RFP 260000002346 - MiConnect - Bidder Questions w SOM Response V2 8-24-26.xlsx
XLSX spreadsheet 66 KB Posted
- Attached to
- MDHHS - MiConnect Maintenance & Support RFP
- Solicitation number
- RFP 171 260000002346 3
- Issued by
- Michigan
About this file
This is a bidder questions and state response document for RFP 260000002346 issued by the State of Michigan, Department of Health and Human Services (MDHHS) and Department of Technology, Management & Budget (DTMB), concerning maintenance and operations services for the MiConnect system. The solicitation requests a comprehensive managed service to support the MiConnect solution, which operates on Salesforce Cloud Platform and Amazon Web Services (AWS) infrastructure, serving approximately 87,325 concurrent public citizen users and processing approximately two million daily portal records and two million monthly AWS transactions. The contract includes a base term with five (5) option years, with an anticipated contract start date of May 3, 2027, following a 180-day transition-in period. The proposal deadline was extended to September 18, 2026, at 3:00 p.m. EST. A single award will be made for all maintenance and operations services, and transition-in activities will commence immediately upon contract execution.
The contractor must provide 137,676 billable hours annually allocated across multiple roles including developers (37%), testers (28%), business analysts (12%), production support analysts (5%), and supporting specialized roles such as AWS configuration specialists, architects, and integration developers. Monthly pricing should be submitted in Schedule B and must be all-inclusive of travel, on-site attendance, after-hours support, software tools, training, and transition activities. The State will provide licenses for approved tools including Provar, Selenium, SonarQube, Figma, and ELK, while the contractor must maintain a minimum of 80% Apex code coverage and meet a defect density acceptance standard of 0.5. The incumbent contractor information is available under current contract MA071B5500113C; incumbent personnel may transition to the new contractor with State facilitation. The solution must maintain 99.5% uptime (excluding Salesforce and AWS platform outages), meet critical service error response and resolution metrics defined in Schedule D, and comply with FedRAMP requirements as the system is hosted on Salesforce Government Cloud. All work must be performed within the United States with no offshore or nearshore resources permitted, and contractors must comply with IRS Publication 1075 residency requirements for personnel handling Federal Tax Information. The State anticipates approximately 5-10% annual growth in record volume and transactions over the contract term.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFP 260000002346 - MiConnect - Bidder Questions w SOM Response V1 8-11-26.xlsx | XLSX spreadsheet | |
| MDHHS - RFP 260000002346 - MiConnect Maintenance & Support.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Question # | Bidder Question | State of Michigan Response |
| 1 | Who are the incumbent Contractor currently supporting MiConnect Maintenance and Operations? | Please see the current contract (MA071B5500113C) for more information. |
| 2 | How many contractor resources (by role) are currently assigned under the existing contract, and will incumbent staff be permitted to transition to the newly awarded Contractor? | For current roles, please refer to the current contract (MA 071B5500113C) for more information. |
| 3 | Are price increases permitted during the 5 option years, and if so, is there a cap tied to CPI or another index? | Price increases are not encouraged, but are permitted. |
| 4 | Is this solicitation a rebid or replacement of an existing MiConnect M&O contract, and is funding already approved with an estimated annual/total budget? | Please see the current contract (MA071B5500113C) for more information. |
| 5 | What challenges or service gaps has the State experienced under the current contract? | This information is not needed to complete your bid. |
| 6 | Can the State share historical annual/total spend, or the incumbent's current pricing/rate card, as a benchmark for this proposal? | Please see the current contract (MA071B5500113C) for more information. |
| 7 | Please provide the current Salesforce org architecture, including the number of production orgs and sandbox environments (Developer, Partial Copy, Full Copy), and how the MI Bridges portal and case-management functions are deployed across these environments. | There are two production orgs and six sandbox environments, and deployments are handled through the Azure DevOps release pipeline. |
| 8 | Please provide current Salesforce licensing counts and edition details for Service Cloud, Marketing Cloud, Experience Cloud, and any other provisioned clouds, broken out by license type (internal, partner, Experience Cloud/Community, Guest/Public). | The State will provide this information upon award. |
| 9 | Please confirm whether Salesforce metadata is managed through a version-controlled repository (metadata-as-code) or maintained directly in the org, identify the repository and DevOps tooling used to move code between Salesforce environments (e.g., sandbox to production), and describe how source control and branching are governed. | Yes, and this is being handled through Azure DevOps |
| 10 | Please confirm whether Salesforce org-wide administration — including security/sharing settings, license provisioning, and AppExchange package management — is retained by DTMB/MDHHS or transferred to the awarded contractor. | Yes, it will be retained by DTMB/MDHHS |
| 11 | Please confirm whether a Salesforce technical debt assessment or platform health review (e.g., Salesforce Optimizer, Health Check) has been conducted within the past 12 months, and identify any known technical debt — such as deprecated Workflow Rules/Process Builder automations not yet migrated to Flow, unused custom objects, components running on outdated API versions, or storage limits approaching capacity. | Yes |
| 12 | Please provide a Salesforce component inventory reflecting the scale and complexity of the current org — including approximate counts of custom objects/fields, Apex classes and triggers (with total lines of code, if available), Flows, Lightning Web Components, Visualforce pages, and installed AppExchange packages. | The State will provide this information upon award. |
| 13 | Please confirm whether State employees (e.g., recruiters, admissions/case staff) currently use the Salesforce Mobile App for case management, and if so, describe any custom mobile-specific Lightning layouts, offline access, or push-notification configurations in place. | No |
