2023-1.v3.04082026 RFP – Agency Solicitation Specifications Page 1 of 12 Revised 4/8/2026

RFP27006832

AGENCY SOLICITATION SPECIFICATIONS

TITLE: RI ETSS APPLICATION MANAGED SERVICES

SECTION A: BACKGROUND

A.1 High Level Scope The Rhode Island Division of Enterprise Technology Strategy and Services (ETSS) within the Department of Administration (DOA) is seeking proposals from vendors to provide Managed Services for the following:

1. Low Code Platform Services

a. Application Development Maintenance and Support

b. Low Code Platform Strategy Advisory Services (on demand)

c. Low Code Platform Architecture and Design Services (on demand)

2. Legacy Application Maintenance and Support

a. Programming Support for COBOL, Informix, and .Net

3. IBM Mainframe Administrative Support

4. Oracle Database Administrative Support

Low Code Services platform includes Salesforce, Microsoft, ServiceNow &Workday.

1.1 Salesforce Platform: The State of Rhode Island has successfully implemented the following public facing Salesforce applications:

1.1.1 Cannabis Control Commission (CCC) , License/Registration Portal (Implemented March 2023)

1.1.2 Department of Human Services (DHS), RI Start Early System (RISES) (Implemented in phases beginning February 2024 through September 2025 with two additional releases planned in 2026)

1.1.3 Department of Environmental Management (DEM), Agriculture (Implemented October 2024) and Water Resources License/Permit Portal (Implemented May 2025)

Additionally, the following Salesforce applications are currently in progress at different phases of implementation:

1.1.4 Department of Behavioral Health, Developmental Disabilities, and Hospitals (BHDDH), Crisis Care

1.1.5 Department of State (DoS), Business Registry and Online Filing System

1.1.6 Department of Labor and Training (DLT), Workforce Regulation System and Certified Payroll

1.1.7 Department of Children, Youth and Family (DCYF), Child Welfare Information System

2023-1.v3.04082026 RFP – Agency Solicitation Specifications Page 2 of 12 Revised 4/8/2026

1.2 Microsoft Power/Dynamics Platform: The State has implemented over a dozen Microsoft Power Platform/Dynamics applications consisting of internal approval processes, public facing license lookups, customer contact forms, and other applications at smaller scale. See Appendix D for list.

1.3 ServiceNow Platform: ServiceNow is the State’s implemented IT service management platform including asset management. The State is currently considering expansion of the use of ServiceNow including fully utilizing available ITSM and asset management capabilities.

1.4 ERP Workday platform [Tier-3 Support] : Workday was implemented in 2025 as the State’s Enterprise Resource Planning system including Finance, Human Capital Management (HCM) and Payroll.

2. Legacy application programming languages includes COBOL, Informix, and .Net

4. Oracle Database Administrative Support

SECTION B: SCOPE OF WORK AND REQUIREMENTS

ETSS seeks to deliver maximum value to State government constituents by procuring an Application Managed Services (AMS) partner that provides secure, efficient, scalable, flexible, and reliable Application Services across all participating State agencies. The technology solutions and services need to be sustainable and sound from both technological and financial vantage points. Systems need to be scalable to meet changing demand, as well as meet all statutory and regulatory requirements, system security requirements and provide for the confidentiality, integrity, and availability of systems and data. Given the State budgeting processes, a predictable budget for ongoing expenses is required.

Additionally, Vendors will be expected to agree to the terms contained in Addendum E – Business Associates Agreement (BAA)

Vendors are to provide responses to the below 2 Groups of Applications.

Group 1

1. Low Code Platform Services

a. Maintenance and Support [Fixed Price]

b. Low Code Platform Strategy Advisory Services (on demand)

c. Low Code Platform Architecture and Design Services (on demand)

Group 2

1. Legacy Application Maintenance and Support [Fixed Price]

a. Programming Support for COBOL, Informix, and .Net

2. IBM Mainframe Administrative Support [Fixed Price]

3. Oracle Database Administrative Support [Fixed Price]

The State intends on awarding all or part of the scope to one vendor, however, at its sole discretion, reserves the right to make one or multiple awards for this solicitation and/or to reject any or all bids.

