RFP_34101-250701_AMD_Five_Round_2_QC.docx

STATE OF TENNESSEE

TENNESSEE EMERGENCY MANAGEMENT AUTHORITY

REQUEST FOR PROPOSALS # 34101-250701

AMENDMENT FIVE

FOR CRITICAL INCIDENT MANAGEMENT SYSTEM

DATE: September 9, 2026

RFP # 34101-250701 IS AMENDED AS FOLLOWS:

1. This RFP Schedule of Events updates and confirms scheduled RFP dates. Any event, time, or date containing revised or new text is highlighted.

EVENT

TIME

(central time zone)

DATE

1. RFP Issued

May 8, 2026

6. State Response to “Written “Questions & Comments”

August 3, 2026

7. Round 2, “Written “Questions & Comments” Deadline.

NOTE: Respondents may submit no more than ten (10) questions in the 2nd round of Written Questions and Comments.

8. Round 2, State Response to Written “Questions and Comments”

September 9, 2026

10. State Completion of Technical Response Evaluations (Sections A., B., and C., RFP Attachment 6.2)

October 2, 2026

11. State Schedules Respondent Oral Presentation

October 6, 2026

13. State Completion of Technical Response Evaluations (Section D., RFP Attachment 6.2)

October 15, 2026

16. State Notice of Intent to Award Released and RFP Files Opened for Public Inspection

18. State sends contract to Contractor for signature

November 4, 2026

2. State responses to questions and comments in the table below amend and clarify this RFP.

Any restatement of RFP text in the Question/Comment column shall NOT be construed as a change in the actual wording of the RFP document.

1.

disclosures?

The State will not revise this provision. Respondents should comply with Section E.2 to the extent applicable.

Pro Forma Contract Section E.2.a is a Federal Funding Accountability and Transparency Act (FFATA) contract reporting provision and is not a Technical Response evaluation criterion. It does not require Respondents to submit corporate director compensation information with their proposals.

If applicable under the conditions specified in Section E.2.a, the awarded Contractor must report the names and total compensation of its five most highly compensated executives. In accordance with Section E.2.b, the required information is due to the State by the end of the month in which the Contract is awarded.

3.

4.

Please clarify the intent of the three-year commercial availability requirement. If the objective is to ensure solution maturity and reduce implementation risk, would the State consider evidence of successful production deployments, customer references, and demonstrated operational use as an alternative means of satisfying this requirement?

No. Respondents must satisfy Mandatory Requirement A.3 as stated. Please also reference the State’s response to question # 15 in RFP Amendment Three.

5.

Several requirements appear to prioritize traditional enterprise IT controls over operational emergency management considerations. Would the State consider equivalent security measures that achieve the same cybersecurity objectives while better supporting the availability, interoperability, and operational tempo required during emergency and disaster response operations?

Requested clarification, the response was:

The question we provided regarding "equivalent security measures" stemmed from the requirements in Section D37 Information Technology Security Requirements. A clarification to our question is below:

Will the State accept summary reports, attestations, certifications, or other independently validated evidence of compliance in lieu of providing full System Security Plans, Security Assessment Reports, Plans of Action, or other sensitive security documentation that may be considered proprietary by contractor and its cloud service providers?

The State will not consider equivalent security measures; respondents must meet the requirement set forth in the Contract.

6.

7.

Please clarify how the State will evaluate the required production deployments. Must the references represent identical Critical Incident Management System implementations, or will the State consider production deployments that demonstrate equivalent emergency management, situational awareness, resource coordination, incident tracking, and disaster response capabilities implemented on a configurable commercial platform?

Requested clarification, the response was: Question #7 is based on the production deployment requirements in RFP Attachment 6.2, Section A.6, which requires respondents to demonstrate that their proposed CIMS solution has been implemented in at least three (3) separate government or public safety agencies and is currently operating in production. It is also based on the reference requirements in RFP Attachment 6.4, which require references from three separate government or public safety agency implementations of the proposed CIMS solution currently operating in production.

Our question is intended to better understand how the State will evaluate those production deployments and references. Specifically, we are seeking clarification on whether the references must represent implementations of an identical commercial CIMS product, or whether the State will consider deployments that demonstrate the required emergency management capabilities identified throughout the RFP, including incident management, situational awareness, resource coordination, operational reporting, and disaster response workflows.

Per Section A.6, this is a pass/fail, all the State is requiring is the respondent to provide a statement that the Respondent has implemented their proposed CIMS solution in at least three (3) separate government or public safety agency and that the proposed CIMS solution is currently in production in all three agencies.