| 14 | Please confirm whether a native mobile application (distinct from the responsive MI Bridges web portal) exists or is planned that pulls data from Salesforce via API for public citizen use, and if so, describe its current scope and whether ongoing Contractor support is included in this Contract. | The mobile app is planned for development at this time, and ongoing support would be included in this contract. |
| 15 | Please confirm whether Salesforce production support requires 24x7 coverage for Critical Service Errors, consistent with the severity definitions in Schedule D. | No |
| 16 | Please identify Salesforce-native security and observability features currently deployed — including Salesforce Shield (Event Monitoring, Field Audit Trail, Platform Encryption), the org's current Health Check score, and any third-party Application Performance Monitoring tools in use. | Salesforce Shield |
| 17 | Please provide historical Salesforce-specific Support Request volume and severity distribution for the past 12 months, distinct from AWS/Azure-side incidents. | The State will provide this information upon award. |
| 18 | Please identify the number of Agile/Scrum teams currently dedicated to Salesforce work, and provide the historical split of Salesforce effort between production/break-fix support and enhancement/development work over the past 12 months. | The State will provide this information upon award. |
| 19 | Please confirm whether Salesforce-to-AWS integrations are built through middleware (e.g., MuleSoft), native Salesforce outbound/inbound API calls, Platform Events, or AWS-triggered callouts. | The State will provide this information upon award. |
| 20 | Please provide the current inventory of Salesforce integrations, including data direction (inbound/outbound) and sync frequency for each connected system. | The State will provide this information upon award. |
| 21 | Please confirm whether the State anticipates expanding Salesforce-native integration capabilities, such as Data Cloud ingestion or MuleSoft Anypoint, beyond current scope during the contract term. | Not using |
| 22 | Please confirm whether Amazon Connect (referenced in Sec. 19, p.108) is integrated with the Salesforce org via Service Cloud Voice or a CTI adapter for Omni-Channel case/voice/chat routing, and clarify what "centralized messaging capabilities" (Sec. 2, p.93) means in practice — specifically, which channels are unified today, and whether configuration of this integration falls within the Contractor's Salesforce scope or a separate AWS/contact-center scope. | No |
| 23 | Please confirm which Salesforce marketing product is currently in use — Marketing Cloud Engagement (formerly ExactTarget) or Marketing Cloud Account Engagement (formerly Pardot) — as these require different technical skill sets to support. | Marketing Cloud Engagement |
| 24 | Please provide the approximate monthly volume of active journeys/automations, email sends, and SMS/text campaigns currently running in Marketing Cloud. | 10K email/month |
| 25 | Please confirm how Marketing Cloud is integrated with the core Salesforce org (e.g., Marketing Cloud Connect) and with the AWS-based texting service referenced in Sec. 11. | Marketing Cloud Connect |
| 26 | Please confirm the correct product name and describe the business purpose of "Blackthorne Events" within MiConnect (believed to reference the Blackthorn Events AppExchange package), and confirm whether ongoing Contractor support of this package is included in the required Salesforce maintenance scope. | Blackthorne Events, Yes |
| 27 | Please identify the Salesforce-specific CI/CD and deployment tooling currently used to promote Apex, Flows, and Lightning components between sandboxes and production. | Through the Azure DevOps release pipeline |
| 28 | Please provide the current Salesforce production deployment frequency. | Monthly |
| 29 | Please provide the current Apex code test coverage percentage and the percentage of Salesforce regression testing that is automated via Provar or Selenium. | 80% |
| 30 | Please confirm how sensitive data fields within Salesforce (e.g., PII, health/benefits eligibility data) are protected through field-level security, sandbox data masking, or platform encryption. | Salesforce Shield |
| 31 | Please clarify vulnerability scanning and remediation expectations specific to custom Apex code and Salesforce configuration, including current SonarQube usage. | Critical, High, and Mediam must resolved |
| 32 | Please provide recent audit observations or remediation backlog items specific to the Salesforce org's security configuration, including profiles, permission sets, and sharing rules. | The State will provide this information upon award |
| 33 | Please confirm whether the MiConnect Salesforce org is hosted on Salesforce Government Cloud (or Government Cloud Plus), and if so, which FedRAMP authorization level (Moderate or High) applies; if not, confirm which hosting arrangement currently satisfies Schedule E's FedRAMP/NIST 800-53 requirements. | Salesforce Government Cloud |
| 34 | Please identify Salesforce-specific performance KPIs currently measured, such as page load times, batch/Apex job completion times, and API response times. | The State will provide this information upon award |
| 35 | Please confirm whether the Salesforce org has encountered known governor-limit constraints (e.g., SOQL query limits, CPU time limits, API call limits) given the approximately 2 million daily records cited in the SOW. | No |
| 36 | Please identify the anticipated annual growth rate in Salesforce record volume and transaction count. | Approximately 5-10% growth is expected. |
| 37 | Please confirm whether a third-party Salesforce backup/archiving tool (e.g., OwnBackup, Odaseva) is used in addition to the native Salesforce recovery capabilities referenced in Schedule D, Section 7. | No |
| 38 | Please provide the recovery-exercise frequency and results of the most recent Salesforce data-recovery test, if applicable. | The State will provide this information upon award |
| 39 | Please confirm whether Salesforce-native AI capabilities, such as Einstein, Agentforce, or Data Cloud, are currently deployed within the MiConnect Salesforce org. | No |
| 40 | Please confirm whether the State is open to the contractor's use of AI tools to analyze and document the existing Salesforce codebase (Apex, Flows, Lightning Web Components) for onboarding, dependency mapping, and technical-debt assessment. | The State will provide this information upon award |
| 41 | Please confirm whether the State is open to AI-assisted tools being used within the software development lifecycle for ongoing Salesforce support and maintenance delivery, including code review, automated test-case generation, and defect triage, subject to State data security and AI governance requirements. | The State will provide this information upon award |
