RFO_25-151_Questions_and_Answers.pdf

Request for Offer (RFO) 25-151 Questions and Answers

Due Date: 03/04/26 by 2 PM PT

Date Section Page # Question State’s Response

Change to RFO

(Yes/No)

1. 2/26/26 General N/A Is there an incumbent vendor providing these services? If yes, who is the incumbent and is that incumbent eligible to bid for these services?

No, there is not an incumbent vendor providing these services.

No

2. 2/26/26 Exhibit D - Additional Provision

98 Is the vendor awarded this RFO work eligible to bid on any follow-on work resulting from these services? Or will the vendor be precluded from bidding on any future work?

Yes, if selected, a vendor whose services under RFO 25-151 result in subsequent contracts, that vendor is prohibited from participating in those subsequent contracts.

Refer to Exhibit D, Item #5 – Follow-on Contracts are Prohibited.

No

3. 2/26/26 Exhibit A, Section IV.C – Contractor Deliverables

73 Please explain the time required and the number of review cycles for the deliverable reviews and final sign-off.

DOJ budgets fifteen business days for the review cycle; however, that is based on a deliverable that is complete. Reviewers and approvers will vary by deliverable with some requiring approval by project staff only and others requiring approval by project staff and executive stakeholders. Deliverable-specific review and approval processes will be defined in the Work Authorizations.

No

4. 2/26/26 RFO Section III, Attachments 3 – Company Reference Form and Attachment 4

22 and

For the Reference Attachments, we understand the instructions at the bottom of page 1 state that we should move forward past that first page and that the reference people should not fill out or sign the remaining section, as that will be a

Offeror completes Section 1 and returns the entire form with its final offer.

Do not complete Section 2 or ask for reference to return on Offeror’s behalf.

Section 2 is to be completed when DOJ contacts the reference.

No

– Key Staff Reference Form

DOJ task once they contact the reference person, correct? We just want to be clear that the reference person will not fill this out or sign it now, but rather at a later date when the DOJ contacts them.

Refer to Attachments 3 and 4: “The DOJ reserves the right to contact references.”

“The DOJ Assessment Team will verify directly with the Offeror References.”

5. 2/26/26 RFO Section III, Attachments 3 – Company Reference Form and Attachment 4

– Key Staff Reference Form

22 and

When the DOJ contacts individuals for the reference form, what is the allowable response time for the contact person to reply to the DOJ to complete the form (e.g. 48-hours)?

Will DOJ notify the vendor that the reference phase is in motion?

What happens if they go on vacation and lack phone or email access when the DOJ reaches out?

A total of two (2) attempts will be made to contact each reference, via phone call and/or e-mail, and a call back or response e-mail must be received within two (2) business days.

At the DOJ’s discretion, courtesy notification may be sent to the vendor prior to reference checks.

If the DOJ is unable to reach a reference or if there is a conflict of interest with the reference, depending on the nature of extenuating circumstances, the DOJ may request a replacement reference, at its sole discretion. Vacation or general illness does not count as extenuating circumstances.

Refer to Attachment 3 – Company Reference Form and Attachment 4 – Key Staff Reference Form, Part 1A – Instructions to Vendor.

No

6. 2/27/26 General N/A Please could you confirm that additional funds will be added if the option for additional term is exercised.

The DOJ has the option, at its sole discretion, to extend the term of the agreement and/or add money under the same terms and conditions, including pricing terms, for two (2) twelve (12) month terms, for a maximum Agreement term of forty-two (42) months.

Whether DOJ will exercise its options to add time/money and how it will deploy those options depends on various factors that cannot be predicted at this time.

7. 2/27/26 RFO Section III, Attachments 3 – Company Reference Form

22 Can we provide DOJ as a reference for an ongoing project?

Please could you clarify how we can ensure that the reference we are providing is not involved with this solicitation?

Yes, one (1) reference may be a DOJ employee that is not involved with this solicitation.

Offeror is expected to verify with the reference prior to submitting their offer.

Refer to Attachment 3 – Company Reference Form, Part 1A – Instructions to Vendor.

