NEW SMYRNA BEACH UTILITIES

200 CANAL STREET

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

RFP 16-26

ADDENDUM NO 2

Page 1 RFP 16-26 Addendum No 2

DATE: 08-14-26

RE: RFP 16-26 ADDENDUM NO. 02

To prospective vendors:

New Smyrna Beach Utilities is issuing the following addendum. As such it becomes an integral part of the proposal and must be acknowledged by the return of this signed form, with your proposal form, acknowledging receipt of the addendum.

1) Has New Smyrna Beach Utilities established an estimated budget or Not-to-Exceed (NTE) amount for this engagement? If so, could you please share the anticipated budget range?

Pursuant to Florida Statute § 119.071(1)(b), internal cost estimates, budget allocations, and procurement evaluation materials are temporarily exempt from public records disclosure during an active solicitation. To ensure a fair, competitive, and market-driven bidding process for all participating service providers, NSBU is not releasing internal budget thresholds at this stage.

We appreciate your interest in working with us and look forward to reviewing your proposal.

2) Beyond the replacement of Microsoft Dynamics GP, what are the primary challenges that NSBU is seeking to address through this project? Are there any specific pain points or priorities the selected consultant should focus on?

Please refer to the RFP for details.

3) Does NSBU have any preferred ERP platform(s) under consideration or is the selected consultant expected to conduct a vendor-neutral evaluation and recommend the most suitable solution?

The selected Service Provider will be expected to conduct a comprehensive, vendor-neutral evaluation of the market. The final recommendation must be based strictly on NSBU’s documented operational, financial, and technical requirements, rather than any predetermined software affiliation. Proposers must demonstrate a methodology/approach that objectively analyzes multiple ERP and SIEM solutions to identify the most suitable, cost-effective, and scalable platform(s) for a municipal utility environment.

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 2 RFP 16-26 Addendum No 2

Each participating Proposer shall submit a fully executed and completed Conflict of Interest and Vendor-Neutrality Certification Form within its proposal response. Failure to submit this completed form at the time of proposal submission shall result in immediate disqualification of the proposal as non-responsive. NSBU retains sole, absolute discretion to accept or reject any submitted Conflict of Interest Mitigation Plan, and any plan deemed inadequate by NSBU shall result in the disqualification of the Service Provider's proposal.

CONFLICT OF INTEREST AND VENDOR-NEUTRALITY CERTIFICATION FORM

Solicitation Number: NSBU IT Consulting Services RFP 16-26 Project Title: ERP Replacement and SIEM Design and Implementation Proposer Name: __________________________________________________

PART I: CERTIFICATION OF INDEPENDENCE AND OBJECTIVITY

The Proposer, by and through the undersigned authorized representative, hereby certifies, warrants, and agrees that:

1. Independent Advisory Status: The Proposer operates as an independent advisory entity and does not hold exclusive reselling, implementation, or financial partner agreements with Enterprise Resource Planning (ERP) and/or Security Information and Event Management (SIEM) software providers that would bias or compromise the outcome of their analyses, assessments, and recommendations.

2. Financial Relationships: The Proposer has reviewed its corporate relationships, financial ties, and historical business practices. All financial relationships, referral fees, commission structures, or mutual marketing agreements with ERP and/or SIEM vendors—whether past, ongoing, or pending—have been fully and transparently disclosed in Part II of this form.

3. Vendor Neutrality: The Proposer guarantees that its personnel assigned to this contract will provide objective, vendor-neutral analysis free from corporate bias, external financial incentives, or commercial partnerships.

PART II: CONFLICT DISCLOSURE STATEMENT

Check the appropriate box below. If a conflict or relationship is disclosed, you must attach a detailed Conflict of Interest Mitigation Plan.

□ NO CONFLICT EXIST: The Proposer certifies that there are no actual, potential, or perceived organizational or personal conflicts of interest, including financial relationships or exclusive partner agreements with ERP or SIEM providers, that could impact the objectivity of this project.

□ POTENTIAL/ACTUAL CONFLICT DISCLOSED: The Proposer notes the following historical, ongoing, or pending relationships, fees, or agreements with ERP and/or SIEM vendors (attach additional sheets if necessary):

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 3 RFP 16-26 Addendum No 2 o Vendor Name:______________________________________________ o Nature of Relationship/Fee Structure:___________________________________

PART III: MITIGATION PLAN REQUIREMENTS (For Disclosed Conflicts Only) In accordance with Florida procurement practices and standard guidelines under Florida Statute § 287.057(19), any Proposer checking the "Potential/Actual Conflict Disclosed" box above must attach a formal, signed Conflict of Interest Mitigation Plan. This plan must provide detailed, actionable information regarding:

1. Firewalls & Ring-Fencing: The strict electronic, physical, and organizational barriers used to separate the Proposer NSBU project team from employees managing service provider partner relationships.

2. Staff Attestations: The process for ensuring all assigned project personnel sign individual non-disclosure and objectivity agreements.

3. Compliance Officer: The name, title, and contact details of the Proposer’s internal executive responsible for overseeing, auditing, and enforcing the mitigation plan.