| 42 | Please describe the approval process, if any, for introducing AI-powered development or support tools into the Salesforce environment specifically. | See Section 24 - Artificial Intelligence under the IT Professional Terms & Conditions and the attached Acceptable Use of Information Technology Standard 1340.00.130.02 document. |
| 43 | Please identify preferred or required Salesforce certifications for the Programmer and Architect roles, such as Platform Developer I/II, Administrator, Application Architect, or Marketing Cloud Administrator. | Preferred |
| 44 | Please provide existing Salesforce-specific technical documentation, including data model diagrams, Apex/Flow inventories, integration maps, and configuration runbooks. | The State will provide this information upon award |
| 45 | Please clarify what percentage of the 137,676 annual hours is expected to be dedicated to Salesforce platform engineering and support versus AWS/Azure-side work. | Primarily it is Salesforce support. However, the workload will vary; the State will direct and prioritize work. |
| 46 | Please confirm whether any federally funded modernization initiatives are planned that may expand Salesforce scope, such as new clouds, Data Cloud, or Agentforce, during the contract term. | No |
| 47 | Please provide the current MiConnect support organization, including State resources, contractor resources, and role distribution for maintenance, operations, and enhancements. | Please see the current contract (MA071B5500113C) for more information. |
| 48 | Please confirm whether the incumbent contractor will support a formal transition period, including documentation transfer, knowledge-transfer sessions, and shadowing. | Yes, there will be a 180 day transition-in period. |
| 49 | Please provide historical onboarding and knowledge-transfer metrics from prior MiConnect transitions. | The State is unable to provide this information. |
| 50 | Please provide current backlog statistics, including user stories, enhancements, production defects, technical debt, and audit remediation items. | Please see Section 18 in the Statement of Work for more information regarding capacity needs. |
| 51 | Please provide the average sprint velocity for the past 12 months and the number of Agile teams currently supporting MiConnect. | This information is not needed to complete your bid, as this information varies. The State can provide this upon award. |
| 52 | Please provide the historical annual effort allocation across production support, maintenance, regulatory changes, enhancements, and modernization or refactoring. | Please see Section 18 in the Statement of Work for more information regarding capacity needs. |
| 53 | Please provide current Salesforce licensing counts and environment inventory for Service Cloud, Marketing Cloud, sandboxes, developer environments, and Experience Cloud. | 1. DEV (2) |
2. SIT (2)
3. UAT (2)
4. PREPROD (1)
5. PROD (1)
| 54 | Please provide the current AWS service inventory, monthly spend, and major workloads hosted in the AWS tenant. | The State will provide this information upon award. |
| 55 | Please provide the approximate number of external systems and APIs currently integrated with MiConnect. | Inbound Calls: 37 |
Outbound Calls: 42
| 56 | Please provide Schedule D SLA requirements, including severity definitions, response times, resolution expectations, and availability targets. | This information is available in Schedule D. |
| 57 | Please provide production-support metrics for the past 24 months, including ticket volume, severity distribution, after-hours incidents, and emergency releases. | The team works at the State's direction. Work will vary. On average, annual 28% production support resources. |
| 58 | Please confirm when non-public PSP security standards will be available after NDA execution. | If the non-public PSPs are required, please contact the Solicitation Manager. |
| 59 | Please provide summaries of open audit findings, security findings, and remediation obligations impacting MiConnect. | The State is unable to provide this information. |
| 60 | Please clarify the anticipated onsite versus remote percentage for contractor resources under the current work model. | Please see Section 20 - Contracter Personnel Requirements for onsite requirements. |
| 61 | Please provide historical turnover rates for contractor resources supporting MiConnect over the past three years. | This information is not needed to complete your bid. |
| 62 | Please clarify expected State personnel participation in requirements definition, UAT, sprint reviews, and production-support triage. | Business and DTMB participate in all listed activities. |
| 63 | Please provide existing report templates, dashboards, and Azure DevOps metrics used for MiConnect governance. | Please see the RFP for more information regarding ADO metrics. The State will provide report templates upon award. |
| 64 | Please identify approved initiatives, legislation, CMS mandates, or program expansions expected to materially increase workload during the first three contract years. | The State is unable to provide this information. |
| 65 | Please identify anticipated architectural modernization initiatives during the contract term, including integration-platform migration, Salesforce upgrades, cloud transformation, AI adoption, or contact-center modernization. | The State is seeking a partnership to support all of these activities. The workload will vary; the State will direct and prioritize work. |
| 66 | Please confirm whether an approved AI governance framework exists and whether contractors may use AI-assisted development, testing, documentation, code analysis, and operational-support tools. | See Section 24 - Artificial Intelligence under the IT Professional Terms & Conditions and the attached Acceptable Use of Information Technology Standard 1340.00.130.02 document. |
| 67 | Please confirm whether approved AI technologies may be used to improve software quality, test automation, knowledge transfer, documentation, and production-support efficiency. | See Section 24 - Artificial Intelligence under the IT Professional Terms & Conditions and the attached Acceptable Use of Information Technology Standard 1340.00.130.02 document. |
| 68 | Please confirm whether the State will consider contractor recommendations for AI-enabled improvements to citizen experience, self-service, accessibility, support operations, or workforce productivity. | See Section 24 - Artificial Intelligence under the IT Professional Terms & Conditions and the attached Acceptable Use of Information Technology Standard 1340.00.130.02 document. |
