RFI-Dairy inspection and Licensing.pdf

Revised: February 2022 Page 1 of 11 Request for Information

STATE OF NEVADA

DEPARTMENT OF AGRCULTURE

Division of Animal Industry 405 South 21st Street │ Sparks, NV 89431

Phone: 775-353-3601

Request for Information: 2501 For

Dairy inspection and Licensing system

Release Date: 08/12/2024 Deadline for Responses: 09/20/2024 @ 5:00 pm

Refer to Timeline and Submission Requirements for complete schedule and instructions

Single point of contact for the RFI:

Cynthia Prasad, Management Analyst II

Phone, 775-353-3629 Email Address, ndacontracts@agri.nv.gov

(TTY for Deaf and Hard of Hearing, 800-326-6868 Ask the relay agent to dial, 1-775-515-5173/V.)

TABLE OF CONTENTS

1. APPLICABLE REGULATIONS GOVERNING PROCUREMENT

2. PROJECT OVERVIEW

3. SCOPE OF WORK

4. COST

5. TIMELINE

6. SUBMISSION CHECKLIST

Revised: February 2022 Page 2 of 11 Request for Information

1. APPLICABLE REGULATION GOVERNING PROCUREMENT

All applicable Nevada Revised Statutes (NRS) and Nevada Administrative Code (NAC) documentation can be found at: www.leg.state.nv.us/law1.cfm.

Vendors are advised to review Nevada’s ethical standards requirements, including but not limited to NRS 281A, NRS 333.800, and NAC 333.155.

This solicitation is a Request for Information (RFI) only. It is not a solicitation for bids or proposals. No contract award will result from this RFI. Aggregate information from this RFI will be analyzed and may be used as budget justification or to develop a subsequent solicitation.

All information received in response to this solicitation is considered confidential business information by the Administrator of the Purchasing Division. This solicitation will not lead to evaluation or award pursuant to NRS 333.335(7), so responses remain confidential.

2. PROJECT OVERVIEW

The Nevada Department of Agriculture is seeking a vendor to create its dairy environmental health permitting and inspection software and database system to be used in the dairy inspection program. The dairy program conducts sanitation inspections of dairy farms, plants and single service container manufacturers along with plan reviews of new facilities. The program is also responsible for conducting regulatory tests on pasteurizers, evaluating milk haulers and samplers, monthly sampling of dairy products, and inspection of milk tank trucks. The dairy program also conducts investigations into consumer complaints relating to dairy products. We have two lines of business (i)permits (ii)licenses.

We do health inspections and issue permits to our dairy plants, milk haulers, single service plants, and dairy farms.

licenses are issued to the distributors/retailers of dairy products sold in the state and they pay remittances. A client can have both a permit and license.

Currently, the NDA health inspection staff are manually typing out the reports and logging them into excel spreadsheets. The vendor will be asked to analyze the structure of the environmental health program, recommend changes in capturing data, data storage, and user workflows.

The NDA licensing staff is using a SQL database to capture information regarding licensing and the reporting and payment of dairy remittances. The vendor will be asked to analyze the structure of the dairy distributor licensing program and recommend changes in capturing data, invoicing, and payment processing.

The NDA is requesting information, solutions, concepts, and interest for vendor-provided cloud based environmental health program. The environmental health software and database system must have client portals which allow customers to access their information through a smartphone, computer, or other internet accessible device and be ADA/Section 508 compliant.

As part of your response to this RFI, please feel free to include any additional comments or suggestions your company believes would be helpful to the NDA. However, generic marketing brochures, marketing resumes, and other non-project specific materials may be discarded without consideration and are not encouraged.

2.1 AGENCY BACKGROUND

The Department of Agriculture regulates the Nevada dairy industry from farm-level production through the sale to the consumer. The department inspects, licenses, and regulates all segments involved in the production and sale of dairy products to Nevada consumers under the provisions of Nevada revised statutes chapter 584 and Nevada administrative code chapter 584. The milk and dairy foods inspection program has the responsibility of administering public health and safety programs in all aspects of milk processing and production. Milk producers and processors wishing to ship milk interstate must meet the requirements of the pasteurized milk ordinance. (2019 PMO-FINAL) A list of current Grade “A” producers and processors are available in the interstate milk shippers list. Manufactured dairy food products are regulated under the USDA milk for manufacturing purposes and its production and processing.

3. SCOPE OF WORK

The Nevada Department of Agriculture is issuing a request for information (RFI) to procure, develop/customize and implement dairy inspection and licensing system. This RFI communicates the State’s general expectations and envisioned project direction. Vendors are asked to provide costing and approach information based on the functionality described. Where appropriate, vendors are encouraged to include additional functionality or components that may be of value or interest to the State. Such information should be accompanied with related cost, product and services description information.

The Scope of work (SOW)details the services requested.

http://www.leg.state.nv.us/law1.cfm

Revised: February 2022 Page 3 of 11 Request for Information

3.1 GOALS

• Require a dairy inspection and licensing system which provides a solution to allow flexibility, maintainability, and sustainability.

• Move from paper to digital process.

• Simplify and streamline overall dairy inspection experience.

• Satisfy Federal and Nevada specific dairy inspection statues.

• Nevada State Statutes 584

• Nevada Administrative Code 584

• NCIMS DOCUMENTS – NCIMS

• Satisfy federal and Nevada specific security requirements.

• Provide Single Sign on (SSO) and multi-factor authentication (MFA) capabilities when logging into the application.

• Provide application access across various platforms, including web browsers (MS Edge, Google chrome, Apple Safari and devices (Microsoft Windows, Apple and Android). Ensure compatibility with both desktop and mobile devices.

3.2 PROJECT SCOPE

NDA requires a vendor to provide dairy inspection and licensing system and propose any NV specific configurations and/or customizations required to satisfy department’s needs.

Since it is not feasible to convey a complete and comprehensive functional scope for dairy inspection and licensing system within this RFI, the State anticipates receiving varied responses. The state acknowledges this constraint and encourages vendors to provide a response based on their best understanding of the RFI content.

The overall scope is to procure, implement, maintain and support fully functional dairy inspection and licensing system that support NDA key business functions.

The anticipated scope includes:

• Dairy permitting, inspections and licensing system should provide the ability to fill out inspection forms, log in the information, create licenses and permits and provide fiscal management.

• Cloud solution to allow flexibility, maintainability, sustainability and interoperability.

• Initial system setup and configuration.

• Inspection data migration from excel documents to the new system.

• System capable of meeting accessibility and other compliance standards.

• Solution must comply with federal, state and agency security standards.

https://ncims.org/about/2017-procedures-constitution-bylaws/

Revised: February 2022 Page 4 of 11 Request for Information

Attachment A – Permits and inspections Functional Requirements

CATEGORY

FUNCTIONAL REQUIREMENTS

Available Not

Comments

All requirements listed as required in the field must be available while offline.

Inspections

System should provide the ability to conduct the environmental health inspections.

Inspections System must have mechanism for an authorized user or supervisor to review, comment, and modify inspection reports

Inspections and Scheduling

The system must allow users to schedule inspections for dairy farms, plants and single service container manufacturers.

System must support recurring/re-inspection schedules based on regulatory requirements.

System can alert authorized staff to what inspections/ sample collections are due and assist with scheduling and placing on calendar.

Data collection and Entry

The system must provide digital forms for data entry during inspections

The system must allow users to enter data offline and synchronize when online.

Users must be able to attach photos, videos and other files to inspection records.

The system must provide the ability to upload satellite images of facility and maps so inspector can easily navigate to and around facility.

The system must provide the ability to store contact information on all facilities and allow inspection staff to access the contact information while in the field.

Revised: February 2022 Page 5 of 11 Request for Information

Not

Violation Logging The system must allow users to log violations observed during inspections.

Violation Logging The system must support documenting corrective actions and tracking their status.

Form generation and management

The system must automatically populate required regulatory forms based on the inspection type.

Form generation and management

Users must be able to review, edit, and approve forms before submission. All forms will be digitally archived.

Communication and notifications

The system must allow users to send notifications and emails to dairy operators regarding inspection results and approvals, corrective action updates and upcoming deadlines.

Reports Ability for system to calculate a numerical score onto inspection report. Each violation has a point value that corresponds to it. It’s a calculated score based on inspection results.

Plan Review System should provide mechanism to perform plan review approval and customer can see approval status.

Fiscal management for permits

System must provide ability to generate various dairy permits

Fiscal management for permits

System must provide mechanism for authorized and external users to schedule testing to obtain a permit /revoke permit

Client Portal for

Permits

System must provide client login to see inspection scores, inspection reports, permit, approval status, warning letters, Lab results.

Attachment B – Licensing Functional Requirements

Revised: February 2022 Page 6 of 11 Request for Information

Not

Licensing System must provide mechanism for dairy retailers, distributors and processing plants to enter their annual license application and make payments

Licensing System must provide mechanism for dairy retailers, distributors and processing plants and keep track of licensees that are exempt from filing remittances

Fiscal management for Licensing

System must provide mechanism for collecting and tracking financial data for distributor licenses and monthly remittances

System must provide a mechanism for licensee to fill in their monthly remittance forms and make payments. it is required for the system to interface with the state’s preferred payment gateway

Client Portal for Licensing

System must provide client login to report sales, system have ability to calculate tax on reported sales to make remittances.

Attachment C – Shared Functional Requirements

Not

User Management The system must provide the ability to create, edit and delete and suspending/disable users.

User Management The system must provide the ability to change passwords, perform password resets, force password changes and lockout users.

User Management System must support different user roles like inspectors, administrators, dairy operators with role-based access control.

The system must allow users to enter data offline and synchronize when online.

Communication and notifications

The system must allow users to send notification to both scheduled and ad-hoc and emails to dairy operators and distributors regarding inspection results, approvals, corrective action updates and upcoming deadlines.

Reports The vendor must describe standard reporting suite and the process for creating custom reports.

Data Migration The system must provide the ability to migrate 2 years of legacy data into new system

Payment /Invoicing Clients shall be able to pay by cash or check for licensing, remittance, permits and/or fines through the system.

Revised: February 2022 Page 7 of 11 Request for Information

Auditing and security

System must provide mechanism for authorized auditors to audit the financial information and adjust or write-offs as needed.

Auditing and security

Users must have access only to the data and functionalities relevant to their roles.

Integration The system must provide APIs for integration with external systems, such as state financial system, payment portals and LIMS systems

User Interface The system must comply with accessibility standards to accommodate users with disabilities.

Backup and Recovery

The system must perform regular data backups to prevent data loss and restore data in case of system failures.

Documentation and Training

The vendor must provide documentation and training to all authorized users/NDA Staff

Attachment D– System Security Requirements

System Security REQUIREMENTS

Available Not Available Comments

FEDERAL SECURUTY REQUIREMENTS

System must be compliant with the National Institute of Standards and Technology (NIST) SP 800-53 for storing, processing and transmitting federal data.

https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final

STATE SECURITY REQUIREMENTS

Cloud Service Providers (CSPs) offering Infrastructure as a Service (IaaS) must be able to demonstrate or show proof of comparable controls and processes needed to meet FedRAMP certified requirements or Center for Internet Security (CIS) controls identified as applicable to IaaS service models in the current CIS Controls Cloud Companion Guide.

https://www.cisecurity.org/controls/

CSPs offering Platform as a Service (PaaS) must be able to demonstrate or show proof of comparable controls and processes needed to meet FedRAMP certified requirements or CIS controls identified as applicable to PaaS service models in the current CIS Controls Cloud Companion Guide.

https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final

Revised: February 2022 Page 8 of 11 Request for Information

CSPs offering Software as a Service (SaaS) or any other cloud service model not explicitly named in this standard must be able to demonstrate or show proof of comparable controls and processes needed to meet the current version of CIS controls identified as applicable to SaaS service models in the current CIS Controls Cloud Companion Guide or SOC 2 Type 2.

CSPs offering Function as a Service (FaaS) must be able to demonstrate or show proof of comparable controls and processes needed to meet the current version of CIS controls identified as applicable to FaaS service models in the current CIS Controls Cloud Companion Guide, or SOC 2 Type 2.

CSP data centers, staff and contractors collecting, processing, transmitting, storing, or interconnecting State data in a cloud environment must be located within the continental United States.

System must require Multi-Factor Authentication (MFA) when any user is connecting to or accessing the system.

Cloud services must enforce least-privilege access to data, based on access roles established or agreed to by the agency.

Vendor must meet or exceed the State of Nevada Information Security Policies. Standards. And Procedures.

http://it.nv.gov/governance/state-policy-procedures/

System must be compliant with Nevada Revised Statutes NRS 242 Information Services.

https://www.leg.state.nv.us/NRS/NRS-242.html

System must meet State security standards for encryption of personal information for data at rest, in transit, and when data is active.

NRS 205.4742 Encryption https://www.leg.state.nv.us/Division/Legal/LawLibrary/NRS /NRS-205.html#NRS205Sec4742 and NRS 603A. Security and Privacy of Personal Information https://www.leg.state.nv.us/Division/Legal/LawLibrary/NRS http://it.nv.gov/governance/state-policy-procedures/ https://www.leg.state.nv.us/NRS/NRS-242.html https://www.leg.state.nv.us/Division/Legal/LawLibrary/NRS/NRS-205.html#NRS205Sec4742 https://www.leg.state.nv.us/Division/Legal/LawLibrary/NRS/NRS-205.html#NRS205Sec4742 https://www.leg.state.nv.us/Division/Legal/LawLibrary/NRS/NRS-603A.html

Revised: February 2022 Page 9 of 11 Request for Information

/NRS-603A.html

Vendor must preserve, discarded or destroy any application systems and information that become obsolete and no longer used in accordance with Electronic Record and Record Management requirements defined in NRS 239 and NAC 239

– Public Records, for Records Management.

https://www.leg.state.nv.us/Division/Legal/LawLibrary/NRS /NRS-239.html https://www.leg.state.nv.us/Division/Legal/LawLibrary/NAC /NAC-239.html

System must utilize the existing State Multi-Protocol Label Switching (MPLS) connection for the transmission of data.

Optimizing the MPLS connection will ensure minimal impact for all services using this same connection.

AGENCY SECURITY REQUIREMENTS

System must have documented security specifications that include an analysis of security risks and recommended controls, including access control systems and contingency plans.

Vendor must provide a Test environment, separate from the Production and Development environments which will be included with cloud hosting with documented Deployment Procedures.

Vendor must be able to perform quarterly vulnerability scans on its network and applications and report to the NDA within 10 business days from the end of each quarter showing confirmation that the scan was completed and any vulnerabilities found have been resolved or provide the expected date of resolution.

Vendor must provide NDA, at no additional cost, two data extractions, one within thirty (30) days of contract termination notification, and a final extraction of data upon termination of the contract. The extractions will be a complete backup copy of the production database in a format acceptable to the State and delivered via a method acceptable to the State.

https://www.leg.state.nv.us/Division/Legal/LawLibrary/NRS/NRS-603A.html https://www.leg.state.nv.us/Division/Legal/LawLibrary/NRS/NRS-239.html https://www.leg.state.nv.us/Division/Legal/LawLibrary/NRS/NRS-239.html https://www.leg.state.nv.us/Division/Legal/LawLibrary/NAC/NAC-239.html https://www.leg.state.nv.us/Division/Legal/LawLibrary/NAC/NAC-239.html

Revised: February 2022 Page 10 of 11 Request for Information

System hosting may be with Nevada Office of the Chier Information Officer (OCIO) Computing Services and must comply with OCIO standards https://it.nv.gov/Governance/Security/State_Security_Policie s_Standards___Procedures/.

Ability to authenticate all users accessing the system https://it.nv.gov/Governance/Security/State_Security_Policies_Standards___Procedures/ https://it.nv.gov/Governance/Security/State_Security_Policies_Standards___Procedures/

Revised: February 2022 Page 11 of 11 Request for Information

4. COST

Please provide a cost estimate for a system that fulfills the above requirements. Cost estimates for this RFI will be for informational purposes only. Please include any anticipated fees, subscription costs, etc.

5. TIMELINE

All questions regarding this RFP shall be submitted using the Bid Q&A feature in NevadaEPro by the deadline below.

The following represents the proposed timeline for this project.

• All times stated are Pacific Time (PT).

• These dates represent a tentative schedule of events.

• The State reserves the right to modify these dates at any time.

A. Deadline for Questions No later than 4:00 pm on 08/30/2024 B. Answers Posted On or about 09/06/2024 C. Submission Deadline No later than 5:00 pm on 09/20/2024

6. SUBMISSION CHECKLIST

This section identifies information requested and how to respond.

• Information should be submitted as a Quote through NevadaEPro, https://NevadaEPro.com.

• Technical information and Cost information should not be included in the same attachment.

• All attachments should be flagged as confidential in NevadaEPro.

• Additional attachments may be included.

https://nevadaepro.com/