No

8. 2/27/26 RFO Section III, Attachments 4 – Key Staff Reference Form

24 Part 1E- Project $ Amount- Most resources do not have an idea of the project $ Amount. Please could this be made optional for assessment?

Offeror is expected to provide as much information as possible on the Form.

No

9. 2/27/26 RFO Section III, Attachments 4 – Key Staff Reference Form

24 Part 1E- For the Field- Workplace, is it sufficient to enter as Remote if so?

Offeror is expected to provide as much information as possible on the Form.

No

10. 2/27/26 RFO Section III, Attachment 5.1 Staff Qualifications Matrix

27 MQ1- If a resource doesn't have a Bachelor's degree and a Masters degree, please could you confirm that they need to have a total of 13 years of experience to be eligible for the DQ1?

Yes, if the resource does not have Bachelor’s and Master’s degrees, the resource will need to demonstrate eleven

(11) years of experience to meet MQ1 and an additional two (2) years of experience, for a total of thirteen (13) years of experience, to earn the DQ1 points.

(MQ1: if no Bachelor’s degree, Eleven (11) years of experience related to MQ2 (seven

(7) years + four (4) additional qualifying years)).

Refer to Attachment 5.1 – Staff Qualifications Matrix.

11. 2/27/26 RFO Section III, Attachment 5.1 Staff Qualifications Matrix

27 In the Qualifications Matrix, for each MQ and DQ, we are required to provide the Contact Address, Phone & Email. At times it is not possible to give the current contact details of the contact persons, especially for older projects.

For example, for a resource with no Bachelor's degree and no Master’s degree, they would have to provide contact details of the last 13 years. The contact persons would have moved companies, and their contact information may have changed as well. This is a challenge that we have often faced. In some situations, the resources have been hesitant as asking for address, email and phone numbers are a Privacy issue. Please could DOJ consider making this field as optional. Or at least make it optional for older projects (say beyond 5 years).

This change is requested as DOJ is taking Reference in the form of Staff Reference form either way.

Offeror is expected to provide as much information as possible on the Form.

No

12. 2/27/26 RFO Section II, G – Scoring Criteria

17 Please could you confirm if the highest score will be awarded to the lowest average hourly rate on Cost sheet 1 of 2 OR the lowest grand total on Cost sheet 2 of 2.

The lowest Grand Total cost offered on Cost Sheet 2 of 2 is awarded the maximum cost points. All other Responses’ cost points are awarded based on the following calculation:

Cost Score Awarded to Offeror = Lowest Rate / Offeror’s Rate multiplied by the Maximum Cost Points Available (300).

13. 2/27/26 General N/A If a vendor is awarded contract under RFO #25-141, would that vendor also be eligible to compete for or perform services under RFO #25-151?

Since RFO #25-141 is for Independent Verification & Validation services, the Contractor awarded that contract may not be awarded other contracts for the FITSM project due to a conflict of interest.

No

14. 2/27/26 General N/A Will the award of this contract in any way preclude the awarded vendor from participating in any follow-on contracts of this project?

Refer to the answer to Question #2. No

15. 2/27/26 General N/A Is there any incumbent to this project?

Refer to the answer to Question #1. No

16. 3/3/26 General N/A Is this a new contract or renewal to an existing contract? If existing, please share name of incumbent and what was the last year contract value?

This is a new contract. Also refer to the answer to Question #1.

No

17. 3/3/26 RFO Section I, E – Agreement Terms and Conditions

10 Please confirm that the budget mentioned “$2,640,000.00” is for twelve (12) months.

The budget for the initial Agreement amount is estimated at $2,640,000.00. The base term of the Agreement is eighteen

(18) months. The work outlined in the Scope of Work represents approximately twelve

(12) months of effort. The additional six (6) months are included only to allow for flexibility in the delivery and acceptance of deliverables.

Refer to RFO Section I, E – Agreement Terms and Conditions.

