RFP 0063-N.pdf

RFP 0063-N, Page 1 of 34

BOILERPLATE

REVISED MARCH 2026

STATE OF WYOMING

DEPARTMENT OF ADMINISTRATION & INFORMATION

GENERAL SERVICES DIVISION, PROCUREMENT SECTION

2323 CAREY AVENUE

CHEYENNE, WY 82002

REQUEST FOR PROPOSAL NUMBER 0063-N

WYOMING DEPARTMENT OF HEALTH

PUBLIC HEALTH DIVISION

PUBLIC HEALTH PREPAREDNESS AND RESPONSE

INFORMATION SYSTEM

PROPOSAL DUE DATE AND TIME

OCTOBER 29, 2026 – 2:00:00 P.M. MOUNTAIN TIME

AGENCY REPRESENTATIVE:

HEATHER TOTTINGHAM

PROCUREMENT REPRESENTATIVE:

JAMIE RAFF

Jamie.raff1@wyo.gov 307-777-6721

RFP 0063-N, Page 2 of 34

Table of Contents

SECTION 1: REQUEST FOR PROPOSAL 3

SECTION 2: GENERAL PROVISIONS 5

SECTION 3: SPECIAL PROVISIONS INFORMATION 7

SECTION 4: KEY DATES 10

SECTION 5: ADMINISTRATIVE BACKGROUND 11

SECTION 6: REQUIREMENTS/SPECIFICATIONS 12

SECTION 7: PROPOSAL SUBMISSION REQUIREMENTS 18

SECTION 8: EVALUATION METHODOLOGY 21

SECTION 9: PROPOSAL PRICE SHEET AND SIGNATURE PAGE 24

REMAINDER OF PAGE INTENTIONALLY LEFT BLANK.

RFP 0063-N, Page 3 of 34

SECTION 1: REQUEST FOR PROPOSAL

1. SUBMISSION OF PROPOSALS:

The A&I Procurement Office will receive proposals for providing a public health preparedness and response program information system that will replace legacy systems for the State of Wyoming, Wyoming Department of Health (Agency) through the Public Purchase online bidding system. Proposals are due no later than 2:00:00 P.M. (Mountain Time) on October 29, 2026.

The technical proposal and cost proposal should be uploaded as separate documents and identified as such.

1.1. Proposals should be accompanied by the attached Proposal Price Sheet and signed by the proper official of the firm. All proposals should be uploaded on the Public Purchase online bidding system. Proposals sent by facsimile, email or paper copy may be rejected.

1.2. Proposals should be submitted through the Public Purchase online bidding system on or before the date and time specified. Proposals received after the date and time specified may be rejected.

1.3. The State of Wyoming reserves the right to withdraw this Request for Proposal, without cause, at any time before a contract has been fully signed and submitted to the A&I Procurement Office.

2. MODIFICATIONS OR WITHDRAWAL OF PROPOSALS:

2.1. A proposal may be altered through the Public Purchase online bidding system before the proposal due date and time contained in this document.

2.2. The proposer may withdraw its proposal through the Public Purchase online bidding system up to the proposal due date and time contained in this document. If a proposal is accepted and the proposer fails to furnish the service agreed upon in the proposal, that proposer may be eliminated from future consideration.

3. PREPARATION OF PROPOSALS:

3.1. A proposal may be rejected if it modifies any of the provisions, specifications or minimum requirements of the Request for Proposal.

3.2. In case of error in the extension of prices in the proposal, unit prices will govern.

4. AWARD AND CONTRACT INFORMATION:

4.1. The State of Wyoming will ensure that minority business enterprises will be afforded full opportunity to submit proposals. The State of Wyoming will not discriminate on the grounds of age, race, color, sex, creed, national origin, or disability status.

4.2. The proposer also, agrees that should their firm be awarded a contract, it will not discriminate against any person who performs work there under because of age, race, color, sex, creed, national origin or disability. In addition, the successful proposer shall comply with the Americans with Disability Act and the Wyoming Fair Employment Practices Act.

4.3. The proposer expressly warrants to the State that it has the ability and expertise to perform the contract if awarded. In doing so, it shall use the highest standards of professional workmanship.

4.4. The State of Wyoming reserves the right to reject any or all proposals, to waive any informality or technical defect in the proposals, or to award the contract in whole or in part, if deemed to be in the best interest of the State to do so. The A&I Procurement Office will award the contract to

RFP 0063-N, Page 4 of 34 the firm, determined to have the most responsive and responsible proposal by the Wyoming Department of Health, Public Health Division.

4.5. The successful proposer will be required to agree to and execute a formal contract with the State containing terms required by the Attorney General with reasonable adjustments acceptable to the State.

4.6. If applicable, the State will negotiate payment terms based upon a schedule to be determined by the proposer and the State. Paying invoices will be based upon the proposer successfully completing the deliverables within the stated deadlines, and upon the Agency’s written acceptance of the deliverables or services.

DATED: September 24, 2026

State of Wyoming Procurement Section Buyer: Jamie Raff

RFP 0063-N, Page 5 of 34

SECTION 2: GENERAL PROVISIONS

1. INSURANCE:

1.1. The contract between the successful proposer and the State shall require the successful proposer to carry certain insurance policies. All such insurance policies, except workers’ compensation and unemployment compensation policies, shall contain a waiver of subrogation against the Agency and the State, its agents and employees.

