RFP_31701-03585_Prepaid_Credit_Card_Services_AMD_Two_Questions.pdf

RFP 31701-03585 – AMD Two Page 1 of 14

STATE OF TENNESSEE

DEPARTMENT OF FINANCE AND ADMINISTRATION

REQUEST FOR PROPOSALS # 31701-03585

AMENDMENT TWO

FOR PREPAID DEBIT CARD SERVICES

DATE: June 16, 2025

RFP # 31701-03585 IS AMENDED AS FOLLOWS:

1. This RFP Schedule of Events updates and confirms scheduled RFP dates. Any event, time, or date containing revised or new text is highlighted.

EVENT

TIME

(central time zone)

DATE

1. RFP Issued May 5, 2025

2. Disability Accommodation Request Deadline 2:00 p.m. May 8, 2025

3. Notice of Intent to Respond Deadline 2:00 p.m. May 9, 2025

4. Written “Questions & Comments” Deadline 2:00 p.m. May 20, 2025

5. State Response to Written “Questions & Comments” June 16, 2025

6. Response Deadline 2:00 p.m. June 27, 2025

7. State Completion of Technical Response Evaluations July 16, 2025

8. State Opening & Scoring of Cost Proposals 2:00 p.m. July 17, 2025

9. State Notice of Intent to Award Released and RFP Files Opened for Public Inspection 2:00 p.m. July 22, 2025

10. End of Protest Period July 29, 2025

11. State sends contract to Contractor for signature July 30, 2025

12. Contractor Signature Deadline 2:00 p.m. August 15, 2025

2. State responses to questions and comments in the table below amend and clarify this RFP.

Any restatement of RFP text in the Question/Comment column shall NOT be construed as a change in the actual wording of the RFP document.

RFP 31701-03585 – AMD Two Page 2 of 14

Question RFP SECTION QUESTION / COMMENT STATE RESPONSE

1. 6.6 Pro Forma (Mandatory Terms & Conditions)

On page 20 of the Mandatory Terms & Conditions section of the RFP, it asks for the respondent to comply with the HIPAA Act.

Would our processor, Galileo, be able to fulfill the HIPAA requirements? For context, we don’t hold the data but our processor holds PHI data.

Since the Contract will be between the State and the Contractor the Contractor would be responsible for compliance with the terms and conditions of this Contract; it is up to the Contractor as the independent contractor to best decide how to fulfil the obligations of the Contract. The HIPAA Compliance term only applies if applicable and a separate Business Associate Agreement is not required at this time.

See RFP 31701-03585 Release 2 for revised language.

2. 6.6 Pro Forma (Mandatory Terms & Conditions)

On page 20 of the Mandatory Terms & Condition section of the RFP, it asks for the respondent to comply with the HIPAA Act. Are you willing to accept something that’s comparable, such as compliance with the Gramm-Leach-Bliley Act (GLBA)? As a financial institution, we do not hold or process PHI data.

See State’s response to question #1.

3. 6.4 Reference Questionnaire

On page 34 of the RFP, it asks for the respondent to provide references that fit the following:

• two (2) contracts Respondent currently services that are similar in size and scope to the services required by this RFP; and

• three (3) completed contracts that are similar in size and scope to the services required by this RFP.

Would our Bank’s (redacted) references work?

We are the program manager and redacted is our issuing partner, so would bank partner references count towards this requirement? If not, would the State modify this requirement to include both program manager and bank partner references?

No, Bank’s reference will not fulfill this requirement.

The State will not agree to revise this requirement.

4. 6.4 Reference Questionnaire

Would the State accept the Prime Vendor as the point of contact for #1 and #2 of the Reference Questionnaire? Additionally, would the State accept the Prime Vendor to arrange for contact with our references to validate the fully completed questionnaire for confidentiality concerns?

No, the State will not accept the Prime Vendor as the point of contact for #1 and #2.

No, the State will not accept the Prime Vendor to arrange for contacts on the references.

For confidentiality, see RFP 31701- 03585 Release 2, Section 4.8 Disclosure of Response to Contents.

Mary Anne Queen Release 2?

Sharon Pope revised

RFP 31701-03585 – AMD Two Page 3 of 14

5. 6.6 Pro Forma (Scope and Services)

On page 7 of the Scope and Services section of the RFP, it asks the respondent to provide companion cards. Are you able to provide a historical volume of companion cards by program?