PART IV: ACKNOWLEDGEMENT AND EXECUTION

The undersigned warrants that they possess the legal authority to bind the Proposer. The Proposer acknowledges that NSBU reserves the sole right to evaluate the adequacy of any submitted mitigation plan. NSBU retains the absolute right to find the Proposer "non-responsible" and disqualify the proposal if it determines that a conflict of interest cannot be effectively neutralized.

Authorized Signature: __________________________________________________ Printed Name: _________________________________________________________ Title: ________________________________________________________________ Date: ___________________________

4) Does NSBU anticipate selecting a firm that is independent from the ERP vendor community?

Please refer to the response provided for Question 3 above.

5) Does NSBU anticipate selecting a firm to complete the full ERP lifecycle?

Please refer to the “Background” section in the RFP. The Commission is procuring professional services to plan and lead a comprehensive ERP replacement lifecycle, including assessment, requirements, RFP development, vendor selection, business process reengineering, solution design, data migration, implementation, training, and support transition, as well as the design and

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 4 RFP 16-26 Addendum No 2 implementation of an enterprise SIEM integrated with the ERP and the Commission’s broader environment.

6) Would NSBU consider selecting a firm to complete certain portions of the scope of services? For example, would NSBU consider selecting a firm that is independent from the ERP vendor community to assist with the assessment and selection scope of services?

Please see paragraph 19, “Consideration of Proposals” under “General Terms and Conditions”.

7) Does NSBU anticipate releasing a separate RFP for the ERP system(s)?

As stated in Section B, “The Commission Responsibilities” (p.24), NSBU will complete required procurement actions to obtain the resources, tools, and licenses needed for implementation and testing, based on the Service Provider’s written recommendations and specifications.

8) Does NSBU anticipate releasing a separate RFP for the SIEM system?

Please refer to the response provided for Question 7 above.

9) Does NSBU anticipate the selected firm will provide all of the deliverables listed in the RFP?

Yes.

10) Does NSBU anticipate the selected firm will provide the following:

a. Testing and Quality Management

b. Data Migration and Integration

c. Security Architecture and SIEM integration

d. Public Records, Retention and Legal Holds

e. Incident Response and Vulnerability Management

f. Training and Knowledge Transfer

g. Post Go-Live Support and Transition

h. Acceptance and Completion

The selected Service Provider shall deliver all services in accordance with the requirements set forth in the RFP. The selected Service Provider is expected to directly coordinate with ERP and SIEM vendors and the Commission’s third parties to deliver fully operational ERP and SIEM systems.

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 5 RFP 16-26 Addendum No 2

11) Will NSBU consider extending the due date by two weeks due to the amount of time between the addendum release and the current due date?

The proposal submission deadline has been extended to 2:30 PM Eastern Time on Tuesday, September 10, 2026. Vendors may listen to the opening by clicking the link below or calling

(872) 216-5903 PIN 831 859 640#

https://teams.microsoft.com/meet/230171949830573?p=T2WVCq7Xo mtOv8paSX

12) “Include a copy of your current Occupational License from an authorizing government agency.”

Our firm is headquartered in Spicewood, Texas (Burnet County), a jurisdiction that does not require a general occupational or business license for professional consulting services of the type we would provide under this engagement. We are registered and in good standing with the Texas Comptroller of Public Account and are also qualified to transact business in Florida.

Could you please advise what documentation would satisfy this requirement for a firm headquartered in a jurisdiction where no such local license is issue or required?

The firm should include with its proposal:

A. A Written Explanation or Affidavit from the Firm -- The proposal should include a signed statement from an authorized officer of the firm explaining that: (a) the firm’s principal place of business is in Spicewood, Texas (Burnet County); (b) Burnet County, Texas does not require or issue occupational licenses, business tax receipts, or general business licenses for professional consulting services of the type to be provided under the engagement; (c) accordingly, no such license has been issued to the firm and none can be obtained; and (d) the firm is in full compliance with all applicable licensing requirements of its home jurisdiction.

B. Florida Certificate of Authority to Transact Business -- The firm should include its current certificate of authority issued by the Florida Department of State (Division of Corporations) confirming that it is qualified to transact business in Florida.

C. Texas Comptroller of Public Accounts Registration -- The firm should include documentation of its registration and good standing with the Texas Comptroller of Public Accounts.

13) The Scope of Work lists both “RFP Development Assistance” and “ERP System

Selection Analysis and Recommendation” as deliverables. If the awarded firm assists https://teams.microsoft.com/meet/230171949830573?p=T2WVCq7XomtOv8paSX https://teams.microsoft.com/meet/230171949830573?p=T2WVCq7XomtOv8paSX

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 6 RFP 16-26 Addendum No 2

NSBU in developing an ERP procurement RFP or recommends the selected platform, will that firm remain eligible to be awarded and perform the subsequent design, migration, and implementation work, whether under this contract or a resulting separate procurement? Please confirm that any organizational conflict of interest provision would preclude the firm that develops the RFP or selection recommendation from bidding on or performing the implementation.

Please see response to Question 3 above.