1.2. The contract between the successful proposer and the State shall require cyber liability insurance which shall be sufficiently broad to cover all duties and obligations undertaken by successful proposer and shall include, but not limited to, claims involving infringement of copyright, trademark, trade dress, invasion of privacy violations, information theft, damage to or description of electronic information, release of private information, alteration of electronic information, extortion and network security, with minimum limits as follows:

1.2.1. $2,000,000.00 each occurrence; and

1.2.2. $2,000,000.00 general aggregate.

1.2.3. Coverage should include breach response, regulatory fines and penalties, and credit monitoring expenses, with limits sufficient to respond to these obligations. Higher limits may be required when the contract involves large amounts of protected information or is high risk.

2. LAWS TO BE OBSERVED:

2.1. The proposer shall keep fully informed of, and comply with, all applicable federal and state laws or rules, all local bylaws, regulations and all orders and decrees of bodies or tribunals having any jurisdiction or authority. The proposer shall protect and indemnify the State and its representatives against any claim or liability arising from or based on the violation of any law, bylaw, ordinance, regulation, order or decree whether by himself or its employees.

3. ASSIGNMENT:

3.1. The proposal shall not be assigned by the proposer. Third party participation is authorized only as a joint venture that shall be clearly stated in detail in the original proposal and signed by all parties participating.

3.2. The proposer shall not enter into any subcontracts for any of the work contemplated under this Request for Proposal without the State’s prior written authorization.

4. EXTENSION AND AMENDMENT:

4.1. The proposer and the State covenant and agree that this proposal or subsequent contract may, with the mutual approval of the proposer and the State, be extended one year at a time, for a total contract period not to exceed five (5) years.

5. AUDIT AND ACCESS TO RECORDS:

5.1. The State or any of its duly authorized representatives shall have access to the proposer’s books, documents, papers, electronic data and records that are directly pertinent to this Request for Proposal.

RFP 0063-N, Page 6 of 34

6. CONFLICT OF INTEREST:

6.1. The proposer warrants that no kickbacks, gratuities, or contingency fees have been paid in connection with this Request for Proposal and none have been promised. The proposer warrants that no one being paid pursuant to the proposal is engaged in any activity that would constitute a conflict of interest with respect to the purchases of the proposal.

7. NO FINDER’S FEE:

7.1. The proposer warrants that no finder’s fee, employment agency fee, or any such fee related to the proposal shall be paid.

8. SOVEREIGN IMMUNITY:

8.1. Pursuant to Wyoming Statute § 1-39-104(a), the State of Wyoming and the Agency expressly reserve sovereign immunity and specifically retain all immunities and defenses available to them as sovereigns. The proposer acknowledges that the State of Wyoming has sovereign immunity and only the Wyoming Legislature has the power to waive sovereign immunity. Designation of venue, choice of law, enforcement actions, and similar provisions shall not be construed as a waiver of sovereign immunity. The parties agree that any ambiguity in this Request for Proposal shall not be strictly construed, either against or for either party, except that any ambiguity as to sovereign immunity shall be construed in favor of sovereign immunity.

9. INDEMNIFICATION:

9.1. The proposer shall release, indemnify, and hold harmless the State, the Agency and its officers, agents, and employees from any and all claims, suits, liabilities, court awards, damages, costs, attorneys’ fees, and expenses arising out of the proposer’s failure to perform any of the proposer’s duties and obligations hereunder or in connection with the negligent performance of proposer’s duties and obligations, including, but not limited to, any claims, suits, liabilities, court awards, damages, costs, attorneys’ fees, and expenses arising out of proposer’s negligence or other tortious conduct.

10. APPLICABLE LAW/VENUE:

10.1. The construction, interpretation, and enforcement of this Request for Proposal shall be governed by the laws of the State of Wyoming, without regard to conflicts of law principles. The terms “hereof,” “hereunder,” “herein,” and words of similar import, are intended to refer to this Request for Proposal as a whole and not to any particular provision or part.

11. RIGHT OF OWNERSHIP AND MARKETING OF INTELLECTUAL PROPERTY

AND INTELLECTUAL ASSETS SUBMITTED FOR THE RFP (IF APPLICABLE):

11.1. It is acknowledged and agreed that the only party with a right to market, trademark, patent, copyright, or any like right to any intellectual property or intellectual assets submitted in relation to the Request for Proposal shall be and is solely vested in the State. This includes all intellectual property and intellectual assets related to both the written proposal and the oral presentation and any and all documents, pitches, products, media pitches, web screens, layouts, etc. produced for the written proposal and the oral presentation, and any updates, changes, alterations, or modifications to or derivative works.

RFP 0063-N, Page 7 of 34

SECTION 3: SPECIAL PROVISIONS INFORMATION

PROPOSALS SHOULD BE SUBMITTED THROUGH THE PUBLIC PURCHASE ONLINE BIDDING

SYSTEM BY 2:00:00 P.M. MOUNTAIN TIME ON OCTOBER 29, 2026. PROPOSALS RECEIVED

AFTER THE DATE AND TIME SPECIFIED MAY BE REJECTED.

It is the responsibility of the proposer to clearly identify all information that is considered confidential in accordance with the Wyoming Public Records Act, Wyoming Statute §16-4-201 through §16-4-205. Please identify each confidential page with the word “CONFIDENTIAL” in capital, bold letters centered at the bottom of each page. Information not clearly marked may be considered public. If the proposer submits information that it believes is confidential, it should include a statement justifying its basis for that belief.

