2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 1 of 20 Revised 4/22/2024

RFP26006341

AGENCY SOLICITATION SPECIFICATIONS

DEPARTMENT OF REVENUE, DIVISION OF MOTOR VEHICLES

CREDENTIALING SYSTEM REPLACEMENT

SECTION A. BACKGROUND

Included in this RFP are the following Appendices to the Rhode Island General Conditions of Purchase, or to this RFP, which vendors will be required to sign/comply:

Appendix C – Information Technology Requirements Appendix D - ETSS Cybersecurity Questionnaire Appendix E – Business Associate Agreement

The State reserves the right to update various Addenda to RI’s General Conditions of Purchase, and at such time(s), execute an amendment to the contract resulting from this award. The amendment will be included at the time of a contract extension and/or at the time a new Addenda is approved by the State. This includes, but is not limited to, Addendum B For Information Technology Policies and Procedures.

The State also reserves the right to request vendors submit Information Technology Cyber Security Questionnaires for review and approval annually, and/or during the time of any contract extension.

Additional Appendices contained in this RFP:

Appendix F – Minimum proposed SLA Appendix G – Technical Business Requirements Appendix H – Cost Proposal Template

The State requests that any vendor who intends to list a current Rhode Island State employee as a reference on a bid proposal, contact that State person to receive written permission, prior to listing that person on any bid proposal. If this pre-approval is not obtained and provided within the submittal of a vendor’s technical proposal, the State reserves the right to eliminate information received from that employee, as it pertains to a vendor reference.

The Rhode Island Division of Motor Vehicles (RI DMV) is seeking a vendor to provide a Driver’s License and Identification (DL/ID) card solution and associated services, as described in this Request for Proposal (RFP).

The DL/ID card solution shall contain services including customer image capture, signature capture, temporary paper documents, centralized card manufacturing/mailing of several DL/ID types and other DMV issued credentials. Additional services and equipment that will be required include biometric identification processes and portable workstations. Connections will be required to RI Department of State and RI State Police.

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 2 of 20 Revised 4/22/2024

The selected vendor is expected to provide the system solution, equipment procurement, and professional services necessary to configure, install, implement, document, test, host, train, and integrate with related systems. The selected vendor will also provide ongoing maintenance and support for the proposed DL/ID card solution. Potential vendors should be able to demonstrate experience in implementing similar solutions with public sector clients.

DMV Overview The RI DMV maintains 7 locations known as branch offices that are responsible for the issuances of driver’s licenses and identification cards, including first time issuance, renewals, updates, and duplicate card transactions. Additional transactions performed within branch office include the reinstatement of driving privileges and licenses, the administration of knowledge and road skills testing, and the processing of motor vehicles titles and registrations. On behalf of various entities, the RI DMV also performs statutorily mandated activities such as voter registration, organ donor registration, and the collection of sales tax. In addition, there are currently 9 American Automobile Association Northeast (AAA Northeast) branch offices that are authorized to perform certain licensing transactions, including renewals and duplicates of driver’s licenses and other Rhode Island Identification Documents (RI State IDs).

The RI DMV provides driver’s licenses for approximately 750,000 licensed drivers in the State and an additional 70,000 RI State IDs for residents needing a State-issued identity credential.

The RI DMV is also responsible for over 22,000 road tests for all classes of licenses annually.

Current DL/ID Overview The current vendor contract is an all-inclusive cost-per-card arrangement whereby the incumbent contractor provides equipment and software products required for DL/ID card issuance as well as product service and maintenance. The processes known as Biometric Identification, and Gated Issuance are among the services included in this contract. The current vendor’s DL/ID software application supports the complete DL/ID process, which includes interfacing with the RI DMV’s core business operation system, RIMS, as well as RI Department of State, and RI State Police.

Under the current contract, all DL/ID cards are centrally produced and delivered through the United States Postal Service (USPS). The RI DMV currently produces approximately 300,000 DL/ID cards annually.

Core Business Operation System (RIMS) Overview The RIMS application serves as the RI DMV’s core business operation system for DL/ID issuance and other driver and vehicle services and is the RI DMV’s system of record. RIMS is currently integrated with each relevant component of the current vendor’s DL/ID card solution.

Customer data and images captured through the vendor solution are relayed separately between RIMS and each component via web service calls. All necessary data (signature image, customer image, and demographic information) for card production requests are sent in bulk from the vendor solution to the current vendor twice a day: once mid-morning, which includes any expedited card requests, and again in the evening. An additional nightly batch is performed to gather and transmit images captured that did not result in a DL/ID issuance, such as those part of a learner permit or abandoned transactions, which are referred to as to non-production images or transactions.

In addition to storing information collected from transactions for DL/ID issuance, RIMS is integrated with the RI DMV’s customer portal to facilitate dozens of different online self-service transactions such as scheduling road tests, submitting renewal application information, or updating an address.

