RFP_34101-250701_AMD_Three_QC.docx

STATE OF TENNESSEE

TENNESSEE EMERGENCY MANAGEMENT AUTHORITY

REQUEST FOR PROPOSALS # 34101-250701

AMENDMENT THREE

FOR CRITICAL INCIDENT MANAGEMENT SYSTEM

DATE: August 3, 2026

RFP # 34101-250701 IS AMENDED AS FOLLOWS:

1. This RFP Schedule of Events updates and confirms scheduled RFP dates. Any event, time, or date containing revised or new text is highlighted.

EVENT

TIME

(central time zone)

DATE

1. RFP Issued

May 8, 2026

6. State Response to “Written “Questions & Comments”

August 3, 2026

8. Round 2, State Response to Written “Questions and Comments”

September 4, 2026

10. State Completion of Technical Response Evaluations (Sections A., B., and C., RFP Attachment 6.2)

September 28, 2026

11. State Schedules Respondent Oral Presentation

September 30, 2026

13. State Completion of Technical Response Evaluations (Section D., RFP Attachment 6.2)

October 15, 2026

16. State Notice of Intent to Award Released and RFP Files Opened for Public Inspection

18. State sends contract to Contractor for signature

November 4, 2026

2. State responses to questions and comments in the table below amend and clarify this RFP.

Any restatement of RFP text in the Question/Comment column shall NOT be construed as a change in the actual wording of the RFP document.

1.

2.

3.

Suggested edits are provided. CPO should review the proposed edits with CPO Legal to determine whether they concur or recommend alternate language. Comment by Shalini P. Gupta: Accepted Comment by Jessica Prater: Agree.

4.

5.

Additionally, within the internal TEMA user base, could you provide an estimated breakdown of:

· Managers and administrators who require primarily read-only and approval access; and

· End users who will require daily operational access to complete work activities?

The State is not providing a role-by-role licensing breakdown. Respondents should explain in their response how their solution will provide the roles, workflows, and user volumes described in the RFP.

6.

Is Fedramp authorization mandatory in order for a vendor to be considered? If so, please clarify what is meant by Fedramp authorization - for example, we use Amazon Web Services which is Fedramp authorized at the infrastructure level, but our software platform has not been Fedramp authorized. Is this acceptable?

Given there are very few vendors who are fully Fedramp authorized, we are hoping there is some flexibility here.

No. Please see Amendment Item 3 below for revisions to Pro Forma Contract Sections D.37.a.(3). and Section D.37.a.(4) where additional acceptable third-party security authorization frameworks applicable to both the proposed solution and processing environment have been listed. Comment by Terry Mason: When a State response results in a corresponding RFP or Pro Forma revision, identify that revision in the response. Suggested edits are provided for this response based on the Release 2changes to the IT Security Requirement provision. Comment by Shalini P. Gupta: Accepted. Added additional comments for second part, please review

7.

Are you currently using any Critical Incident Management System (CIMS), emergency management platform, incident coordination solution, or similar operational management tool?

If yes, please share which platform or tool is in use and detail the operational challenges, workflow limitations, reporting gaps, integration issues, scalability concerns, or emergency response coordination problems you are facing, so we can address them effectively in our proposed solution.

The State currently uses a CIMS system. Due to the confidential nature of the current contract the State cannot provide the requested information.

8.

There are two statements mentioned in the RFP:

“Years 1 – 5 - Base User Licensing — Provisioned Accounts: Annual price for up to 5000 provisioned (named) user accounts” and “Years 1 – 5 - Base User Licensing — Simultaneous Users: Annual price for up to 300 simultaneous (concurrent) users.”

Our products can fulfill the Agency requirement. However, for our products, named user licenses and concurrent user licenses are the same, and since 5000 is a very large number, could you please specify the exact number of licenses required? This will allow us to prepare the best and most cost-effective pricing for the agency.

Respondents should price based on the RFP baseline of up to 5,000 provisioned accounts and 300 simultaneous users. The solution must also support temporary emergency surge capacity of up to 600 simultaneous users as stated in the RFP.

The RFP pricing structure remains as stated. Respondents should complete the Cost Proposal using the pricing structure provided in the RFP.

9.

However the State anticipates the following data types and volume: SQL, Excel, CSV files and volume of approximately 30 GB

10.

From a project resource perspective, is there a preferred implementation model? Remote, onsite, or a blend of both etc.?