1. STATE PARTIES:

1.1. This Request for Proposal is issued by the Wyoming Department of Administration and

Information, General Services Division, Procurement Section (Procurement) on behalf of the Wyoming Department of Health, Public Health Division (Agency).

1.2. Throughout this document and others in connection with this project, various references are made, or will be made to the “State.” Generally, whenever this reference appears, the term “State” incorporates all state agencies working on this project.

1.3. It should be understood that the Director of the Wyoming Department of Health is empowered to be the signatory on all contracts, agreements, or modifications pertaining to this project. Any contracts, agreements, or modifications not bearing this signature or that of a designee are invalid.

2. CONTENT AND PROCUREMENT POINTS OF CONTACT:

2.1. Procurement is the primary point of contact from the date of release of the Request for Proposal until a proposer is selected and the selection is announced.

2.2. Written questions about the procurement should be submitted through the Public Purchase online bidding system until 2:00:00 P.M. Mountain Time on October 8, 2026. Any questions received after that deadline may not be accepted or considered. Each question should be submitted individually. It is the proposer’s responsibility to check the Public Purchase online bidding system for answers to questions, addenda, or bid tabulations. Telephone calls, emails or faxes may not be accepted.

2.3. Written responses will be available through the Public Purchase online bidding system. Responses will not identify the firm that submitted the question. Only the written answers issued by the Agency are the official position on an issue, and these answers shall become part of the Request for Proposal.

3. RESTRICTIONS ON COMMUNICATIONS WITH AGENCY STAFF:

3.1. Until a proposer is selected and the selection is announced, proposers shall not communicate with

Agency staff except via written questions through the Public Purchase online bidding system.

3.2. If a proposer violates this restriction, the State reserves the right to reject the proposal.

4. EFFECTIVE DATES OF PROPOSAL:

4.1. All terms, conditions and costs quoted in the proposer’s response will be binding on the proposer for one-hundred eighty (180) days from the effective date of the proposal.

RFP 0063-N, Page 8 of 34

5. ADVERTISING AWARD CONDITIONS:

5.1. A fully executed contract should be completed with the State before the successful proposer may advertise the award of the contract or the services being performed. The proposer should agree not to refer to awards in commercial advertising in such a manner that states or implies that the firm or its services are endorsed or preferred by the State of Wyoming.

6. CONTRACT NEGOTIATIONS:

6.1. The State will notify the most qualified/successful proposer and negotiate a contract in accordance with the Wyoming Attorney General’s contract guidelines. The successful proposer will be required to enter into and sign a formal contract with the Agency.

6.2. In the event the Agency determines contract negotiations are making no forward progress, negotiations will be terminated, and at the State’s sole discretion, negotiations may be initiated with the next most qualified/successful proposer, or the RFP may be withdrawn or reissued. This process will be followed until an agreement is reached, or until the State determines that the RFP will be withdrawn or reissued. The State assumes no obligation to a selected proposer until an agreement is reached and a contract is fully executed. The State will not negotiate concurrently with more than one proposer for the same award.

7. BEGINNING WORK:

7.1. The successful proposer may not perform any work that could be billed until a contract has been executed. The State will not pay for any work by the proposer before a contract is executed.

8. COPYRIGHT INFRINGEMENT:

8.1. The proposer warrants that no materials, products, and services proposed will infringe upon or violate any patent, copyright, trade secret, or other proprietary right of any third party. In the event of a claim by any third party against the State, the State shall promptly notify the proposer, and the proposer shall defend the claim. The defense will be at the proposer’s expense.

9. COST OF PREPARING PROPOSALS:

9.1. All costs incurred for preparing the proposal and for other procurement related activities are solely the proposer’s responsibility. The State of Wyoming will not provide reimbursement of these costs.

10. RISKS AND LIABILITIES:

10.1. By submitting a proposal, a proposer assumes any and all risks and liability associated with information in the proposal and its release.

11. AMENDMENTS:

11.1. The State reserves the right to amend this Request for Proposal before the proposal submission date. Amendments shall be uploaded to the Public Purchase online bidding system. It is the proposer’s responsibility to check the Public Purchase online bidding system for amendments.

12. PROPERTY DAMAGE AND LIABILITY INSURANCE:

12.1. The proposer may be required to furnish proof of property damage liability insurance in the amount deemed necessary by the Agency for this project, if applicable.

12.2. Questions regarding required insurance coverage and limits for this project should be submitted in writing, in accordance with instructions outlined in the special provisions.

RFP 0063-N, Page 9 of 34

13. MISREPRESENTATION OF INFORMATION:

13.1. Misrepresentation of a proposer’s status, experience, or capability in the proposal may result in disqualification of that proposer from the selection process. Discovery of litigation or investigations in a similar area of endeavor may, at the discretion of the Agency and after consultation with Procurement, preclude the proposer from the selection process.

14. DISPOSITION OF PROPOSALS:

14.1. All material submitted becomes property of the State of Wyoming, which is under no obligation to return any of the material submitted.