14) Is the award intended as a single combined contract for the full lifecycle (assessment through support transition), or will NSBU contract in stages? The Sample Agreement term is one year plus up to three on-year renewals; how is that intended to map to the six phases running into 2029?

Please see responses to Questions 5 and 6 above.

15) Are oral presentations or demonstrations anticipated in the evaluation, or will award be made on the written response alone?

No oral presentations or demonstrations are anticipated.

16) Does NSBU have a target or preferred ERP platform, or an incumbent driven preference?

Please refer to the response provided for Question 3 above.

17) How many legal entities or funds, and approximately how many named users by department or role, will the new ERP support?

NSBU’s ERP requirements are for one legal entity with 75-100 users in the system.

18) Are FERC reporting and utility specific accounting expected as standard configuration, or does NSBU anticipate custom or ISV components? Can NSBU FERC report formats?

Yes, NSBU expects FERC reporting accounting standards to be standard configuration. An ISV component currently exists. ISV functionality must be available in the new ERP capability.

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 7 RFP 16-26 Addendum No 2

19) What are approximate annual transaction volumes, and what depth of Dynamics GP history is expected to be migrated versus archived?

Within the ERP system, approximate transaction batch volumes can reach 50,000 per year and transaction level volume is approximately 850K per year. A minimum retention level of history is five (5) years.

NSBU follows the State of Florida general records retention schedule GS1-SL for state and local government agencies. The selected service provider shall provide technical expertise on planning for data migration or archival.

20) Can NSBU provide an inventory of GP add-ons in use (for example ,eConnect, Management Reporter, and eRequest purchasing) and confirm which must be replaced versus retired?

Pursuant to Florida Statutes § 119.0713 and § 119.0725, certain technical information regarding NSBU’s current operational infrastructure, software applications, and network architecture is strictly confidential and exempt from public disclosure. To maintain cybersecurity integrity and protect critical infrastructure, the specific product names, hardware configurations, and system vulnerabilities of the Utility's legacy or existing systems will not be disclosed within this Request for Proposals (RFP). Full details will be provided to the selected Proposer upon execution of NDAs and prior to final contract award.

To enable transparency for proposal responses, a total of 25 add-ons or system interfaces require evaluation to recommend which should be retained, replaced, or retired based on business process reengineering results. An example of some functions accomplished using add-ons are listed below in lieu of product names:

• A developer tool and API framework that allows external software applications to safely read and write data directly into the Dynamics GP database.

• A real-time financial reporting and analysis tool to generate formal corporate financial statements like Balance Sheets, Income Statements, and Cash Flow Statements.

• An electronic capability to request purchases, log expenses, and route those requests through a formal approval chain outside of the core ERP system, keeping unauthorized spending in check.

• Integrated Voice Response (IVR) automated telephony capability that interacts with callers, gathers necessary information, and routes calls to the appropriate human agent or self-service feature to manage phone payments, account information, and outbound collection calls.

• Automated mail processing for residential and commercial billing.

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 8 RFP 16-26 Addendum No 2

• Automated process of generating, delivering, and paying customer invoices entirely over the internet, eliminating the need for paper statements and physical mail (sometimes referred to as “electronic billing” or “digital billing”).

• Generation of unified monthly utility statements, consolidating electric, water, wastewater, and reclaimed water charges into a single invoice for approximately 32,000 active residential and commercial accounts based on meter data. To support consistent long-term growth projected by municipal plans, any proposed ERP solution must feature high database scalability. Depending on the specific location of the home or business, an NSBU bill will break down charges for the following core utility provisions:

• Electric Service: Charges based on monthly kilowatt-hour (kWh) consumption, which includes a standard pass-through Fuel and Purchased Power Cost Adjustment Clause

(FPPCAC).

• Potable Water Service: Volumetric charges for safe drinking water, determined by localized meter sizes.

• Wastewater (Sewer) Service: Base and usage-based collection and reclamation fees.

• Reclaimed (Reuse) Water Service: Specialized irrigation water billing for customers utilizing recycled water lines.

• Specialized Bill Layouts and Formats: Aside from standard monthly usage invoices, NSBU generates variations of statements tailored to specific customer needs:

o Net Billing Statements (Solar Customers): For businesses and homes with interconnected solar facilities, NSBU generates a bidirectional meter statement. It explicitly tracks energy consumption versus solar production, rolling over excess monetary credits month-to-month and issuing an annual payout if generation exceeds usage.

o Budget Billing Invoices: Available to help customers stabilize seasonal costs, this format displays a balanced, fixed payment amount derived from an averaged calculation of the client's trailing 12-month billing history.

o First-Month Activation Statements: The very first bill generated after a customer signs a Contract for Service includes one-time administrative adjustments, such as a $35 initial connection fee or required security deposits.

• Warehouse inventory management barcoding interface.

• Asset management interface to support real-time inventory management, tracking, disposition, and reorder.

• Payroll Integration: An automated, secure data pipeline to integrate payroll data from the existing, retained Human Resources (HR) system into the new ERP platform.

21) For each named integration (AMI,OMS,GIS,CIS,WAMS,SCADA,HR and payroll and Silverblaze), what is the vendor or product, and the available integration method (REST,SOAP,OData,or file)?