2023-1.v3.04082026 RFP – Agency Solicitation Specifications Page 3 of 12 Revised 4/8/2026

Currently, the State’s goal is to transition legacy applications to low code application platforms and is primarily utilizing Microsoft Power Platforms/Dynamics for internal applications and small-scale public facing applications, Salesforce for large scale public facing applications, ServiceNow for ITSM, and Workday for Finance, HCM and Payroll. The AMS partner may also assist in analyzing current and future implementations to ensure cost savings are maximized and to provide recommendations where appropriate. An AMS partner with broad expertise across multiple low code platforms is required. As part of the advisory services the State may request the AMS partner to assist with the following:

• Enhance the current low code platform strategy and approach at an enterprise level.

• Develop baseline low code platform standards (ex: architecture, reusability, automation, integration, data sharing, cross-platform) for various categories of applications.

• Implement a financial modeling tool to assist agencies understand the true and total cost of digital transformation.

• Architect & define best practices and standards for deployment of applications

• Data migration best practices and standards

• Ongoing management and maintenance of low code platforms

This RFP Relates to the following Areas

1. Low Code Platform Services Areas:

1.1 Low Code Application Development Maintenance and Support Services (Fixed Price)

The Vendor shall provide Application Managed Services (AMS) for all in-scope business applications and platforms detailed in Exhibit 1- Application Inventory. AMS shall, at a minimum, include:

(a) Application Maintenance,

(b) Application Support (L1–L3),

(c) Enhancements and Minor Changes,

(d) Application Development/Configurations,

(e) Platform and Environment Management, and

(f) Monitoring and Continuous Improvement.

These services shall be delivered using a consistent set of processes, SLAs, and governance mechanisms across all platforms, with platform-specific details detailed in Exhibit 1- Application Inventory and summarized below:

• Low code platforms include Microsoft Power

Platform/Dynamics, Salesforce, ServiceNow and Workday

• Solution, develop, troubleshoot, maintain current and new applications/platforms

• Coordinate with agency IT managers, IT teams and system implementers, other vendors as it pertains to integrations, application requestors, project management

• Configure/modify applications deployed to fulfill specified functionality based on approved architecture

• Coordinate SSL Certificates acquisition, DNS and F5 security configurations, review security scans and assessments

• Testing and verification of application development in DEV, UAT and PROD

• Problem (bug/issues), corrective actions and configuration management

• Enhancements, maintenance, and release management

• Proactive monitoring, recommendations, and assistance to maintain high usage availability

2023-1.v3.04082026 RFP – Agency Solicitation Specifications Page 4 of 12 Revised 4/8/2026

• Managed Services members should have proper certifications

• Architectural review and adherence to State defined best practices for implementation of new platforms

• Gathering requirements from all stakeholders

• Review/modification of current best practices and standards

• Development/monitoring/management of integrations

• Dashboard/report configurations

• Azure DevOps Administration

• Testing and troubleshooting

1.2. Low Code Platform Strategy Advisory Services

The State would like the awarded vendor to provide the following Services:

• Low Code Platform Strategy that includes holistic review including current Low Code Center of Excellence best practices and standards pertaining to development, governance, and security/compliance.

• Total Cost of Ownership (TCO) Analysis both at enterprise level and specific Agency / Project Level

• Enterprise approach to optimize licenses

• Cost recovery and chargeback model

1.3. Low Code Platform Architecture and Design Services

• Develop architecture, standards, guidelines and design documents

• Establish and implement enterprise level DevSecOps model and CI/CD pipelines.

• Establish and implement appropriate automations to realize productivity improvements.

• Development of Dev / QA / Production requirements for new implementations

• Data integration and sharing approach

• Development of ongoing M&O managed services model for new implementations

• Tools recommended as add-ons such as MuleSoft, Tableau, or testing

• Total cost of ownership Analysis / Budget planning

2. Legacy Applications Maintenance and Support

2.1 Programming Support

• Support current applications maintenance, modifications and bug fixes o Informix (4GL and 4Js), COBOL (Native and RGP), and .Net

• Support data migration from current applications to new platforms

• Support integrations to other applications

• Support refactoring efforts

• Support ODBC, SFTP, QLIK, SMB, Screen scraping

• Support application databases using DB2 and SQL

• Generate ad hoc and standard reports

• IBM Mainframe System Programming (VSE, MVS, VM) Provide COBOL. JCL, and CICS programming support; maintain and make updates on current applications.