15. LEGAL CONSIDERATIONS:

15.1. This Request for Proposal is issued under Wyoming Statute §9-2-3204.

16. PROPOSER RELATIONS WITH STATE:

16.1. The proposer and its staff will have an ongoing relationship with the State that is based on trust, confidentiality, objectivity and integrity. The proposer will operate at all times in the State’s best interests and in a straightforward, trustworthy and professional manner. The proposer shall:

16.1.1. Work cooperatively with the State’s staff and business partners whenever required.

16.1.2. Work cooperatively with the staff of other proposers whenever required.

RFP 0063-N, Page 10 of 34

SECTION 4: KEY DATES

Event Description Date Time (Mountain Time)

RFP Release Date September 25, 2026

Closing Date for Questions October 8, 2026 2:00:00 P.M.

Response to Questions Returned October 15, 2026 2:00:00 P.M.

RFP Submission Due Date October 29, 2026 2:00:00 P.M.

Tentative Award Date January 2027 N/A

Tentative Work Begins Date January 2027 N/A

RFP 0063-N, Page 11 of 34

SECTION 5: ADMINISTRATIVE BACKGROUND

1. INTRODUCTION AND BACKGROUND:

1.1. The Public Health Preparedness and Response (PHPR) Unit of the Wyoming Department of

Health, Public Health Division, is dedicated to supporting emergency-ready state, local, and tribal public health departments and healthcare facilities. It coordinates support by collaborating with community organizations, government agencies, and the private sector to effectively respond to local emergencies, including pandemics, natural disasters, and acts of terrorism. Wyoming’s Healthcare Preparedness Program (HPP) is a program within the PHPR Unit. The mission of HPP is to enhance community and healthcare preparedness, improve medical surge capacity, and support healthcare organizations during emergency response and recovery through regional healthcare coalitions.

1.1.1. PHPR and HPP are conducting this solicitation to modernize and combine program systems.

Data are currently tracked in multiple, separate systems, reducing efficiencies and complicating maintenance and reporting.

2. PURPOSE AND INTENT:

2.1. The purpose of this Request for Proposal (RFP) is to solicit competitive proposals from proposers who can offer a program information system that will replace several current systems (WebEOC RID Board, EMResource, multiple Excel spreadsheets) to create one system to meet the Agency’s needs and expectations, as described within this RFP.

3. STAKEHOLDERS:

3.1. Customers include State Agencies, Wyoming Healthcare Coalitions, Wyoming Emergency

Medical Services providers, Wyoming Healthcare Facilities, Volunteer Agencies, and other agencies required to report collected data.

4. BUDGET:

4.1. The estimated budget PHPR and HPP have for this information management system is an annual amount of $40,000 per year.

RFP 0063-N, Page 12 of 34

SECTION 6: REQUIREMENTS/SPECIFICATIONS

1. SCOPE OF PROJECT:

1.1. PHPR and HPP are soliciting proposals for a public health and medical preparedness and response program information system that will replace several current systems (WebEOC RID Board, EMResource, multiple Excel spreadsheets) to one cloud-based system, including software, hosting, disaster recovery, implementation, training and maintenance for use by the Agency. This RFP is intended to support five project areas, including:

1.1.1. Incident Management – an electronic incident command system (ICS) that adheres to the National Incident Management System (NIMS) framework and ICS guidance and is adapted for public health and healthcare use.

1.1.2. Volunteer Registry and Management – a system for the registry, tracking, and deployment of volunteers for the fulfillment of the Administration for Strategic Preparedness & Response (ASPR) Hospital Preparedness Program Cooperative Agreement Emergency System for Advanced Registration of Volunteer Health Professionals (ESAR-VHP) compliance requirements.

1.1.3. Inventory Management – a system for tracking inventory at the state and local level, including Personal Protective Equipment, supplies, and equipment.

1.1.4. Patient Tracking – electronic system for the tracking and movement of triaged patients in the event of a mass casualty situation.

1.1.5. Bed Availability Tracking – electronic system for tracking hospital and healthcare bed types available daily by facility as well as facility situational assessment data.

Proposer can respond to any combination of the project components (1.1-1.5). Proposer must identify which project components are included in the response.

2. GENERAL REQUIREMENTS:

2.1. PHPR and HPP have developed a Requirements Matrix, Attachment A, to describe the requirements for the proposed solutions. See this attachment for a detailed description of the required and desired features and functionality of the IT solution. The IT solution must be implemented with a minimum of all requirements rated with a priority of Core and Essential. If the Proposer is successful, the Proposer agrees that it shall comply with all requirements throughout the full term of the Contract. Proposers must provide a full response to each requirement without cross-referencing other sections of the proposal. Proposers must use the table format and maintain the numbering provided by the Agency to respond to each requirement.

Attachments, documents, or samples must be clearly referenced in the response where they can be found in the applicable item number. In addition, the Proposer Response must include any specific references and/or supportive materials as described in the Proposer Response. The Agency reserves the right to determine whether the supportive materials submitted by the Proposer demonstrate the Proposer will be able to comply with the Requirements.

2.2. The proposed project components shall be commercially available (beta versions will not be considered) and designed to support disaster and special event management, and daily operations.

RFP 0063-N, Page 13 of 34

2.3. The proposed project components must be web browser-based and capable of supporting more than one browser client (Edge, Chrome, Safari, and Firefox) and must be formatted for tablet devices and mobile phones.

2.4. The proposed project components shall not have per seat/per use license fees and be able to support 1,500 concurrent users.

2.5. All software shall be designed to work with projectors for information display.

2.6. The proposed project components must offer a high availability solution with a track record of 99.99% uptime or better.