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 3 of 20 Revised 4/22/2024

Current Workflow There are various processes implemented at RI DMV branch offices and AAA Northeast offices that are essential to DL/ID card issuance. The processes relevant for this procurement include the following:

Credentials Customers arrive at the branch office, present necessary documentation, and enter a waiting queue. Once called via the queuing system, customers approach the workstation area where they provide the customer service representative (CSR) with their completed applications and any other required documentation. Depending on the type of transaction, the CSR will search for the customer by credential number or name and DOB. CSRs can also search by Social Security Number or scan the barcode on the Rhode Island DMV issued credential. The CSR starts by searching for the customer record. If a record is found, the most recent photo and signature is brought up, and the CSR proceeds with the transaction. If no record is found, the CSR verifies all required documentation has been provided, then enters the new customer’s information to create a customer record in RIMS.

Rhode Island operates under a photo first model. After the customer record has been created or updated in RIMS, the CSR begins the RIMS transaction, which initiates the Capture process.

When a credential transaction is initiated, RIMS relays the customer’s information to the Capture application. Next, the CSR selects the applicant from the camera queue, reviews the customer’s information, and captures the customer’s image. Current software allows the option to use the existing photo and signature (if the customer has a RI credential). This is for exceptions only.

The captured image can either be automatically or manually centered and cropped. Capture indicates if the image is compliant with International Civil Aviation Organization (ICAO) image standards. If so, the CSR will continue with the transaction. If it is not compliant, CSR will capture another photo. There is an override process for customers who are unable to take a compliant photo. During the Capture process, Camera application will display the most recent image captured for the applicant and perform a 1:1 Image Comparison. Once an acceptable image is captured and approved by the CSR, the Capture application relays the transaction back to RIMS. CSR continues the credential transaction in RIMS. Customer’s photo is imported into the “Application Form” tab and CSR must verify the photo belongs to the customer and check the box.

CSR enters/updates applicant information in RIMS, including demographic data. If applicant has indicated they wish to register to vote (and are eligible), CSR will register them at this time. If applicant has indicated they wish to be an organ and tissue donor, CSR will register them at this time. If customer is applying for a DL/ID card which is compliant with the REAL ID Act of 2005 (REAL ID or REAL ID Act), documentation is verified with the Department of Homeland Security, if required. Applicable endorsements and restrictions are generated on the Customer record.

Upon completion of RIMS transaction, CSR is directed back to the Capture application. Current system provides the option to have hard copy credential expedited back to DMV headquarters.

Customer is directed to the signature pad, and must answer YES or NO to attestations, confirm voter registration information (if they were registered to vote during the transaction) and sign the signature pad. This is the signature that will appear on the credential, when issued. The customer has the option to choose between English or Spanish on the signature pad. The CSR can answer the questions on behalf of the customer, or to clear an unacceptable signature.

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 4 of 20 Revised 4/22/2024

CSR issues workstation generated temporary paper credential receipt (license/ID/Permit).

Customer verifies information on the temporary credential is accurate and complete.

Upon issuance of the temporary document, the new Image Files and demographic files are uploaded to the Central Image System in real-time. Select users have access to the Card Manager software. Users can view the credential details along with the issuance status, including historical data. Issuance status includes both facial recognition gates, factory processing, and mailing status. Privileged users may also cancel the production of the credential.

Biometric Identification The RI DMV uses facial recognition technology to protect the integrity of the RI DMV’s driver licensing program and the licensing/identification credentials it issues. Use of facial recognition technology in the credential issuance process assists the RI DMV in identifying and correcting administrative errors, ensures that each customer’s identity has not been misused by another person, and can lead to the uncovering of other forms of potentially fraudulent activity. Access to the RI DMV’s facial recognition software is provided only to RI DMV personnel assigned to the RI DMV Enforcement Unit and to the Rhode Island State Police personnel assigned to the Fusion Center. These are two separate user groups, both in terms of the activities performed, and records logged within the facial recognition application.

The facial recognition technology is not automatically connected to any criminal justice system.

The RI DMV has adopted ICAO Standards for capturing credential photos. ICAO photo guidelines are used for passport photos.

• The captured image must be a straightforward looking view of the applicant.

• All the applicant's facial features must be visible (e.g., eyes, nose, mouth, cheeks, etc.).

• A solid or transparent facial cover (scarf, veil, face mask, etc.) is not acceptable.

• Eyeglasses, including reading or prescription glasses, are not allowed, even if the applicant normally wears them.

• A hat or other head cover is not acceptable, but if worn for medical or religious reasons, it may be allowed if it does not hide any facial features.

• Natural facial hair and hairpieces may be acceptable unless the overall effect disguises the person's true facial appearance or facial features are obscured.

• Permanent facial tattoos are acceptable but temporary tattoos are not.

• Bluetooth headsets are not acceptable.