18. 3/3/26 RFO Section I, E – Agreement Terms and Conditions

10 If the budget is for twelve (12) months, will DOJ add funds for an additional six (6) months?

No, DOJ will not add funds for the additional six (6) months. The additional six (6) months is to allow flexibility in the delivery and acceptance of the deliverables.

Refer to the answer to Question #17

No

19. 3/3/26 Exhibit D - Additional Provision

98 Will the successful bidder be precluded bidding on or participating in the future FITSM implementation or System Integrator procurement due to conflict-of-interest or procurement integrity rules?

Refer to the answer to Question #2. No

20. 3/3/26 RFO Section III, Attachment 7 – Cost Sheet (2 of 2)

57 Is the total cost proposed in Attachment 7 (Page 2) considered a not-to-exceed cap for the entire potential 42-month Agreement term, including optional extensions?

No. “The actual cost quoted below by the Offeror shall be binding for the term of the Agreement” on page 57, Attachment 7, Cost Sheet represents a Not-to-Exceed Fixed Price for each Task/Deliverable.

No

21. 3/3/26 RFO Section I, E – Agreement Terms and Conditions

10 If DOJ exercises one or both optional extension periods, will the Agreement amount be increased proportionally based on the awarded hourly rates and additional authorized hours?

No. Whether DOJ will exercise its options to add time/money and how it will deploy those options depends on various factors that cannot be predicted at this time.

No

22. 3/3/26 Exhibit A – Scope of Work, Section IV, K

– Acceptance Criteria

78 Does DOJ have defined review and approval timeframes for deliverables submitted for Formal Acceptance? If so, what are the expected turnaround times?

Yes. The expected turnaround time for reviewing and approving submitted deliverables of acceptable quality is fifteen

(15) business days.

Refer to Exhibit A – Scope of Work, Section IV, K – Acceptance Criteria.

No

23. 3/4/26 General N/A Is there a current incumbent contractor providing services substantially similar to those described in this RFO? If so, please provide the name of the incumbent vendor.

Refer to the answer to Question #1. No

24. 3/4/26 Exhibit D - Additional Provision

98 Exhibit D, Section 5 of the RFO addresses Follow-on Contract prohibitions under Public Contract Code 10365.5. Can you confirm whether the vendor awarded this agreement would be precluded from submitting a proposal on any future solicitations related to the Firearms Information Technology Systems Modernization (FITSM) project, including, but not limited to, the eventual System Integrator procurement?

Refer to the answer to Question #2. No

25. 3/4/26 RFO Section III, Attachment 7 – Cost Sheet (2 of 2)

57 Reference: Attachment 7 (Cost Sheet) and Exhibit B (Budget Details and Payment Provisions)

Will DOJ consider interim or milestone-based progress payments within each Work Authorization? If not, can DOJ clarify the anticipated cadence of WA issuance and deliverable acceptance so offerors can accurately assess cash flow requirements?

Pursuant to Public Contract Code Section 12112, DOJ will withhold 10% of payment for each deliverable/task pending completion and acceptance of all deliverables. Payment information will be identified in the Work Authorization.

Refer to RFO Section III, Attachment 7 – Cost Sheet (2 of 2) and Exhibit A – Scope of Work, Section IV, I – Work Authorizations.

No

26. 3/4/26 Exhibit A – Scope of Work, Section IV, E

– Resource Location

75 For proposal and staffing purposes, does DOJ anticipate the majority of work to be performed remotely, or should Offerors assume a regular onsite presence at DOJ Sacramento locations during the engagement? If onsite work is anticipated, is there an expected cadence (e.g., periodic vs. full-time)?

Full remote services are permitted under this contract; however, Contractor may be required to report onsite at DOJ Sacramento Headquarters as needed.

Refer to Exhibit A – Scope of Work, Section IV, E – Resource Location.

No

27. 3/4/26 RFO Section I, E – Agreement Terms and Conditions

10 The RFO mentions an estimated total budget of approximately $2.64 million and an overall agreement term of eighteen

(18) months, while also indicating that the Scope of Work represents approximately

Refer to the answer to Question #17. No twelve (12) months of active effort. For proposal and cost-sheet purposes, can DOJ please clarify whether the stated budget is intended to cover the full eighteen (18) month contract period, or if it is based specifically on the estimated twelve (12) months of active work within the eighteen-month term?