2.7. The proposed project components must be easily scalable should other organizations wish to participate.

2.8. The proposed project components should align with ASPR and CDC federal guidelines where applicable.

3. SYSTEM AND WYOMING INFORMATIONAL TECHNOLOGY STANDARDS:

The services, work products and final deliverables provided by the proposer shall be in compliance with the State Statutes, CIO Promulgated Rules, State IT policies and standards and the Agency standards for required system hardware, software and development components, when completed and accepted by the Agency.

3.1. State of Wyoming Electronic Transactions: Visit https://rules.wyo.gov/Search.aspx and search Electronic Transactions. Click on the Enterprise Technology Services drop down arrow, then the Director’s Office drop down arrow. Chapters 4, 5 and 7.

3.2. State of Wyoming IT Policies and Standards: https://ets.wyo.gov/resources/policies-standards

4. TECHNOLOGY AND SPECIFICATIONS:

Describe the technology, which will drive the development, implementation and operations of this project.

4.1. Vendors shall describe how the proposed software can be used for each of the following:

4.1.1. System can be used to manage disasters, special events, security and day-to-day operations.

4.1.2. System shall be capable of being used for multiple real world and drill/exercise events simultaneously.

4.1.3. System can manage related incidents in a hierarchical incident structure.

4.1.4. Describe how customers collaborate regionally.

4.2. The proposed Incident Management System (IMS) project component shall comply with NIMS principles and provisions for the Incident Command System (ICS).

4.3. Vendor shall describe the system’s Incident Action Plan capability.

4.4. The proposed IMS project component must support Emergency Support.

4.5. The proposed IMS project component must time and date-stamp all actions performed on the system, and include the user’s name of the person performing the action. Time and date stamps must not be alterable.

https://rules.wyo.gov/Search.aspx https://ets.wyo.gov/resources/policies-standards

RFP 0063-N, Page 14 of 34

4.6. The proposed system must provide spell-check capability.

4.7. The proposed system must provide for all major facets of emergency management without requiring the purchase of additional modules.

4.8. Must provide for Receipt of Alert Notifications. The proposer must include in its proposal what methods the proposer’s deliverable has to deliver alerts. The proposer’s deliverable will be responsible for facilitating the communication of any alert.

4.9. Proposals shall include Alert Notification for the following:

4.9.1. Incidents/Events

4.9.2. Resource Requests

4.9.3. Mission Taskings

4.9.4. Other Requests/Polling of Stakeholders

5. HOSTING

The proposer should provide multiple layers of external and internal security that provides administrative, physical and technical means to protect sensitive or confidential information used in performing the responsibilities and duties set forth in this RFP.

5.1. Physical Location: primary and failover facility(ies)

5.2. Facility access and security/integrity: facility and equipment allocation

5.3. Staffing Security: the proposer should maintain policies and procedures for security clearance and staffing controls, allowing proposer personnel access to Agency owned confidential information and/or to restricted areas within the proposer’s host environment.

5.4. Security and Environmental Controls: The proposer shall maintain proper power and cooling, including redundant power and cooling, to safeguard all hardware, software and State-owned data.

The secure perimeter of defense includes, but is not limited to, the use of technical barriers, physical barriers and administrative safeguards, etc.

5.5. Technical Support/Staffing: The proposer shall maintain adequate technical supporting/staffing to provide 24x7x365 hosting services.

5.6. Architectural Design: The proposed project component must not require any software to be downloaded onto Customer machines to function properly. Solutions that require installation of client software will not be considered.

5.6.1. Option of an additional mobile application available to be used on tablets or mobile phones is requested. Mobile-native applications must use the State’s Identity Provider.

5.7. Secure Server(s): Server(s) is protected from intrusion through the use of physical barriers, technical barriers and administrative barriers, etc.

5.8. Secure Network: Network is secured through use of multiple redundant firewalls, anti-virus software, data encryption for files transferred to and from external users, etc. Data encryption shall meet Federal Information Processing Standard (FIPS) 140-3.

5.9. Secure Application: Access to the proposer system is granted through the use of a unique user identifier and user profile, combined with a strong password. Any transaction or change to data is traced and audited, down to the user ID level.

RFP 0063-N, Page 15 of 34

5.10. Security Awareness: Security policies and procedures are maintained for each location or account.

Proposer routinely reviews logs of system activity for suspicious activity. If applicable, the proposer shall provide HIPAA privacy and security training to all new hires and subcontractors.

5.11. Data Storage: proposer shall provide sufficient storage to operate and support the proposed solution.

5.12. Denial of Service (DOS) Attack: proposer should provide examples of policy, procedures and safeguards employed to respond and/or recover from a denial of services. Proposals should also include metric RTO, etc.

5.13. Internet Congestion: proposer will provide sufficient bandwidth and redundancy to access the proposed solution functionality.

5.14. Hosting Reports: Uptime Reports – Detailing system availability; Performance Metrics – Including response time, throughput, and overall system performance; Security Incident Reports

– Documenting breaches, vulnerabilities, and actions taken; Capacity Utilization Reports – Detailing system resource usage; Incident Management Reports – Tracking issue resolution times.

5.15. Backup/Archive Routine: proposer should be able to demonstrate at a minimum requirement for archiving set by the agency first, then industry standards and practices.