The RI DMV Enforcement Unit will determine error situations that need to be resolved and stop problematic issuances from being manufactured. Under the current system, images are automatically flagged for manual review.

A case management system will be used to assist with these activities and the investigation and resolution processes. The case management system will provide a repository for the user to package facial images, associated demographic data, notes, and workflow data into a secure electronic case folder that will be viewable and printable through the life of the process.

The system utilizes adjustable facial recognition ratios to assess the confidence level of potential matches. If no matches are detected, the applicant’s record successfully passes through the Facial Recognition Gate and enters the Central Issue Queue for credential production.

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 5 of 20 Revised 4/22/2024

If one or more matching images are identified, they are automatically placed into a review queue.

Each case in this queue must be assessed by an authorized Enforcement Unit member to identify potential fraud. Until the case is reviewed, the credential remains in a pending status and cannot proceed beyond the Facial Recognition stage.

Enforcement staff members will examine all flagged images to determine whether the applicant's photo matches an existing image on file. If it is evident that no match exists, the staff member will close the case, allowing the applicant’s record to clear the Facial Recognition Gate in Card Manager and move to the Central Issue Queue for credential production.

Cases requiring further investigation will be escalated to the Research queue for review by an investigator. Enforcement staff utilize advanced tools such as facial shading and multiple-angle comparisons to assess potential matches. The system applies color coding to images, indicating the likelihood of a match.

If a match is suspected, the Enforcement Unit member will categorize the case as either a Possible Data Error (e.g., inaccuracies in the image or demographic information) or Suspect Activity (e.g., potential fraudulent or criminal activity). The case is then forwarded to a Senior Investigator for further evaluation.

Upon review, the Senior Investigator will determine whether the case involves a data error or potentially fraudulent activity. If criminal activity is suspected, the case will be flagged accordingly. Once a Senior Investigator saves or closes a case, the associated records are stored with the appropriate designations, enabling law enforcement to act as necessary.

Card Manufacturing and Production The following table shows the approximate number of hard copy DL/ID cards manufactured over the past five years:

Year Number of Cards

2024 305,676 2023 296,399 2022 289,333 2021 287,135 2020 256,954

Historic Production Data

The RI DMV currently produces the following REAL ID non-compliant DL/ID cards. They are as follows:

1. Driver’s License, Horizontal

2. Commercial Driver’s License, Horizontal

3. Identification Card, Horizontal

4. Driver’s License, Vertical (Provisional Operator License1)

5. Driver’s License, Vertical (Under-21)

6. Commercial Driver’s License, Vertical (Under-21)

7. Commercial Driver’s License, Non-Domicile, Horizontal

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 6 of 20 Revised 4/22/2024

8. Identification Card, Vertical (Under-21)

9. Commercial Learner Permit, Horizontal

10. Commercial Learner Permit, Non-Domicile, Horizontal

In accordance with the REAL ID Act, the RI DMV currently produces the following REAL ID compliant DL/ID cards. They are as follows:

1. Driver’s License, Horizontal

2. Commercial Driver’s License, Horizontal

3. Identification Card, Horizontal

4. Driver’s License, Vertical (Provisional Operator License)

5. Driver’s License, Vertical (Under-21)

6. Commercial Driver’s License, Vertical (Under-21)

7. Identification Card, Vertical (Under-21)

8. Commercial Driver’s License, Non-Domicile, Horizontal

The RI DMV also produces two paper permits on-site. They are as follows:

1. Learner Permit

2. Limited Learner Permit (Under 18)

In addition, the RI DMV produces a temporary paper copy of each of the cards listed above on site at the time of the transaction.

The card manufacturing process begins once the Photo Capture and Signature Capture process is complete. There are two types of card manufacturing requests – expedited and standard.

Expedited requests require a same-day issuance process whereby the vendor manufactures and mails the card to a RI DMV specified location within 24 hours of receiving the request. Standard requests require the vendor to manufacture and mail the card within 96 hours of receiving the request. The Vendor’s software uploads in bulk a “request to manufacture” to the card vendor twice a day: once mid-morning, which includes any expedited card requests, and again the evening. The manufacture request contains all the information the vendor needs to produce the applicable DL/ID.

There are also quality assurance activities in the manufacturing process to ensure validity and accuracy of the DL/ID cards.

RI Department of State The current solution includes two processes with the RI Department of State.

The first process is a nightly sFTP transfer of three distinct files. Files contain the information of customers who selected they would like to register to vote. This information is transmitted from RIMS to the current Capture application. Voter registration questions are asked by Capture on the signature pad. If the customer indicates they meet the criteria to register to vote, their information is sent in the nightly “Yes” file. If the customer indicates they do not meet the criteria, their information is sent in the nightly “No” file. The third file is a summary file of all data.

The second process involves the transmission of signature images to the RI Department of State via an API call initiated by them.

RI Law Enforcement The current solution includes two processes that are used by RI Law Enforcement.