| 69 | Please provide the current AWS architecture diagram, including accounts, VPCs, networking topology, Transit Gateway usage, load balancers, security services, and MiConnect application dependencies. | The State will provide this information upon award. |
| 70 | Please provide the number of AWS accounts used for Production, UAT, QA, Development, and Shared Services environments. | The State will provide this information upon award. |
| 71 | Please confirm whether AWS Control Tower or a custom AWS Landing Zone is implemented and identify the governance controls currently enforced. | The State will provide this information upon award. |
| 72 | Please clarify whether AWS environments are managed through Infrastructure as Code, such as CloudFormation, Terraform, or CDK, or through manual administration. | Yes, this is managed through Infrastructure as Code. |
| 73 | Please clarify which AWS operational responsibilities remain with DTMB and which responsibilities are expected of the awarded contractor. | The State is seeking a partnership to support all of these activities. The workload will vary; the State will direct and prioritize work. |
| 74 | Please identify the AWS services currently in production that the contractor will be expected to support. | The workload will vary; the State will direct and prioritize work. |
| 75 | Please clarify whether the contractor will have administrative access to AWS accounts or operate under State-controlled administrative teams. | State controlled access will be granted. |
| 76 | Please confirm whether AWS production support requires 24x7 coverage for critical incidents. | Yes, depending on the application. |
| 77 | Please confirm whether CloudWatch, X-Ray, AWS Health Dashboard, CloudTrail, or third-party tools are used for monitoring and observability. | ELK will be utilized for monitoring currently, but this is subject to change. |
| 78 | Please provide historical AWS incident volumes, severity distribution, and average monthly ticket counts. | This information is not needed to complete your bid. |
| 79 | Please identify currently deployed AWS security services, including Security Hub, GuardDuty, Inspector, Macie, IAM Identity Center, AWS WAF, and Shield Advanced, if applicable. | This information is not needed to complete your bid. |
| 80 | Please identify the federal and State compliance frameworks applicable to the AWS environment, including CMS, IRS Publication 1075, HIPAA, NIST 800-53, and FISMA, if applicable. | Please see the contract for this information. |
| 81 | Please clarify vulnerability scanning and remediation expectations for AWS-hosted resources. | The State is seeking a partnership to support all of these activities. The workload will vary; the State will direct and prioritize work. |
| 82 | Please clarify encryption requirements for data at rest, data in transit, key management, and KMS administration. | Please see Schedule E - Data Security Requirements for this information. |
| 83 | Please provide recent audit observations or remediation backlogs related to AWS infrastructure. | The State will provide this upon award. |
| 84 | Please describe how Salesforce is currently integrated with AWS services. | The State is using Amazon Connect to integrate. |
| 85 | Please identify AWS-native integration services currently in use, including API Gateway, Lambda, Step Functions, EventBridge, and SNS/SQS, if applicable. | The State is currently using Lambda. |
| 86 | Please provide the number of external State, federal, or third-party systems that integrate with AWS components supporting MiConnect. | This information can be provided upon award. |
| 87 | Please provide the current integration inventory for inbound and outbound AWS data exchanges. | This information can be provided upon award. |
| 88 | Please confirm whether the State anticipates expanding AWS-native capabilities beyond the current scope during the contract term. | Nothing is planned at this time. |
| 89 | Please identify the DevSecOps and CI/CD tools currently used, including Azure DevOps, GitHub, GitLab, Jenkins, and AWS CodePipeline, if applicable. | Please see Section 11 - Integrations for further details. |
| 90 | Please provide the current production deployment frequency for AWS-hosted components. | Frequency is dependant on the requirement and varies. |
| 91 | Please provide the percentage of application and infrastructure testing that is currently automated. | For application testing, around 50-60%. The State does not do any infrastructure testing. |
| 92 | Please clarify whether AWS infrastructure deployments are automated or manually executed. | Automated; but this is done by the State's CTO team. The State is seeking a partnership to support the State with these activities. |
| 93 | Please identify the repositories containing AWS infrastructure and application code and describe how they are governed. | The State will provide this information upon award. |
| 94 | Please provide the anticipated annual growth rate for the approximately 2 million monthly AWS transactions referenced in the RFP. | Approximately 5-10% growth is expected. |
| 95 | Please identify the AWS-based performance KPIs currently measured. | This information can be provided upon award. |
| 96 | Please confirm whether existing AWS environments have known capacity bottlenecks. | No bottlenecks are currently known. |
| 97 | Please provide the required Recovery Time Objectives and Recovery Point Objectives for AWS-hosted workloads. | Each one of our systems has a different RPO/RTO times. The State will provide this after award. |
| 98 | Please confirm whether MiConnect AWS workloads are deployed across multiple availability zones or multiple AWS Regions. | Yes, it is deployed in multiple availability zones. |
| 99 | Please provide the current AWS disaster-recovery architecture and testing procedures. | The State will provide this information upon award. |
| 100 | Please identify AWS-native backup solutions currently used, including AWS Backup, S3 versioning, and snapshot strategies, if applicable. | This information can be provided upon award. |
| 101 | Please provide the recovery-exercise frequency and the results of the most recent recovery test. | The State will provide this upon award. |
| 102 | Please confirm whether AI or ML services are currently deployed within the AWS tenant. | No. |
| 103 | Please confirm whether MDHHS anticipates using AWS AI services, including Amazon Bedrock, SageMaker, Textract, Comprehend, or Connect AI capabilities, during the contract term. | The State is open to considering these. See Section 24 - Artificial Intelligence under the IT Professional Terms & Conditions for details on the approval process for AI tools. |