The State does not have access to which issued cards are companion cards vs primary cards.

6. 6.6 Pro Forma (Scope and Services)

On page 3 of the Scope of Services section of the RFP, it lists a number of customer-support requirements the respondent should fulfill. Is the State able to provide data on the following:

o Total number of calls and average number of calls received in 2024 o Hours of operation in 2024 o Sample SLAs o IVR data in 2024 o Additionally, please share the speed-of-answer desired.

o Total number of calls is included in attachment 6.7 o The contract requires live representatives to be available from 8 a.m. to 5 p.m. Central Time.

o The State does not utilize an SLA carrying out this contract. Service Standards are outlined in A.4.m.iii. will be discussed and agreed-upon with the execution of the contract.

o The total number of calls represents the IVR data.

7. 6.6 Pro Forma (Scope and Services)

Is the State willing to modify the requirement in Section A.4 (w) (page 5 of the Scope of Services section of the RFP) to allow for the State and Vendor to mutually agree upon a return mail policy?

No, the State will not modify this requirement.

8. 2. RFP

Schedule of Events

On page 7 of the RFP, it states that the responses to questions and comments will be issued on June 10. Considering that it is 10 days before the response deadline, will the State consider extending the response deadline?

No, the State will not revise the Response due date.

9. Attachment 6.4

When does the State wish to receive the reference questionnaires by email? The due date of the responses, or can they be sent in at any time up until the due date?

If you are responding to this RFP by mail, then they must be included in your mailed response per the requirement. If you are responding by email, then the reference questionnaires may be sent directly to the Solicitation via email before the response due date.

10. 1.6.2 Will the State allow a follow-up round of questions after the State’s answers to questions, but before the response deadline?

No.

11. 3.1.1.2 May bidders use a smaller, still readable font for each of the following:

• Headers and footers

• Requirement text

• Exhibits/figures/graphics

Tables

Yes, only for the sections listed in this question. All others must remain at 12 point font.

12. 3.1.1.2 May bidders use a larger font size for the cover page and heading text?

Yes

13. 3.1.1.2 Several requested documents/samples (i.e., Credit Report, Financials, Bank Reference Confirmed.

Mary Anne Queen Do you think there will still be competition if you do not offer a second round of questions and comments?

yes

RFP 31701-03585 – AMD Two Page 4 of 14

Letter, etc.) do not comply with font restrictions.

They are not available in a native MS Office format for font adjustments. Please confirm that it is permissible to submit those documents as is.

14. 3.1.1.2 As we will be submitting some pre-existing documents and scanned, signed forms, can those documents be excluded from the page numbering requirement so we can leave them unaltered?

No, see requirement for 3.1.1.2.

15. Are there any restrictions on the file size that can be submitted? The State email restriction is up to

20MB. Anything over this would be multiple emails and must be named accordingly when submitting (ex.

Email 1, Email 2).

16. Attachment

6.2 Section

C.5 and C.6

The language in C.5 and C.6 is identical, with C.5 encompassing RFP Attachment 6.6 – Pro Forma Contract Scope of Services, Section A.4, subsections a through z. while C.6 only requires a response for subsection ‘m’ of A.4.

Is it the State’s intention that we respond to the requirement (A.4.m) in both places?

The State does not intend for respondents to include the response for this item in both places. The State included A.4.m.

as a separate item because we wish to assess the technical response to this separately.

17. Attachment

6.2 Section

C.5 and C.7

The language in C.5 and C.6 is nearly identical, with C.5 encompassing RFP Attachment 6.6 – Pro Forma Contract Scope of Services, Section A.4, subsections a through z.

C.6 only requires a response for subsection ‘p’ of A.4.

Is it the State’s intention that we respond to the requirement (A.4.p) in both places?

The State does not intend for respondents to include the response for this item in both places. The State included A.4.p.

as a separate item because we wish to assess the technical response to this separately.

18. Attachment

6.6 Proforma

Contract, Section A.4.m

Do the locations include U.S. territories? Yes. Please see revised language in RFP 31701-03585 Release 2.