• Support IBM SQL/DS, ADABAS databases; VSAM file structures.·

• Support current interfaces between the mainframe and other agencies. IBM Power

9 I Series (AS400) Systems Programming (System 36 and Native Mode) Patches and Updates: Verify that the system is running the latest cumulative PTF (Program

2023-1.v3.04082026 RFP – Agency Solicitation Specifications Page 5 of 12 Revised 4/8/2026

Temporary Fix) package. Check for the latest operating system updates and patches.

• Disk Space: Review disk space utilization and run disk reports to address issues.

• Job Queues and Job Scheduler: Deploy new jobs into the schedule, examine job queue configuration. Review the job scheduler to ensure scheduled jobs are running as expected and report on success/failure and triage exceptions for all scheduled items including but not limited to scheduled jobs, file transfers, file locks, message waiting, email alert and report notifications.

• Security: Maintain and review user profiles and system values to ensure proper user system access and security. Check object authorities to sensitive objects and data.

• Backup and Recovery: Confirm that regular backups are scheduled and completed successfully. Verify the integrity of backup media and perform a test restore if requested. Currently leveraging legacy tapes in a tape library, LaserVault.

• Network Configuration: Check network configurations, routing, host tables and DNS.Performance Monitoring: Utilize performance tools like Performance Navigator or IBM Navigator to analyze system performance metrics. Identify any performance bottlenecks and take corrective actions.

• Journaling and Logging: Review journals and receivers. Check system logs (DSPLOG) for any unusual or critical messages.

• Printing and Output Queues: Verify that printers and output queues are configured correctly. Monitor for any spool file issues or printer errors.

4. Oracle Database Administrative Support

• Environment Management o Install, configure, clone, and maintain Oracle EBS (DEV/TEST/PROD) o Manage application tier services (Forms, OAF, WebLogic, Concurrent

Managers) o Maintain file systems (APPL_TOP, DB_TOP, COMMON_TOP)

• Linux & OS Administration (DBA-focused) o User/group management, permissions, cron jobs o Disk, memory, CPU monitoring and tuning o Patch OS libraries required for Oracle (glibc, kernel params) o Virtualization administration

• Database Administration o Manage Oracle Database (RAC or single instance) o Performance tuning (SQL, indexes, AWR/ASH) o Backup/recovery (RMAN), archive log management o Space management and data growth planning

• Patching & Upgrades o Apply EBS patches, CPUs, and security updates o Perform database and middleware patching o Support version upgrades and tech stack updates

• Security & Compliance o Secure EBS, database, and Linux OS o Manage encryption, auditing, and access controls o Support SOX / audit requirements

• Monitoring & Troubleshooting o Proactively monitor system health and performance o Diagnose issues across Linux, database, and application tiers o Handle incidents, outages, and root cause analysis

• High Availability & DR

2023-1.v3.04082026 RFP – Agency Solicitation Specifications Page 6 of 12 Revised 4/8/2026 o Support HA configurations (RAC, load balancing) o Implement and test disaster recovery solutions (Data Guard) o Perform failover and recovery exercises

• Perform failover and recovery exercises

As part of Proposal, Vendor to provide their approach, process, and deliverables taking into consideration, multiple platform assessments.

Vendor is expected to provide weekly report on number of requests made, level of effort, resolutions, completed work.

5. Managed Services - Phased Approach

The following phased approach is anticipated:

Phase 1 Upon Award – Targeted January 1 2027

Phase 2 Targeted January 1 2028

Phase 3 Beginning July 1st 2028

Phase 4 Beginning January

Group 1 – Low Code Applications

1.1. Salesforce

1.1.1 CCC

1.1.2 DEM

1.2 Workday

1.2.1 ERP Workday Finance &

HCM/Payroll - Technical Support – Tier 3 Integrations/ Reporting

1.3 Low Code Advisory services

Salesforce 1.1.3

DHS – RISES

1.1.4 BHDDH-

Crisis Care

1.4 Microsoft

Power Platform/Dynamics

1.5 ServiceNow

Salesforce DoS

DLT

Salesforce

DCYF

Group 2 - Legacy Application

2.1 Legacy application programming

languages includes COBOL, Informix,

2.2 IBM Mainframe Administrative Support

2.3 Oracle Database Administrative

Support

2.1 Legacy

Application .Net

2.3 Oracle

6. Service Level Management

– Refer to Exhibit 1– AMS Minimum Service Level Requirement

Business Hours is the period from 8:30am eastern to 4pm eastern Monday through Friday excluding State Holidays.