5.16. Disaster Recovery Plan (DRP): A copy of the hosting DRP and Continuity of Operations Plan (COOP). Proposer shall have a disaster recovery facility and provide documented policies and procedures to implement a recovery. If a complete failure occurs, the proposed solution shall be available within twenty-four (24) hours. Annual testing shall be conducted to ensure a smooth transition should the plan need to be activated. The proposer shall provide a copy of the annual test results to the Agency within thirty (30) days of disaster recovery demonstration.

5.17. Restoration Priority: Enumerate the prioritized order of restoration for your proposed solution hosted services.

5.18. Data Security: Proposer shall maintain policy and procedures to maintain and support the security of confidential information. Agency policies, procedures and protocol on data security breach can be found at https://ets.wyo.gov/resources/policies-standards. Data breach notification procedures and plans are maintained and shall at a minimum, comply with Wyoming Statute §40-12-502.

5.18.1. If applicable, data breach notification procedures and plans shall also comply with CFR 45 parts 160 and 164 (HIPAA/HITECH).

5.19. Data Breach – Venue of Law: If the proposer’s solution were to be selected, provide discussion on what state law would have jurisdiction in regards to data security breach notification.

5.20. Certification and Audits: Provide a discussion on certification/audits, as applicable to these RFP requirements, the proposer may have achieved (i.e., SAS 70 Audit, HIPAA, SOX, GLB, etc.)

5.20.1. Provide a copy of these certifications/audits, including the dates these were conducted.

5.21. Website Archiving: Provide a brief description of the proposer’s website archiving practices and how their practices will meet the requirements of the Wyoming Public Records Act (Wyoming Statute §16-4-201 through 16-4-205).

5.22. System Availability: The system should be available 24/7. Any maintenance outages will be coordinated in advance with the Agency designated personnel.

RFP 0063-N, Page 16 of 34

6. RISK MANAGEMENT:

6.1. Provide a description of how the proposer will conduct risk management planning, identification, analysis, responses and monitoring and controlling the risks throughout the life cycle of the project. Identify how the proposer’s Risk Management Plan will increase positive impacts and decrease adverse events in the project.

6.2. For work performed in each location, describe what plans/arrangements are in place for an alternative work site should the facilities become inoperative because of fire, earthquake, etc.

6.3. Describe your emergency and disaster recovery plans.

7. RESOURCE RESPONSIBILITIES:

7.1. Project Manager: The proposer should designate a project manager to represent and oversee the project. This individual will serve as the focal and contact point for all proposer business matters relating to the project. An individual resume, a list of their qualifications, years of experience, current work assignments and office location should be included. Confirm that the project manager will:

7.1.1. Be the single point of contact for the duration of the engagement.

7.1.2. Be responsible for timely completion of all phases of the project.

7.1.3. Be responsible for meeting all contractual requirements for the duration of the project.

7.1.4. Attend status, quality review and acceptance meetings as required and present status and progress reports on the project.

7.1.5. Remain assigned to the project through completion of the project as determined by the Agency.

7.1.6. Identify project responsibilities and job functions.

7.2. Other Key Personnel: The proposer should provide a list of all key personnel to be assigned to any part of the project and the duration of time they will serve on the project. The following should be considered:

7.2.1. Project Management

7.2.2. Information Technology Implementation Strategies

7.2.3. Change Management Strategies

7.2.4. Subject Matter/Industry Expertise

7.2.5. Experience on Government Projects

7.2.6. Quality Assurance for Government Projects

7.2.7. Identify how long the current team to be assigned to the project has been together

7.2.8. Describe the proposer’s transition plan, how the firm plans to deal with the possible sudden departure of key personnel within the team

7.3. Subcontractors will report to and be responsible to the proposer

7.3.1. The proposer shall provide a description of work to be subcontracted to third parties.

7.3.2. Certify any supporting contractor who may assist the primary contractor and meet the minimum proposer qualifications.

RFP 0063-N, Page 17 of 34

7.3.3. A description of the nature and duration of the previous relationship of all subcontractors and/or third parties with the prime contractor.

7.3.4. Explanation of any existing contractual relationship between the prime and subcontractors, or among subcontractors.

7.4. Resource Management and Staffing Plan: the proposal should contain the proposer’s staffing plan in response to the requirements set forth in the RFP. At a minimum, the staffing plan should address the following:

7.4.1. Staffing Levels (estimated by staff disciplines by month for the duration of the project).

7.4.2. Break out of staff disciplines (including title and job responsibility)

7.4.3. Detail differentiated by staff (proposer, subcontractor, etc.)

7.4.4. Personnel whose names and resumes are submitted in the proposal shall not be removed from this project without prior approval of the Agency. Substitute or additional personnel shall not be used for the project until a resume is received and approved by the Agency.

7.4.5. The agency shall have the right to request the removal of any proposer staff member from all work on this project, and the proposer will comply with any such request immediately.

7.4.5.1. The replacement for any staff member who is removed from or leaves the project for any reason should match or exceed the replaced staff member in terms of skill level and experience. Such replacements are subject to the Agency approval at the time of assignment and again 90 days later.

8. INCIDENT COMMAND SYSTEM PROJECT AREA USER TOOLS

REQUIREMENTS:

8.1. The proposed system must include automated After-Action Report functionality.

8.2. The proposed system must have formatting capabilities for standard Homeland Security Exercise and Evaluation Program reporting.