8.

9.

During Round 2, respondents may propose revisions to contract language for the State's consideration. Please identify which Pro Forma Contract provisions are considered mandatory and non-negotiable versus those provisions the State is willing to consider modifying through the Round 2 contract revision process.

With a competitive bid the State considers all terms and conditions mandatory and non-negotiable. In Round 2 respondents were to submit any alternate language to the State’s terms to consider, as the State will not negotiate terms not included in either Round of Questions or after the response deadline.

10.

Section A.3.4.a requires the CIMS to provide "native, out-of-the-box Integration with company;s ArcGIS Online." MD-2 requires that administrators be able to configure the integration through the system's native administrative interface.

Please confirm whether an integration built with Company published SDKs or REST APIs, or with a commercially available component from an Company Partner Network member, meets this requirement when it ships as a standard supported feature of the licensed product rather than as custom development for this project.

Yes. For this requirement, “native, out-of-the-box” means the integration is part of the Respondent’s standard, generally available licensed SaaS offering, is maintained and supported as part of that offering, and can be configured through the system’s administrative interface without custom code or vendor development, regardless of the underlying technical method used to implement the integration.

MD-3 requires two way data exchange, so that updates in ArcGIS Online show up in the CIMS and updates in the CIMS show up in ArcGIS Online.

Does the write back requirement cover every CIMS record type that has a location, such as incidents, resource requests, tasks, facilities and activity log entries? Or does it cover a smaller set agreed during implementation? If it is a smaller set, please identify which record types the State needs at go live.

MD-3 requires bidirectional data exchange with ArcGIS Online feature services. The State does not require every CIMS record type with a location to synchronize at go-live. The proposed solution must allow authorized administrators, through the system’s native administrative interface, to configure which CIMS record types or layers are synchronized with ArcGIS Online; determine whether each synchronization is one-way or bidirectional; and publish or enable additional synchronized services after go-live as new record types, layers, or operational needs are developed, without Contractor custom development.

MD-4 requires automatic synchronization "without manual intervention." MD-5 requires synchronization "with a maximum delay of no more than ten (10) minutes."

Please confirm two points. First, does a scheduled synchronization service that runs on a set interval without any operator action meet MD-4?

Second, how will the State measure the ten minute limit during acceptance testing? Specifically, what is the start point and end point of the measurement, and is the limit applied as an average, a percentile, or a hard maximum for every record?

Yes. A synchronization service that runs on a fixed or configurable schedule without requiring an operator to manually initiate each synchronization cycle satisfies the “without manual intervention” requirement in MD-4.

MD-5 requires synchronization with a maximum delay of no more than ten minutes. The State will measure the ten-minute limit from the time a synchronized record is created or updated in the source system to the time the update is reflected in the receiving system.

To scope and price the integration accurately, please provide the following.

a. Is the target environment ArcGIS Online only, or is ArcGIS Enterprise or Portal for ArcGIS also in scope?

b. Will TEMA supply its own ArcGIS Online user licenses and credits, or must respondents include those costs in the Cost Proposal?

c. What authentication method does the State expect between the CIMS and ArcGIS Online, such as application credentials, Auth 2.0, or federated single sign on?

a. The target environment for this integration is ESRI ArcGIS Online.

b. The State will use its existing ArcGIS Online user accounts and credits. Respondents do not need to include ArcGIS Online user license or credit costs in their Cost Proposal.

c. The RFP does not mandate a specific authentication method for the ArcGIS Online integration. Respondents should describe the secure authentication approach used by their offered solution, including any required ArcGIS Online account type, permission level, and compliance with Contract Section D.37 and applicable interface design documentation requirements.

Amendment Three revised D.37.a.(3) to accept any one of six security frameworks. The State's answer to Question 69 says a respondent must already hold one of these for both the proposed solution and the processing environment that holds State Data.

Please confirm that a current ISO/IEC 27001:2022 certificate, issued by a certification body accredited by the ANSI-ASQ National Accreditation Board, satisfies Mandatory Requirement A.4 and D.37.a.(3) when the certified scope covers the production environment hosting the proposed solution.

Please also confirm what proof must be included with the Technical Response at submission, as opposed to the documents listed in D.37.a.(4) that are provided on request after award.

Please see Amendment Item #3 below for revision to RFP Attachment 6.2. – Section A - Mandatory Requirement Item A.4.

No additional proof or supporting documentation is required to be submitted with the Technical Response to satisfy Mandatory Requirement A.4.

The documentation identified in Section D.37.a.(4) is not required with the Technical Response and must be provided by the Contractor upon request by the State or the Comptroller of the Treasury in accordance with Section D.37.a.(4).

Under the payment schedule, the one time System Implementation charge is paid only after the State accepts all implementation deliverables in writing, including go live readiness. The Year 1 subscription is invoiced only after the State accepts in writing that the service is ready for production use.

Would the State consider paying the implementation charge in stages tied to deliverables the State has accepted? For example: approval of the project management plan and the system architecture and design plan required by A.3.5; completion of configuration and integration; successful completion of User Acceptance Testing; and go live acceptance. Each payment would still require the State's written acceptance of that stage.

This change would not affect the State's acceptance rights or the total contract cost. It would let more qualified vendors compete on price, since fewer firms can fund a full implementation before receiving any payment.

See State’s response to question #1.

Both the implementation payment and the Year 1 subscription payment depend on written acceptance by the State.

Please clarify how the State will decide that implementation deliverables are accepted and that the system is ready for production use. Will acceptance criteria be set and agreed during implementation planning? Will the State agree to a set review period, for example fifteen business days, in which it either accepts a deliverable in writing or provides a written list of what is missing?

Acceptance will be based on completion of the applicable deliverable and satisfaction of the requirements established in the Contract. For implementation payment milestones, the State will provide written acceptance of the applicable milestone before payment is made.

During the planning phase, the State and Contractor will establish detailed test procedures, acceptance documentation, and review timelines consistent with the requirements of the Contract. The CIMS must successfully complete applicable functional and non-functional requirements and User Acceptance Testing before production deployment and go-live acceptance.

The review period for individual deliverables will be established during the planning phase.

D.37.a.(2) says "The State shall control all access to encryption keys." In a shared cloud environment, platform level keys protect infrastructure used by more than one customer. Handing exclusive control of those keys to a single customer is not possible without weakening security for everyone on the platform.

Would the State consider revising D.37.a.(2) along these lines: "The Contractor shall use key management practices that keep State Data cryptographically separated from all other customer data. Where the Contractor offers customer managed keys, the State may choose to control the keys that protect State Data. Where platform managed keys are used, the Contractor shall document how keys are held, rotated and revoked, and shall certify that no key material is accessible to unauthorized

The State will not agree to this revision.

In its answer to Question 33 the State declined to extend the Severity 1 initial response time. We are not asking the State to extend it. We are asking the State to define how it is met.

Would the State consider adding wording along these lines: "Initial Response is met when the Contractor acknowledges the incident through its monitored support channel within fifteen minutes. This acknowledgement may be automated. The Contractor shall assign a qualified technical resource and make live human contact with the State within sixty minutes of that acknowledgement, and shall provide status updates every thirty minutes while work continues."

This keeps the fifteen minute commitment the State asked for and adds a measurable deadline for live human contact.

The State will not agree to the proposed revision. Attachment B already defines “Initial Response Time” as the time from Contractor receipt of a ticket to Contractor acknowledgment by qualified support personnel and assignment of a tracking number, including severity confirmation and initial troubleshooting contact. For Severity 1 incidents, these initial response requirements must be met within fifteen (15) minutes.

An automated acknowledgment alone does not satisfy the Severity 1 Initial Response requirement. The existing requirement for escalation to engineering/SME within thirty (30) minutes of ticket receipt and status updates every thirty (30) minutes during active work also remains unchanged.

Section A.2.o defines a Maintenance Window as a recurring scheduled maintenance period approved by the State. Section E.12 requires the Contractor to provide all software upgrades and improvements that it makes generally available to its customers.

Would the State consider adding wording along these lines: "The Contractor shall give the State at least ten business days notice before any planned release that changes system functionality, and shall perform planned maintenance only during Maintenance Windows approved by the State. The Contractor shall not perform planned maintenance or non emergency releases while the State has an active emergency activation. Emergency security patches may be applied without advance notice, and the Contractor shall notify the State as soon as practical."

The State will not agree to the proposed revision.

3. Delete RFP # 34101-250701 Release 2 in its entirety, and replace it with RFP # 34101-205071, Release # 3, attached to this amendment. Revisions of the original RFP document are emphasized within the new release. Any sentence or paragraph containing revised or new text is highlighted in yellow.

4. Add new Excel Workbook Attachment 6.3 Cost Proposal.

5. RFP Amendment Effective Date. The revisions set forth herein shall be effective upon release. All other terms and conditions of this RFP not expressly amended herein shall remain in full force and effect.

RFP 34101-250701 AMD Five Page 1 of 2 image1.jpeg