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 7 of 20 Revised 4/22/2024

In the first process, RI DMV’s facial images are accessed by Rhode Island law enforcement through the Rhode Island Law Enforcement Telecommunications System (RILETS) via a stored procedure. This only provides access to the DMV’s facial images and not the biometric identification system or technology.

In the second process, the RI State Police Fusion Center is granted access to the biometric identification system and technology. Access is granted via a separate user group with distinct privileges within that system.

SECTION B: SCOPE OF WORK AND REQUIREMENTS

RI DMV seeks a COTS solution that is secure, reliable, and takes advantage of the latest technologies (at the branch office workstation and in the production facility) to allow RI DMV to continue improving the way we provide this core service to the State. The purpose of this RFP is to procure a solution which will:

• Replace the existing solution without the loss or deterioration in quality of any of the existing capabilities or services as described in the Background section of this document.

• Increase the efficiency and effectiveness of the RI DMV in conducting, processing, and monitoring DL/ID card transactions through state-of-the-art equipment and application technology.

• Provide residents of Rhode Island access to a secure identity document resistant to fraud through biometric identification checks and issuance checks and balances and in the production of the physical card using latest industry card manufacturing materials and security features.

• Produce various DL/ID card types in compliance with the latest AAMVA standard and REAL ID Act standards.

• Include a black and white laser engraved portrait on the physical card.

• Ensure the timely and efficient production and delivery of DL/ID cards from a secure central issuance production facility.

• Securely store and deliver large image files for photos and signatures.

• Provide thorough “train-the-trainer” and direct participatory trainings and documentation that will enable RI DMV staff and partners to comfortably utilize the full capabilities of the vendor solution.

• Support the timely and effective resolution of any hardware and software issues as it relates to the vendor’s solution or RI DMV DL/ID issuance process.

• Implement quality assurance and disaster recovery protocols that will sufficiently prepare against any issues impacting the RI DMV’s processing and production of DL/ID cards.

• Meet system performance expectations and service level agreements as determined by the

RI DMV.

• State expects the implementation duration to be no less than 6 months and within 12 months.

FUNCTIONAL REQUIREMENTS

RI DMV requires several key functional requirements to be met when considering a DL/ID card solution. The Vendor should describe how they plan to satisfy the following functional requirements. The functional categories and what they encompass are listed. Additional information for each functional category may be found in the subsections below.

• Software – Photo capture, signature capture, biometric identification, card management.

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 8 of 20 Revised 4/22/2024

• Hardware – Cameras, signature pads, photo backdrops, mobile workstation

• Card Production – Secure card production and mailing

• Interface Connections – RI DMV system of record RIMS, RI Department of State, RI

Law Enforcement

Software Requirements

Photo Capture Existing functionality as described in the Background section of this RFP, including but not limited to, RIMS connectivity, photo first workflow, ability to reuse photos and signatures, ability to expedite credential requests, ability to interact with the customer signature pad, and ability to produce temporary paper credentials, must be maintained at a minimum.

Workflows should be intuitive and user friendly. While all technologies will be considered, preference will be given to web or cloud-based systems.

Signature Capture Existing functionality as described in the Background section of this RFP, including but not limited to, the ability to present information to the customer for review, the ability to ask questions of the customer and collect answers, and the ability to produce high-resolution signature images, must be maintained at a minimum.

Signature images transmitted to the RI Department of State must be black-and-white industry-standard TIFF images or grayscale TIFF images with 8 bits per pixel, with an image resolution of 200-300 dpi.

Signature capture software must be included with photo capture to minimize the number of software applications users must learn and use.

Workflows should be intuitive and user friendly. Software must be capable of storing or returning to RIMS responses given by the customer for future review. While all technologies will be considered, preference will be given to web or cloud-based systems.

Biometric Identification Existing functionality as described in the Background section of this RFP, including but not limited to, gated issuance, automatic 1:N matches, configurable ratio for auto-matches, multi-tiered queues and workflows, packaged customer investigation files, robust photo comparison tools, ability to exclude a photo from future matches, case statuses, and a robust reporting suite, must be maintained at a minimum.

Workflows should be intuitive and user friendly. Biometric identification software may be packaged with or separate from Photo and Signature Capture software. While all technologies will be considered, preference will be given to web or cloud-based systems.

Card Management Existing functionality as described in the Background section of this RFP, including but not limited to, customer-centric design with issuance history, ability to void a credential prior to production, viewable audit history, gate status with date of passage, and mailing date of credential, must be maintained at a minimum.

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 9 of 20 Revised 4/22/2024

Workflows should be intuitive and user friendly. Card Management software may be packaged with or separate from Photo and Signature Capture software. While all technologies will be considered, preference will be given to web or cloud-based systems.

Hardware Requirements

Cameras Cameras must comply with current industry standards, including without limitation being capable of taking photos which meet AAMVA 2025 DL/ID Card Design Standards (or most recent at time of implementation), as well as complying with emerging compliance standards.