19. 3.3.1 Can bidders provide written comments on the State’s contract for further discussion? No, After the RFP response deadline, there will be no discussions or negotiations. All questions/comments/ revisions for the State to consider must be submitted during the question period.

20. 3.3.1 If the bidder is selected, will the successful Respondent have an opportunity for good faith negotiation?

See answer to question #2.

21. Attachment

6.6 Proforma

Contract, Section B Term of Contract

Does the State intend to award any renewal term beyond the initial 5-year term? If so, will a renewal be at the State’s sole discretion or by mutual agreement of the parties?

The State does not intend to award a renewal beyond the initial 5-year term.

Mary Anne Queen This should be question #?

Yes, revised from 20 to 2

RFP 31701-03585 – AMD Two Page 5 of 14

22. Attachment

6.6 Proforma

Contract, Section B Term of Contract

Since the current contract expires December 14, 2025, please advise if the State wants a contract effective August 1, 2025.

Yes. The State wants a contract effective date of August 1, 2025.

23. Attachment

6.6 Proforma

Contract, Section D.4

Will the State agree to compensate the contractor for any unamortized costs and reasonable wind-down costs if the State opts to terminate the contract for any reason other than Contractor default?

No. The State will only pay for services provided.

24. Attachment

6.6 Proforma

Contract, Section D.5

Will the State allow a notice and cure period (e.g., 30 days) prior to Termination for cause?

Yes. See revised language in RFP 31701-03585 Release 2, item D.5.

25. Attachment

6.6 Proforma

Contract, Section D.6

Would the State allow an assignment without the need for prior consent in the event of a sale of the Contractor’s assets to another entity, or, failing that, could State consent be “not unreasonably withheld”?

The State will not agree with this revision.

26. Attachment

6.6 Proforma

Contract, Section D.16

Would the State agree to make the exclusion of indirect, special, incidental, punitive, exemplary, or consequential damages mutual?

This is the State’s liability and the State will not agree to this revision.

27. Attachment

6.6 Proforma

Contract, Section D.25

Would the State agree to limit the indemnity to “third party” claims “directly caused by” the Contractor’s fault (i.e., negligence, willful misconduct)?

The State will not agree to this revision.

28. Attachment

6.6 Proforma

Contract, Attachment A

Please confirm that “Attachment A: Attestation Re Personnel Used in Contract Performance” will be completed after contract award and will not need to be submitted with the proposal.

Confirmed.

29. Attachment

6.6 Proforma

Contract, Section D.9.c

Section D.9(c) requires the Contractor to maintain records for “all personnel used in the performance of this Contract.” We respectfully request that the language be revised to replace “personnel” with “Potential Respondent, personnel,” and that the following phrase be added to the end of the sentence: “unless prohibited by applicable law.”

The State will not agree to revise the language. (Please note for reference purposes that the use of this word personnel originated from Bredesen Executive Order No. 41.

30. Attachment

6.6 Proforma

Contract, Section D.24, first paragraph

Will the State agree to also exclude “Crime” from this statement? The State is not permitted to be named as an additional insured for crime, workers’ compensation, or professional liability.

Yes, crime insurance can also be excluded from the additional insured requirement.

31. Attachment

6.6 Proforma

Contract, Section D.24, Will the state agree to revise this section?

Potential Respondent will only provide copies

See RFP 31701-03595, Release 2.

This language (i.e., the last sentence of the third paragraph in https://publications.tnsosfiles.com/pub/execorders/exec-orders-bred41.pdf Mary Anne Queen CPO’s Risk Manager is okay with the State’s response?

Yes, that was his decision.

RFP 31701-03585 – AMD Two Page 6 of 14 third paragraph of insurance policies in relation to a litigated matter and not at any time, as stated.

Section D.24) can be revised to read as follows: “The State reserves the right to require, at any time, relevant excerpts from all required insurance policies, including all endorsements or the equivalent policy language, as needed to check for compliance with these specifications.”

32. 1.1.2.d Can you please provide more details on the use case of the DOE card? Is the source of funds from the state or deposited by other individuals?

The Department of Education cards are offered to participants in the Individualized Education Program to be used to fund a variety of educational services. All deposits of funds are made by the State.

33. A.4.g In order to comply with payroll regulations that require free access to the full card balance, we offer the ability for payroll cardholders to write a check to themselves to cash out the entire balance of the card. Would the State be agreeable to this functionality on the payroll card program only?

No, the State will not agree to this request.

34. Attach 6.1 A.5 Will the state accept a phased in approach of the multiple programs? Yes, the state is open to a phased approach to implementation.

35. 1.1.1.f / Attachment 6.7

Could you please provide the attachment 6.7 activity report for electronic transfers to a bank account for each of the programs?

The State does not have access to this information.

36. A.4.m.ii To increase availability and ensure the lowest fees for cardholders, would the state amend this section to allow for the use of international call centers?

No, the State will not agree to revise this section.

37. 4.4.2 Since the State will be using multiple card programs and our subcontractors are used to support all client programs, would the State please amend section 4.4.2 to the following:

4.4.2. If a Respondent intends to use

subcontractors, the response to this RFP must specifically identify the scope and portions of the work each subcontractor will perform (refer to RFP Attachment 6.2., Section B, General Qualifications & Experience Item B.14.). For purposes of this RFP and the awarded contract, the definition of “Subcontractor(s)” does not include Contractor’s third-party vendors which provide goods or services to Contractor in the ordinary course of business, and do not provide goods or services directly to the State.

The State will not agree to this revision.

38. A.12.a.vi To meet industry standards, we request replacing the definition of Customer Service Activity from ‘twenty seconds’ with thirty seconds.

Yes, see RFP 31701-03585 Release 2 revised contract language.

RFP 31701-03585 – AMD Two Page 7 of 14

Customer Service Activity – summary of live calls accepted, answered, and abandoned after twenty (20) thirty (30) seconds and average speed of response.

39. D.15 Please strike entire section as it is not applicable to services provided. The State will not agree to delete this section.

40. D.26 Please strike entire section as it is not applicable to services provided. See RFP 31701-03585 Release for revised language.

41. E.3 Would the state be open to the following edits?

E.3. Personally Identifiable Information. While performing its obligations under this Contract, Contractor may have access to Personally Identifiable Information held by the State (“PII”). For the purposes of this Contract, “PII” includes “Nonpublic Personal Information” as that term is defined in Title V of the Gramm- Leach-Bliley Act of 1999 or any successor federal statute, and the rules and regulations thereunder, all as may be amended or supplemented from time to time (“GLBA”) and personally identifiable information and other data protected under any other applicable laws, rule or regulation of any jurisdiction relating to disclosure or use of personal information (“Privacy Laws”). Contractor agrees it shall not do or omit to do anything which would cause the State to be in breach of any Privacy Laws. Contractor shall, and shall cause its employees, agents and representatives to: (i) keep PII confidential and may use and disclose PII only as necessary to carry out those specific aspects of the purpose for which the PII was disclosed to Contractor and in accordance with this Contract, GLBA and Privacy Laws; and (ii) implement and maintain appropriate technical and organizational measures regarding information security to: (A) ensure the security and confidentiality of PII; (B) protect against any threats or hazards to the security or integrity of PII; and (C) prevent unauthorized access to or use of PII. Contractor shall promptly immediately notify State: (1) of any disclosure or use of any PII by Contractor or any of its employees, agents and representatives in breach of this Contract; and (2) of any disclosure of any PII to Contractor or its employees, agents and representatives where the purpose of such disclosure is not known to Contractor or its employees, agents and representatives. The State reserves the right to review Contractor's policies and procedures used to maintain the security and confidentiality of PII and Contractor shall, and cause its employees, agents and

The State will not agree to this revision.

RFP 31701-03585 – AMD Two Page 8 of 14 representatives to, comply with all reasonable requests or directions from the State to enable the State to verify or ensure that Contractor is in full compliance with its obligations under this Contract in relation to PII. Upon termination or expiration of the Contract or at the State’s direction at any time in its sole discretion, whichever is earlier, Contractor shall immediately return to the State any and all PII which it has received under this Contract and shall destroy all records of such PII.

The Contractor shall report to the State any instances of unauthorized access to or potential disclosure of PII in the custody or control of Contractor (“Unauthorized Disclosure”) that come to the Contractor’s attention. Any such report shall be made by the Contractor within seventy-two (72) twenty-four

(24) hours after the Unauthorized Disclosure has come to the attention of the Contractor.

Contractor shall take all necessary measures to halt any further Unauthorized Disclosures.

The Contractor, at the sole discretion of the State, shall provide no cost credit monitoring services for individuals whose PII was affected by the Unauthorized Disclosure. The Contractor shall bear the cost of notification to all individuals affected by the Unauthorized Disclosure, including individual letters and public notice. The remedies set forth in this Section are not exclusive and are in addition to any claims or remedies available to this State under this Contract or otherwise available at law. The obligations set forth in this Section shall survive the termination of this Contract.

42. E.4 Will the State please consider amending section E.4 with the follow edits:

When requested by the State or the Comptroller of the Treasury, the Contractor must provide the State or the Comptroller of the Treasury with a detailed written description of the Contractor’s information technology control environment, including a description of general controls and application controls. The Contractor must also assist the State or the Comptroller of the Treasury with obtaining a detailed written description of the information technology control environment for any third or fourth parties, or Subcontractors, used by the Contractor to process State data and/or provide services under this Contract.

Contractor will maintain and cause its Subcontractors to maintain a complete audit trail of all transactions and activities in

The State will not agree to any of these revisions.

Jennifer Young Defer to COT/STS for COT Audit Requirements questions

Mary Anne Queen We agree with the State’s response to Q42 re E.4 (that the revision is unacceptable).

Ok

RFP 31701-03585 – AMD Two Page 9 of 14 connection with this Contract, including all information technology logging and scanning conducted within the Contractor’s and Subcontractor’s information technology control environment. Upon reasonable With at least thirty (30) days’ notice, during normal business hours and at any reasonable time, the Contractor grants the State or the Comptroller of the Treasury with the right to audit the Contractor’s information technology control environment, including general controls and application controls, that provide services directly applicable to this RFP and resulting contract. Sensitive or confidential information can be viewed by the parties at a Contractor’s location or via a video conference call, however the parties may not record or create copies of the sensitive or confidential information. The audit may include testing the general and application controls within the Contractor’s information technology control environment and may also include testing general and application controls for any third or fourth parties, or Subcontractors, used by the Contractor to process State data and/or provide services under this Contract. The audit may include the Contractor’s and Subcontractor’s compliance with the State’s Enterprise Information Security Policy and all applicable requirements, laws, regulations, or policies.

Upon reasonable With at least thirty (30) days’ notice, and at any reasonable time during normal business hours, and in such a manner as to not interfere unreasonably with normal business activities, the Contractor and Subcontractor(s) agree to allow the State, the Comptroller of the Treasury, or their duly appointed representatives to perform information technology control audits of the Contractor and all Subcontractors used by the Contractor. Contractor will provide to the State, the Comptroller of the Treasury, or their duly appointed representatives access to Contractor and Subcontractor(s) personnel for the purpose of performing the information technology control audit. The audit may include interviews with technical and management personnel, physical or virtual inspection of controls, and review of paper or electronic documentation.

The Contractor must have a process for correcting control deficiencies that were identified in the State’s or Comptroller of the Treasury’s information technology audit. For

RFP 31701-03585 – AMD Two Page 10 of 14 any audit issues identified, the Contractor and Subcontractor(s) shall submit a corrective action plan to the State or the Comptroller of the Treasury which addresses the actions taken, or to be taken, and the anticipated completion date in response to each of the audit issues and related recommendations of the State or the Comptroller of the Treasury.

The corrective action plan shall be provided to the State or the Comptroller of the Treasury upon request from the State or Comptroller of the Treasury and within 30 days from the issuance of the audit report or communication of the audit issues and recommendations.

Upon request from the State or Comptroller of the Treasury, the Contractor and Subcontractor(s) shall provide documentation and evidence that the audit issues were corrected.

Each party shall bear its own expenses incurred while conducting the information technology controls audit. For purposes of this Section E.4., the definition of “Subcontractor(s)” does not include Contractor’s third-party vendors which provide goods or services to Contractor in the ordinary course of business, and do not provide goods or services directly to the State.

43. E.5.a. Would the State please modify E.5 with the follow edits:

(2) The Contractor shall encrypt Confidential State Data at rest and in transit using the current version of Federal Information Processing Standard (“FIPS”) 140-2 or 140-3 (or current applicable version) validated encryption technologies. The State shall control all access to encryption keys. The Contractor shall provide installation and maintenance support at no cost to the State.

(3) The Contractor and any Subcontractor used by the Contractor to host State data, including data center vendors, shall be subject to an annual engagement by a licensed CPA firm in accordance with the standards of the American Institute of Certified Public Accountants (“AICPA”) for a System and Organization Controls for service organizations (“SOC”) 2 Type 2 examination or similar certifications.

The scope of the SOC 2 Type 2 examination engagement must include the Security, Availability, Confidentiality, and Processing Integrity Trust Services Criteria. In addition, the Contractor services that are part of this Contract, including any processing or storage

(2) See revised language on encryption key management in RFP 31701-03585 Release 2.

(3) The State will consider the ISO27001 certification or the FedRAMP authorization if the scope and assurance level are deemed sufficient by the State.

Mary Anne Queen Shouldn’t this be E.5.a?

Carrie Allen Updated

No comments re the State’s changes re Q43 E.5(2).

RFP 31701-03585 – AMD Two Page 11 of 14 services, must be included in the scope of the SOC 2 Type 2 examination engagement(s).

(4) The Contractor must annually review its SOC 2 Type 2 examination reports. Within 30 days of receipt of the examination report, or upon request from the State or the Comptroller of the Treasury, the Contractor must provide the State or the Comptroller of the Treasury a non-redacted copy of the Contractor’s SOC 2 Type 2 examination report(s) applicable to the applicable services provided to the State under this RFP, which can be viewed by the parties at a Contractor’s location or via a video conference call, however the parties may not record or create copies of Contractor’s sensitive or confidential information. The Contractor must review the annual SOC 2 Type 2 examination reports for each of its Subcontractors and must also assist the State or Comptroller of the Treasury with obtaining a non-redacted copy of any SOC examination reports for each of its Subcontractors, including data centers used by the Contractor to host or process State data, which can be viewed by the parties at a Contractor’s location or via a video conference call, however the parties may not record or create copies of Contractor’s or its Subcontractor’s sensitive or confidential information. For purposes of this section, the definition of “Subcontractor(s)” does not include Contractor’s third-party vendors which provide goods or services to Contractor in the ordinary course of business, and do not provide goods or services directly to the State.

Any and all information shared from Contractor’s SOC 2 Type 2 to the State is considered confidential and proprietary and is not subject to disclosure under any circumstances. Contractor may require the State to sign a Non-disclosure Agreement in advance of sharing its confidential information and SOC 2 Type 2.

If the Contractor’s SOC 2 Type 2 examination report includes a modified opinion, meaning that the opinion is qualified, adverse, or disclaimed, the Contractor must share the SOC report and the Contractor’s plan to address the modified opinion with the State or the Comptroller of the Treasury within 30 days of the Contractor’s receipt of the SOC report or upon request from the State or the Comptroller of the Treasury. If any Subcontractor(s) SOC 2 Type 2 examination report includes a modified opinion, the Contractor must assist the State or

The State will not agree to any revisions in Subsection (4).

We request that the State response re (3) be changed to: The State will consider the ISO27001 certification or FedRAMP authorization if the scope and assurance level are deemed sufficient by the State.

Also, please check the original language in the RFP. It appears the vendor is adding “ISO27001, or FedRAMP” as well, and all requested changes should be in red font.

Carrie Allen See updated language in release 2.

Shakuntala Smith Defer to Comptroller

We cannot agree with the proposed changes in Subsection (4).

RFP 31701-03585 – AMD Two Page 12 of 14

Comptroller of the Treasury with obtaining the Subcontractor(s) SOC report and the Subcontractor(s) plan to address the modified opinion.

The Contractor must have a process for correcting control deficiencies that were identified in the SOC 2 Type 2 examination, including follow-up documentation providing evidence of such corrections. Within 30 days of receipt of the examination report, or upon request from the State or the Comptroller of the Treasury, the Contractor must provide the State or the Comptroller of the Treasury with a corrective action plan and evidence of correcting the control deficiencies. The Contractor must require each of its Subcontractors, including data centers used by the Contractor to host State data, to have a process for correcting control deficiencies identified in their SOC examination reports and must assist the State or Comptroller of the Treasury with obtaining a corrective action plan and obtaining evidence of correcting control deficiencies identified in Subcontractor(s) SOC reports.

No additional funding shall be allocated for these examinations as they are included in the Maximum Liability of this Contract.

(6) The Contractor must annually perform Penetration Tests and Vulnerability Assessments against its Processing Environment per the NIST 800-115 definition.

“Processing Environment” shall mean the combination of software and hardware on which the Application runs. “Application” shall mean the computer code that supports and accomplishes the State’s requirements as set forth in this Contract. “Penetration Tests” shall be in the form of attacks on the Contractor’s computer system, with the purpose of discovering security weaknesses which have the potential to gain access to the Processing Environment’s features and data. The “Vulnerability Assessment” shall be designed and executed to define, identify, and classify the security holes (vulnerabilities) in the Processing Environment. The Contractor shall allow the State, at its option, to perform Penetration Tests and Vulnerability Assessments on the Processing Environment.

The Contractor shall provide a letter of attestation on its processing environment that penetration tests and vulnerability assessments has been performed on an

RFP 31701-03585 – AMD Two Page 13 of 14 annual basis and taken corrective action to evaluate and address any findings.

In the event of an unauthorized disclosure or unauthorized access to State data, the State Strategic Technology Solutions (STS) Security Incident Response Team (SIRT) must be notified and engaged by calling the State Customer Care Center (CCC) at 615-741- 1001. Any such event must be reported by the Contractor within seventy-two (72)twenty-four

(24) hours after the unauthorized disclosure has come to the attention of the Contractor.

(9) Upon termination of this Contract and in consultation with the State, the Contractor shall destroy, and ensure all subcontractors shall destroy, all Confidential State Data it holds (including any copies such as backups) in accordance with the current version of National Institute of Standards and Technology (“NIST”) Special Publication 800-88, and consistent with Contractor’s document retention policy and Applicable Law. The Contractor shall provide a written confirmation of destruction to the State within ten (10) business days after destruction .

See revised language on penetration testing in RFP 31701- 03585, Release 2.

The State will not agree to revise to 72 hours.

The State does not agree to this

44. E.5.b Will the State please accept the following edits to ensure consistent application of security protection within our systems.

(1) The Contractor and all data centers used by the Contractor to host State data, including those of all Subcontractors, must comply with Contractor’s internal policies and procedures addressing information security and Applicable Law. the State’s Enterprise Information Security Policies as amended periodically. The State’s Enterprise Information Security Policies document is found at the following URL:

https://www.tn.gov/finance/strategic-technology-solutions/strategic-technology-solutions/sts-security-policies.html.

The State will not agree to this

45. 1.1.2.a What are some areas the State is looking to improve upon from their current provider? This information is not necessary to respond to this solicitation.

3. Delete RFP # 31701-03585 in its entirety, and replace it with RFP # 31701-03585, Release # 2, attached to this amendment. Revisions of the original RFP document are emphasized within the new release. Any sentence or paragraph containing revised or new text is highlighted.

https://www.tn.gov/finance/strategic-technology-solutions/strategic-technology-solutions/sts-security-policies.html https://www.tn.gov/finance/strategic-technology-solutions/strategic-technology-solutions/sts-security-policies.html https://www.tn.gov/finance/strategic-technology-solutions/strategic-technology-solutions/sts-security-policies.html Mary Anne Queen No comments re (6).

Mary Anne Queen No comments re (9).

Shakuntala Smith If the contractor cannot or will not agree to abide by the State’s EISP, then we can use the conditional language below:

The Contractor shall implement and maintain privacy and security controls that follow the guidelines set forth in NIST 800-53, “Security and Privacy Controls for Federal Information Systems and Organizations,” as amended from time to time. Contractor shall meet annually, or as otherwise agreed, with the State to review the implementation of this Section. A “System Security Plan (SSP)” is required whether a vendor has FedRAMP, ISO27001, or SOC 2 Type II.

Mary Anne Queen No comments Q44 except that if the contractor cannot agree to the State’s EISP, it is my understanding that the Comptroller Audit Requirements would have to be revised since they specify EISP.

Revised.

RFP 31701-03585 – AMD Two Page 14 of 14

4. RFP Amendment Effective Date. The revisions set forth herein shall be effective upon release. All other terms and conditions of this RFP not expressly amended herein shall remain in full force and effect.