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 9 RFP 16-26 Addendum No 2

See answer to Question 20 above. The following data transfers occur through system interfaces:

• AMI integration with existing ERP – daily file transfers

• OMS integration with existing ERP – daily file transfers

• GIS-ArcGIS integration with ERP – daily file transfers

• CIS and Workorder and Asset Management integration to Great Plains Inventory – daily file transfers

• HR/Payroll information integration with Great Plains – batch transfer

• Customer Portal integration with ERP – real-time

Specific product information and integration methods for system interfaces will be provided to the selected Service Provider at the beginning of Phase 1.

22) Is HR and payroll in scope within the ERP, or integrated to an external system? Is NSBU aligning payroll with the City’s move to UKG, or maintaining as a separate solution?

HR and payroll is not in scope for the ERP replacement. It will be maintained in the existing, external HR system and will need an integration to the new ERP.

23) For Silverblaze (customer self-service), does NSBU intend to integrate with or replace it? Is CIS being replaced with the same program?

See responses to Questions #20 and #21 above. The selected Service Provider is expected to recommend the ERP solution that best meets NSBU’s needs based on the requirements and work described in the RFP.

24) Does NSBU have a preferred or incumbent SIEM platform, or is the firm free to recommend one? Are there existing security tools or a security operations center to integrate with?

Pursuant to Florida Statutes § 119.0713 and § 119.0725, certain technical information regarding NSBU’s current operational infrastructure, software applications, and network architecture is strictly confidential and exempt from public disclosure. To maintain cybersecurity integrity and protect critical infrastructure, the specific product names, hardware configurations, and system vulnerabilities of the Utility's legacy or existing systems will not be disclosed within this Request for Proposals (RFP). Full details will be provided to the selected Proposer upon execution of NDAs and prior to final contract award.

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 10 RFP 16-26 Addendum No 2

To enable fairness and transparency, Proposers should assume no SIEM exists in their responses.

25) Can NSBU confirm the hosting expectation (Microsoft-cloud SaaS versus hybrid) and how it reconciles with the mandatory U.S. data-residency and no-offshore-access requirement for a cloud ERP?

See U.S. Data Residency requirement under “Security and Compliance Requirements” on p.21 of the RFP. The following is provided to enable Proposers to fully understand the details of this requirement.

Cloud Data Sovereignty and U.S. Residency Requirements:

A. Mandatory FedRAMP and Government-Class Cloud Architecture To safeguard critical utility infrastructure data and support the aerospace and national defense footprint within Volusia County, the Contractor/Cloud Service Provider (CSP) shall deploy the NSBU ERP application and all associated databases within an isolated government-class cloud environment. The hosting environment must maintain an active Federal Risk and Authorization Management Program (FedRAMP) Moderate or High Authorization (such as AWS GovCloud, Azure Government, or an equivalent federally audited sovereign cloud directory). Commercial, multi-tenant public cloud deployments that co-mingle municipal infrastructure assets with general commercial enterprise data are prohibited.

B. Data Sovereignty and ITAR Compliance The cloud environment will ingest, process, and store highly sensitive technical data, including physical grid topologies, Supervisory Control and Data Acquisition (SCADA) network integrations, and engineering schematics. Consequently, the CSP must guarantee absolute compliance with the International Traffic in Arms Regulations (ITAR) and Export Administration Regulations (EAR).

• Domestic Data Residency: All primary, secondary, backup, and disaster recovery database environments must reside on physical server hardware located exclusively within the geographic borders of the United States.

• U.S. Sovereign Personnel Restrictions: All logical access, technical support, database administration, network engineering, and system troubleshooting performed by the CSP or its subcontractors must be executed exclusively by verified U.S. Citizens located on U.S. soil. The CSP must legally guarantee that no foreign nationals or overseas personnel can access unencrypted NSBU database tables, system audit logs, or server metadata, preventing a prohibited "deemed export" under federal law.

• Foreign Countries of Concern: In strict compliance with Chapter 2026-65, Laws of Florida (originally Senate Bill 484), the cloud hosting infrastructure, hardware, and

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 11 RFP 16-26 Addendum No 2 upstream service layers shall not be owned, operated, or controlled by any legally designated foreign countries of concern.

C. Florida Local Government Cybersecurity Act Compliance Any proposed cloud solution and the Contractor's/CSP’s operational procedures must fully align with the Florida Local Government Cybersecurity Act (Florida Statutes § 282.3185) and the Florida Cybersecurity Standards (Chapter 60GG-2 of the Florida Administrative Code):

• NIST Alignment: The Contractor/CSP must guarantee that its cloud architecture, identity parameters, and operational safeguards strictly adhere to the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

• Incident Reporting Integration: In the event of an active cybersecurity incident within the hosted cloud environment, the Contractor/CSP must provide all necessary technical forensics and data parameters to ensure compliance with mandatory state reporting windows. The Contractor/CSP must report ransomware incidents to NSBU within 12 hours of discovery, and Severity Level 3, 4, or 5 incidents within 48 hours of discovery to ensure prompt routing to the Florida Digital Service (FDS).