Cameras must be durable, offer flexible mounting options for various settings, be user friendly, and should have technology that automatically adjusts for common issues such as lighting conditions, focus, centering, and red eye.

Signature Pads Signature Pads must be capable of capturing accurate, high-resolution signatures which meet AAMVA 2025 DL/ID Card Design Standards (or most recent at time of implementation), as well as complying with emerging compliance standards.

Signature pads must be durable, easily replaceable, and must automatically crop and adjust the signature image.

Photo Backdrops Standard blue photo backdrops must be provided and maintained for all RI DMV branch and AAA workstations.

Additionally, RI DMV seeks a solution that offers background removal, possibly eliminating the need for the physical backdrops.

Mobile Workstation The RI DMV is seeking a mobile workstation solution that can perform most, if not all, credential transaction types and steps offered by the RI DMV branch office workstations. Mobile workstation equipment required to perform DL/ID transactions should be durable, ruggedized, and portable for transport to other RI DMV designated locations. Authorized personnel should also be able to perform DL/ID functions at temporary and mobile locations.

Card Production and Mailing Existing functionality as described in the Background section of this RFP, including but not limited to, central issuance, secure production facilities, quality assurance, expedited and standard requests, and timely card mailing, must be maintained at a minimum. It is essential that card materials and design are following the latest AAMVA standard and REAL ID Act standards.

For this procurement, the RI DMV would like the Vendor’s solution to improve current processes to ensure accurate tracking of document status and the ability to respond, in real time, to customer inquiries. To that end, RI DMV is requiring three types of information from the awarded Vendor:

• Reconciliation information for manufactured DL/ID cards.

• Reports tracking document status through the manufacturing process.

• Intelligent Mail data used to track documents from handoff to USPS.

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 10 of 20 Revised 4/22/2024

The following are major requirements that Vendors must consider for the RI DMV’s new DL/ID cards:

• Quality: The cards will be of high quality. This means they need to be durable, error-free, readable, and of identical quality.

• Security: The cards need to be difficult to modify or duplicate as well as easy to authenticate through both human inspection and machine reading. They also need to be manufactured in a highly secure environment.

• Usability: The cards need to be usable under extreme weather conditions in accordance with ISO 7810 identity card physical characteristics standards. In particular, the security features on the cards should not inhibit their readability.

• Flexibility: Changes to the current DL/ID credential types may be required by changes in laws, regulations, or procedures.

• Improvements: The current set of RI DMV DL/ID cards has been in circulation for 9 years. Although the design and production are proven, there are areas for improvement.

The new cards to be manufactured through this procurement should consider the latest security features available to help improve the design, manufacturing, and quality assurance of the existing cards.

• Industry Standards Compliance: The cards must comply with current industry standards, including without limitation AAMVA 2025 DL/ID Card Design Standards (or most recent at time of implementation), as well as comply with emerging compliance standards.

• Audit: From request through fulfillment, each card request can be tracked throughout its manufacture/delivery life cycle.

• REAL ID Act: The card manufacturing process needs to adhere to REAL ID Act requirements.

The RI DMV may introduce additional card types in the future. Thus, it is essential that Vendors be flexible in their ability to design and produce additional DL/ID card types that can both meet the most current Federal and State legal requirements and take advantage of the latest security technologies.

Interface Connections

RI DMV RIMS

Existing functionality as described in the Background section of the RFP, including but not limited to Windows Communication Foundation (WCF) services, must be maintained at a minimum, with an option to transition to REST API services as part of implementation.

RI Department of State Existing functionality as described in the Background section of this RFP, including but not limited to, sFTP file transfers and API signature image calls, must be maintained at a minimum.

RI Law Enforcement Existing functionality as described in the Background section of this RFP, including but not limited to, stored procedure image calls and role-controlled biometric identification access, must be maintained at a minimum.

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 11 of 20 Revised 4/22/2024

NON-FUNCTIONAL REQUIREMENTS

RI DMV requires several key non-functional requirements to be met when considering a DL/ID card solution. The Vendor must describe how they plan to satisfy the following non-functional requirements. The non-functional categories and what they encompass are listed. Additional information for each non-functional category may be found in the subsections below.

• Training

• QA, UAT, Production environments

• System Performance, SLAs, Maintenance

• Accessibility

• Security, Disaster Recovery

• Data Storage and Migration

• Eligibility of Vendors

Training RI DMV requires the Vendor to provide a training plan and training content that incorporate industry best practices and are specifically tailored to the RI DMV products. The development of the training plan will be completed as a joint effort between the awarded Vendor and the RI DMV’s Training Office. The training plan and materials will consider the full life of this procurement from initial implementation through the end of the contract and be easily consumable by RI DMVs estimated 200 staff, and AAA employees. The training courses will be interactive, utilizing role playing and user environment scenarios. In addition, to promote knowledge consumption, enhance user learning experience, and assist the RI DMV with a continuing learning experience, the Vendor will provide eLearning modules, videos, and reference guides in addition to equipment job aids and participant guides.