28. 3/4/26 RFO Section I, G – Projected Timetable

11 We respectfully request DOJ’s consideration for a short extension to the RFO response submission deadline to allow sufficient time to prepare a complete and fully compliant proposal once the Q&A responses are received.

DOJ will extend the submission deadline as a part of Addendum 1.

Yes

29. 3/4/26 Exhibit A – Scope of Work

N/A FITSM reference architecture and integration pattern Can DOJ share the FITSM reference architecture (even a high-level view) and specify the standard integration pattern expected for component systems (e.g., synchronous REST, async messaging, file-based exchange, CLETS sockets), including any mandated gateways or mediation layers?

Purpose of the ask: This RFO component cannot be designed in isolation; alignment avoids rework and mismatched interfaces.

The question will help us ascertain the API design, integration approach, environment/config strategy, and sprint sequencing.

The standard integration pattern includes REST, async messages, file-based exchange and CLETS sockets. The proposed API is to interact with the CLETS infrastructure.

The FITSM architecture is not yet defined.

30. 3/4/26 Exhibit A – Scope of Work

N/A Deduplication rules, thresholds, and explainability requirements

a. Can DOJ provide additional detail regarding the current deduplication approach implemented in the proof-of-concept, including whether the matching logic is rule-based, probabilistic, or relies on specific matching libraries?

b. Does DOJ have a defined canonical firearms entity model for FITSM (person/weapon/transaction identifiers, survivorship rules), and which system/data store is the system of record for post-dedup mastered data?

c. Are dedup match rules predefined (deterministic rules, weights, thresholds), and does DOJ require explainability for each match decision (e.g., “matched on X,Y; score=0.87; overridden by rule Z”)?

Purpose of the ask: Explainability and override workflows can double the effort versus a simple match engine. We need to ascertain data structures to store match evidence, UI requirements, audit logging, and test case design. This will really help us understand how much logic already exists vs. what must be engineered.

The data reconciliation deliverable involves building a web application to resolve the suspected data duplicates which have already been identified.

DOJ will provide data rules required for reconciliation after award.

No

31. 3/4/26 Exhibit A – Scope of Work

N/A Hosting Environment for FITSM Applications Can DOJ clarify the hosting environment for FITSM applications, including whether the OpenShift platform referenced in the RFO is deployed in a DOJ/state data

All in-scope deployments and environments are on-premises (DOJ’s Hawkins Data Center).

center, AWS, Azure, or another state-managed cloud environment?

32. 3/4/26 Exhibit A – Scope of Work

N/A Scope boundary for CLETS socket integration For CLETS socket-based integration (dot-delimited proprietary format), what is the contractor’s responsibility boundary:

(a) implement/modify the socket client/server, (b) implement only parsing/serialization + validation, or (c) consume an existing DOJ-managed CLETS interface service?

Purpose of the ask: CLETS integration is high-risk and specialized; clarity prevents scope blowup. We want to ascertain requisite Staffing (specialized integration skills), security review effort, and testing strategy (mocks/simulators).

The Contractor must create client-side socket connections to CLETS using TCP/IP protocol with dot-delimited message format, preserving the existing message structure and communication patterns.

The solution should implement parsing/serialization + validation of messages and consume existing DOJ-managed CLETS interface service.

No

33. 3/4/26 Exhibit A – Scope of Work

N/A OpenShift platform standards and DevSecOps gates What DOJ standards apply to OpenShift deployments: required base images, approved registries, secrets management, ingress policies, namespace strategy, and release gates (SAST/DAST, SBOM, vulnerability thresholds)?

Purpose of the ask: OpenShift isn’t just “where we deploy”. It imposes constraints that affect design and cadence. This can help us ascertain CI/CD pipeline integration, container build approach, The Contractor will have to comply with DOJ’s standards and policies for deployment.

security hardening tasks, and lead time per release.

