rfpaddendum4_-_Clean.pdf
PDF 483 KB Posted
- Attached to
- MNIT/AELSBOA RFP ITN Licensure Compliance System
- Solicitation number
- 2000018382
- Issued by
- Ramsey County, Minnesota
About this file
This is RFP Addendum #4 to the Request for Proposals for a Licensure and Compliance System (LCS), issued jointly by the Minnesota Department of Information Technology Services (MNIT), the Minnesota Board of Architecture, Engineering, Land Surveying, Landscape Architecture, Geoscience and Interior Design (AELS), and the Minnesota Board of Accountancy (BOA). The addendum addresses vendor questions regarding security and compliance requirements, specifically clarifying the application of GovRAMP Snapshot and Authorization obligations to systems integrators, subcontractors, and third-party SaaS platform providers. The primary contract solicitation seeks a cloud-based, vendor-managed SaaS licensing system to replace legacy systems and serve approximately 40,000 applicants and licensees across eight professional fields. The system must support electronic application intake, renewals, reinstatements, firm licensing, continuing education tracking, complaint and investigation management, and board workflows, with deployment targeted for June 30, 2027. The original proposal deadline was June 22, 2026 at 2:00 PM Central Time, with the anticipated contract term running from July 2026 through June 2027, renewable for up to four additional years in State-determined increments.
This addendum provides critical clarifications regarding GovRAMP compliance pathways. The State confirms that FedRAMP Moderate (Revision 5) authorization held by a SaaS platform provider, coupled with enrollment in GovRAMP continuous monitoring within 12 months, satisfies the hosting infrastructure layer requirements, with vendors responsible only for application-layer GovRAMP Snapshot compliance. Subcontractors operating separate cloud services within the solution boundary must obtain independent GovRAMP authorization, while those providing application components may inherit security controls from the prime contractor's or platform provider's authorized environment. Vendors may submit current GovRAMP Ready status, third-party assessment evidence, SOC reports, and documented authorization roadmaps with proposals to support evaluation, provided they commit to achieving GovRAMP Snapshot within 60 days of contract award and full GovRAMP Authorization by April 1, 2027. The State will accept GovRAMP Authorization at Moderate Impact Level status achieved by the go-live date as compliant with contract requirements.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 4.3.2026_ptsamplecontractsandexhibits.pdf | ||
| Attachment_A_and_B.pdf | ||
| AELS_BOA_LCS.RFP_Final_5.19.26.pdf | ||
| Attachment_D.pdf | ||
| rfpaddendum2_7.2.26.pdf | ||
| Attachment_E_FunctionalReq_SelfAssess3.13.26.xlsx | XLSX spreadsheet | |
| Attachment_C_Cost_Detail_4-15-25.docx | DOCX document | |
| rfpaddendum3_-_Clean.pdf | ||
| MNIT_AELSBOA_RFP_ITN_Licensure_Compliance_System.pdf | ||
| rfpaddendum1.pdf | ||
| Attachment_F_AccessibilityTG.docx | DOCX document | |
| Replaced_Attachment_C_Cost_Detail_7.6.26_LCS.docx | DOCX document |
Show all 12
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Rev. 07.01.2024
Request for Proposals (RFP) Addendum #4
SWIFT Event #: 2000018382 Agency: MNIT/MN Board of AELSLAGID (AELS) & MN Board of Accountancy (BOA) Addendum Number: 4 Date of Addendum: 07/21/2026 Title: RFP ITN Licensure and Compliance System (LCS)
SCOPE OF ADDENDUM
The following are changes to the RFP: (A) Sharing vendor questions unanswered from Addendum 3 of the RFP and State’s answers.
A. Vendors’ unanswered questions posted in Addendum 3 to the RFP and the State’s answers are as follows:
11. Question: Where the responder is a systems integrator implementing on a third-party SaaS platform, do the GovRAMP Snapshot and Authorization requirements attach to the SaaS platform provider, the integrator, or both? Will the State accept a platform holding FedRAMP Moderate (Rev. 5) authorization with GovRAMP continuous monitoring enrollment within 12 months, with the integrator providing ATO artifacts for the implemented configuration?
11. Answer:
GovRAMP Snapshot/Authorization applies to the SaaS platform provider, not the systems integrator, unless the integrator operates its own cloud service within the solution boundary.
For part b of question 1 a FedRAMP Moderate (Rev. 5) authorized SaaS platform with GovRAMP continuous monitoring enrollment within 12 months is acceptable.
22.3 How does the State expect security/GovRAMP obligations to flow down to subcontractors — must each subcontractor independently hold GovRAMP Authorization, or may subcontracted application components inherit authorization from the prime’s/platform’s authorized hosting environment?
22.3 Answer:
Each subcontractor does not typically need its own GovRAMP Authorization if it is not operating a separate cloud service. Subcontracted application components may inherit security controls from the prime contractor's or platform provider's authorized hosting environment, but only for controls that are truly inherited. Any subcontractor-operated cloud service or SaaS component that falls within the solution boundary is generally expected to obtain its own GovRAMP authorization as authorization does not automatically flow from the hosting environment. The subcontractor remains responsible for documenting inherited versus customer-implemented controls and providing evidence for any controls it is responsible for.
Rev. 07.01.2024
23.1 If the Solution is hosted on a platform that already holds FedRAMP Moderate (or High) Authorization, will the State accept that platform’s authorization as satisfying the GovRAMP Moderate requirement for the hosting/infrastructure layer, with the responder responsible only for an application-layer GovRAMP Snapshot?
23.1 Answer:
Yes, provided the platform is enrolled in GovRAMP continuous monitoring and the application layer complies with GovRAMP requirements
23.2 The RFP requires a GovRAMP Snapshot within 60 days of execution and Authorization by April 1, 2027. For a solution built on an already-authorized platform, does the April 1, 2027 Authorization milestone apply to the platform, the application configuration, or both?
23.2 Answer:
It would apply to the application configuration as the platform already meets requirements
23.3 The RFP states the State will accept FedRAMP Moderate/High with enrollment in GovRAMP continuous monitoring within 12 months. Will a FedRAMP-authorized SaaS with that enrollment be considered fully responsive, or is GovRAMP Authorization ultimately required regardless?
23.3 Answer:
GovRAMP authorization is not required if the platform/system has a FedRAMP Moderate or High certification and is enrolled in the GovRAMP continuous monitoring program.
85. GovRAMP evidence: Section 3.4.17 requires GovRAMP Snapshot within 60 days after contract execution and GovRAMP Authorization by April 1, 2027. Please confirm whether current GovRAMP Ready status, 3PAO assessment evidence, SOC reports, and a documented authorization roadmap may be submitted with the proposal to support evaluation, with the selected vendor meeting the post-award GovRAMP milestones as stated.
85. Answer:
Yes, if it commits to achieving the required GovRAMP Snapshot within 60 days of contract award and GovRAMP Authorization by April 1, 2027, in accordance with the contract milestones.
98. If the vendor obtains GovRAMP Authorization at Moderate Impact Level status by the go-live date, would that be acceptable?
98. Answer:
Yes
File details come from the government source that posted it. Updated .