RFP 250000002044 - Bidder Questions and Answers.docx

Michigan.gov/MiProcurement

BIDDER QUESTIONS & ANSWERS

RFP 250000002044

Custom-built Agency-Wide Business application for the Department of Insurance and Financial Services and optional maintenance and support.

NOTE: RFP has been updated to include the following:

· New date for question responses and proposal deadline

· Section 3. Purpose updated to include “The State may request additional enhancement work after go-live.”

· Removal of all mentions of Transition In Bidders are responsible for using the correct RFP document when submitting their proposals.

The RFP cites several schedules. The only schedules available for download are Schedule A Specification Worksheets. Missing are at least D, E, and F.

Could you please post these at your convenience?

All other schedules are within the RFP 250000002044 document.

Are containerized solutions using Kubernetes (e.g., EKS, GKE, AKS) acceptable under the State's hosting guidelines?

Question Date: 2025-04-14 Containerized solutions are acceptable with hosting guidelines. Hosting selection will be at the discretion of the State of Michigan to determine most effective approach for functionality and financial needs for the department.

Vendor-built system should be designed to accommodate DIFS current staff count with consideration for larger use in the future. Benchmarks will be formulated alongside development.

Project Scope & Requirements

· Legacy System Details: Can you provide a more detailed technical description of the current legacy system(s) being replaced (architecture, technology stack, integrations, databases, etc.)?

· Project Objectives: What are the primary business and operational goals for this system replacement (e.g., modernization, scalability, compliance)?

· Third-party Integrations: What existing systems or third-party platforms must the new solution integrate with?

As stated in the RFP:

Legacy System: The current system is built in PowerBuilder with an Oracle backend. There are also an assortment of business systems built in Microsoft Access and other key business data stored in Excel and SharePoint

Project Objectives: The goal is a single system to support all of DIFS business processes. It is a modernization and consolidation of legacy systems

Third Party Integrations: Refer to the integration section listed in the RFP.

Technical Expectations

· Technology Stack Preferences: Are there any preferred technologies, languages, frameworks, or platforms (e.g., Microsoft stack, open-source solutions)?

· Data Migration: Will historical data need to be migrated from the legacy system? If so, can you provide data volumes or complexities?

· API Requirements: Are there existing API specifications we should know about, or is API development expected as part of the scope?

· Accessibility Standards: Are there specific federal/state accessibility standards the system must adhere to (e.g., WCAG 2.1)?

Tech Stack:

The State preference is Microsoft .NET Core C# following DTMB Policies, Standards, and Procedures (https://www.michigan.gov/dtmb/policies/it-policies). All NuGet packages or open-source solutions will be subject to licensing requisition, vulnerability scanning and enterprise approval for use. The agency is open to both desktop and web solutions.

Data Migration: Migration of historical data based on the retention schedule is in scope. The retention schedule information will be disclosed after the contract is signed. The data volume information is provided in the RFP.

API: Other than development of an API to integrate with the public facing portal, API development is not expected as part of scope of this effort. Use of existing APIs is expected.

Accessibility: As stated in the RFP - Bidder must acknowledge that all deliverables provided will be in conformance with World Wide Web Consortium (W3C) Web Content Accessibility Guidelines (WCAG) 2.1 Level AA specifications

Team Composition & Key Roles

· Time Allocation: What is the expected full-time equivalent (FTE) percentage for each key role over the duration of the project?

· Subcontractors: Are there restrictions on subcontractor usage or specific reporting requirements for subcontracted personnel?

· Background Checks: The RFP outlines various background check and security clearance requirements for proposed staff. Could the State clarify the specific background check requirements (e.g., level of clearance, fingerprinting, etc.) for key personnel? Additionally, is there any flexibility or waiver process available for staff to reduce some of the burden, especially if their roles are limited in access to sensitive data?

Time Allocation: Unsure of what this question is asking. Full-time employees are 100% allocated to the project. State does not have specific percentages in mind for vendor-managed employees as it is the vendors responsibility to meet the deliverables on the project, hence the vendor can manage their own resource allocations.