34. 3/4/26 Exhibit A – Scope of Work

N/A Oracle constraints: version, tuning permissions, and change control What is the Oracle environment baseline (version/edition), and will the project have permission to implement schema changes, indexes, partitions, materialized views, and stored procedures—subject to DOJ DBA change control?

Purpose of the ask: If schema/index changes are restricted, performance and dedup design must adapt.

This will help us ascertain the performance risk, DBA dependency, delivery timeline, and sprint definition of done.

The current version of Oracle is 19c.

There are no de-duplication requirements

The Contractor will have permission to implement schema changes, indexes, partitions, materialized views, and stored procedures as needed, subject to DOJ approval.

No

35. 3/4/26 Exhibit A – Scope of Work

N/A Identity and Access Management Does the application need to integrate with an existing DOJ enterprise identity provider or single sign-on service, and are there specific authentication or authorization standards that must be followed?

The Data Reconciliation application must implement SSO with the DOJ identity provider. The identity management provider is Ping One.

The API application does not have to integrate with SSO.

No

36. 3/4/26 Exhibit A – Scope of Work

N/A Audit Logging Requirements Does DOJ maintain enterprise logging or audit standards that the application must adhere to, particularly for tracking user activity, data access, and system events?

Application-specific logging and audit standards must be followed.

37. 3/4/26 Exhibit D - Additional Provision

98 Security controls beyond OWASP: CJIS and DOJ audit specifics Beyond OWASP Top 10, what are DOJ’s required application security controls, specifically for:

• encryption in transit/at rest

• session management and MFA expectations

• RBAC/ABAC role model

• audit event taxonomy (what must be logged)

• retention and tamper-evidence requirements

The proposed applications are to be available on the DOJ internal network.

The applications are expected to handle encryption, session management, RBAC, audit and logging.

The applications have to comply with DOJ security standards and policies, of which the FBI’s CJIS Security Policy is the foundation.

No

38. 3/4/26 Exhibit A – Scope of Work

N/A Search Capability Expectations For the required search functionality, does DOJ expect the solution to leverage existing database capabilities, or should Offerors plan for an external indexing or search framework?

There are no data de-duplication requirements.

The Data Reconciliation web application must implement search capabilities using existing database capabilities based on requirements.

No

39. ¾/26 Exhibit A – Scope of Work

N/A Data Volume and Performance Expectations Can DOJ provide guidance on the anticipated data volumes and processing scale for the deduplication functionality to help inform performance and indexing strategies?

There are no de-duplication requirements.

The Data Reconciliation web application is only allowing users to resolve already identified records that have been flagged as “suspect-duplicates”. The reconciliation web app is not performing the de-duplication.

No

40. 3/4/26 Exhibit A – Scope of Work

N/A Deployment Environment Constraints Are there state or DOJ infrastructure standards that influence how applications must be deployed, such as containerization requirements, application servers, or state-approved runtime environments?

Deployments must follow DOJ infrastructure standards.

41. 3/4/26 Exhibit A – Scope of

N/A Accessibility and UI Standards Are there DOJ or State of California UI/UX standards or accessibility requirements (e.g., Section 508 compliance frameworks, WCAG 2.2) that the Angular interface must follow?

DOJ complies with State of California accessibility requirements, including Web Content Accessibility Guidelines (WCAG) 2.1 (“AA” standard) and Section 508, to ensure that individuals with disabilities can use these tools effectively to access and interact with the system.

No

42. 3/4/26 Exhibit A – Scope of Work

N/A System Integration Dependencies Beyond the existing proof-of-concept components, are there other DOJ systems or data services that the enhanced application will need to interface with as part of the deduplication or search workflows?

The web application for reconciliation is not performing de-duplication, so there are no external services or integrations needed. It is simply working with data in a dedicated database and flagging records as needed.

43. 3/4/26 Exhibit A – Scope of Work

N/A Is the State considering a specific deployment approach (on-premises, hybrid, or cloud) for the API and web application workstreams?