SECTION C: PROPOSAL MATERIALS

1. Pass/Fail Documentation

Mandatory Requirements [Pass/Fail] Mandatory [Pass/Fail] Qualification Requirements https://hr.ri.gov/

2023-1.v3.04082026 RFP – Agency Solicitation Specifications Page 7 of 12 Revised 4/8/2026

There are minimum qualifications, defined as Mandatory Requirements, for Vendors that the State of Rhode Island intends to use to assess whether a Systems Integrator (SI) with their AMS Service offerings are qualified to be considered for detailed evaluation.

The State will only consider proposals that fulfill ALL the minimum qualifications as outlined in Section C – Proposal Mandatory Requirements.

Vendors are expected to submit as part of Technical Proposal - Part 1 with necessary details including examples of their experience that qualify them to meet these mandatory requirements.

The state reserves the right to verify these claims during the “Pass/Fail” evaluation process.

Mandatory Pass/Fail Criteria are listed in Section C – Proposal

Vendor References

The State requests that any vendor who intends to list a current Rhode Island State employee as a reference on a bid proposal, contact that State person to receive written permission, prior to listing that person on any bid proposal. If this pre-approval is not obtained and provided within the submittal of a vendor’s technical proposal, the State reserves the right to eliminate information received from that employee, as it pertains only to a Vendor reference.

Eval Criteria Proposal Response Yes/No 1 1 referenceable client in the last 2 years providing AMS

Services with Salesforce cluster Provide detail writeup

2 1 referenceable client in the last 2 years providing AMS Services with WorkDay

Provide detail writeup

3 1 referenceable client in the last 2 years providing AMS Services with Legacy Mainframe

Provide detail writeup

4 Salesforce Partner [Crest and/or Summit level] past 1 year

Provide Partnership Status

5 Workday certified Partner past 1 year Provide Partnership Status

2. Technical Proposal

Narrative and format: Vendors must submit a technical proposal which addresses each of the following elements and is limited to fifty (50) pages total that includes an executive summary not more than five (5) pages (this excludes any appendices and as appropriate, resumes of key staff that will provide services covered by this request):

A. Staff Approach and Key Staff Qualifications:

As part of Tech Proposal – Staffing provide:

A.1 Staffing Model Provide Staffing Model to deliver Applications for the Managed Service Areas. Provide FTEs assumed [full time or part time] over a 36 month duration with staffing ramp up/ramp down assumed to achieve any productivity gains.

For each Managed Service, Provide roles, with onsite, offsite and offshore.

A.2 Provide Key Staff resumes for each of the three areas with qualifications and relevant experience who will be involved in this project. Key staff will be required to participate during the demonstration/presentation phase should the Vendor qualify.

2023-1.v3.04082026 RFP – Agency Solicitation Specifications Page 8 of 12 Revised 4/8/2026

AMS Managed Services members should have relevant certifications.

B. Capability, Capacity, and Qualifications of the Vendor –

As part of Tech Proposal - Please provide a detailed description of the Vendor’s experience in each of the 3 Managed Services areas each with

• 2 case studies of previous projects with one of them having Client references [ include client names, addresses, contact names with emails and phone numbers, dates of service and exact type(s) of service(s) provided for

• Low code development and support [SF and ERP Workday preferred]

• Legacy App support

• Mainframe Admin support

For references of the Vendor, Subcontractor(s), and/or its Resources, The Department reserves the right to contact none, any, or all of the specified references. The Department also reserves the right to include or not include reference information obtained from those references, in the evaluation criteria of this RFP.

C. Work Plan, Approach and Methodology - This is the core part of the Technical Proposal. This section should provide a detailed description of the Vendor’s Approach with Tools to Transition & Operationalizing the Managed M&O Services.

As part of Tech Proposal - Work Plan provide:

1. Transition: including plan, approach, Tools, and your deliverables

2. Steady State:

• Operating Model: Staffing coverage, support tiers, and handoff between L1/L2/L3.

• Incident, Problem & Change Management Procedures aligned to ITIL.

• Off-hours and On-call Support Plan with escalation matrix.

• Service Level Management

3. Release and Environment Management

4. Governance & Communication

5. BCP / DR plan

6. Enhancement delivery approach.

System Security Plan –

1. IMPORTANT: Whether the vendor and any subcontractors are handling PII or PHI, all responding vendors must detail that it has robust database security by adhering to steps below:

A. The State requests your firm provide insights and information into all Artificial Intelligence (AI) in your proposed solution. If the functionality your firm is proposing contains any use of AI (Generative, etc.), the State requests:

a. It be identified, and

b. It be optional during the initial implementation of your solution, including if it is

Hosted or not Hosted on State Infrastructure.

B. Please describe in detail the cybersecurity risk mitigation controls that are implemented within scope of the proposed solution and applicable cybersecurity framework used: NIST CSF 2.0, NIST 800-53 low, moderate, or high control families, CIS Benchmarks, ISO 27001, ISO270002, PCI DSS, CSA, or SCF. Please

2023-1.v3.04082026 RFP – Agency Solicitation Specifications Page 9 of 12 Revised 4/8/2026 complete the Appendix D – ETSS Cybersecurity Questionnaire attached and include it with your submission, and additional applicable information per the above. Please complete the Questionnaire to number 5, select yes this will complete the Questionnaire and provide documented plan or report artifact (e.g. SOC2 Type 2 reports or ISO27001 certification) to validate your selected response.

The Questionnaire must always be submitted, regardless of the number of questions and replies within it.

C. Additional security documentation may be requested. Prior to contract award, the State may in its discretion require the Vendor to provide additional security documentation, including but not limited to, vulnerability assessment reports and penetration test reports.

The awarded Vendor shall provide such additional security documentation upon request by the State during the term of the contract.

The above-referenced Appendix D – ETSS Cybersecurity Questionnaire will be evaluated as part of the Technical Proposal.

During the RFP evaluation process, or anytime thereafter, the State reserves the right to request additional Artificial Intelligence (AI) and/or IT Security information be provided and approved, based on any subsequent request and eventual award for services.

Return your responses to Appendix D – ETSS Cybersecurity Questionnaire as an excel spreadsheet, as a separate document in your technical proposal.

Additionally, if a vendor does not adhere to the above and/or alters the layout of the Appendix D - ETSS Cybersecurity Questionnaire, the State reserves the right to reject their proposal.

2. Please see and review the attached Addendum B – IT Policies, and the attached Appendix

F – Vendor Checklist to RI GCOP IT Policies.

a. For all applicable items, vendors are to respond to the categories in the Appendix

F – Vendor Checklist to RI GCOP IT Policies.

b. For each row, indicate if your firm Agrees (A) or is Rejecting (R), by entering the value of 'A', or 'R' in column 'E' of that item’s row.

c. If your firm enters an 'R' in any row, please use column ‘F’ to comment on the rejection.

d. If your firm enters an ‘A’ in any row, and that item is covered in an agreement that already exists with the State and/or is part of your terms and conditions, please use column ‘F’ to explain

Return this Checklist as an excel spreadsheet, and if applicable, redlines to Addendum B

– IT Policies, in your reply, as separate documents in your technical proposal.

3. Vendor Presentation/Demonstration

Vendors meeting the minimum technical score will be required to present their proposal and recommended solutions for a presentation/demonstration. Details of the demonstration including the location and agenda will be communicated to the qualified vendors at a later date. All costs associated with providing the demonstration will be borne by the bidder. All subcontractors/partners listed in the technical proposal must participate in the demonstration.

2023-1.v3.04082026 RFP – Agency Solicitation Specifications Page 10 of 12 Revised 4/8/2026

4. Cost Proposal

Vendors are required complete and submit cost proposal attached (Appendix C – AMS RFP Cost proposal template) for the required services.

The Cost-proposal is requested for the Base Term period of 3 years, Vendor are requested to price the Services in 2 Groups [Low Code and Legacy Group] Assume Scope using Phase 1 and Phase 2 applications and services in scope as shown in Section B.5.

Refer to Appendix C for instructions

5. Supplemental Bidder Attestation Form

See Appendix A on the “Overview” tab in Ocean State Procures™ for information. Vendors are required to complete, sign and submit this form with their overall proposal.

6. ISBE Proposal

See Appendix B on the “Overview” tab in Ocean State Procures™ for information and the MBE, WBE and/or Disability Business Enterprise Participation Plan form(s). Vendors are required to complete, sign and submit these forms with their overall proposal. Please complete separate forms for each MBE, WBE, and/or Disability Business Enterprise subcontractor to be utilized on the solicitation.

SECTION D: EVALUATION AND SELECTION - SOLICITATION SPECIFIC

Proposals shall be reviewed by a Technical Evaluation Committee (“TEC”) comprised of staff from State agencies, departments and ETSS.

The evaluation process will consist of the following phases:

Phases Phase Description Phase 1 Mandatory Pass/Fail Requirements Phase 2 Technical Proposal Phase 3 Presentation/Demonstration Phase 4 Cost Proposal and ISBE Participation Proposal

Phase 1 – Mandatory Requirements [Pass / Fail] – detailed in Section C Mandatory Requirements will first be reviewed by the State for a “Pass”/ “Fail” determination. Phase1 - Mandatory Requirements with a full “Pass” determination is required to advance to the Phase 2 - Technical Proposal Evaluation.

Phase 2 – Technical Proposal

Technical Proposals must receive a minimum of 40 (80%) out of a maximum of 50 points to advance to the third phase. Any Phase 2 – Technical Proposals scoring less than 40 points shall not advance to Phase 3 - Presentation/Demonstration and shall not have the accompanying Phase 4 - Cost or ISBE Participation Proposals opened and evaluated. The proposal will be dropped from further consideration.

Phase 3 – Presentation/Demonstration

2023-1.v3.04082026 RFP – Agency Solicitation Specifications Page 11 of 12 Revised 4/8/2026

Presentation/Demonstrations must receive a minimum of 16 (80%) of the 20 possible points to advance to the Phase 4 - Cost Proposal and ISBE Proposal phase. Phase 2 - Presentation/Demonstration not meeting the above criteria shall not advance to Phase 3 - Cost or ISBE participation Proposal phase and shall not have the accompanying Cost or ISBE Participation Proposals opened and evaluated. The proposal will be dropped from further consideration.

Phase 4 – Cost Proposal

Presentation/Demonstrations scoring 16 points or higher shall be evaluated for Cost and assigned up to a maximum of 30 points in the Phase 3 - cost category, bringing the potential maximum score to 100 points.

For those bidders whose proposed materials met or exceeded all preceding minimum scoring thresholds and proceeded to cost evaluation, ISBE proposals shall be evaluated and assigned up to 6 bonus points for ISBE participation.

The Division of Purchases reserves the right to select the vendor(s) or firm(s) (“vendor”) that it deems to be most qualified to provide the goods and/or services as specified herein; and, conversely, reserves the right to cancel the solicitation in its entirety in its sole discretion.

Proposals shall be reviewed and scored based upon the following criteria:

Criteria

Possible Points

Mandatory Requirements

Mandatory Requirements Pass/Fail

Technical Proposal

Staff Approach and Key Qualifications 10

Capability, Capacity, and Qualifications 10

Work Plan, Approach, and Methodology

Total Possible Technical Proposal Points

50 Points

Interview/Demonstration

Presentation/Demonstration

20 Points

Total Possible Technical Proposal & Presentation/Demonstration Points

70 Points

Cost Proposal Cost Proposal 30 Points

Total Possible Evaluation Points

106 Points

ISBE Participation 6 Points

Total Possible Points 106 Points

2023-1.v3.04082026 RFP – Agency Solicitation Specifications Page 12 of 12 Revised 4/8/2026

Additional evaluation criteria can be found at:

• For those with an OSP account, see the “Requirements” tab of this solicitation in OSP for additional information on the evaluation and selection process in the “RFP Standard Specification” section.

• For those without an OSP account, public access to the full bid can be found at https://ridop.ri.gov/vendors/bidding-opportunities. Search for this solicitation, open the record, click on the “Print/Download Solicitation Summary” button in the upper right corner for all the solicitation requirements and supporting documents are found at the bottom of the page in the “Solicitation Attachments” section.

https://ridop.ri.gov/vendors/bidding-opportunities

SECTION D: EVALUATION AND SELECTION - SOLICITATION SPECIFIC