The State does not have a preferred implementation model. Remote, onsite, or blended implementation models are acceptable if they meet the RFP requirements. Respondents should address their implementation approach in the applicable Section C Technical Response items. The State will have staffing available during this implementation. to assist the Contractor. Comment by Sharon Pope: Do we need this, that is not part of the question?

11.

12.

13.

14.

Commercial Product History (Section A.3.b) The RFP requires that the proposed solution be purpose-built for emergency management or disaster response operations and have been offered as a commercial product for at least three (3) consecutive years prior to the RFP release date.

Would the State consider solutions that can demonstrate equivalent operational maturity, public safety functionality, and successful deployments, but have not yet reached the three-year commercial availability threshold?

No, the State will not consider a solution that does not meet the requirements set forth in the RFP.

Production Deployments (Section A.6) The RFP requires implementation of the proposed solution in at least three (3) separate government or public safety agencies, with the solution currently in production in all three agencies.

For purposes of this requirement, does the State consider active pilot deployments, operational evaluations, beta deployments, or limited production implementations within government or public safety agencies to qualify as implementation experience?

No. Active pilot deployments, beta deployments, or limited production implementation does not count towards the three (3) separate government or public safety agency requirement.

Where respondents may not fully satisfy historical deployment requirements, will the State consider alternative evidence of operational readiness and capability, including public safety pilot programs, agency evaluations, letters of support, operational exercises, security certifications, or other documented evidence of successful use within emergency management or public safety environments?

No, such evidence will not substitute for, waive, or modify mandatory requirements.

19.

Emerging Technology Providers

Can the State provide any additional guidance regarding how innovative or emerging technology providers will be evaluated when their solutions may offer capabilities aligned with the State's objectives but do not have the same deployment history as long-established incumbent platforms?

All responses will be evaluated according to the requirements and evaluation criteria stated in the RFP.

20.

User Counts and Licensing Assumptions

Can the State provide an estimate of the anticipated number of users, including any breakdown by user type, department, agency, or role that may assist respondents in preparing accurate pricing and implementation plans?

Respondents should price based on the RFP baseline of up to 5,000 provisioned accounts and 300 simultaneous users. Respondents should also describe how temporary emergency surge capacity of up to 600 simultaneous users is supported.

21.

Mobile Device Environment

Can the State provide information regarding whether personnel expected to utilize the system are currently issued mobile devices?

If so:

· What percentage of anticipated users are issued mobile devices?

· Are the devices State-owned or personally owned?

· What mobile operating systems are currently deployed (iOS, Android, or both)?

· Are there any Mobile Device Management (MDM) requirements or restrictions that respondents should consider?

The State is not providing mobile-device inventory. Respondents should describe supported devices, operating systems, browsers, mobile capabilities, offline capabilities, and any MDM considerations.

22.

Incident Scale and External Participants

Does the State anticipate that the system will be utilized exclusively by Tennessee Emergency Management Agency personnel, or will local agencies, mutual aid partners, federal agencies, contractors, volunteers, or other external organizations require access during emergency operations?

The system may be used by TEMA, State, local, mutual-aid, federal, contractor, volunteer, and other authorized partner users during emergency operations, exercises, training, and steady-state preparedness activities.

Attachment 6.7. – Pro Forma Contract Section D.37.a.(3) i. FedRAMP Authorization - The Contractor and Contractor’s processing environment containing State Data shall maintain an active Federal Risk and Authorization Management Program (FedRAMP) Moderate or higher Authorization to Operate as issued by a federal agency or the FedRAMP Program Management Office

Given the resources required to respond to this RFP, can you confirm that TEMA has appropriately budgeted for the inclusion of the FedRAMP requirements which typically come at a cost of $500,000 to $1+ million annually?

See State’ response above to Question/Comment #6. Respondents are responsible for meeting Contract Section D.37.a.(3) and D.37.a.(4) within their proposed pricing.

24.

Would TEMA consider it acceptable for a respondent who holds a FedRAMP High authorization for its federal software solution, but to instead propose its state and local government software solution in response to this RFP in an effort to provide the most budget friendly approach?

While our proposed state and local government solution is not FedRAMP High certified, it incorporates many of the security controls, processes, and operational practices established through the respondent’s FedRAMP High authorization efforts.

See State’ response above to Question/Comment #6.

26.

Page 42, CONTRACT BETWEEN THE STATE OF TENNESSEE, TENNESSEE EMERGENCY MANAGEMENT AGENCY AND CONTRACTOR NAME –

Will TEMA permit the successful respondent to include their Subscription Agreement as part of the contract? We would be happy to provide the template to TEMA at any point during this RFP process.

No. Respondents shall not include supplemental terms, subscription agreements, online terms, clickwrap terms, or other documents that modify or conflict with the Pro Forma Contract.

Please see Amendment Item 3 below for updated language to RFP Section 3.3.2

We understand that it may be difficult for TEMA to accurately estimate the number of concurrent users needed during emergency operations and other surge events. If actual usage were to exceed the 300 concurrent user threshold on a recurring basis, would TEMA consider adding language that defines an allowable overage period (e.g., one month per contract year) after which additional concurrent user licenses would need to be purchased if usage continues to exceed the licensed threshold? Comment by Terry Mason: Please consult with CPO Legal on this response, as this question appears to ask the State to add contract scope and/or payment methodology language clarifying what triggers the State’s obligation to purchase Additional Simultaneous Users licenses. If the State does not add that language, the respondent asks how the State intends to address recurring concurrent-user overages.

Also, the Release 2 change to Section A.3.2.n. needs to be pointed out and context added explaining its intent.

Comment by Jason L. Laney: An event that is widespread to such a degree as to require more than 300 simultaneous users would be the trigger. This would be an available buffer in the number of users the system could support during a critical incident response. The State could alert the vendor in the event that this number of users is close to breeching the standard simultaneous user availability with the intent of activating the temporary loosening of the restriction.

For repeated overages, an advisory would be sent alerting the State to the potential repeated overage prior to an overage statement/invoice being issued, allowing the State to cover the cost. This would need to be set forth in the contract with the vendor. Comment by Jessica Prater: We can put a similar response as we did in number 51 about round 2 of Q&C. Please correct me if I’m wrong but I don’t believe the intent is to limit the amount of allowable overages in the Contract. Comment by Shalini P. Gupta: Added the language similar to QC #51 regarding round2 Comment by Jason L. Laney: We are not intending to dictate overage limits. Comment by Terry Mason: Edited the last line some to clarify that any respondent, not just the respondent who asked the question, may offer contract language.

Alternatively, does TEMA have a preferred approach for addressing recurring concurrent-user overages under the licensing model?

Please see Amendment Item 3 below for revisions to Pro Forma Contract Section A.3.2.n..

During Written Questions and Comments Round #2, respondents may propose revisions to the contract language for the State’s consideration. The State may, in its sole discretion, accept, reject, or modify any proposed revision, in whole or in part, for incorporation into the RFP’s Pro Forma Contract through a written RFP amendment.

We provide our clients with export data capabilities via non-proprietary formats such as CSV and PDF. Once exported, that data can be converted into JSON, GeoJSON and shapfiles via ArcGIS. Is that an acceptable solution?

Respondents must provide export capabilities in the formats required by the RFP. Respondents should describe any native export format and any conversion steps required.

These standards seem to apply to applications such as 911 for data types such as ANI/ALI and don’t seem to apply to CIMS. Can this requirement be stricken?

The requirement remains as stated. Respondents should describe support for applicable data-exchange standards and identify any limitations or alternative standards supported by the proposed solution.

We do not provide service credits for SLA breaches. Can this requirement be stricken?

The State revised the RFP Pro forma Contract Section A.3.5 by removing this requirement.

We encrypt data using FIPS standards but don’t provide our clients with the encryption keys. Is that acceptable?

Respondents must meet the encryption and key-control requirements stated in the RFP.

In our state and local software solution, we adhere to SOC 2 Type 2 and ISO 27001 standards. Is that acceptable instead of NIST 800-53?

Yes SOC 2 Type 2 and ISO 27001 are acceptable instead of NIST 800-53, See State’ response above to Question/Comment #3.

No. The State will not agree with this request.

The State’s estimated maximum liability is $800,000 for the full contract term of 60 months. This estimate reflects the anticipated cost of acquiring, implementing, and maintaining a Critical Incident Management (CIM) system, including software licensing, configuration, Integration with ArcGIS, training, support, and any associated services.

The scope of work and technical requirements as written appear to exceed what can be reasonably delivered within the stated budget allocation and under the contractual terms and conditions as drafted. Specifically, Section 1.1.2 of $800,000 over 60 months. Would the State of Tennessee please confirm:

(a) whether the budget figure represents a not-to-exceed ceiling or a target estimate;

(b) whether the State of Tennessee is open to phasing the scope, deferring optional requirements, or adjusting acceptance criteria to align the requirements, terms, and budget; and

(c) which of the three - requirements scope, T&Cs, or budget - the State of Tennessee considers fixed versus negotiable for purposes of bid responsiveness?

See State’ response above to Question/Comment #3.

To ensure accurate scoping and accountability, please confirm the intended scope of the Service Level Agreements (SLAs). Specifically:

· Do the SLAs apply to the underlying SaaS infrastructure (platform availability)?

· The application layer, including configured functionality and workflows?

· Or end-to-end system performance, including integrations and external dependencies?

The SLAs apply to the Contractor-provided solution and associated services required by the Contract. Specifically:

· Underlying SaaS infrastructure / platform availability: Yes, to the extent the hosted infrastructure or platform is part of the Contractor-provided solution or is managed by or for the Contractor.

· Application layer, configured functionality, and workflows: Yes. These are part of the Contractor-provided solution and are within the intended SLA scope.

· End-to-end system performance, integrations, and external dependencies: SLAs apply to integrations, interfaces, and performance components under the Contractor’s control. SLAs do not apply to outages or performance issues caused solely by State systems, third-party systems, networks, or other external dependencies outside the Contractor’s control.

Section A.3.4 requires 'native, out-of-the-box integration with Esri ArcGIS Online, including bidirectional synchronization.'

(a) Would the State consider an ArcGIS-native CIM solution built on the ArcGIS platform, or is the State specifically seeking a separate third-party product that integrates with ArcGIS?

(b) Regardless of approach, please clarify the expected data authority model: should the CIMS consume operational data from existing TEMA ArcGIS feature services, or will the CIMS be the authoritative source with publication back into ArcGIS?

(a) The State will consider any proposed solution approach that meets all RFP requirements, including the ArcGIS Online requirements. The RFP does not require the solution to be separate from the ArcGIS platform, provided the Respondent can meet the functional, administrative, security, support, data, and contractual requirements.

(b) The State does not prescribe a single data-authority model in the RFP. Respondents should describe their proposed data-authority model, including whether the CIMS consumes data from existing ArcGIS Online feature services, publishes data to ArcGIS Online, or supports bidirectional synchronization. Final source-of-record and synchronization rules will be confirmed during implementation.

Will the CIM solution process or store any Criminal Justice Information (CJI) subject to CJIS Security Policy?

No CJIS data will be processed, stored, or transmitted across the CIM solution and is therefore not subject to CJIS Security Policy.

Please identify the authoritative source systems for integration (e.g., 911/CAD, NWS, Everbridge/AlertTN, FEMA IPAWS, Power BI, EnviroFlash, traffic, USNG/lat-long feeds), expected data volumes/frequencies, and which integrations are in scope at go-live vs. future phases.

The State does not identify 911/CAD, NWS, Power BI, EnviroFlash, traffic, or other listed feeds as required go-live integrations.

Will the State provide a non-production instance of each upstream/downstream system for integration testing, or is sandbox access the bidder's responsibility?

The State will not provide a non-productions instance. Availability of any State-provided non-production systems or sandbox access will be determined during implementation.

Given that a response must not include alternate contract terms and conditions or it may be deemed a non-responsive counteroffer, please confirm whether the State will entertain pre-bid clarifications or amendments to the Pro Forma Contract (Attachment 6.7) for SaaS-specific provisions - including limitation of liability, indemnification, IP, audit rights, and source-code escrow - that are typically incompatible with multi-tenant SaaS commercial models.

The State will not agree to entertain pre-bid clarifications or amendments to the Pro Forma Contract and the State will not incorporate supplemental SaaS terms, See State’ response above to Question/Comment #26. .

Please confirm the expected go-live date and identify any hard external dependencies (legislative deadlines, hurricane/severe-weather season readiness, retirement of an incumbent system).

The expected go-live date will be determined during implementation planning after the Contract is awarded. The State is not identifying any hard external dependency through this clarification. Respondents may address implementation schedule, milestones, testing, training, and post-go-live support in the applicable Section C Technical Response items, including C.1, C.2, C.3, C.19, C.23, and C.24.

(a) Of these users, how many are expected to be building/modifying applications, creating/editing data, or viewing information?

(b) What concurrent user volume should respondents assume for statewide surge activations above the 300-user baseline?

(c) What performance thresholds (page load, transaction response, dashboard refresh, API response times) will the State use during acceptance testing?

(a) The State is expecting the same type of breakdown as our current system. Under the current system, all the provisioned accounts have access to creating/editing data or viewing data, and only limited number of users (<10) have access to building/modifying data.

(b) Respondents should assume temporary emergency surge capacity of up to 600 simultaneous users for limited emergency activations above the 300-user baseline.

(c) The State has not prescribed specific page-load, transaction-response, dashboard-refresh, or API-response thresholds beyond the performance, availability, testing, and acceptance requirements stated in the RFP. Respondents should describe proposed performance standards, measurement methods, in the applicable Technical Response items addressing hosting/performance, testing, implementation, and acceptance.

Please identify the legacy systems and migration scope expected for this procurement. What source systems, record volumes, attachment volumes, historical retention periods, and data-quality considerations should respondents assume for data migration, reconciliation, and archival?

See State’s response to Question/Comment # 9.

The State at this time will not provide legacy systems. Final source systems, volumes, formats, retention periods, data-quality issues, validation steps, and acceptance criteria will be provided to the Contractor during implementation discovery

Please clarify the State’s expectations for “without vendor coding” Are respondents permitted to use native low-code/no-code configuration tools, business rules, form designers, workflow engines, and report builders that ship with the platform so long as no custom software development is required for the described changes?

Native low-code/no-code configuration tools, business rules, form designers, workflow engines, and report builders are acceptable if they are part of the proposed solution and do not require custom software development, scripting, or vendor coding to meet the stated requirement. The requirement remains as stated in the Requirements Matrix.

Please clarify the preferred operating model for statewide and multi-jurisdiction participation. Should respondents assume a single statewide tenant with external/local user, separate agency spaces, or a hybrid governance model? How should county/local submissions, approvals, visibility boundaries, and mutual-aid workflows be managed at go-live and during multi-jurisdiction operations?

Yes, a single statewide tenant would be used.

Respondents should propose an operating model that supports statewide and multi-jurisdiction participation as required by the RFP. Final governance, roles, permissions, and tenant structure will be confirmed during implementation.

Please clarify expectations for outbound notification services. What is the intended scope of recipients (internal, external, public) and does the State intend to supply any messaging gateways, approved providers, or enterprise notification services to support this process?

Recipients would be internal and external partners with assigned accounts. The general public would not be recipients for the alerts.

Please clarify the expected roles and categories of trainees (e.g., system administrators, operational command staff, field users, partner agency users, IT support personnel), and the expected depth of training for each group.

Additionally, please confirm whether the State expects trainers to be capable of independently delivering full operational training (including system configuration, workflow design, and troubleshooting), or primarily focused on end-user adoption and basic system use.

Respondents should propose training for administrators, end users, train-the-trainer users (facilitators), and partner-agency users sufficient to meet the RFP requirements. The proposal should identify recommended delivery methods and materials.

Facilitators should be able to train operational teams.

Systems Administrators/IT Support should be trained on configurations, design, and troubleshooting.

Please clarify the expected scope of offline operations. Which user roles and workflows must function offline at go-live, what devices/browser environments should respondents assume are in scope, and are there any minimum supported operating systems or field-device constraints the State expects vendors to meet?

By the go-live date, offline operations are expected to support field data entry and automated resynchronization for applicable incident-management workflows when connectivity is restored. The State has not identified specific minimum operating systems, browsers, or field-device constraints beyond the RFP requirements. Respondents may address offline functionality, supported workflows, device/browser support, local data handling, audit trail, and resynchronization in Technical Response Item C.25, which addresses mobile or field-device usability.

For oral presentations, will the State provide scenario-based demonstration scripts, sample data, or specific use cases in advance, or should respondents prepare their own demonstration flow aligned to the listed evaluation items?

Oral demonstrations should be prepared per the RFP requirements in Section D. Oral Presentations.

Will the State modify the relevant provisions of Attachment 6.7 (Pro Forma Contract), Attachment 6.6 (System Requirements Matrix), and (as required) Section 1.1.2 (Maximum Liability) and Attachment 6.3 (Cost Proposal) - prior to the Response Deadline - to align the procurement purpose, the budget, the delivery model, release management, security testing rights, and SLA accountability into a single coherent package, so that compliant SaaS providers are not deemed non-responsive under Section 3.3 for declining (i) unrestricted customer control over the release cycle, (ii) customer-conducted penetration testing of shared infrastructure, or (iii) end-to-end SLAs over layers outside the provider's control?

Respondents need this clarification to construct a responsive Technical Response and a Cost Proposal in Attachment 6.3 that align with the chosen delivery model and the maximum liability stated in Section 1.1.2.

During Written Questions and Comments Round #2, respondents may propose revisions to the contract language for the State’s consideration. The State may, in its sole discretion, accept, reject, or modify any proposed revision, in whole or in part, for incorporation into the RFP’s Pro Forma Contract through a written RFP amendment.

Several requirements (including SLA accountability, A.3.8 performance metrics, business continuity/disaster recovery obligations, and provisions for penetration testing and vulnerability assessments of the processing environment) are typically associated with specifically single-tenant SaaS or contractor-managed infrastructure environments.

Please clarify whether the State intends to accept multi-tenant SaaS platforms, where the underlying infrastructure is managed and controlled by the SaaS provider under a separate SLA than the contractor provided applications, or whether the State’s expectation is a more directly managed hosting model where the contractor is responsible for operations, testing, and compliance at all tiers

Multi-tenant SaaS is not prohibited, provided the Respondent meets all RFP and Pro Forma Contract requirements.

Specifically, are respondents expected to provide administrative access, support State-led penetration testing and vulnerability scanning, and perform infrastructure-level monitoring and remediation activities on the SaaS processing environment (hardware and software), or will these responsibilities be limited to the application layer where the solution is delivered via SaaS infrastructure environment?

The State does not expect administrative access to the underlying SaaS hosting environment. For SaaS solutions, the Contractor remains responsible for meeting the RFP and Pro Forma Contract security requirements for the proposed solution and processing environment. Required audit certifications and security, testing, monitoring, vulnerability management, and remediation documentation must be provided where specified in the RFP or Pro Forma Contract.

Section A.4 Provide a statement to indicate that the Respondent has the required FedRamp authorization outlined in RFP Attachment 6.7. – Pro Forma Contract Section D.37.a.(3)

What are the State’s security requirements for data transiting between the FedRAMP systems to other systems the CIM is to be integrated with?

The Mandatory Requirement A.4 response remains limited to the statement required by the RFP. See State’ response above to Question/Comment #6 as revisions have been made to Pro Forma Contract Section D.37.a.(3).

Data transiting between the CIMS and integrated systems must meet the applicable RFP and Pro Forma Contract security, encryption, access-control, and integration requirements, including Contract Section D.37 as applicable. This clarification does not create an additional response requirement.

55.

56.

When is the expected project start date?

The expected project start date will follow the Contract effective date

57.

58.

Please indicate what business registrations (if any) are required for vendors to do business in your location if awarded a contract.

To do business with the State, a Supplier must be registered through Edison.

See RFP Section 4.7. Professional Licensure and Department of Revenue Registration and Pro Forma Contract section D.2..

59.

60.

61.

62.

Please clarify, how many users the vendor will need to train in the following categories: End-User, Customer Administrators, Train-the-Trainer?

Regional customer admins will handle train-the-trainers.

End users - approximately 150+ Regional customer admins - approximately 10-20 Major admins - approximately 3-5

63.

64.

65.

Can TEMA provide recommendations/ requirements for these so that all vendors can address this specification equally? This will ensure price proposals are apples to apples instead of comparing different levels of service.

TEMA has no recommendations. Respondents shall meet the RTO, RPO, uptime, redundancy, backup, disaster recovery, and testing requirements stated in the RFP.

67.

68.

69.

70.

71.

72.

FedRAMP Reciprocity:

Regarding Section A.4, does the State accept StateRAMP Moderate certification or an equivalent SOC 2 Type 2 report in lieu of a federal agency-sponsored FedRAMPATO?

See State’ response above to Question/Comment #6.

Requires surge concurrency during emergencies at no additional cost. Can the State clarify if there is a cap on the number of simultaneous users permitted during these "Surge Events," or if it is truly unlimited for the duration of the activation?

Respondents should assume a baseline capacity of 300 simultaneous users and temporary emergency surge capacity of up to 600 simultaneous users for limited emergency activations. The RFP does not establish unlimited simultaneous-user capacity. Comment by Terry Mason: See COT comments to QC #27 above. Comment by Shalini P. Gupta: CPO legal to review #27 and based on that we can modify this Comment by Jessica Prater: Please reference 3.2n. Comment by Shalini P. Gupta: Added the language to reference A.3.2n if that is what you are suggesting?

Please see Amendment Item 3 below for revisions to Pro Forma Contract Section A.3.2 n.

Section C.8 mentions the migration of incident and resource data from…