• Data Isolation and Artificial Intelligence (AI) Bans: The Contractor/CSP shall maintain unique, traceable audit logs for all access to exempt data. To protect critical municipal utility infrastructure information under Florida Statutes § 119.0713 and § 119.0725, the Contractor shall not integrate, scan, or feed NSBU database assets into unapproved, public, or generative artificial intelligence engines.

D. Cryptographic Standards and Public Records Protections

• Encryption Standards: All NSBU data must be protected using FIPS 140-2 (or FIPS 140-3) validated cryptographic modules. Data must be fully encrypted at all times— both in transit across all communication endpoints using secure TLS protocols and at rest within the cloud storage architecture.

• Customer-Controlled Keys: The CSP must support Bring Your Own Key (BYOK) or Hold Your Own Key (HYOK) frameworks, allowing NSBU or its designated administrators to retain exclusive ownership and control over database decryption keys.

• Public Records Exemption Handling: The Contractor/CSP acknowledges that the utility network configurations, software codebases, and technical schemas hosted within the ERP constitute confidential and exempt cybersecurity files pursuant to Florida Statutes § 119.0713 and § 119.0725. All such data must be protected from external data-scraping and public records disclosure requests.

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 12 RFP 16-26 Addendum No 2

26) Is there an established program budget or funding range (for example, tied to the Series 2026 bond or the Capital Improvement Plan) that the phased cost estimates should target?

Please see response to Question #1 above.

27) Given requirements are at a module level today, does NSBU expect firm fixed pricing across all six phases at proposal time, or firm pricing for Phase 1 (Assessment and Strategy) with ranges that firm up after requirements definition and ERP selection?

As subject matter experts in ERP migrations, Proposers are expected to leverage their historical implementation metrics, discovery methodologies, and the module-level requirements provided in this RFP to accurately estimate and price the total effort. NSBU will not accept open-ended ranges or ambiguous pricing structures for the latter phases. Proposers must clearly define all underlying assumptions, constraints, and resource-allocation models used to calculate their pricing.

28) Will NSBU provide authoritative sources for organizational structure, chart of accounts, retention schedules, and compliance requirements at project start?

29) Does the required current Occupational License from an authorizing government agency accept an out of -state business license, or is a Florida specific registration required for award?

Please see response to Question #12 above as applied to the state in which your firm is headquartered.

30) Are there any VendorLink registration prerequisites (for example, UEI or EIN) that vendors should complete now to ensure electronic submission by the deadline?

No.

31) Are there organizational, regulatory, financial, audit, fiscal year-end, or operational blackout periods that could impact the project schedule, testing cycles, migration activities, or go-live planning?

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 13 RFP 16-26 Addendum No 2

32) SIEM Expertise/Security Testing Reports/Security Architecture and SIEM integration/incident Response and Vulnerability Management-Pages 21,22,26,27:Please identify any currently deployed application security testing, vulnerability management, security monitoring, and SIEM solutions in use by NSBU and indicated whether these capabilities are expected to be enhanced, expanded, replace or newly implemented as part of this engagement.

Please see response to Question #24 above.

33) Incident Response and Vulnerability Management-Page 27: Does NSBU anticipate conducting ongoing application security testing and vulnerability assessments following go-live, and if so, what frequency is anticipated?

NSBU cybersecurity activities align with the NIST Cybersecurity Framework.

34) Deliverable Ownership, Formats and Tools-Page 25: If NSBU intends to retain security testing tools following project completion, please provide the anticipated number of named users and concurrent users requiring access to the solution.

Proposers should assume 75-100 users for the ERP and 25 users for the SIEM.

35) Deliverables/Security Architecture and SIEM integration-Pages 22,26: If the selected provider is expected to provide application security testing tools, are those tools intended solely for project execution, or does NSBU intend to retain and continue utilizing those tools following project completion?

NSBU will operate, maintain, and sustain the SIEM upon project completion.

36) Deliverables / Testing and Quality Management - Pages 22, 26: Please clarify whether the expected scope of Application Security Testing includes vulnerability scanning only or also includes penetration testing, dynamic application security testing (DAST), static application security testing (SAST), software composition analysis (SCA), and remediation validation.

Any recommended Security Information and Event Management (SIEM) solution must provide comprehensive telemetry collection, continuous monitoring, and automated logging capabilities strictly aligned with the NIST Cybersecurity Framework (CSF 2.0). The platform must natively support the continuous technical safeguards, automated threat detection protocols, and forensic reporting controls necessary to fulfill NSBU’s compliance obligations under Florida Statutes §

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 14 RFP 16-26 Addendum No 2

282.3185 (The Florida Local Government Cybersecurity Act) and NERC CIP standards.

Furthermore, the SIEM must generate immutable, time-stamped audit trails of all ledger adjustments, user access privileges, and system configuration modifications. These controls must strictly satisfy the data integrity, internal control validation, and segregation of duties (SoD) requirements mandated by the Florida Auditor General for municipal utility financial statement audits.

The selected Service Provider is expected to provide vulnerability management throughout the duration of the project. Penetration testing is an enhanced or advanced activity within the broader vulnerability management and security testing disciplines and not required for this project.