| 104 | Please describe the approval process for introducing AI-powered capabilities into the MiConnect environment. | See Section 24 - Artificial Intelligence under the IT Professional Terms & Conditions and the attached Acceptable Use of Information Technology Standard 1340.00.130.02 document. |
| 105 | Please identify preferred AWS certifications for key technical roles supporting the AWS tenant. | The State is seeking a partnership to support all of these activities. The workload will vary; the State will direct and prioritize work. |
| 106 | Please provide existing AWS knowledge-transfer artifacts, including runbooks, architecture diagrams, operational procedures, and support documentation. | The State will provide this information upon award. |
| 107 | Please clarify what percentage of the 137,676 annual hours is expected to be dedicated to AWS operations and engineering support. | The workload will vary; the State will direct and prioritize work. |
| 108 | Please confirm whether any federally funded modernization initiatives are planned that may expand AWS scope during the contract term. | No federally funded modernization initiatives planned at this time. |
| 109 | Please clarify the recurring duties expected of the 0.5 FTE Contractor Security Officer (e.g., SSP and POAM maintenance, scan result analysis, secure SDLC oversight, audit liaison), and confirm how this role is to be priced in Schedule B given Schedule A Section 19 states it is not included in the Contractor resource capacity. | The duties expected of the Security Officer relate to the Contractor personnel and that Support Staff comply with all security measures. The managed service team is expected to support the SSP, POAM, maintenance, etc. |
| 110 | Please identify which security monitoring functions — including operation of the Elastic Stack (ELK) referenced in Schedule A Section 11, SIEM content engineering, and 24x7 security event triage — are performed by DTMB and Michigan Cyber Security versus the Contractor, and confirm which party owns Elastic Stack administration and license renewal. | The State is seeking a partnership to support all of these activities. The workload will vary; the State will direct and prioritize work. |
| 111 | Please confirm whether security incidents affecting MiConnect are classified and managed under the Schedule D Service Level Table or under a separate State incident response process, and describe the Contractor's expected role in security incident triage, containment, and root cause analysis. | Yes, security incidents are classified under Schedule D. |
The State is seeking a partnership to support all of these activities. The workload will vary; the State will direct and prioritize work.
| 112 | Please confirm whether the State anticipates requiring Contractor-performed penetration testing under Schedule E Section 9.4(b), including expected frequency and scope, and whether such testing is to be priced within the annual billable hours or handled through a separate SOW. | For Cloud hosted solutions it is the hosting provider's responsibility to provide penetration testing. |
| 113 | Please confirm whether the DAST, SAST, and SCA obligations in Schedule E Section 9 apply to the SaaS-hosted Salesforce components of the State-owned MiConnect Solution; identify which DAST operating model in Section 9.1 (State-performed scanning or Contractor-performed quarterly scans) is in effect; and confirm whether the required application scanning tool licenses are State-furnished or Contractor-furnished. | Section 9.1 refers to obligations to scan Contractor provided software. The managed team would be expected to support the State with scanning. The State would furnish the licenses. |
| 114 | Please confirm whether a control responsibility matrix exists delineating the NIST 800-53 MOD controls inherited from Salesforce, AWS, and State-managed infrastructure versus the controls the Contractor must implement and evidence under the Schedule E Section 6 Security Accreditation Process. | The State will provide this information upon award. |
| 115 | Please confirm the current authority to operate (ATO) status of the MiConnect Solution, the number of System Security Plan boundaries it comprises, and the timing of the next annual control reassessment under Schedule E Section 6. Please also identify the State's automated GRC platform referenced in that section. | MiConnect ATO has been published 04/17/2026. The State will provide this information upon award. |
| 116 | Please confirm that the FedRAMP authorization, annual SSAE 18 SOC 2 Type II audit, and Uptime Institute Tier 3 data center requirements in Schedule E Sections 5.1, 5.2, 5.5, and 8.3 apply only if the Contractor itself provides Hosted Services, given the MiConnect Solution is hosted in State-controlled Salesforce and AWS environments. | Contractor is not responsible for hosting; but they are responsible to ensure audit compliance. |
| 117 | Please identify the data classifications present in each MiConnect component, including whether PHI, PII, Federal Tax Information, SSA-provided data, CJIS data, or payment card data is stored or processed in Salesforce Service Cloud, Salesforce Marketing Cloud, the AWS tenant, and the Azure SQL database, respectively. | All of these could be involved under this contract. |
| 118 | The title of Schedule E, Attachment 1 references PCI, CEPAS, CJIS, and SSA requirements, but the attachment text contains only the IRS Security Requirements. Please provide the corresponding PCI, CEPAS, CJIS, and SSA requirement documents (or confirm each does not apply to this Contract), and confirm whether CMS MARS-E / Acceptable Risk Safeguards obligations flow down to the Contractor. | The title of Schedule E Attachment 1 was in error - the correct title should have been IRS Security Requirements. |
The corresponding audit requirements are publicaly available by the source. The Acceptable Risk Safeguard obligations flow down to the Contractor.
| 119 | Please confirm whether the Michigan State Police background check and RI-8 Fingerprint Card referenced in Schedule A Section 20 are required for this project, and provide the typical adjudication timeline for the required background checks. | Yes, the listed background checks are required. |
| 120 | Please confirm whether audit support, POA&M creation and remediation, and annual control reassessment activities required at no additional cost under Schedule E Section 6 are to be performed within the 137,676 annual billable hours, and provide the number of external audits and security assessments conducted against MiConnect in a typical year with the historical contractor support effort for each. | Yes. |
The State will provide that information upon award.