Subcontractors: Offshore resources are not permitted. For additional information regarding subcontractors within RFP see “Disclosure of Permitted Subcontractors”, Disclosure of GDBE Background Checks:

Refer to section 20 Contractor Personnel Requirements in Schedule A – Statement of Work. Vendor resources will be expected to complete and sign the DIFS Confidentiality Agreement.

Timeline & Milestones

· Go-Live Expectations: Is there a target go-live date or mandated delivery deadline?

· Response Deadline: Can the response deadline be extended an additional 2 weeks to allow for a detailed response to be crafted following the release of the Q&A?

Go-Live: The target date is predicated on the proposal. State is not dictating a date.

Response Deadline: The deadline has been extended two weeks.

Pricing & Budget

· Budget Expectations: Is there a defined or expected budget range for the project that vendors should be aware of?

· Optional Services: What are the expectations for the optional support and maintenance components (duration, SLAs, on-call availability)?

· Pricing Format: Can we confirm whether a time-and-materials, fixed price, or hybrid pricing model is preferred?

Budget: Information relating to budgeting on the project will not be disclosed during the bidding process.

Optional Serv: State would like a plan that includes staffing and cost of ongoing support and maintenance. On-call support is not required. DIFS expects the system to have 99.99% availability during regular business hours 7 AM to 7 PM.

Price Format: Time and material pricing is not acceptable and will not be given consideration. This will be a firm fixed price contract as indicated in Schedule B - Pricing.

Evaluation & Compliance

· Weighted Criteria Clarification: Can you clarify how "Schedule A – Business Specifications Worksheet" will be evaluated (e.g., binary met/not met, qualitative scoring)?

· Security Requirements: Can the State provide an example or template for the required Security Accreditation Process referenced in Schedule E?

· Performance Metrics: What SLAs or KPIs will the solution and vendor be held accountable for post-deployment?

· Subcontractor: The RFP references a 20% target for utilizing underserved subcontractors. Can the State clarify if this target is a requirement for all bidders or only applies if a subcontractor is being used to fill capacity or capability gaps? Additionally, is there a waiver or alternative accommodation available for certified small businesses?

Weighted Criteria Clarification: No further detail will be provided outside of what was communicated in the proposal instructions.

Security Requirements:

The security accreditation process mimics the federal government ATO process. It is a review of NIST 800-53 moderate and applicable regulatory controls.

Performance KPI:

We will be using State of MI standard project metrics, examples include Overall Project Status (green, yellow, red), Milestone and Task Progress as % Complete, Number of Project Issues by Priority, Number of Project Risks by Impact & Probability, Number of Project Change Requests, Budget vs Actual Cost and Industry Standard Testing Metrics. We will work with selected vendor to define metrics to be used for the project and ensure they are captured and reported on a consistent basis.

Subcontractor: As indicated per the RFP, “If contractors plan to utilize subcontractors to perform more than 20% of the deliverables under this contract, at least 20% of that subcontracted work must be awarded to Michigan-based Geographically Disadvantaged Business Enterprises (GDBE).

There is no waiver, etc.

What technology is the public facing portal “Portal Service” currently built on?

MS Internet Information Services (IIS), .NET, MS SQL Server, and Oracle.

The “Portal Service” is in reference to this Portal. They are one in the same.

Response Deadline: The deadline has been extended two weeks.

Text from RFP:

· From Page 61: "7.3 Contractor Technology Ownership and License. Ownership of all Contractor Technology, including all Intellectual Property Rights therein, is and will remain with Contractor, subject to the following licenses:

(a) Contractor hereby grants to the State such rights and licenses with respect to the Contractor Technology that will allow the State to use and otherwise exploit perpetually throughout the universe for all or any purposes whatsoever the Deliverables to the same extent as if the State owned the Contractor Technology, without incurring any fees or costs to Contractor (other than the Fees set forth under this Contract) or any other Person in respect of the Contractor Technology."

· From page 81: "(a) Contractor has all necessary rights, title, and/or licenses required to create, develop, or generate Work Product and to transfer all ownership rights in Work Product to the State as set forth in Section 7."