8.3. The proposed system must include an integrated Joint Commission 6 Critical Element Evaluation.

8.4. The proposed system must have the ability to report from an Electronic Medical Record provider to the National Hospital Available Beds during Emergencies and Disasters.

8.5. The proposed system must have the ability to automatically extract census data from their Electronic Medical Record provider and populate a patient manifest within the incident management platform.

8.6. IMS shall include a status board that displays all open incidents and active users.

8.7. Proposals must outline how the proposed IMS project component handles incident journaling and logging.

8.8. The proposed IMS project component must include integrated ICS forms.

8.9. Proposals shall describe how the proposed IMS product handles mission/tasking.

8.10. Proposal shall identify how users can switch between incidents and authorized roles/positions without logging out of the system.

RFP 0063-N, Page 18 of 34

8.11. The proposed IMS product shall have integrated All Hazards checklists, and be adaptable for Hospital Incident Command Systems.

8.12. The proposed IMS product must include a database that stores contact information for individuals.

8.13. The proposed IMS software shall have a method to store documents and link them to incidents, critical infrastructure and key resources, and missions at a minimum. The proposed IMS software shall have the ability to integrate with the State’s Document Management System (Google Drive) using APIs.

8.14. Proposed IMS product shall provide a common operating picture.

8.15. Proposed solutions shall provide the capability for multiple agencies to operate under a common incident.

8.16. Proposed product shall support resource and map sharing features between users based on permissions.

8.17. Provide the ability to poll the deployment for resource status, operations status, or ask basic questions of the user base.

8.18. Proposed system must include mobile app that allows for the initiation of incidents, log entry and data entry, assign to ICS role, and uploading pictures.

8.19. Proposed system must include a mobile app for the triage and tracking of patients. Mobile-native applications must use the State’s Identity Provider.

9. INCIDENT COMMAND SYSTEM PROJECT AREA ADMINISTRATIVE

FEATURES:

9.1. The proposed IMS software shall provide the ability to create incidents, manage multiple incidents simultaneously, and store, query and view historical data associated with an incident.

9.2. The proposed project components must have a distinct user administration section. A system administrator must be able to easily add/change/inactivate/remove users. Each user must have a distinct access profile that defines that user’s access to data, at a minimum, read or edit access.

9.3. Administration of the proposed project component shall be through a browser. Software administration from the server only will not be considered.

9.4. The proposed project component shall be capable of supporting a large number of users from multiple jurisdictions.

9.5. The proposed project component shall support the ability to export reports in XML, CSV, PDF, MHTML, Excel, TIFF and Word formats.

9.6. Historical data must follow the State’s record retention policies on the IMS project component on an incident basis to facilitate post-operational analysis and debriefing.

9.7. The proposed project component must allow agencies/users access to the system from any location (e.g., local, regional, state, national, office, home, hotel, etc.) thereby implementing a “Virtual Emergency Operations Center.”

9.8. The proposed project component must provide links to different types of reference data.

RFP 0063-N, Page 19 of 34

10. INCIDENT COMMAND SYSTEM PROJECT AREA MAPPING FEATURE

REQUIREMENTS:

10.1. The system shall allow authorized users to annotate the map using icons, labels or other symbols.

10.2. Must be capable of viewing live dynamic, multiuser process data on a map.

10.3. Must be capable of combining data with other geographic information system or services on a single map.

10.4. Must be capable of saving locations or marking areas as bookmarks.

10.5. The system shall have the ability to display Critical Infrastructure/Key Resources on a map based on the geocode resource location.

11. IMPLEMENTATION SUPPORT REQUIREMENTS:

11.1. Implementation process. System must be deployed to Agency within 90 days of award.

11.2. Training and technical assistance must be provided to ensure administrative users have a working understanding of the system. Training sessions will be offered to users based on their user level.

11.3. End-user documentation as well as online help available from within the system.

11.4. Administrative user documentation as well as online help available from within the system.

11.5. System must include all upgrades, including major releases.

11.6. Proposer’s approach to customer support.

11.7. Schedule for system releases and updates.

12. GENERAL IT REQUIREMENTS:

12.1. Hosting and Data Access Requirements: The State will own all data tables created as a result of the Agreement. The State must have the ability to manipulate data, run reports as needed, pull code tables, access raw data, and develop dashboards as needed through Microsoft Power BI, ESRI, Tableau, and associated platforms. The proposer’s proposal must describe how the State can access data housed within the proposed solution for ingestion into the state data repository, encompassing available methodologies (e.g., application programming interface (API), flat file, data formatting, frequency of updates, and any inherent constraints. Additionally, the proposer’s proposal must provide a high-level architecture diagram, as part of the solution diagram as required by Section 7, 2.1.13, explaining the proposed solution’s data provision mechanism.

12.2. Single Sign-on (SSO) Requirements: If the proposer’s proposal includes a deliverable with a login component, the proposal must describe how the deliverable be fulfilled by the proposer.

12.3. SSO Logout Initiation Requirements:

12.3.1. The proposer’s deliverable must provide users with a clear and easily accessible logout mechanism (e.g., a “Logout” button/link).

12.3.2. The logout functionality of the proposer’s deliverable must trigger a session-based logout process utilizing the sign-out endpoint found in the metadata document provided during implementation.