| 121 | Please identify whether the State provides an enterprise privileged access management or secrets management solution that Contractor Personnel must use for privileged and service account credentials across Salesforce, Azure, and AWS, and clarify which party owns issuance, rotation, and storage of the service accounts, API keys, and certificates supporting the integrations described in Schedule A Section 11. | Yes, the State can provide (and owns) privileged access management, and can provide as needed. |
| 122 | Please clarify the division of responsibilities between the Contractor and the DTMB MiLogin team for maintaining the MiConnect–MiLogin federation, specifically whether the Contractor performs identity-provider-side configuration changes (SAML/OIDC connection updates, certificate rotation, attribute mapping) or supports only the Salesforce service-provider side. | The State is seeking a partnership to support all of these activities. The workload will vary; the State will direct and prioritize work. |
| 123 | Schedule E Sections 5.3 and 5.4 and the Contract Terms require U.S. work authorization and performance from within the United States. Please confirm whether any data category on this Contract, including Federal Tax Information under IRS Publication 1075 or SSA-provided data, imposes U.S. citizenship or lawful permanent residency requirements on Contractor Personnel beyond these stated requirements. | IRS Pub. 1075 does impose residency requirements. |
| 124 | Please provide the typical end-to-end lead time and approval workflow for provisioning a new Contractor resource with all required access (State network account, MiLogin, Salesforce, Azure DevOps, Clarity PPM, and AWS), and confirm whether provisioning requests may be initiated at Contract execution to support the kickoff at Contract Execution plus 20 calendar days. | Provisioning requests should be addressed at the kickoff meeting. |
| 125 | Please confirm whether Salesforce Shield capabilities, including Platform Encryption, Event Monitoring, and Field Audit Trail, are currently licensed and deployed for the MiConnect Salesforce org, and identify which party administers the associated encryption keys. | Yes |
| 126 | Please identify which party administers Salesforce profiles, permission sets, role hierarchy, and day-to-day user account management for the admin and worker user populations identified in Schedule A Section 6, and describe the approval process for changes to these security configurations. | DTMB |
| 127 | Please clarify how the media sanitization and disposal certification requirements of Schedule E Section 5.13 (NIST SP 800-88) are to be satisfied for State Data residing in Salesforce, AWS, and Azure environments where physical media is owned and controlled by the cloud service providers, and whether cryptographic erasure and provider attestations are acceptable. | The State will provide this after award. |
| 128 | Please clarify where the 4.92 TB Azure SQL production database referenced in Schedule A Section 11 is hosted, and describe the division of responsibilities between DTMB and the Contractor for Azure subscription ownership, database administration, patching and tuning, capacity management, and cost management. | The State is seeking a partnership to support all of these activities. The workload will vary; the State will direct and prioritize work. Responsibility would be shared. |
| 129 | Schedule D Section 7 states the Disaster Recovery and Backup Plan is based solely on Salesforce processes and that backup environments outside Salesforce are out of scope. Please confirm whether the Contractor has any backup, disaster recovery, archival, or purge obligations for the Azure SQL production database, and if so, identify where those obligations and the associated recovery time and recovery point objectives are defined. | The State is looking for a partnership with a Contractor team to assist the State (at SOM's direction) in the case of such an event. Responsibility would be shared. |
| 130 | Please clarify the required end-user computing model for Contractor Personnel, given Schedule A Section 9 requires Contractor-provided laptops that are State imaged and connected to the State network, while Section 10 permits State-provided VDI or Contractor-managed workstations. For Contractor-provided devices, please identify which party performs and funds State imaging, patching, endpoint security administration, and account provisioning. | Models can vary; computers should have the appropriate computing power to perform tasks by role. |
For Contractor provided laptops/devices, the State will coordinate with the vendor to provide updates for imaged laptops.
| 131 | Please confirm whether regression testing and remediation for Salesforce's three annual seasonal releases are included within the 137,676 annual billable hours, and provide the historical effort consumed per seasonal release. | Yes |
| 132 | Please confirm which party owns, funds, and renews licenses for the State-approved tools referenced in Schedule A Sections 11 and 24.1, including Selenium, Provar, HP LoadRunner, SonarQube, Figma, and Blackthorn Events, and whether the load test infrastructure supporting runs of up to 2,000 concurrent users is State-provided. | The State. |
Yes, the State will provide that.
| 133 | Please confirm whether production data containing citizen PII, PHI, or FTI is currently replicated into Salesforce sandboxes or other non-production environments, and describe the existing environment refresh cadence and any data masking, de-identification, or synthetic test data processes and tools the Contractor must use or maintain. | Production PII data is not replicated to any lower environments. |
| 134 | Please identify which party administers Microsoft Power BI workspaces, data gateways, and dataset-level access controls for MiConnect reporting, whether reporting datasets contain citizen PII or PHI, and whether Power BI licensing is State-provided. | State managed & licensing provided. Datasets will vary. |
| 135 | Given that NGDI is a private cloud maintained by DTMB per Schedule A Section 1, please clarify which party is responsible for patching and version currency of MiConnect application-tier and middleware components deployed on or interfacing with NGDI, and for remediating MiConnect-side impacts when DTMB upgrades NGDI platform components. | The State is seeking a partnership to support all of these activities. The workload will vary; the State will direct and prioritize work. Responsibility would be shared. |
| 136 | Please clarify the basis for the 87,325 concurrent Public Citizen users stated in Schedule A Section 6, given Section 24.1 specifies load test runs of up to a maximum of 2,000 concurrent users, and describe how the State expects the concurrent-user capacity commitment to be validated. | Duplicate of 158. |
| 137 | Please confirm that Schedule D - Service Level Agreement applies in full to this Contract notwithstanding its State Hosted designation, given the MiConnect Solution is hosted on the Salesforce Cloud Platform and an AWS tenant rather than State infrastructure. | Confirmed. |
| 138 | Please confirm whether Service Errors caused by Salesforce, AWS, or Microsoft Azure platform-level outages are excluded from the Contractor's Service Level Metrics and the 99.5% uptime requirement, consistent with the infrastructure exclusions in Schedule D Section 6. | Confirmed, they are excluded. |
| 139 | Please confirm whether Service Level Credits under Schedule D Section 3 are subject to an aggregate monthly cap, and clarify how many missed Resolution metrics constitute the repeated failure that triggers material breach under Section 3.4. | Service Level Credits are not subject to a monthly cap. |
The other requested information is not needed to complete your bid.