The Vendor will be responsible for providing “train-the-trainer” and direct participant training services for all equipment and services provided to the RI DMV as part of this procurement. The train-the-trainer training will be a separate class from the direct participant training class and include examples, scenarios, and a Leader’s Guide. The Vendor’s equipment subject matter experts must be present in Rhode Island at vendor’s sole expense during all the train-the-trainer classes. The Vendor will provide RI DMV trainer evaluations before RI DMV trainers are to begin training the wider audience of RI DMV staff and users.

In instances such as biometric identification applications, where there are a limited number of RI DMV users, the Vendor will be responsible for training the RI DMV participants and partners directly.

QA, UAT, Production Environments RI DMV requires rigorous quality assurance and user acceptance processes prior to deploying a system for production use. This acceptance process examines both the functional and the technical aspects of the system. The Vendor will be responsible for creating and maintaining non-production environments, at least one of which will mirror the production environment for load and performance testing. All non-production environments will be accessible using any branch equipment that runs the vendor solution.

The selected Vendor’s non-production environments will provide the following:

• Non-production environment for testing and training that contains test data.

• Staging environment that mirrors the production environment for load and performance testing. This non-production environment will contain and maintain at a minimum, a high

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 12 of 20 Revised 4/22/2024 percentage of production data that aligns with the RI DMV’s most current production database.

System Performance, SLAs, Maintenance The Vendor will include in its proposal a detailed repair, maintenance and support plan that proposes maintenance and support services for the DL/ID card solution(s) under this RFP to ensure that all service locations will remain operative during normal business hours.

The Vendor will be responsible for the following as applicable to the individual vendor solution:

• DL/ID card solution (branch office equipment, vendor servers, software, and manufacturing).

• Mobile workstation and mobile workstation solution.

The Vendor will propose the following maintenance and support requirements:

• The number of service representatives available and their office locations.

• Identification of preventive maintenance procedures required for both the RI DMV and the Vendor.

• A justified frequency schedule for preventive maintenance by the Vendor.

• A description of how parts supply and back up equipment availability will be assured for all branch and AAA Northeast locations.

• A detailed explanation of anticipated response times for unscheduled and emergency service needs for the DL/ID card solution system solution, method of reporting incidents.

• Reliability data or industry-recognized independent user ratings on all equipment being proposed.

• Suggestions for alternatives to onsite maintenance.

• A description of the vendor’s disaster recovery response which includes Recovery Time

Objective (RTO) and Recovery Point Objective (RPO) targets.

• See Appendix F - Minimum proposed Service Level Agreement

Accessibility Any potential solution must be ADA compliant in accordance with the World Wide Web Consortium’s Web Content Authoring Guidelines, version 2.2, level A and AA Guidelines (WCAG 2.2 Standards).

The Vendor shall submit to any third-party accessibility testing requested by the RI DMV as part of this procurement. The Vendor shall provide sample communications and training materials as well as information regarding hardware accessibility features upon request from the RI DMV to help the third-party testing vendor procured by the RI DMV evaluate the Vendor’s accessibility compliance and standards.

Security and Disaster Recovery Vendor will be required to maintain an Incident Management/Response Plan that includes the following minimum requirements:

• Notification to Rhode Island DMV within two (2) hours of declaring an incident potentially impactful to the security of DMV applications, systems, networks, and/or data. This includes but is not limited to operational availability.

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 13 of 20 Revised 4/22/2024

• Delivery of a written, status report to DMV within twenty-four (24) hours of declaring an incident and every twenty-four (24) hours until incident resolution. Relief from this schedule/cadence can only be granted with written authorization from Rhode Island DMV.

• Twice-daily meetings with DMV starting within four (4) hours of declaring an incident.

• Delivery of a written post-incident summary to DMV within one (1) week of incident resolution. This summary is expected to include a plan of action that describes improvements that the Vendor will make to help prevent a similar incident from occurring in the future.

Vendor will be required to maintain a Disaster Recovery Plan that describes the procedure for recovering the entire technology solution contracted by the Vendor in the event of a disaster. This plan should include a detailed description of the backup process and process for testing backups.

Vendor’s security plan for its Card Production Facility and all Rhode Island/Rhode Island DMV data must meet or exceed the standards of the REAL ID Act and 6 C.F.R. 37.41, 37.43. Vendor must also certify that all employees or persons who are involved in the manufacture or production of a REAL ID driver’s license or identification card, or current employees who will be assigned to such positions shall be subject to a background check which complies with 6 C.F.R. 37.45. At a minimum, the Vendor’s card facility must be monitored by security cameras and intrusion alarms throughout the facility and key card access must be required for building access. It must provide for limited and secure access to areas of the facility where production and/or storage of DL/ID cards are taking place. DL/ID cards and security laminations must be stored in a limited access safe or highly secure room during non-business hours.