Refer to answer to Question #31. No

44. 3/4/26 RFO Section I, J – Presentations and/or Interviews

12 Clarification on Interview Requirements For the optional interview phase, will the DOJ accept substitute resources if a proposed resource becomes unavailable due to circumstances beyond the contractor’s control between the response date and interview date?

Replacement of resources prior to contract award is at the discretion of the DOJ.

Refer to Exhibit A, Section L.

No

45. 3/4/26 Exhibit A – Scope of Work, Section IV, E

– Resource Location

75 Validation of Required Onsite Expectations For the resource location requirement, can the DOJ confirm whether onsite presence is mandatory for any portion of work, and if so, which roles and how frequently?

Refer to the answer to Question #26. No

46. 3/4/26 RFO Section I, G – Projected Timetable

11 Confirmation on Using Multiple Emails for Submission If multiple emails are needed due to size limits, can the DOJ confirm whether the timestamp of the first email or the full set of emails will determine compliance with the submission deadline?

All RFO responses must be received by the date and time specified in the Table 1 - Key Action Dates.

Refer to RFO Section I, G – Projected Timetable.

No

47. 3/4/26 RFO Section III, Attachment 6 – Narrative Technical Response

55 Clarification on Formatting Requirements for Attachment 6 (Narrative Technical Response) Can the DOJ confirm whether tables, diagrams, or illustrations are allowed within the 3-page limit for the Narrative Technical Response?

Yes. Tables, diagrams, or illustrations are allowed and they will count towards the Narrative Technical Response page limit.

No

48. 3/4/26 RFO Section III, Attachment 7 – Cost Sheet (1 of 2)

56 Clarification on the Cost Sheet For Attachment 7, does ‘Combined Average Hourly Rate’ mean a simple average of the two average rates, or should it be weighted based on the number of hours in the initial term versus optional years?

Yes, the Combined Average Hourly Rate is a simple average of the “Initial Term” and the “Optional Years 1 and 2” from line 7.

Refer to RFO Section III, Attachment 7 – Cost Sheet (1 of 2).

No

49. 3/4/26 RFO Section III, Attachment 5 - Staff Qualifications Matrix

26 Confirmation on Overlapping Qualification Experience Can the DOJ clarify whether overlapping projects count at 100% of time for each project as long as full-time designation is indicated, or whether percentages of time must be prorated?

Overlapping projects will count as Part-time experience for each to equal a total of 100% Full-time experience combined.

No

50. 3/4/26 RFO Section III, Attachments 3 – Company Reference Form and Attachment 4

22 and

Validation of Reference Requirements If a reference is unresponsive after two attempts within the two-business-day window, will the DOJ allow replacement references if the Offeror can demonstrate good-faith effort?

Refer to the answer to Question #5. No

– Key Staff Reference Form

51. 3/4/26 Exhibit A – Scope of Work

N/A Clarification on CLETS / CJIS Access Will developers need to obtain any specific certifications or prior CJIS/CLETS approvals before beginning work, or can they start work while background checks are processing?

Individuals working on the project must have background clearance before they can start working. No other certifications or approvals are required.

No

52. 3/4/26 Exhibit A – Scope of Work

N/A API Specification Details Will the DOJ provide existing service definitions, WSDLs, schemas, or message formats for the legacy systems (ACH, AFS, ROS, etc.) to be integrated via the new

API?

CLETS Message formats will be provided.

There are no dependencies or integrations with any other existing web services.

No

53. 3/4/26 Exhibit A – Scope of Work

N/A Web App Consolidation Technical Environment Will the DOJ provide existing code repositories and architecture diagrams for both applications prior to design activities, and which Git platform is currently used?

The API development is a new effort where existing code structures may have no relevance. DOJ will provide access to existing code and design documents for the development of the data reconciliation app.

No

54. 3/4/26 RFO Section III, Attachment 1 – Required Attachment Checklist

19 Attachment 1 – Required Attachment Checklist states that Attachment 5 – Key Staff Qualifications Matrices is required to be submitted.

Can the DOJ please clarify whether Offerors are supposed to submit Attachment 5 as is, or if there is anything else we need to submit to comply with this requirement?