| 140 | Please identify the ITSM or ticketing system that will serve as the system of record for Support Request receipt, Response, and Resolution timestamps under Schedule D, and confirm whether the State or the Contractor owns and administers that system and its SLA measurement data. | Azure Dev Ops and Helix |
| 141 | Please confirm whether the Support Request Resolution clock is suspended during periods when the Contractor is awaiting State actions, such as remote access provisioning under Schedule D Section 2.3, State-supplied data, or the State's written confirmation of Resolution acceptance. | The State expects open communication with ongoing issues; the State would consider pausing the clock during down periods as long as Contractor is transparent and partnering with the State in solving the issue. |
| 142 | Independent of the on-call coverage model, please confirm whether Schedule D Response and Resolution metrics for Critical Service Errors are measured in continuous calendar hours or accrue only during the defined Support Hours of 7 a.m. to 6 p.m. EST Monday through Friday, including on State holidays. | Critical Service Errors are measured in continous calendar hours. |
| 143 | Please confirm whether after-hours on-call standby time and night or weekend incident-response work count toward the 137,676 annual billable hours and the fixed monthly fee, given Schedule A Section 20 states that no overtime will be authorized or paid. | Yes after-hour support would be considered billable hours. |
| 144 | Please describe the change and release governance process for MiConnect production deployments, including who holds final deployment approval authority, and clarify how the Go/No Go reporting requirement in Schedule A Section 23 applies to emergency break-fix changes subject to the 4-hour Critical Service Error Resolution metric in Schedule D. | We will follow the AGILE process. |
| 145 | Please clarify the acceptance criteria and approval process the State will use to determine that Transition In is complete and the Contractor has assumed full support on day 181, including who formally certifies transition completion and the consequence if the State deems transition incomplete at day 180. | The formal plan will be developed in collaboration with the selected bidder and the State during the Transition-in period with milestone and dates. |
| 146 | Please confirm whether the formal Transition Out effort beginning approximately 12 months prior to contract end, including transition plan development, skill proficiency evaluations, formal DTMB training, and turnover activities, is to be performed within the 137,676 annual billable hours or priced as a separate line item in Schedule B. | Transition activities are to be performed within the 137,676 annual bilable hours. |
| 147 | Please confirm whether the DTMB Application Support team's Transition In Plan, which the Contractor's plan must supplement under Schedule F, will be made available to bidders prior to the proposal deadline or only after award. | This will be available after award. |
| 148 | Please clarify whether GDBE participation under Schedule A Section 20 (Disclosure of GDBE) is evaluated at proposal submission or may be achieved during contract performance, and when the required GDBE subcontracting plan and any exemption requests are due. | This is evaluated at proposal submission. |
| 149 | Please confirm whether the Human Centered Design activities described in Schedule A Section 25 are to be delivered within the 137,676 annual billable hours, and identify the anticipated annual volume or cadence of HCD engagements (e.g., research studies, prototyping cycles) the State expects. | They are considered in the billable hours. The volume can vary as most HCD led activities are owned by DHHS. |
| 150 | Please clarify the expected timing for State approval of Approved Pre-Existing Works under the IT Professional Services Terms, and confirm whether written approval for Contractor-developed accelerators, utilities, and test automation frameworks may be requested and obtained at or before Contract execution. | Approval can be granted during contract execution. Please provide this information in the appropriate bidder response box under Section 9 - End User & IT Operating Environment. |
| 151 | Please clarify which SUITE SEM stage exits and documentation templates apply to routine maintenance and operations releases under the Agile/SCRUM delivery model, and confirm whether an existing SUITE tailoring agreement for MiConnect will carry forward. | Tailoring is done annually. |
| 152 | Please clarify the definition and unit of measure for the Defect Density Acceptance Standard of 0.5 in the Schedule A Section 23 Delivery Quality metrics, and confirm whether failure to meet this standard carries contractual consequences beyond reporting. | Similar to Question 205 // |
| 153 | Please clarify how the Schedule A Section 24.1 requirement that defects submitted during UAT be 15% or less of total UAT test cases will be measured per release, and describe the consequence to the Contractor if a release exceeds this threshold or UAT exit criteria are not met. | Metrics are contained in Azure Dev Ops. |
It will be upon the State's discretion whether to proceed or not if the exit criteria is not met.