Inventory control and sign-in/sign-out procedures for tracking security laminations must be maintained. Security laminations and defective DL/ID cards must be destroyed.

Data Retention and Migration RI DMV requires the vendor to securely store all images and data associated with previous transactions and card issuances. This includes past images and data. Vendor should present a plan detailing how migration of historical data to the new system will be accomplished.

RI DMV requires the Vendor to certify that all steps will be taken to ensure the security and confidentiality of all Rhode Island/Rhode Island DMV data for which the vendor becomes a holder, either as part of performance or inadvertently during performance with special attention to restricting access, use and disbursement of personal data and information and notification procedures under R.I.G.L. § 11-49.3-1 et seq.

The vendor will immediately notify Rhode Island DMV in the event of any security breach, including the unauthorized access, disbursement, use or disposal of personal data or information and in the event of a security breach, vendor will cooperate fully with the State of Rhode Island and or it’s designee(s) and provide access to any information necessary for the State of Rhode Island to respond to the security breach. The vendor will be fully responsible for any damages associated with vendor’s breach including but not limited to R.I.G.L. § 11-49.3-5.

Licensing Model with Additional tools/software/Bill of Materials (BOM):

If your proposed solution includes utilizing other vendors’ products, tools, and/or licensing, please provide full details of the Third-Party Software, as part of the BOM section of both your Technical and Cost Proposals, as applicable.

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 14 of 20 Revised 4/22/2024

Vendors are asked to provide all software and licensing quantity [Do NOT provide cost information related to your BOM as part of Technical Proposal] associated with your proposal and solution, aligned to the contract terms and if applicable, phases within it.

Also clarify the duration, and if this is a one-time or perpetual deployment. If your proposed solution is acquired through a reseller, please indicate the name of that firm. The State assumes all items will be purchased and/or renewed through your firm. If, however, the items being referenced cannot be procured by your firm, or the State is expected to provide such products and/or tools, also clearly indicate that within your technical and cost proposals.

Ensure that all cost information is included only in your Cost Proposal.

Eligibility of Vendors Potential vendors must meet the following minimum requirements to be eligible to submit a proposal:

1. Currently have in full operation a Credentialing system such as contained in the proposal the vendor is submitting.

2. Have at least one public sector client who has been utilizing the software for a period of at least 12 months, and

3. Is currently hosting the software, operating the software as a service, and providing technical assistance.

The State reserves the right to remove any bid from consideration if deemed the vendor does not meet the minimum requirements listed above.

Special Enhancement Activities as Needed In addition to Tasks listed above in Section B: Scope of Work and Requirements, should additional funding become available, the State reserves the option to conduct additional tasks to support the overall scope of this project. It is critical that the state have the flexibility to bring on additional technical assistance and expertise in a timely manner to perform activities which require similar expertise and work functions as those in Section B: Scope of Work and Requirements, above. The decision to utilize services under an additional Task will be solely at the State’s request and will be for specific enhancement activities not already included above.

These optional activities will be defined and agreed to in writing, by both the State and the vendor, before any enhancement work begins. There is no commitment on the part of the State to utilize any or all special projects/enhancement activities. All bidders must bid on this Task using the hourly rates established in the award. The Task should be bid on a fully loaded Time and Materials or Firm Fixed Price basis, in accordance with the specifics of the contract year in which the services are provided, for all personnel and subcontractors to be utilized in completing the optional task(s). This work must support but not duplicate the work described in the technical proposal’s scope of work. This work cannot exceed 10% of the initial award’s Total Contract Value. Should new funding become available the Purchasing Agent would need to authorize payments more than 10% of the contract for special enhancements. The awarded vendor shall not perform any special enhancement activities without receipt of a formal change order issued by the Division of Purchases.

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 15 of 20 Revised 4/22/2024

SECTION C: PROPOSAL

1. Technical Proposal Narrative and format: Vendors must submit a technical proposal which addresses each of the following elements and is limited to thirty (30) pages (this excludes any appendices and as appropriate, resumes of key staff that will provide services covered by this request). Please include an Executive Summary not more than five (5) pages as part of the thirty

(30) page technical proposal. The technical proposal should be printable if necessary:

A. Staff Qualifications – Provide staff resumes/CV and describe qualifications and experience of key staff who will be involved in this project, including their experience in Motor Vehicles Credentialing systems.

B. Capability, Capacity, and Qualifications of the Vendor –

1. Please provide a detailed description of the Vendor’s experience in implementing Motor Vehicles Credentialing systems. List a minimum of three (3) relevant client references, to include client names, addresses, contact names with emails and phone numbers, dates of service and type(s) of service(s) provided. These references should be for implementations that were of the same services requested in this RFP. For references of the Vendor, Subcontractor(s), and/or its Resources, The RI DMV reserves the right to contact none, any, or all the specified references. The RI DMV also reserves the right to include or not include reference information obtained from those references, in the evaluation criteria of this RFP.

Vendors must provide details supporting their eligibility to bid for this RFP as per section B - Eligibility of Vendors.

For Credentialing: DL/ID card physical samples of each of the following should be provided:

REAL ID non-compliant DL/ID cards as follows:

• Driver’s License, Horizontal

• Commercial Driver’s License, Horizontal

• Identification Card, Horizontal

• Driver’s License, Vertical (Provisional Operator License)

• Driver’s License, Vertical (Under-21)

• Commercial Driver’s License, Vertical (Under-21)

• Commercial Driver’s License, Non-Domicile, Horizontal

• Identification Card, Vertical (Under-21)

• Commercial Learner Permit, Horizontal

• Commercial Learner Permit, Non-Domicile, Horizontal

REAL ID compliant DL/ID cards as follows:

• Driver’s License, Horizontal

• Commercial Driver’s License, Horizontal

• Identification Card, Horizontal

• Driver’s License, Vertical (Provisional Operator License)

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 16 of 20 Revised 4/22/2024

• Driver’s License, Vertical (Under-21)

• Commercial Driver’s License, Vertical (Under-21)

• Identification Card, Vertical (Under-21)

• Commercial Driver’s License, Non-Domicile, Horizontal

a. The samples shall be produced using the same technology and methodology proposed by the vendor in their response. All samples submitted by Vendor shall be originals and not copies. Vendor must provide as part of their response independent laboratory tests showing that their proposed DL/ID cards will meet the durability and security requirements of the RFP. Division of Motor Vehicles may submit originals to the AAMVA for laboratory test.

2. System Security Plan, ETSS Security Questionnaire, and Authority to Operate (ATO) artifacts:

IMPORTANT: The vendor and any subcontractors handling PII or PHI must detail that it has robust database security by adhering to steps below:

1. The State requests your firm provide insights and information into all Artificial Intelligence (AI) in your proposed solution. If the functionality your firm is proposing contains any use of AI (Generative, etc.), the State requests:

a. It be identified, and

b. It be optional during the initial implementation of your solution, including if it is Hosted or not Hosted on State Infrastructure.

2. Please describe in detail the cybersecurity risk mitigation controls that are implemented within scope of the proposed solution and applicable cybersecurity framework used: NIST CSF 2.0, NIST 800-53 low, moderate, or high control families, CIS Benchmarks, ISO 27001, ISO270002, PCI DSS, CSA, SCF, MARS-E or ARC-AMPE.

a. Please complete the Appendix D - ETSS Cybersecurity Questionnaire and include it, clearly named, as a separate EXCEL spreadsheet, with the submission of your technical proposal, and well as with additional applicable information per the above.

The Questionnaire must always be submitted, regardless of the number of questions and replies within it.

3. Additional security documentation may be requested. Prior to contract award, the State may in its discretion require the Vendor to provide additional security documentation, including but not limited to vulnerability assessment reports and penetration test reports. The awarded Vendor shall provide such additional security documentation upon request by the State during the term of the contract.

2023-1.v2.04222024 RFP – Agency Solicitation Specifications Page 17 of 20 Revised 4/22/2024

The above-referenced Appendix D – RI ETSS Cybersecurity Questionnaire will be evaluated as part of the Technical Proposal for award and inclusion on the RFP.

The State reserves the right to request additional Artificial Intelligence (AI) and/or IT Security information be provided and approved, based on any subsequent request and eventual award for services.

Additionally, if a vendor does not adhere to the above and/or alters the layout of the ETSS Cybersecurity Questionnaire, the State reserves the right to reject their proposal.

C. Work Plan, Approach, Methodology and Deliverables -

1. Implementation Plan: Vendor shall provide implementation plan with major deliverables as defined in section B; Plan should provide estimated hours for each phase of the project.

• Staffing Plan: Provide Staffing assumed for each phase with approximate effort hours

• Training Plan: Provide training plan documentation

2. Solution and Delivery approach: Provide details on your platform, tools, and approach to deliver functionality.

• Also provide details of the Third-Party Software Licenses needed to run this platform [ with approximate quantity details]

• Maintenance Plan for vendor supplied equipment

3. Project Plan: The Project Plan must include sufficient details to give the State an understanding of how the vendor’s knowledge and approach will:

• Manage the Project;

• Guide Project execution;

• Provide details of a phased approach if recommending doing so;

• Manage quality assurance of deliverables before received by the State

• Assumed RACI [Vendor vs State]

• Document planning assumptions and decisions.

• Facilitate communication among stakeholders.

• Define key management review as to content, scope, and schedule; and

• Provide a baseline for progress measurement and Project control.

At a minimum, the vendor’s Project Plan, as…