Attachment 5 is the Key Staff Qualifications Matrix Instructions and is not required to be submitted.

Yes

55. 3/4/26 Exhibit A – Scope of

N/A Can DOJ clarify the expected scope of “environment preparation,” specifically whether this includes data architecture design, tooling/platform recommendations, and governance framework development, or is limited to data cleansing, normalization, and structuring activities?

The ”environment preparation” refers to the future FITSM environment.

It is only meant to convey that we are preparing some services to ease access to data and to prepare some data for easier consumption by the future FITSM solution.

Refer to the two main tasks as outlined in Exhibit A – Scope of Work in the RFO.

• API Development (Deliverables 1 through 4)

• Web Application Enhancements (Deliverables 5 through 8)

The scope of this effort is limited to API development and existing web application enhancements.

No

56. 3/4/26 Exhibit A – Scope of Work

N/A What systems currently house the ITSM-related data (e.g., ServiceNow or other platforms), and can DOJ provide an overview of data volume, structure complexity, and known data quality challenges?

ITSM solutions are not applicable to this

RFO.

Refer to the two main tasks as outlined in Exhibit A – Scope of Work in the RFO.

• API Development (Deliverables 1 through 4)

• Web Application Enhancements (Deliverables 5 through 8)

Data quality is not the primary subject of these efforts.

No

57. 3/4/26 Exhibit A – Scope of Work

N/A Is there an identified target data platform or architectural direction for this effort, or is the contractor expected to recommend and design the future-state data

The target data platform has already been established. Therefore, the contractor will NOT be expected to recommend and design the future-state data environment.

environment that will support eventual FITSM implementation?

58. 3/4/26 Exhibit A – Scope of Work

N/A What specific operational, reporting, or governance outcomes is DOJ expecting this data preparation effort to enable (e.g., improved SLA reporting, service performance dashboards, audit readiness, analytics use cases)?

The main tasks as defined in Exhibit A – Scope of Work do not involve improvements to existing operational, reporting, or governance.

No

59. 3/4/26 RFO Section III, Attachment 7 – Cost Sheet (2 of 2)

57 The RFO references an estimated 12,000 hours to complete the deliverables.

Should vendors structure their cost proposals based strictly on this estimated level of effort, or may vendors propose an alternative number of hours if supported by their technical approach and methodology?

The total number of hours on the Cost Worksheet assumes 200 hours per month per resource. Offerors may distribute the total number of hours among the deliverables how they feel are best.

The hours listed are projected for assessment purposes only and based on the DOJ’s ability to anticipate needs. Hours listed under “Total”, “Unanticipated Tasks”, and “Grand Total” shall not be changed by Offeror.

No

60. 3/4/26 RFO Section III, Attachment 6 – Narrative Technical Response

55 Regarding Attachment 6 – Narrative Technical Response, can the DOJ please confirm if the requirement is 3 pages total across all three NTR questions, or if the requirement is 3 pages per NTR question (9 pages total)?

The response to all the NTR questions must not exceed a total of three (3) single spaced pages.

No

61. 3/4/26 Exhibit A – Scope of Work

N/A Can DOJ clarify who the primary users of these applications are? Specifically, are the applications used exclusively by DOJ internal staff, by law enforcement agencies statewide, or by both DOJ

The Data Reconciliation application is for internal DOJ users.

The API is for a wider range of external users who access the DOJ network.

personnel and external law enforcement partners?

62. 3/4/26 Exhibit A – Scope of Work

N/A The Scope of Work references the CJIS Data Access API communicating with multiple external systems (DMV, ACHS, AFS, ROS, MHFPS, WPS, NICS, III, and ICE) through CLETS using a proprietary dot-delimited message format over a network socket.

Can DOJ clarify the nature of the integration with each of these systems?

Specifically:

Will the contractor be expected to consume existing APIs provided by these systems?

Will the contractor need to connect directly to shared databases?

Or will the contractor be responsible for constructing and parsing raw CLETS messages independently for each system?

Additionally, does DOJ maintain existing interface control documents, message specifications, or integration documentation for these downstream systems that will be made available to the contractor?

The system must create client-side socket connections to CLETS using TCP/IP protocol with dot-delimited message format, preserving the existing message structure and communication patterns.

The interactions to the underlying system would only be through CLETS messages.

The scope of work pertaining to the CLETS interface is limited to the request/response messages to/from CLETS. DOJ maintains existing interface control documents, message specifications, and integration documentation for these downstream systems that will be made available to the contractor

63. 3/4/26 Exhibit A – Scope of

N/A The Scope of Work identifies several UI/UX improvements, including enhancements to authentication and authorization screens, search capabilities, and overall interface consistency.

Can DOJ confirm whether documented UX requirements, wireframes, or design mockups currently exist for these improvements and will be provided to the contractor?

If such materials do not exist, should the contractor assume responsibility for developing UX design artifacts (e.g., wireframes, prototypes, or design specifications) as part of the deliverables?

Additionally, will DOJ assign designated stakeholders or product owners to review, provide feedback on, and approve UX design decisions throughout the engagement?

The Data reconciliation app will have a web-based front end. Existing UI/UX components and design documents will be provided to the Contractor. The Contractor is responsible for the development of UX design artifacts. Product owners will review, provide feedback on, and approve UX design decisions throughout the engagement.

No

64. 3/4/26 Exhibit A – Scope of Work

N/A The deliverables matrix lists the “Detailed Requirements Document” as the first deliverable. Can DOJ confirm whether an existing baseline of business or technical requirements will be provided to the contractor, or whether the contractor is expected to develop the requirements from the ground up?

High level requirements will be provided to the Contractor. The Detailed Requirements must be developed.

No

65. 3/4/26 Exhibit A – Scope of Work

N/A Who currently owns or maintains the deduplication business logic referenced in the Scope of Work? Additionally, will this individual or team be available to the contractor during the requirements phase

DOJ will provide all business logic needed to develop the reconciliation web application.

to provide clarification and subject matter expertise?

66. 3/4/26 Exhibit A – Scope of Work

N/A The Scope of Work references 17 legacy applications, which suggests involvement from multiple program areas. Can DOJ provide an estimate of how many business stakeholders or program representatives the contractor will need to coordinate with during requirements development?

Will these stakeholders be designated and available for workshops, interviews, and validation activities?

There are no requirements to modify or interface with any of the 17 legacy applications.

No

67. 3/4/26 Exhibit A – Scope of Work

N/A Does DOJ maintain existing technical documentation for the legacy applications, such as architecture diagrams, data models, interface specifications, or system documentation? If so, will this documentation be made available to the contractor at project initiation?

There are no requirements to modify or interface with any of the 17 legacy applications.

No

68. 3/4/26 Exhibit A – Scope of Work

N/A The Scope of Work references an existing proof-of-concept implementation. Can DOJ clarify the expected approach for this codebase? Specifically, should the contractor plan to extend and operationalize portions of the existing code, or is the expectation that the solution will be largely redesigned and redeveloped?

Plan is to extend and operationalize parts of the code while redesigning some sections.

69. 3/4/26 RFO Section III, Attachment 5.1 - Staff Qualifications Matrix

27 Would the DOJ consider changing MQ 5 Minimum Qualification for the Sr.

Software Engineer from “Three

(3) years of relevant experience deploying, configuring, and managing applications on the Red Hat OpenShift platform” to “Three

(3) years of relevant experience deploying, configuring, and managing applications on the Red Hat OpenShift platform or similar”.

DOJ will not modify the MQs or DQs. No

70. 3/4/26 RFO Section III, Attachment 5.1 - Staff Qualifications Matrix

27 Would the DOJ consider changing DQ 5 Desirable Qualification for the Sr.

Software Engineer from “Four (4) years of relevant experience deploying, configuring, and managing applications on the Red Hat OpenShift platform” to “Four

(4) years of relevant experience deploying, configuring, and managing applications on the Red Hat OpenShift platform or similar”.

DOJ will not modify the MQs or DQs. No