Any IT professional services contract terms and conditions items will be addressed during evaluations or negotiations if necessary.

Section 20

As highlighted above, to expedite implementation, we may leverage our proven proprietary frameworks and components. Some team members involved in implementing these proprietary tools may provide support from offshore locations, but they will have no access to client data or confidential information. Hope it aligns with the State’s data security requirements.

Could you please clarify whether such offshore resources—who do not access confidential data—are required to meet background check requirements, or are those requirements applicable only to key personnel with access to sensitive state data?

The State is expecting a fully customized solution that must be built in the United States. The State is not interested in any proprietary frameworks.

Per section 20, Background checks are required for all staff identified for assignment to this project. This includes Contractor personnel that will have access to or have the ability to control access to State Data.

You have noted that the State will provide First Line Support prior to submitting a Service Request for Second Line Support from the contractor.

Could you please clarify if the contractor is expected to provide only technical support to ensure the application is up and running, or does the support also include assisting end-users—post-training—with application usage queries and administrative tasks?

The State is open to proposals for ongoing support as they are willing to explore options presented by the bidder. Ongoing support proposals for post-go-live ongoing vendor support should include maintenance and operations. It is expected that administrative tasks will be handled by the State. State will provide ongoing training after go-live.

· Will the State be responsible for all infrastructure-related support, including backups, with the vendor only responsible for deploying and ensuring the application is up and running? Or is there any additional scope of responsibility expected from the vendor?

· In this scenario, should we exclude infrastructure-related costs from our proposal?

Additionally, can the contractor propose its own hosting environment within the RFP guidelines, subject to State approval? If so, should the infrastructure cost be included as part of the overall project cost?

The State of Michigan will host the solution. The State is responsible for infrastructure.

The State is not considering a vendor-hosted solution and no infrastructure-related costs for hosting should be included in any proposal.

The State preference is Microsoft .NET Core C# following DTMB Policies, Standards, and Procedures (https://www.michigan.gov/dtmb/policies/it-policies). All NuGet packages or open-source solutions will be subject to licensing requisition, vulnerability scanning and enterprise approval for use. The agency is open to both desktop and web solutions.

In Section 20 of the RFP it states Offshore Resources. Use of Offshore Resources is prohibited per the Schedule E – Data Security Requirements. Contractor must comply with the data security and other requirements in this Contract.

Does the proposed application need any data to be encrypted?

IF Yes, Does State require the vendor to propose solution for encrypting data for any sensitive data OR are there any existing services with State that can be leveraged. Please clarify.

All data classified as sensitive must encrypted inflight/at rest. The State has standards expected for RDBMS and algorithms for development which will be provided after signed contract with a selected vendor.

· Primary Business Function lists

· Business Process flows

Documentation under development includes:

· Obase business rule extracts

· non-Obase business rule extracts

· Report and Inquiry rule extracts Any user manuals or training videos available regarding the legacy systems will be provided after a contract is signed with a selected vendor although much of this information is not up to date. State resources can assist in providing insight on the current system.

Office of Appeals, Legal Research, and Market Regulation (OALRMR) Office of Banking (OB) Office of Communications (OC) Office of Consumer Finance (OCF) Office of Consumer Services (OCS) Office of Credit Unions (OCU) Office of Financial and Administrative Services (OFAS) Office of General Counsel (OGC) Office of Innovation and Research (OIR) Office of Insurance Evaluation (OIE) Office of Insurance Licensing, Investigations, and Audit (OILIA) Office of Insurance Rates and Forms (OIRF) The Directors Office is part of DIFS. The list of other offices is correct.

With regards to Integration, this information is detailed in the RFP in section 12.

State of Michigan leaves open the possibility of maintaining existing Oracle database and not requiring migration of data.

Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production

What is the reason, SOM wants to maintain in Oracle DB? With all the additional business line functionality, will it not modify the existing data model? Please clarify your thought process.

The data is already in Oracle and the structure is sound. It is proposed that the State will see a time/cost savings by maintaining the current database structure with minor modifications made to meet departmental goals with entity management.