154 Please confirm the current Salesforce org topology for MiConnect (number of production orgs, sandboxes, Experience Cloud sites/portals, and whether MI Bridges and other MDHHS case-management portals share a single org or multiple orgs). 1. DEV (2)
2. SIT (2)
3. UAT (2)
4. PREPROD (1)
5. PROD (1)
| 155 | Schedule D is labeled “State Hosted,” yet MiConnect is described as Salesforce Cloud with AWS. Please clarify which hosting model applies for SLA purposes (State-hosted, Salesforce-hosted, hybrid), and which uptime/SLA commitments apply to Salesforce, AWS, NGDI, and MiLogin respectively. | 2. SIT (2) |
| 156 | Please define the boundary between “minor development / incremental refactoring” (in base M&O capacity) versus work that requires a separate Change Notice/SOW. What criteria (hours, story points, risk, architecture impact) will the State use? | If known work exceeds our planned capacity, the Parties mutually review and increase or decrease capacity (through a Change Notice). |
| 157 | Amazon Connect is referenced under Architect responsibilities. Is Amazon Connect (or other AWS Contact Center services) in scope for this Contract? If yes, please describe current architecture, volumes, and support ownership. | 4. PREPROD (1) |
| 158 | Concurrent public users are listed as 87,325, while performance testing in §24.1 caps load tests at 2,000 concurrent users. Please confirm the authoritative performance baseline the Contractor must sustain, and whether historical peak concurrent metrics will be shared. | 5. PROD (1) |
| 159 | What is the expected growth (users, transactions, data volume) over the 5-year base term? Please provide projections for Salesforce storage, Azure SQL (currently 4.92 TB), API call volume, and AWS transactions (~2M/month). | Approximately 5-10% growth is expected. |
| 160 | Please describe the current MiLogin federation pattern for each portal (SAML vs OIDC, IdP-initiated vs SP-initiated, MFA requirements by user type, and any privileged/admin access exceptions). Will architecture diagrams and SSO runbooks be provided under NDA? | The State will provide this information upon award. |
| 161 | For archival to State on-premises infrastructure: what is the current archival architecture (Salesforce → AWS → Azure SQL → on-prem), retention schedules by data class, and who owns purge/delete workflows for backups and offline stores? | The State is seeking a partnership to support all of these activities. The workload will vary; the State will direct and prioritize work. Responsibility would be shared. |
| 162 | Which MiConnect datasets contain IRS FTI, CMS/Medicaid, SNAP/FNA, HIPAA PHI, or other regulated data? Please identify applicable compliance regimes by module/portal so staffing, logging, and audit support can be scoped correctly. | Datasets can vary; Contractor must be able to support all types. |
| 163 | Please list all environments (Dev, SIT, UAT, Perf, Prod, DR) and the refresh/data-masking approach. Who controls Salesforce sandbox refreshes and AWS non-prod account provisioning? | 1. DEV (2) |
2. SIT (2)
3. UAT (2)
4. PREPROD (1)
5. PROD (1)
| 164 | Please describe the current CI/CD topology (Azure DevOps pipelines, branching, promotion path, gates, automated security tools). What percentage of deployments are automated end-to-end today, and what is the current release cadence (sprint length and production release frequency)? | The State cannot describe security tools. The majority of our tools are automated. Sprints are every 4-5 weeks. |
| 165 | Are Selenium, Provar, and HP LoadRunner State-furnished licenses available to Contractor, or must Contractor provide licenses? What concurrent-user profiles and transaction mixes are used today for performance baselines? | The State will furnish the licenses. |
| 166 | Production uptime target is 99.5% 24×7 excluding planned downtime. Who schedules Salesforce major releases/maintenance windows, how is planned downtime communicated, and how are Salesforce platform outages treated for Service Level Credits? | Salesforce schedules major releases and maintenance windows. |
Salesforce platform outages are part of the exceptions listed in Section 6 of Schedule D - Service Level Agreements.
| 167 | Evaluation Criterion 4 awards 25 points to “SOW — Staffing Plan Only,” but Schedule A does not include a section titled “Staffing Plan.” Please clarify which Schedule A response(s) and/or attachments will be scored as the Staffing Plan, and the expected content/format (for example, role-by-role hours/FTE against the 137,676 annual capacity, organization chart, hybrid/onsite plan, surge/backfill approach, and subcontracting approach). | The Staffing Plan is comprised of the information from Sections 18-20 and section 24 from Schedule A - Statement of Work. |
| 168 | Schedule A identifies 137,676 annual billable hours, while Schedule B states that “Year 1 must recognize any transition months and shall be priced accordingly.” Please clarify: (a) whether Year 1 Months 1–6 may be staffed/priced below steady-state capacity during transition-in; (b) whether transition-in hours are included within the 137,676 annual capacity or are incremental; and (c) when the State expects full steady-state capacity to begin (Month 1, Day 181, or another milestone). | (a) We expect staff to be phased in as the contract ramps up, and associated costs to reflect that. |
(b) Transition-in hours should be included within annual billable hours.
(c) This process will be evaluated and negotiated during contract execution, as this information will depend on bid responses.
169 Schedule F requires the Contractor to supplement an (In) Transition Plan provided by DTMB Application Support, with a 180-day transition and full support assumed on Day 181. Please clarify: (a) when the State’s base (In) Transition Plan will be provided to the awarded Contractor; (b) whether any non-confidential transition framework, milestone checklist, or workstream list can be shared with bidders before proposal submission; and (c) how production-support ownership (including Critical/High incidents) is expected to be divided between the incumbent and the new Contractor during Days 1–180. (a) It will be provided upon award as requested
(b) Non-confidential information can be found in Schedule F - Transition In & Out
(c) This process will be evaluated and negotiated during contract execution, as this information will depend on bid responses.
| 170 | During the 180-day transition-in period, will the incumbent be required to provide knowledge transfer, documentation/repository access, shadowing, and joint support? If yes, please describe the expected cooperation model (for example, dual-support RACI, required KT deliverables, and access to ADO/Clarity/Salesforce/AWS artifacts) so bidders can align Schedule F assumptions and staffing. | See Schedule F - Transition In & Out for this information. Selected contractor will work closely with the incumbent to ensure a smooth transition. |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .