RFP - Operations and Maintenance to Existing ODHS and OHA Salesforce System - FINAL~2.pdf

DAS Procurement Services, Version 4.5 March 31, 2023 Page 1 of 29

STATE OF OREGON

COVER PAGE

Department of Administrative Services, Enterprise Goods and Services, State Procurement Services on behalf of Oregon Department of Human Services, Oregon Health Authority, and Oregon Eligibility Partnership Business of

Information Services

Is issuing this Request For Proposals (RFP) under ORS 279B.060 and OregonBuys Bid Number S-DASOBO-00014873 for

OPERATIONS, MAINTENANCE, DATA MIGRATION AND

ENHANCEMENT SERVICES

Date of Issue: 09/12/2025

Opening Date and Time: 10/13/2025 at 12:00 PM PT

Single Point of Contact (SPC): Brad Wisniewski, State Procurement Analyst

Address: 1225 Ferry St. SE City, State, Zip Salem, OR 97301 Phone (voice) (971) 707-1672 E-mail: Brad.wisniewski@das.oregon.gov

The State of Oregon promotes equal opportunity for all individuals without regard to age, color, disability, marital status, national origin, race, religion or creed, sex or gender, sexual orientation, or veteran status.

mailto:Brad.wisniewski@das.oregon.gov

DAS Procurement Services, Version 4.5 March 31, 2023 Page 2 of 29

SECTION 1: GENERAL INFORMATION

1.1 INTRODUCTION

The State of Oregon (“State”), acting by and through the Department of Administrative Services, Enterprise Goods and Services, State Procurement Services (“DAS SPS”) on behalf of Oregon Department of Human Services (“ODHS”, formerly known as “DHS”), Oregon Health Authority (OHA), and Oregon Eligibility Partnership Business of Information Services (“OEPBIS” or “Agency”), is issuing this Request for Proposal (RFP) for Operations, Maintenance, Data Migration, and Enhancement Services (“Services”) for the existing ODHS & OHA Salesforce System (“System”).

The ODHS & OHA Salesforce System operates within the Salesforce Government Cloud and is comprised of several solutions, all designed for the protection and safety of vulnerable adults and children, for different ODHS and OHA program authorities. See Section 2.2, Overview and Purpose, for additional information.

The selected Proposer must be able to provide all required components of Operations, Maintenance, Data Migration and Enhancement Services as outlined in this RFP and in accordance with Section 3. The Selected Proposer is to ensure the continued functionality, security and enhancement of the ODHS & OHA Salesforce System, supporting both current and future business needs. Additional details on the scope of services are included in Section 2.2, Scope of Work/Specifications.

This RFP outlines the scope of work, Proposer qualifications, evaluation criteria and submission guidelines.

Agency anticipates the award of one (1) Contract from this RFP. The initial term of the Contract is anticipated to be two (2) years with options to renew.

1.2 SCHEDULE

The table below represents a tentative schedule of events. All times are listed in Pacific Time. All dates listed are subject to change. N/A denotes that event is not applicable to this RFP.

Event Date Time

RFP Release to OregonBuys 09/12/2025 By COB

Voluntary Pre-Proposal Teleconference 09/19/2025 10:30 AM PT

Questions / Request for Clarification(s) Due 09/24/2025 3:00 PM PT

Answers to Questions / Request for Clarification(s) posted to OregonBuys (approx.) 10/01/2025

RFP Protest Period Ends 7 calendar days after RFP Release

Opening (Proposal Due) See RFP cover page

Evaluation Committee Evaluates Proposer(s) Response TBD

Competitive Range Announcement TBD

Subsequent Round Evaluation TBD

Issuance of Notice of Intent to Award (approx.) TBD

Award Protest Period Ends 7 calendar days after Notice of Intent to Award

DAS Procurement Services, Version 4.5 March 31, 2023 Page 3 of 29

1.3 SINGLE POINT OF CONTACT (SPC)

The SPC for this RFP is identified on the Cover Page, along with the SPC’s contact information. Proposer shall direct all communications related to any provision of the RFP only to the SPC, whether about the technical requirements of the RFP, contractual requirements, the RFP process, or any other provision.

1.4 ATTACHMENTS

The following attachments are incorporated into this RFP:

Attachment A: Sample Contract Attachment B: Disclosure Exemption Affidavit Attachment C: Proposer Information and Certification Sheet Attachment D: Reference Check Form Attachment E: Reserved for Round 2 Price Proposal Attachment F: Certified Disadvantaged Business Outreach Plan Attachment G: Responsibility Inquiry Attachment H: Requirements

Attachment I: Work Sample & Supplemental Questions

SECTION 2: AUTHORITY, OVERVIEW, AND SCOPE

2.1 AUTHORITY AND METHOD

DAS SPS is issuing this RFP pursuant to its authority under ORS 279A.050 and OAR 125-246-0170(2).

DAS SPS is using the Competitive Sealed Proposal method, pursuant to ORS 279B.060 and OAR 125-247- 0260. DAS SPS may use a combination of the methods for Competitive Sealed Proposals, including optional procedures: a) Competitive Range; b) Discussions and Revised Proposals; c) Revised Rounds of Negotiations;

d) Negotiations; e) Best and Final Offers; and f) Multistep Sealed Proposals.

2.2 DEFINITION OF TERMS

2.2.1 General Definitions

For the purposes of this RFP, capitalized words are defined in OAR 125-246-0110 or as defined below. For terms used in reference to OregonBuys, the Terminology Crosswalk can be found at https://www.oregon.gov/das/ORBuys/Documents/Phase1TerminologyCrosswalk.pdf

2.2.2 Project Specific Definitions

“Available” means the application and the supporting computing infrastructure under the Contractor's control are operating normally.

“Business Operations Window” means 7:00 AM -10:00 PM PT Monday-Friday, excluding State Holidays.

“Business Support Hours” means 8:00 AM - 5:00 PM PT Monday-Friday, excluding State Holidays.

https://www.oregon.gov/das/ORBuys/Documents/Phase1TerminologyCrosswalk.pdf

DAS Procurement Services, Version 4.5 March 31, 2023 Page 4 of 29

“Downtime” means any time outside of maintenance window or Agency-requested maintenance that a key function is not Available because the ODHS & OHA Salesforce System is not operating normally.

“End User” means any person employed by Agency with access to the ODHS & OHA Salesforce System or any person authorized by Agency to use the ODHS & OHA Salesforce System.

“Enhancement” means adding new features, capabilities, or integrations to existing to the ODHS & OHA Salesforce System to expand its functionality. Salesforce required updates are not “enhancements” and shall be considered started O&M refinements

“Hot Fix” means an urgent, unscheduled corrective action applied to a system to address a critical issue, such as a security vulnerability, data integrity failure, or service disruption. Hot Fixes are implemented outside of regular maintenance or release cycles and are intended to provide an immediate resolution to high-priority defects with minimal impact to system availability.

“Incident” means an unexpected event or disruption that affects the normal operations, performance or security of the system and requires corrective action.

“Issue” means a broad term that refers to any identified defect, feature request or enhancement in a system.

“Ticket Software” means an Agency procured and maintained online existing system that serves as the ODHS & OHA Salesforce System of record for Requirements and the tool for tracking Incidents through the resolution lifecycle. The requirements and incident management system being used is currently Azure Development Operating System (ADOS).

“Personally Identifiable Information” means the collected and stored personal information in which the State has legal and ethical responsibility to keep private and protected such as protected health information, personal income tax, driving records, criminal history information and education data.

“Refinement” means a mutually agreed-upon system modification requested by Agency to improve an existing system’s efficiency, performance, usability, or security without altering its core functionality.

Refinements may include debugging, streamlining processes, applying minor updates, fine-tuning configurations, or enhancing the user experience. To include all Salesforce required updates.

“Release” means any Hot Fix, Update, Enhancement of the System.

“Release Notes” means documentation summarizing new features and functions that will be included in each Release including a reference to associated Ticket Software tickets and Developer Guides.

“Reporting Period” means a time period that is 1/12 of a calendar year during which the Contractor provides Services and reports on the Services provided.

“Response” means Contractor's acceptance and acknowledgment back to the Agency of a user-reported problem with the ODHS & OHA Salesforce System.

“Resolution” means repair to the ODHS & OHA Salesforce System to correct a failure of the System or any function in the System.

“Scheduled Maintenance” means Maintenance services occurring outside of Business Operations Window and Contractor provided written notice to the Agency as described in the Operational Support Plan.

“Service Level Agreement” or “SLA” means an agreement that defines specific elements of the Services, periods of time for completing the defined Services, measurable conditions for determining successful resolution of Defects, and consequences for not meeting the SLA. The SLA may contain conditions for

DAS Procurement Services, Version 4.5 March 31, 2023 Page 5 of 29 starting, stopping, and pausing the measurement of the relevant time period.

“Software Component” means application software, a web service, a web resource, or software module, script, or any other software developed or configured by Contractor that together comprise the ODHS & OHA Salesforce System.

“State Holiday” means ODHS general business hours are closed for observed State Holidays. Holidays that fall on Saturday shall be recognized on Friday before. When holiday falls on a Sunday, the following Monday shall be recognized as a State holiday.

“Security Audit” means a formal, systematic evaluation of the system’s security controls, configurations, and practices to determine how effectively they protect the system and its data from unauthorized access, misuse, or vulnerabilities.

"System” means the ODHS & OHA Salesforce System.

“System Data Dictionary” means the authoritative reference for how data is structured and behaves in the system.

“System Defect” means a flaw, error or unintended behavior within software system that causes it to fail to perform as intended or specified. Defects can stem from coding errors, design flaws, requirement misunderstandings, configuration issues, or third-party dependencies.

“System Integration” means the engineering process of bringing together the component sub-systems into one system and ensuring that the subsystems function together as a system, and information technology process of linking together different computing systems and software applications physically or functionally to act as coordinated whole.

“Ticket” means the Document created electronically in the Agency ticket software used for reporting, tracking, and resolving System issues or problems.

“Update” means a planned and tested modification to a system that may include Salesforce-required updates, new features, performance improvements, security patches, or minor bug fixes. Updates are typically deployed on a regular schedule and are part of the ODHS & OHA Salesforce System’s ongoing operations and maintenance (O&M) lifecycle.

“User Acceptance Testing” means the final testing stage in software development before production. The agency staff conduct simulated testing in a controlled environment to detect bugs and other issues to ensure the ODHS & OHA Salesforce System meets business requirements, specifications, agreed criteria, workflow aligns with business operations and software complies with State and federal regulations.

2.3 OVERVIEW AND PURPOSE

2.3.1 Agency Overview and Background

The Oregon Eligibility Partnership (OEP) is a dedicated program within Oregon Department Human Services (ODHS) that ensures coordinated, timely, and accurate determination of eligibility for critical benefits, including healthcare, food security, employment, and cash assistance for Oregonians in need.

Within OEP, the Business Information Services (BIS) unit plays a vital role in upholding the integrity and effectiveness of ODHS & OHA programs by supporting enterprise level IT projects, and on-going operations and maintenance such as the ODHS & OHA Salesforce System. BIS specializes in the development and application of standards and practices for business and user acceptance testing, ensuring that technology solutions meet the business needs regulatory requirements of ODHS & OHA.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 6 of 29

Through strategic planning and collaborative partnerships within state agencies, program partners and IT organizations, BIS advances ODHS’s & OHA’s mission by providing expert oversight, quality assurance, and sustainable IT solutions that reinforce program integrity and enhance service delivery for the people of Oregon.

2.3.2 Project Overview and Background

The ODHS & OHA Salesforce System is a unified, enterprise level platform that consolidates data, licensing, and infrastructure to support the agency’s mission of protecting vulnerable adults and children across the state. By streamlining access to critical information and fostering inter-program collaboration, the ODHS & OHA Salesforce System serves as a cornerstone in OHA & ODHS’s efforts to deliver timely, coordinated, and effective services.

In response to a 2014 mandate from the Oregon State legislature, ODHS was directed to standardize the collection and management of adult abuse information to improve statewide coordination and facilitate interagency data sharing. This directive led to the development and phased implementation of the Centralized Abuse Management CAM System (CAM) between 2017-2019, built on the Salesforce platform.

The CAM system is a comprehensive, web-based information management tool that documents abuse reports, investigations, serious incidents and death reviews involving vulnerable populations. CAM supports multiple ODHS programs with investigative and protective responsibilities, ensuring consistency and accountability in handling sensitive cases.

Building upon the success of CAM, the Aging and People with Disabilities (APD) program expanded the Salesforce platform to include additional modules:

1. Corrective Action and Licensing Management Survey (CALMS): A regulatory compliance tool to manage licensing activities, corrective actions, and quality assurance process for licensed care facilities.

2. Emergency Responsible Management System (ERMS): A specialized workflow designed to coordinate emergency responses for residences of licensed care settings and individuals receiving in-home services during geographic or natural emergencies.

Together, these components form a robust, integrated Salesforce ecosystem (ODHS & OHA Salesforce System) that enables ODHS to fulfill its statutory and ethical obligations to protect Oregon’s most vulnerable residents through efficient data management, streamlined workflows, and cross-program transparency.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 7 of 29

2.4 SCOPE OF WORK/SPECIFICATIONS

In addition to meeting all requirements detailed in Attachment H, Requirements, Proposers’ Scope of Services must also encompass the following tasks. Additional functional and non-functional ODHS & OHA Salesforce System requirements will be provided in Round 2 of this RFP. The Proposer selected for Award, in collaboration with Agency, shall provide comprehensive Operations, Maintenance, Data Migration and Enhancement Services for the ODHS & OHA Salesforce System. All project management services must comply with Project Management Body of Knowledge (“PMBOK”) guidelines (6th edition or most current version). The scope of work includes:

1. System Operations and Maintenance:

a. Proposer must ensure the continuous and efficient operations of the ODHS & OHA

Salesforce System.

b. Proposer must provide technical support to the agency’s established support desk, assisting

State Business Analyst with user inquiries and access management.

c. Proposer must conduct third-party software installation, configuration and development within the ODHS & OHA Salesforce System environment according to defined business requirements.

d. Proposer must manage and optimize ODHS & OHA Salesforce System environments for performance, security and compliance.

2. Data Management and Migration:

a. Proposer must provide data management and data migration support services for transferring data from the ODHS & OHA Salesforce System to and from the State Central Data Warehouse (SCDW). This includes mapping data tables, monitoring and addressing issue(s) in data transfer to ensure the successful transfer and migration of data.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 8 of 29

b. Proposer must implement data encryption protocols to protect sensitive information during storage and transmission.

c. Proposer must recommend options to restore data integrity caused by data migration errors.

d. Proposer must provide data analysis within the ODHS & OHA Salesforce System environment, including executing data queries, developing customized reports, migration of data records, and synthesizing data to align with agency business requirements.

e. Proposer must document all actions related to data transfer including but not limited to, data workflow, data tables, test results, errors, and implemented decisions, develop and maintain System Data Dictionary to ensure accurate data documentation.

f. Proposer must ensure data integrity, security and compliance with State and federal regulations at all times.

3. Incident Management and System Defect Resolution:

a. Proposer must identify, track and resolve System Defects and System Incidents in collaboration with agency.

b. Proposer must implement best practices for incident management, trouble shooting and root cause analysis.

c. Proposer must conduct testing before implementing fixes for the ODHS & OHA Salesforce

System. This includes performing unit testing, integration testing, and regression testing to ensure System stability and functionality, conducting User Acceptance Testing (UAT) in collaboration with the agency to validate defect resolution and performance, Identify and mitigate potential risks or unintended impacts before deployment to production.

d. Proposer must document test results, issues identified and resolution for transparency and future reference.

e. Proposer must ensure all fixes comply with security, compliance and Agency-specific requirements prior to implementation.

4. Refinement and Release Management:

a. In collaboration with Agency, Proposer must identify system refinements and Salesforce-required updates.

b. Proposer must analyze business needs and translate them into technical requirements for development and release planning.

c. Proposer must implement a structured change management process to track, evaluate, and approve refinements before deployment.

d. Proposer must develop, configure and implement approved refinements within the

Salesforce environment.

e. Proposer must conduct rigorous testing (unit, integration, regression and UAT) to ensure updates function as intended without introducing new defects.

f. Proposer must ensure refinements comply with agency operational needs and minimizes disruptions.

g. Proposer must ensure roll back procedures are in place to mitigate risks associated with failed deployments.

h. Proposer must provide immediate support and remediations for any post-deployment defects or disruptions.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 9 of 29

i. Proposer must document Releases outcomes, including performance impacts and resolved issues.

j. Proposer must maintain and update technical documentations related to refinements and Releases.

5. System Security – Proposer must ensure robust protection against threats by monitoring security risks, identifying vulnerabilities and implementing proactive measures. Responsibilities may include but are not limited to:

a. Threat Monitoring & Response: Proposer must mitigate security threats to safeguard system integrity.

b. Security Best Practices & Compliance: Proposer must analyze, recommend and implement security modifications, policies and procedures to align with IT best practices and State compliance standards.

6. Access control & Data Protection – Proposer must also serve as system administrator, including but not limited to managing user access, authentication protocols and data encryption to prevent unauthorized access to the ODHS & OHA Salesforce System.

a. Security Audits & Risk Assessments – Proposer must conduct regular security audits and risk assessments to identify and address potential weaknesses.

b. Incident Management & Recovery – Proposer must develop response strategies for security incidents, data restoration, ensure rapid recovery and minimal disruption.

7. Other aspects related to Operations, Maintenance, Data Migration and Enhancement Services.

a. Enhancements to the ODHS & OHA Salesforce System are performed as needed and when initiated by the Agency will be completed using a service order process. Enhancements are outside the scope of normal O&M activity.

b. Agency may contract with Proposer selected for award for additional Enhancement Services. When Enhancement Services are authorized by Agency, Proposer shall be responsible for managing and implementing enhancements in alignment with project management best practices, ensuring structured, secure and efficient updates while maintaining system integrity and compliance.

c. Limited scope may relate to or consist of efforts related to Disaster Recovery, Support Desk, User Account Management, and Deployment Guides.

8. Proposer must provide ongoing Maintenance and Updates of Technical and Operational Documentation, including:

Yearly:

a. Functional, Technical and Data Dictionary documentation every 12 months or after a

System Enhancement.

b. Operational Support Plan every 12 months or as needed.

c. System Performance Report every 12 months or as needed.

Monthly:

d. Monthly Data Migration, Data Tables and Validation Report.

e. Refinement Release Summary.

f. Provide monthly reports detailing system performance, support activities, incident

DAS Procurement Services, Version 4.5 March 31, 2023 Page 10 of 29 management, refinement releases and recommendations for improvement.

g. Provide monthly status report detailing work metrics and staff hours related to scope of services.

h. Comprehensive Knowledge Transfer – Documenting and sharing system architecture, configurations, troubleshooting steps and best practices with State Operations and Maintenance teams to support ongoing Operations and Maintenance, Data Migration, and Enhancement services.

9. Out of Scope Work:

a. The ODHS State Data Warehouse is outside of scope. The State is responsible for storage and maintenance of data after it has successfully transferred from ODHS & OHA Salesforce System.

b. Hosting Services. The ODHS & OHA Salesforce System is hosted by the State of Oregon on the Salesforce Platform Government Cloud. The ODHS State Data Warehouse is responsible for managing data transfer(s).

c. Any data requests or reporting by ODHS State Data Warehouse are outside of scope.

d. The State is also responsible for ensuring the data intended to transfer from ODHS State Data Warehouse to the ODHS & OHA Salesforce System is available, accurate, and that mapping tables are properly configured for successful transfer.

e. Additional ODHS & OHA Salesforce System specifications are included in Attachment H, Requirements.

3 PROCUREMENT REQUIREMENTS

3.1 MINIMUM QUALIFICATIONS

To be considered for evaluation, Proposal must demonstrate how Proposer meets all requirements of this section:

Proposer must describe Proposer’s company’s qualifications and capacity to support a Salesforce Operations & Maintenance (O&M) engagement for the ODHS & OHA Salesforce System. Proposer’s Proposal must demonstrate the organization’s long-term ability to maintain service delivery, support system evolution, and ensure continuity regardless of personnel changes.

3.1.1 Proposer’s Proposal must address the following:

1. A minimum of 5 years of experience providing Salesforce O&M services at the organizational level.

2. A minimum of 5 years of experience managing and protecting highly sensitive information, including layered levels of protection and access within Salesforce platforms.

3. Salesforce Partner Requirement. Proposer must be an official Salesforce Partner. Proposer must provide the following information:

o Proposer Organization current Salesforce Partner Program tier (Registered, Ridge, Crest, or Summit) o A web link to Proposer’s listing in the Salesforce AppExchange Partner Directory

DAS Procurement Services, Version 4.5 March 31, 2023 Page 11 of 29 o Proposer’s Salesforce Partner ID

3.1.2 Recommended Qualifications & Capabilities:

1. Salesforce Administration & Support: Minimum 5 years of experience managing Salesforce operations, including user management, security settings, and system health monitoring.

2. Salesforce Development: Minimum 5 years’ experience in Salesforce development, including

APEX, LWC, integrations and automation.

3. Salesforce Data Migration & Integration: Minimum 5 years executing large-scale data migrations and integration third-party solutions with Salesforce.

4. Experience supporting complex, integrated Salesforce environments in public-sector or regulated industries.

5. Description of Proposer Organization staffing model, including how roles are assigned, transitioned, and backfilled.

6. Describe how Proposer’s organization ensures continuity of service and mitigates risk associated with staff turnover.

7. Description of internal training, onboarding, and knowledge management practices used to ensure consistency across team members.

8. Overview of Proposer’s organizational structure and how support teams are aligned to Salesforce

O&M contracts.

9. Capacity for Proposer to scale support teams quickly in response to workload spikes, outages, or emergency incidents.

10. Proposer may also include relevant certifications held by company personnel and information about

Proposer’s Salesforce partner status or other relevant partnerships.

3.1.3 Key Persons Minimum Requirements, Qualifications & Experience:

Proposer must demonstrate the ability to meet the minimum qualifications for Key Personnel assigned to this engagement. Proposer’s Proposal must include resumes and relevant certifications for proposed team members.

Mandatory Certifications & Experience:

1. Salesforce Administrator (Certified Administrator)

2. Salesforce Platform Developer I

3.1.4 Preferred Certifications:

While the certifications listed below are not required for award, Proposers are encouraged to identify whether their organization includes staff with the following certifications, either assigned to or available in support of this engagement. These certifications may be used as indicators of organizational maturity, subject matter expertise, and the ability to escalate or respond to emerging privacy, security, or compliance needs. The presence of such certifications will not be directly scored but may be considered as part of the overall evaluation of organizational capability and risk management preparedness.

1. CISSP – Certified Information Systems Security Professional

2. CGRC – Certified in Governance, Risk and Compliance

3. CRISC – Certified in Risk and Information Systems Control

DAS Procurement Services, Version 4.5 March 31, 2023 Page 12 of 29

4. CIPT – Certified Information Privacy Technologist

5. CIPP/US – Certified Information Privacy Professional (U.S.)

6. Salesforce Platform Developer II

7. Salesforce Data Architect

8. Salesforce App Builder

9. Salesforce Advanced Administrator

10. Salesforce Technical Architect

11. Salesforce Integration Architect

12. Industry-specific Salesforce certifications (e.g. Service Cloud, Experience Cloud, Market Cloud)

3.1.5 Preferred Technical Skills:

1. Development & Customization: Apex, Lightning Web Components, (LWC), Visualforce, SOQL, SOSL

2. Integrations: REST and SOAP APIs, middleware platforms (MuleSoft, Boomi, etc.)

3. Automation & Maintenance: Flow Builder, Process Builder, Validation Rules

4. Data Migration & Management: ETL tools, Demand Tools, Data Loader, data deduplication and transformation strategies

5. Security & Compliance: Role-based access, data encryption, HIPAA compliance

6. DevOps & Deployment: Experience with CI/CD tolls (Salesforce DevOps, Git, Jenkins)

3.1.6 Proposer’s Proposal must:

1. Provide evidence of prior successful Salesforce projects of similar scope and complexity.

2. Demonstrate scalability to meet ongoing support and SLAs.

3. Include a Staffing Plan, Key Persons, and Resumes. Define positions and duties to fully support the needs outlined in this RFP, Number of staff proposed including full-part, part-time and on-call.

4. Follow Salesforce best practices for security, development and deployment.

5. Demonstrate the ability to manage, maintain and enhance custom code developed by a prior vendor without requiring a full redevelopment of existing functionality and without disruption to business. This includes:

6. Review and understanding the existing Apex, Lightning Web Components (LWC), DAS Procurement Services, Version 4.5 March 31, 2023 Page 13 of 29

Visualforce, and automation rules.

7. Maintaining and debugging existing customization.

8. Enhancing existing features while preserving core functionality

9. Ensuring seamless integration with other systems and third-party applications.

10. Maintain clear documentation and change logs for system enhancements.

3.2 MINIMUM SUBMISSION REQUIREMENTS

3.2.1 ROUND 1 Proposal Submissions

To be considered for evaluation, Proposer’s Proposal must contain each of the following items (further detailed in Proposal Requirements section below):

• Proposer Information and Certification Sheet (Attachment C)

• Executive Summary

• Experience and Capabilities

• Staffing Plan, Key Persons and Resumes

• Proposers Organizational Profile

• Proposed Scope of Services, including Project Management Plan

• Reference Check Form(s)

• Performance Metrics and Service Level Agreements (SLAs)

• Disclosure Exemption Affidavit (Attachment B)

• Certified Disadvantaged Business Outreach Plan (Attachment F)

• Responsibility Inquiry (Attachment G)

• Requirements (Attachment H)

• Work Sample and Supplemental Questions (Attachment I)

• Security Requirements (Pass/Fail)

3.2.2 Proposal Page Limits

Proposal is limited to 50 pages. Any pages exceeding this limit will not be provided to the evaluation committee or considered in the evaluation. The following items do not count toward the page limit:

• Disclosure Exemption Affidavit (Attachment B)

• Proposer Information and Certification Sheet (Attachment C)

• Reference Check forms (Attachment D)

• Certified Disadvantaged Business Outreach Plan (Attachment F)

• Responsibility Inquiry (Attachment G)

• Requirements (Attachment H)

• Work sample & Supplemental Questions (Attachment I)

DAS Procurement Services, Version 4.5 March 31, 2023 Page 14 of 29

3.2.3 Proposal Format and Quantity

Proposal should follow the format and reference the sections listed in the Proposal Requirements section.

Responses to each section and subsection should be labeled to indicate the item being addressed.

OregonBuys Electronic Response. Proposer should submit its Proposal electronically through OregonBuys. Proposer should follow the procedures outlined in Section 4.5.1 for electronic submission.

The Price Proposal must be submitted as a separate electronic response file.

Proposer shall submit one copy of its Proposal and all other submittal requirements, with Attachment C, Proposer Information and Certification Sheet, bearing the Proposer’s authorized representative’s Signature, in one of the following formats: Adobe Acrobat (pdf), Microsoft Word (docx), or Microsoft Excel (xlsx). If Proposer believes any of its Proposal is exempt from disclosure under Oregon Public Records Law (ORS 192.311 through 192.478), Proposer shall complete and submit the Disclosure Exemption Affidavit (Attachment B). Proposer shall also mark as “Confidential” in OregonBuys all attachments to its Proposal that Proposer believes are exempt from disclosure.

The Proposer Information and Certification Sheet (Attachment C) must bear the Proposer’s authorized representative’s Signature.

3.2.4 Authorized Representative

Failure of Proposer’s authorized representative to sign the Proposal may result in rejection of the Proposal by Agency.

3.3 ROUND 1 PROPOSAL REQUIREMENTS

Proposer’s Proposal must address each of the items listed in this section and all other requirements set forth in this RFP. Proposer shall describe the Goods to be provided or the Services to be performed or both. A Proposal that merely offers to provide the goods or services as stated in this RFP may be considered non- Responsive to this RFP and will not be considered further.

Proposal should not include extensive artwork, unusual printing or other materials not essential to the utility and clarity of the Proposal. Do not include marketing or advertising material in the Proposal, unless requested. Proposal should be straightforward and address the requests of the RFP. Proposal containing unsolicited marketing or advertising material may receive a lower evaluation score if required information is difficult to locate.

A Price Proposal submission is not required in Round 1.

3.3.1 Proposer Information and Certification Sheet (Pass/Fail)

Proposer shall complete and submit Attachment C, Proposer Information and Certification Sheet.

The Proposer Information and Certification Sheet must bear Proposers authorized representative’s Signature. Failure of the authorized representative to sign the Proposal may subject the Proposal to rejection by DAS SPS.

Failure to demonstrate compliance with Oregon Tax Laws and sign the Proposer Information and Certification Sheet may result in a finding of non-responsibility.

3.3.2 Executive Summary (Scored)

The Executive Summary should highlight Proposers’ understanding of the Agency’s needs and how Proposer’s Solution addresses these needs. Summarize the Solution’s key features, benefits, DAS Procurement Services, Version 4.5 March 31, 2023 Page 15 of 29 and alignment with the Agency’s objectives, including improved efficiency and compliance.

Briefly outline Proposer’s expertise, and commitment to ongoing support, and emphasize what sets Proposer’s Solution apart from competitors.

3.3.3 Experience & Capabilities (Scored)

The Proposal must clearly and thoroughly demonstrate how Proposer satisfies the minimum qualifications set forth in Section 3. In addition, Proposer’s Proposal must include a detailed summary of Proposer’s experience and capabilities as they pertain to the Requirements and the Scope of Work in this RFP. This summary shall describe Proposer’s organizational expertise, relevant project experience, technical competencies, and capacity to successfully fulfill the requirements of this solicitation. Proposer should highlight any specialized knowledge, certifications, or prior engagements that substantiate its ability to perform the Services.

3.3.4 Staffing Plan, Key Persons and Resumes (Scored)

Proposer shall submit a Staffing Plan, identifying proposed Key Persons, staff, and/or sub- Proposers and their relevant experience that will be assigned to this project.

Proposer must specify Key Persons to be assigned to this project and include a current resume (not to exceed two pages each) for each key person that demonstrates the person’s qualifications and experience for the Work described in this RFP. Proposer’s Proposal may also add further note of any of the mandatory and preferred certifications by their personnel as referenced above in section 3.

If Proposer intends to work with subProposer(s), Proposer shall include a statement detailing any subcontracting firms or individual subProposers that may be engaged as part of the Proposal to this RFP, with those entities and the Services they will provide clearly identified.

3.3.5 Proposer’s Organizational Profile (Scored)

Proposer must provide a profile of its organization. This is Proposer’s opportunity to give an overview of its organization, describe the structure of its business, and discuss how the organization can effectively deliver the Services described in this RFP. The Organizational Profile must include:

1. Ownership. If incorporated, the state in which the organization is incorporated and the date of the incorporation.

2. Location of the organization’s offices (headquarters and branches).

3. Location of the office from which employees will be assigned to provide the Services for the Agency.

4. Number of employees located in the Pacific Northwest, nationally, and internationally.

5. Established business relationships with proposed subProposers (if applicable).

6. Organization’s client base.

3.3.6 Proposed Scope of Services, including Project Management Plan (Scored)

Describe how Proposer will carry out the major activities of this project in context with the Scope of Work. Proposer must provide a comprehensive Project Management Plan that Proposer intends to follow. This Project Management Plan should be comprehensive and concise.

DAS Procurement Services, Version 4.5 March 31, 2023 Page 16 of 29

The Project Management Plan must address, at a minimum, risk and issues management, scope management, software development approach (e.g., agile, etc.). The Project Management Plan must adhere to applicable PMBOK guidelines.

3.3.7 Reference Check Form (Scored)

Provide 5 references from current or former client firms for similar projects performed for any clients within the last 10 years. References must be able to verify the quality of previous, related Work.

Agency may check to determine if references provided support Proposer’s ability to comply with the requirements of this RFP. Agency may use references to obtain additional information, or verify any information needed. Agency may contact any reference (submitted or not) to verify Proposer’s qualifications.

Proposer shall send the Reference Check Form (Attachment D) to its references. Reference Check Forms must be completed by the Reference and returned to Proposer to be submitted as part of Proposer’s Proposal. Reference Check Forms must be received prior to Opening.

3.3.8 Performance Metrics and Service Level Agreements (SLAs) (Scored)

Proposer shall submit its proposed performance metrics and Service Level Agreements (SLAs) for the proposed Solution. These metrics should include, but are not limited to, Solution uptime and availability, response times for support requests, resolution times for incidents, data backup and recovery timelines. Metrics should align with industry standards and ensure the Solution meets the operational needs of the State.

3.3.9 Disclosure Exemption Affidavit (Pass/Fail)

Proposer shall complete and submit Attachment B, Disclosure Exemption Affidavit, as part of Proposal.

Submission is required even if Proposer is not identifying confidential or proprietary information and data for nondisclosure. If Proposer is identifying items for nondisclosure as confidential or proprietary, Proposer must specify the reason for the exemption.

Redacted Proposal. If Proposer is identifying items for nondisclosure, Proposer must provide an appropriately redacted copy of the complete, original Round 1 Proposal Submissions.

3.3.10 Certified Disadvantaged Business Outreach Plan (Pass/Fail)

Proposer shall complete and submit Attachment F, Certified Disadvantaged Business Outreach Plan.

3.3.11 Responsibility Inquiry (Pass/Fail)

Proposer shall complete and submit Attachment G, Responsibility Inquiry.

3.3.12 Requirements (Scored)

Proposer to fill out Attachment H, Requirements. There are directions to fill this out on a tab in the lower part of the excel document. Please follow all directions closely and go through each requirement thoroughly to ensure a proper understanding of the requirements for the ODHS & OHA Salesforce System.

3.3.13 Work Samples and Supplemental Questions (Scored)

Proposer will fill out the Work Sample and Supplemental Questions form (Attachment I) or respond in a separate document to that form attachment. For this attachment, please answer all questions and provide

DAS Procurement Services, Version 4.5 March 31, 2023 Page 17 of 29 any referenced work samples.

3.3.14 Security Requirements (Pass/Fail)

Proposer shall provide a narrative statement that demonstrates how Proposer meets all requirements of this section. Or, in the alternative, Proposer may provide one of the following to demonstrate compliance with Oregon’s Information Technology Control Standards:

1. Proof of current GovRAMP Authorized status (Ready, Provisional, or Authorized) in the form of a GovRAMP Letter, or

2. Documentation of a valid GovRAMP Security Snapshot Score If Proposer is submitting a narrative statement, the narrative statement must demonstrate how the proposed Solution follows a secure software development lifecycle (SDLC) process including, but not limited to, secure coding practices, patch management, integrating DevSecOps into DevOps, testing, and incident response. Proposers may submit supplemental documentation to support this narrative.

Proposer is encouraged to look at the best deployment for a Solution for the State of Oregon in alignment with the State’s cloud strategy, found at:

https://www.oregon.gov/das/OSCIO/Documents/EIS_CloudForward.pdf

Data Protections

• Proposer understands and has the capability of handling and protecting Agency Data that has been classified as Level 3 Information under the State of Oregon’s Information Asset Classification policy, available online at https://www.oregon.gov/das/Policies/107- 004-050.pdf .

• Proposer and its employees, Proposers, and agents shall comply with all applicable state and federal laws and regulations, and State of Oregon policies governing Agency Data and its use and disclosure, including as those laws, regulations, and policies may be updated from time to time, including:

• Oregon’s Statewide Information Security Standards, viewable at:

https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-forstate-agencies.aspx including security controls that meet or exceed “Moderate” security controls in the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53.

• Oregon’s Statewide Information Security Plan, found online at:

https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-forstate-agencies.aspx

• Statewide Cloud Computing policy: http://www.oregon.gov/das/policies/107-004- 150.pdf

• Oregon’s Statewide Information Technology Policies:

www.oregon.gov/das/Pages/policies.aspx#IT

• Privileged Access Monitoring and Reporting, viewable at:

https://www.oregon.gov/das/Policies/107-004-140.pdf

• Cloud Forward, viewable at:

https://www.oregon.gov/eis/siteassets/eis-cloud-forward-20230116.pdf

• Oregon Consumer Privacy Act (OCIPA), viewable at:

https://www.oregon.gov/das/OSCIO/Documents/EIS_CloudForward.pdf https://www.oregon.gov/das/OSCIO/Documents/EIS_CloudForward.pdf https://www.oregon.gov/das/Policies/107-004-050.pdf https://www.oregon.gov/das/Policies/107-004-050.pdf https://www.oregon.gov/das/Policies/107-004-050.pdf https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx https://www.oregon.gov/eis/cyber-security-services/Pages/guidance-for-state-agencies.aspx http://www.oregon.gov/das/policies/107-004-150.pdf http://www.oregon.gov/das/policies/107-004-150.pdf http://www.oregon.gov/das/policies/107-004-150.pdf http://www.oregon.gov/das/Pages/policies.aspx#IT http://www.oregon.gov/das/Pages/policies.aspx#IT https://www.oregon.gov/das/Policies/107-004-140.pdf https://www.oregon.gov/das/Policies/107-004-140.pdf https://www.oregon.gov/eis/siteassets/eis-cloud-forward-20230116.pdf https://www.oregon.gov/eis/siteassets/eis-cloud-forward-20230116.pdf

DAS Procurement Services, Version 4.5 March 31, 2023 Page 18 of 29 https://www.oregonlegislature.gov/bills_laws/ors/ors646a.html

Security Standards To the extent the standards apply to Proposer’s proposed Solution and related Services, Proposer must substantially comply with all the following minimum standards:

• Privileged Access Monitoring and Reporting, viewable at:

https://www.oregon.gov/das/Policies/107-004-140.pdf

• Statewide Information and Cyber Security Standards, viewable at:

https://www.oregon.gov/eis/cyber-security-services/Documents/eis-cssstatewide-information-technology(IT)-control-standards.pdf

• Statewide Cloud Computing Policy, viewable at:

http://www.oregon.gov/das/policies/107-004-150.pdf

• Proposer shall sign a non-disclosure agreement for any and all information received or processed on its equipment from the State of Oregon.

• Proposer shall always protect State of Oregon sensitive materials.

Background Checks Proposer and Proposer's staff monitoring the Solution who will have access to State systems, facilities, and confidential information will submit to all security checks requested by Agency, which may include any combination of fingerprinting, Oregon Law Enforcement Data Systems (“LEDS”) and Federal Bureau of Investigation Criminal Justice Information Services (“FBI CJIS”) background checks.

4 ROUND 1 SOLICITATION PROCESS

4.1 PUBLIC NOTICE

The RFP and attachments are published in the State of Oregon’s electronic procurement system OregonBuys at https://oregonbuys.gov/. Documents will not be mailed to prospective Proposers.

Modifications, if any, to this RFP will be made by written Amendment(s) published in OregonBuys.

Prospective Proposer is solely responsible for checking OregonBuys to determine whether or not any Amendment(s) have been issued. Amendment(s) are incorporated into the RFP by this reference.

4.2 PRE-PROPOSAL CONFERENCE

A Pre-Proposal conference will be held at the date and time listed in the Schedule. Prospective Proposers’ participation in this conference is highly encouraged but not mandatory. Prospective Proposers may attend via conference call or Microsoft Teams.

The purpose of the Pre-Proposal conference is to:

• Provide additional description of the project;

• Explain the RFP process; and

• Answer any questions Proposers may have related to the project or the process.

https://www.oregonlegislature.gov/bills_laws/ors/ors646a.html https://www.oregonlegislature.gov/bills_laws/ors/ors646a.html https://www.oregon.gov/das/Policies/107-004-140.pdf https://www.oregon.gov/das/Policies/107-004-140.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology(IT)-control-standards.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology(IT)-control-standards.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology(IT)-control-standards.pdf https://www.oregon.gov/eis/cyber-security-services/Documents/eis-css-statewide-information-technology(IT)-control-standards.pdf http://www.oregon.gov/das/policies/107-004-150.pdf http://www.oregon.gov/das/policies/107-004-150.pdf https://oregonbuys.gov/

DAS Procurement Services, Version 4.5 March 31, 2023 Page 19 of 29

Statements made at the Pre-Proposal conference are not binding upon Agency. Proposers may be asked to submit questions in Writing.

The Pre-Proposal Conference will be held on 09/19/2025, from 10:30 – 11:30 AM PT

Conference call in number:

+1 971-277-2343 United States, Portland

Find a local number

Phone conference ID: 844 794 336#

Conference Microsoft Teams link:

Join the meeting now

Meeting ID: 260 467 145 090 3

Passcode: Fw3ag244

4.3 QUESTIONS / REQUESTS FOR CLARIFICATIONS

All inquiries, whether relating to the RFP process, administration, deadline or method of award, or to the intent or technical aspects of the RFP must:

• Be delivered to the SPC via an OregonBuys submission or email;

• Reference the OregonBuys bid number;

• Identify Proposer’s name and contact information;

• Refer to the specific area of the RFP being questioned (i.e. page, section and paragraph number); and

• Be received by the due date and time for Questions/Requests for Clarification identified in the Schedule in Section 1.2.

4.4 SOLICITATION PROTESTS

4.4.1 Protests to RFP

Prospective Proposer may submit a Written protest of anything contained in this RFP, including but not limited to, the RFP process, Specifications, Scope of Work, and the proposed Sample Contract. This is prospective Proposer’s only opportunity to protest the provisions of the RFP, except that Proposer may protest Amendment(s) as provided below and Proposer may take exception to the terms and conditions of the Sample Contract marked as negotiable as set forth in the Negotiations Section.

4.4.2 Protests to Amendment(s)

Prospective Proposer may submit a Written protest of anything contained in an Amendment. Protests to an Amendment, if issued, must be submitted by 5:00 p.m. Pacific Time on the second Business Day following the issuance of the Amendment or the date/time specified in the Amendment, or they will not be considered. Protests of matters not added or modified by the Amendment will not be considered.

4.4.3 Requirements for Protests

All protests must:

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdialin.teams.microsoft.com%2F2df0f08c-5e2f-4516-b2d9-ce7dd2663420%3Fid%3D844794336&data=05%7C02%7CBrad.Wisniewski%40das.oregon.gov%7C3b9e131bcaf44f67056a08dde4e6c3b0%7Caa3f6932fa7c47b4a0cea598cad161cf%7C0%7C0%7C638918401965731583%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiO…