical applications across various state agencies. As these applications mature, ensuring their ongoing security, maintainability, and operational integrity becomes paramount.

6.0 CURRENT STATE

NYS Office of Information Technology Services currently utilizes Spring Framework - Spring Boot version 2.7.x and its dependent projects. Currently there is need for information regarding an enterprise portal to obtain patches and updates for our current software.

7.0 QUESTIONS FOR VENDOR COMMUNITY

• Please see Attachment 1 – Questions for Vendor Community Form

5 | P a g e

8.0 RESPONDENT QUESTION AND ANSWER PERIOD

Respondents should submit all inquiries, questions, or comments to its.sm.MAT.Solicitations@its.ny.gov using Attachment 2 – Vendor Community Questions, Respondent Question Submission Form, by the Closing Date for Respondent Questions as indicated Pertinent Dates. No other method of inquiries will be accepted.

Answers to all respondent questions submitted by the Closing Date for Respondent Questions will be provided in the form of a question-and-answer document, which will be posted on the ITS website. See Section 14.0 Communication from NYS to Vendors.

9.0 DESIGNATED CONTACT/WRITTEN INQUIRIES/RFI ELECTRONIC

SUBMISSIONS

Primary Contact:

Contact Name – Heather Chrysler Contact Title – Contract Management Specialist Office of Information Technology Services Email: its.sm.MAT.Solicitations@its.ny.gov

Alternate Contact:

Alternate Contact Name – Roselyn Disonell Alternate Contract Title – Contract Management Specialist Office of Information Technology Services Email: its.sm.MAT.Solicitations@its.ny.gov

10.0 RFI ELECTRONIC SUBMISSIONS

Completed responses must be submitted via email to its.sm.MAT.Solicitations@its.ny.gov by completing Attachment 1 – Questions for Vendor Community Form, with the subject line “Response to RFI C000989”, no later than the RFI Response Due Date shown in Section 12.0 Pertinent Dates. Responses received after the deadline may or may not be reviewed at the discretion of ITS.

11.0 GENERAL REQUIREMENTS FOR SUBMISSION

General Terms:

• All submissions in response to this RFI, must be written in the English language.

• The State will not be liable for any costs of work performed in the preparation and production of any RFI response. By submitting a response, the respondent agrees not to make any claims for, or have any right to, damages because of any misunderstanding or misrepresentation of the functionality, or because of any misinformation or lack of information. The responses shall become the property of the State of New York.

• This RFI is being issued for data gathering purposes only. As a result, neither the issuance of this RFI nor the State’s receipt of a response or several responses to it binds or otherwise obligates New York State to procure any mailto:its.sm.MAT.Solicitations@its.ny.gov mailto:its.sm.MAT.Solicitations@its.ny.gov

6 | P a g e products or services referenced. Similarly, because this RFI is being issued for data gathering purposes only, a response to this RFI does not bind or obligate the respondent to provide or offer to the State any of the products or services referenced. No contract can or will be awarded based on submissions to this

RFI.

• This RFI does not fall under the requirements of State Finance Law §§139-j and 139-k (the Procurement Lobbying Law) and there is no restricted period. However, we ask that you direct your questions and responses in writing to the designated email address referenced above in section 5.1.

• The State reserves the right to:

o Postpone or cancel this RFI upon notification to all RFI respondents.

o Amend the RFI after its release with appropriate notice to all RFI respondents.

o Request RFI respondents to present supplemental information clarifying their responses.

12.0 MULTIPLE SUBMISSIONS

Vendors may submit more than one submission for the purpose of offering alternative possibilities, but each response must be separate and complete.

13.0 COMMUNICATIONS FROM NYS TO VENDORS

ITS has established a procurement website for the purpose of disseminating information relating to this RFI, and vendors are encouraged to monitor the site. The website URL is https://its.ny.gov/competitive-procurement-opportunities

14.0 FREEDOM OF INFORMATION LAW AND RFI RESPONSES

The purpose of New York State's Freedom of Information Law (FOIL), which is contained in NYS Public Officers Law, Sections 84-90, is to promote the public's right to know the process of governmental decision making and to grant maximum public access to governmental records.

Thus, a member of the public may submit a FOIL request for disclosure of the contents of the responses submitted to the State in response to this RFI. The responses of respondents may be subject to disclosure under FOIL. However, pursuant to Section 87(2)(d) of the Public Officers Law, a State agency may deny access to those portions of responses which "are trade secrets or submitted to an agency by a commercial enterprise or derived from information obtained from a commercial enterprise and which if disclosed would cause substantial injury to the competitive position of the subject enterprise." Please note that FOIL has specific instructions for identifying material that an entity claims is exempt from disclosure under FOIL because the information is trade secrets, which if disclosed would cause substantial injury to the competitive position of the respondent.

Please also note that information which you may claim as proprietary, copyrighted or reserved rights is not necessarily protected from disclosure under FOIL.

https://its.ny.gov/competitive-procurement-opportunities

7 | P a g e

If there is information in your response which you claim meets the definition set forth in NYS Public Officers Law Section 87(2)(d), please inform us in a letter accompanying your response.

15.0 NO AWARD

ITS is conducting this RFI solely for the purpose of gathering information related to new, innovative, and cost-effective solutions for repair of print device issues that are not covered by a manufacturer warranty and print devices no longer under warranty. This RFI will not directly result in the award of a contract, however the information may be used for planning purposes.

*Note: All materials submitted by a respondent shall become the property of the State and may be returned to the respondent at the sole discretion of the State.

The State has the right to adopt, modify, or reject any or all ideas presented in any material submitted in response to the RFI.