12.4. Session Timeout Requirements:

RFP 0063-N, Page 20 of 34

12.4.1. The proposer’s deliverables must allow for a customizable, State-defined inactive user session timeout period.

12.4.2. The proposer’s deliverables must notify users of impending session expiration five minutes before the timeout occurs, providing users with the option to extend the session.

12.5. Session Termination on Browser Close Requirement: The proposer’s deliverables must clearly notify users that closing the browser window or tab is not a valid logout because the SSO session may remain active. The notice must further notify users that they are responsible for explicitly logging out to ensure complete session termination.

12.6. Onboarding/Provisioning of Users Requirement: The proposer’s proposal must describe how new users are onboarded or provisioned into the deliverable. The proposer must provide an automated process for onboarding and offboarding users or must provide a process that requires minimal manual steps.

12.7. Interfaces and Integration Requirements: The proposer’s proposal must describe how the deliverables can adapt to business necessary interfaces using widely adopted open APIs and standards. Additionally, the proposer must make available or expose software services that would enable third-party developers to interface other business applications. The proposer must publish documentation for the software services in question. The proposer’s proposal must include a detailed description of system capability.

12.8. Web Application Vulnerability Scan Requirements: Any web-based deliverable must undergo a web application vulnerability scan (“Vulnerability Scan”). The Vulnerability Scan must identify misconfigurations or vulnerabilities such as those found in the Open Worldwide Application Security Project Top Ten and must detail the certainty level of each finding.

Unless expressly indicated in writing, the State assumes all price estimates and bids are for the delivery and support of deliverables that will pass Vulnerability Scans. If the State determines that any aspect of the deliverable has security vulnerabilities that must be corrected, the State will inform the proposer of the nature of the issue and the proposer will be required to respond in writing regarding mitigation plans for the security vulnerabilities. If the deliverable does not pass the initial Vulnerability Scan or the proposer cannot provide a satisfactory Vulnerability Scan report, additional scans may be required to confirm the deliverable is secure.

State Hosted: For state hosted web-based deliverables, the Vulnerability Scan will be performed by the State and the proposer’s proposal should take that into consideration when responding to this RFP. As a condition of the resulting contract, the state hosted web-based deliverable will have to successfully pass the Vulnerability Scan prior to the deliverable being allowed to go in a production environment. Any proposer who responds to this RFP must accept such a contract term and must factor this security requirement into the proposer’s proposal.

Vendor Hosted: For vendor hosted web-based deliverables, any proposer who makes it to the “Tech Review” stage of the RFP process must provide the State a copy of the full report of the deliverable’s most recent Vulnerability Scan, a summary will not be accepted. The proposer should mark the vulnerability report as “Confidential” if it treats such a report as confidential information.

If the proposer requires a Non-Disclosure Agreement (NDA) to be in place before the State may review the Vulnerability Scan report, the proposer must notify the State of such a requirement and resolve the signing of an NDA with enough time to respond to this RFP within the timeframe.

12.8.1. The proposer’s Vulnerability Scan report must consist of, at a minimum:

12.8.1.1. The system that was evaluated,

12.8.1.2. The categories that were evaluated (examples: SQLi, XSS, or RCE),

12.8.1.3. What were the general findings, RFP 0063-N, Page 21 of 34

12.8.1.4. Technical detail of each issue found,

12.8.1.5. Remediation status of enumerated issues (if any).

The cost of any Vulnerability Scans done by the proposer or the proposer’s costs associated with the State performing Vulnerability Scans must be part of the proposer’s cost proposal.

Failure of a deliverable to satisfactorily pass a Vulnerability Scan may result in the proposer’s proposal being rejected.

12.9. Test System Requirement: The proposer must include a test system for its application deliverables to be used at the discretion of the State. All resource costs, including licensing costs, associated with keeping the test system available must be detailed in the proposer’s cost proposal. If the proposer does not include the test system costs in the proposer’s proposal, then the proposer will bear the costs. The proposer will maintain the test system as a mirror image of the production system code base.

12.10. Internal Processes and Procedures Requirement: The proposer must use industry standard processes and procedures, such as a software development lifecycle, when planning the development, configuration, implementation, and support of a proposed deliverable. The proposer must outline their internal processes and procedures in their proposal, including, but not limited to, alerting key stake holders (such as: Operations, Systems Support staff, Desktop Support staff, Administrators, Help Desk personnel, Client Representatives, and others) of changes that will be occurring within State or proposer resources or systems.

12.11. Email Domain Name Requirement: If the proposer’s proposal includes a website or a web application that generates email and is hosted by the proposer or in the State’s cloud, the proposed website or web application cannot use state email domains as the originating domain name.

12.12. Banned Entity Requirement: The proposer’s proposed deliverables cannot include any hardware or hardware components manufactured by Huawei Technologies Company, Nuctech, or ZTE Corporation or any subsidiary or affiliate of such entities. This includes hardware going on the State’s network as well as the proposer’s network if the proposer’s network is accessing the State’s network or accessing State data. This includes Infrastructure as a Service, Platform as a Service, or Software as a Service situations. Any company that is considered to be a security risk by the government of the United States of America under the International Emergency Economic Powers Act, in a United States appropriation bill, an Executive Order, or listed on the US Department of Commerce’s Entity List will be included in this ban.

12.13. Access Management Requirement: If the proposer’s proposed deliverables require accounts allowing access to State systems, then the proposer must indicate the number of the proposer’s staff or subcontractors that will require access, the level of access needed, and if these accounts will be used for remote access.