37) Testing and Quality Management - Page 26: If ongoing performance testing is anticipated following go-live, please describe the expected testing frequency and operational ownership model.

NSBU will operate, maintain, and sustain the ERP and SIEM upon project completion.

38) Testing and Quality Management - Page 26: Does NSBU anticipate performing performance and load testing only during implementation, or does NSBU expect to execute ongoing performance testing activities following production deployment?

Please see response to Question #37 above.

39) Testing and Quality Management - Page 26: Has NSBU established performance objectives, response-time requirements, throughput targets, or service-level expectations for the future ERP platform, or is the selected Service Provider expected to define and establish these objectives?

The selected Service Provider is expected to define and establish these objectives.

40) Testing and Quality Management - Page 26: Please provide the anticipated peak concurrent user count and expected transaction volumes for the future ERP environment that should be used when planning performance and load testing activities.

ERP anticipated peak concurrent user count is 75-100.

41) Deliverable Ownership, Formats and Tools - Page 25: If NSBU intends to retain testing-related software following project completion, please provide the estimated

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 15 RFP 16-26 Addendum No 2 number of named users and concurrent users expected for testing, defect management, reporting, and administration activities.

The Service Provider should recommend all products needed for NSBU to successfully operate, maintain, and sustain the ERP and SIEM after project closeout, excluding the Service Provider’s pre-existing intellectual property and standard tools.

42) Service Provider Responsibilities #8 / Deliverable Ownership, Formats and Tools - Pages 23, 25: If the selected Service Provider is expected to provide testing, defect management, reporting, performance testing, or security testing tools, are those tools intended solely for project execution activities, or does NSBU expect to retain and continue using those tools after project completion?

Please see response to Question #41 above.

43) Service Provider Responsibilities #8 / Commission Responsibilities #5 / Testing and Quality Management - Pages 23, 24, 26: If NSBU currently utilizes testing, quality management, performance testing, security testing, defect management, reporting, or SIEM solutions, does NSBU expect the selected Service Provider to utilize those existing solutions, or provide recommendations for replacement or alternative solutions better aligned to project objectives? If replacement solutions are being considered, has budget been allocated for those tools and associated licensing?

Please see response to Question #24 above.

44) Service Provider Responsibilities #8 / Commission Responsibilities #5 / Testing and Quality Management - Pages 23, 24, 26: Please identify any testing, quality management, defect management, performance testing, automation, reporting, application security testing, vulnerability management, security monitoring, and SIEM solutions currently utilized by NSBU.

Please see responses to Questions #41 and #24 above.

45) Deliverables / Data Migration and Integration - Pages 22, 26: Please clarify the expected scope of Data Conversion Validation activities, including reconciliation, verification, and formal acceptance reporting requirements.

NSBU expects the selected Service Provider to lead, define, and execute a comprehensive, multi-layered Data Conversion Validation strategy. While NSBU business teams will act as final

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 16 RFP 16-26 Addendum No 2 subject matter experts to sign off on historical records, the Service Provider is expected to deliver the core technical mechanisms, automated frameworks, and data validation reports.

46) Deliverables / Data Migration and Integration - Pages 22, 26: How many years of historical data are anticipated to be migrated and validated?

Please refer to the response provided for Question 19 above.

47) ERP Technical Expertise - Pages 20-21: What is the approximate size of the current

Dynamics GP environment, including database size and document storage volumes?

Proposers should use the following ranges to prepare their responses:

• CIS database: 20–150 GB

• ERP/GP database: 60–250 GB

• Work order/asset management: 40–200 GB

• GIS repositories: 100–400 GB

• Drawings/scanned plans: 500 GB – 3 TB

• Total footprint: 1.2 TB – 6 TB

Actual database size and storage volumes will be provided to the selected Service Provider at the beginning of Phase 1.

48) ERP Technical Expertise - Pages 20-21: Can NSBU provide an inventory of current integrations, customizations, reports, third-party applications, interfaces, and add-on products associated with Dynamics GP?

See responses to Questions #20 and #21 above.

49) ERP Functional Expertise / ERP Technical Expertise - Pages 20-21: How many current Dynamics GP users exist across the organization?

User count 75-100.

50) Pricing, Invoicing and Expenses - Page 28: Does NSBU have a preference for Fixed Price, Time & Materials, or blended pricing structures for the various phases of the engagement?

Please see response to Question #27 above.

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 17 RFP 16-26 Addendum No 2

51) Cost and Timeline Estimates - Page 30: What is the budget range for this project, and what percentage of the budget is anticipated to be allocated to testing and quality management activities?

Please see response to Question #1 above.

52) Pricing, Invoicing and Expenses - Page 28: If Travel and Expenses are reimbursable, are there limits, policies, or reimbursement schedules that vendors should assume when preparing their proposals?

Other Direct Costs (ODCs) and Reimbursable Travel Expenses:

A. Classification and Separation of Costs All travel-related expenses incurred by the Service Provider to execute on-site work under this Agreement shall be classified as Other Direct Costs (ODCs). These costs must be isolated, tracked, and invoiced separately from the Service Provider’s professional fixed service fees, hourly labor rates, or general overhead margins.

B. Regional Commuting Boundaries and Proposer Financial Responsibility NSBU actively solicits proposals nationwide; however, NSBU does not assume, and shall not be expected to absorb, the full financial burden of travel, transit, and lodging costs incurred by Proposers choosing to bid from outside the local commuting area. Proposers are expected to absorb general long-distance travel overhead within their standard cost of doing business.

NSBU's financial liability for travel ODCs is strictly limited to necessary, localized on-site milestones that cannot be executed via remote collaboration platforms. Proposers must explicitly minimize on-site resource counts and maximize remote delivery methods within their staffing models.

C. Mandatory NSBU Pre-Approval Required Under no circumstances shall any travel expense or ODC be eligible for reimbursement without explicit, documented prior written approval from the NSBU Project Manager (or designee). The Service Provider must submit a formal Travel Authorization Request—detailing the purpose of the trip, the personnel involved, the estimated dates of travel, and a breakdown of projected costs—at least ten (10) business days prior to scheduling or booking any transit or lodging.

NSBU reserves the right to deny any travel request, mandate remote execution, or cap the number of on-site personnel based on operational utility needs. Any travel costs incurred without an approved Travel Authorization Request are completely non-reimbursable.

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 18 RFP 16-26 Addendum No 2

D. Reimbursement at Actual Cost (No Markup) Approved travel ODCs shall be invoiced and reimbursed strictly at actual cost. The Service Provider is legally prohibited from applying any corporate handling charges, administrative fees, overhead multipliers, or profit margins to any reimbursable expense line item. To receive reimbursement, the Contractor must attach legible, itemized copies of all original receipts, electronic tickets, and corresponding corporate invoices directly to the monthly project invoice.

E. Statutory Caps and GSA Alignment All reimbursable travel expenses must be reasonable, necessary, and strictly aligned with the fiscal constraints of Florida Statutes § 112.061 and the federal U.S. General Services Administration (GSA) Travel Regulations:

• Airfare and Rail: Air travel must be booked as coach/economy class at the lowest logical commercial fare available. Premium economy, business, or first-class upgrades are strictly non-reimbursable.

• Lodging and Meals: Nightly hotel rates and daily meal allowances are strictly capped at the maximum allowable per diem rates published by the GSA for Volusia County, Florida, effective at the time of travel.

• Ground Transportation: Reimbursable vehicle transit is restricted to standard/mid-size rental cars, local parking fees, toll costs, or standard rideshare platforms (such as Uber/Lyft). Luxury vehicle rentals or unapproved personal mileage variations will not be reimbursed.

53) Pricing, Invoicing and Expenses - Page 28: Should vendors include Travel and

Expenses within proposed pricing, or will approved Travel and Expenses be reimbursed separately under the final agreement?

Please see response to Question #53 above.

54) Service Provider Responsibilities #11 - Page 24: Please clarify expectations regarding onsite participation. Are key project resources expected to be onsite, hybrid, or primarily remote, and are there minimum onsite attendance requirements for specific project phases or roles?

NSBU does not have any expectations regarding the staffing model for onsite, hybrid, or primarily remote. NSBU expects Proposers to leverage their experience performing the work described in the RFP when preparing their staffing models.

55) Scope of Services / High-Level Phases and Milestones - Pages 20, 25, 26: Please clarify implementation ownership expectations. Is the selected Service Provider

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 19 RFP 16-26 Addendum No 2 expected to directly perform ERP and SIEM implementation activities, or provide advisory, project management, testing, governance, and oversight services while implementation activities are performed by selected ERP and technology vendors?

Please see answer to Question #10 above. Furthermore, In the event of a technical dispute, configuration conflict, or interoperability failure between the ERP software vendor, the SIEM software vendor, and/or third-party integration partners, the Service Provider shall serve as the primary investigative and resolution lead. The Service Provider shall:

• Diagnose the Root Cause: Conduct immediate technical root-cause analysis to isolate the organ of the conflict or performance degradation.

• Formulate Remediation Paths: Develop and document viable engineering workarounds or configuration adjustments that preserve system functionality without compromising the project timeline.

• Direct Multi-Vendor Resolution Meetings: Convene and chair technical resolution panels with all affected vendors to drive a unified solution.

• Escalate to NSBU: Within 48 hours of identifying an impasse, submit a formal technical impact assessment and recommended path forward to the NSBU Project Manager (or designee) for final administrative determination. The Service Provider’s failure to resolve tor promptly escalate multi-vendor technical deadlocks shall not relieve the Service Provide of its milestone delivery obligations.

As a condition of NSBU final acceptance, the Service Provider shall conduct comprehensive knowledge transfer and technical training to ensure that NSBU personnel are entirely proficient to:

• Operate the ERP and SIEM systems by independently executing all daily administrative, core business, utility infrastructure, and cybersecurity operational workflows.

• Maintain the ERP and SIEM systems by performing all necessary technical configuration, security patching, and routine maintenance to prevent operational degradation. Necessary tasks may include verifying and validating Cloud Service Providers are adhering to Service Level Agreements if cloud-based ERP or SIEM solutions are used.

• Sustain the ERP and SIEM systems by managing long-term lifecycle viability, software upgrades, and infrastructure optimization.

56) Subcontractors - Page 28: If NSBU's current intent is to pursue a single-award approach, are teams consisting of a prime contractor and approved subcontractors acceptable and evaluated equally with firms providing all services internally?

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 20 RFP 16-26 Addendum No 2

Proposers should provide the delivery model (e.g., prime only, prime + subcontractors, etc.) they think is most viable to successfully accomplish the Statement of Work.

57) Scope of Work / Proposal Requirements - Pages 19-31: Did NSBU engage any third-party consulting firms, advisors, system integrators, ERP vendors, cybersecurity firms, or other external parties in the development of this RFP, scope of work, requirements, deliverables, evaluation criteria, or procurement strategy? If so, please identify those organizations and indicate whether they are eligible to participate in this procurement.

NSBU engaged a firm who is not eligible to participate in this procurement.

58) General Terms & Conditions (Award Language) - Pages 8, 32: The RFP states that NSBU reserves the right to make multiple or split awards. What evaluation criteria, business considerations, or project factors will NSBU use when determining whether to make a single award, multiple awards, or split awards?

59) Can NSBU provide a current inventory of systems, interfaces, and integrations?

Yes. Details will be provided to the selected Service Provider at the beginning of Phase 1.

60) Travel is mentioned for “Key workshops, stakeholder sessions, and go-live events.”

Is there a specific desired schedule/cadence for travel?

61) Should travel expenses be included in the pricing estimate, or should they be priced separately?

Please see response to Question #52 above.

62) Fixed Fee or Time and Materials pricing structure is identified on page 28, with requests per phase and deliverable. Is there a specific pricing structure or template we should utilize?

No. See response to Questions #27 and #52 above.

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 21 RFP 16-26 Addendum No 2

63) What systems are included within the AMI, OMS, GIS, CIS, WAMS, SCADA, HR, and payroll integration scope?

Current system interfaces to or from the existing ERP are in scope and include AMI, OMS, GIS, CIS, Workorder and Asset Management, SCADA and payroll. The existing HR system will be retained and operates separately from the ERP.

A quantity of 25 system interfaces should be used for the purpose of responding to the RFP.

64) Does NSBU have an estimated project budget for the consulting services in this RFP?

Please refer to the response provided for Question #1 above.

65) Is NSBU interested in change management services from the Service Provider in Phases 4 and 5 of the project?

66) Where should Staffing Roles/Resumes be included in the proposal?

Resumes may be included in the References Section.

67) Is the response for “Evaluation Criteria #6 Cultural Fit and Communication Effectiveness” intended to be its own standalone proposal section, or can the response be given throughout the other areas of the proposal?

Standalone Proposal Section.

68) The scope includes “the design and implementation of an enterprise SIEM integrated with the ERP and the Commission’s broader environment”. Can you please confirm if the consultant selected from this RFP is responsible for the implementation itself, or we are expected to be an advisor that will assist in selecting and advising on the implementation, similar to the ERP scope?

Pursuant to the RFP, Section B. Technical Requirements, “The Service Provider shall assess, design, and provide recommendations and implementation support for ERP functions…” and “The Service Provider shall design and implement an enterprise SIEM to support the new ERP and the Commission’s IT/OT environment…”. The method and approach to meet these requirements should be clearly described by the Proposer.

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 22 RFP 16-26 Addendum No 2

69) The RFP does not specify a required response format. We are structuring our proposal based on the evaluation criteria outlined on Page 30. Please confirm whether this approach is acceptable, or if the Commission expects a specific response format.

Confirmed.

70) The project timeline includes “RFP Development” as a phase. Please clarify what is meant by this activity and whether it should be included in the proposed timeline and cost estimate.

RFP Development means the work involved to prepare the purchasing packages for NSBU to procure the recommended ERP and SIEM solutions. Two separate procurements – one for the ERP and one for the SIEM – are anticipated.

71) Please clarify whether the Commission expects a Fixed Price, Time & Materials, or another pricing model for this engagement. If multiple pricing approaches are acceptable, please specify the preferred format for submitting cost estimates.

See response to Questions #27, #52, and #62 above.

72) Please clarify the pricing elements that should be included in the cost proposal (e.g., assessment, design, migration, implementation, training, support transition, travel, software/licenses, third-party costs, etc.) to ensure a complete and responsive submission.

Pricing elements to be included in the cost proposal are at the discretion of the Proposer and should clearly trace back to the RFP.

73) May proposers submit the cost proposal as a separate document from the technical proposal?

One proposal is preferred.

74) Please confirm whether the "certification of a drug-free workplace" referenced in the tie-bid preference provision refers to the "Certification of Drug-Free Workplace Form" included in this RFP package, or whether the Commission requires any additional supporting documentation or separate certification demonstrating compliance with Section 287.087, Florida Statutes?

P.O. BOX 100

NEW SMYRNA BEACH, FL 32170-010

IT CONSULTING SERVICES

Page 23 RFP 16-26 Addendum…