S-DASOBO-00012374 ALERT IIS Request for Proposals.docx

State of Oregon

Cover Page Department of Administrative Services, Enterprise Goods and Services, State Procurement Services on behalf of Oregon Health Authority (“OHA”)

Alert immunization information system (“Alert iis”)

Request for Proposal (“RFP”) RFP #S-DASOBO-00012374

The State of Oregon promotes equal opportunity for all individuals without regard to age, color, disability, marital status, national origin, race, religion or creed, sex or gender, sexual orientation, or veteran status.

S-DASOBO-00012374

ALERT Information System (“ALERT IIS”) Page 2 of 27 Table of Contents

LIST OF ATTACHMENTS

· Attachment A: SAMPLE CONTRACT

· Attachment B: AFFIDAVIT OF EXEMPTION FROM DISCLOSURE

· Attachment C: PROPOSER INFORMATION AND CERTIFICATION SHEET

· Attachment D: REFERENCE CHECK FORM

· Attachment E: PRELIMINARY PRICE PROPOSAL FORM

· Attachment F: CERTIFIED DISADVANTAGED BUSINESS OUTREACH PLAN

· Attachment G: RESPONSIBILITY INQUIRY

· Attachment H: BUSINESS NEEDS / SOLUTION REQUIREMENTS

· Attachment I: SCOPE OF WORK

· Attachment J: STATEWIDE INFORMATION TECHNOLOGY (IT) CONTROL STANDARDS SPREADSHEET

GENERAL INFORMATION

INTRODUCTION

The State of Oregon acting by and through the Department of Administrative Services, Enterprise Goods and Services, State Procurement Services (“DAS SPS”), on behalf of the Oregon Health Authority, (“Agency” or “OHA”), is issuing this Request for Proposals (“RFP”) under the provisions of Oregon Revised Statutes (“ORS”) 279B.060 to replace Oregon’s existing ALERT Immunization Information System (“ALERT IIS”) with a more modernized solution comprising an Immunization Information System “(IIS”) (the “Solution”, as defined below) to support modernizing data processes state-wide in the integration of multiple existing systems into one, maintenance, and support of the Oregon Immunization Program (“OIP”).

OHA, through its Public Health Division’s OIP, uses the ALERT IIS, a database that records all immunization doses administered by participating providers in Oregon, as a vital tool for managing immunization records and promoting healthier communities. The ALERT IIS replacement project will ensure the continued administration of the functionality currently offered within the Immunization Record Information System (“IRIS”) as well as selected features from the Partner Organization System Tracking (“POST”). This project aligns with the national Data Modernization Initiative (“DMI”) and supports OHA’s strategic goal of eliminating health inequalities in Oregon by 2030. Agency desires to Go-Live with the Solution by December 31, 2027 but is open to extended timelines as long as the Solution is live within two years of signing of the Contract resulting from the RFP.

Additional details on the scope of services are included in Attachment I, Scope of Work.

DAS SPS and OHA will evaluate Responsive Proposals through two or more evaluation rounds but reserve the option to issue a Notice of Intent to Award after any round depending on scoring results.

Round 1 Proposal submissions must include the following three components:

1. Administrative Proposal

2. Technical Proposal

3. Preliminary Price Proposal Additional details on the Round 1 Proposal submission requirements are included in Section 3, Procurement Requirements and Evaluation.

DAS SPS anticipates the award of one contract from this RFP. The initial term of the contract resulting from this RFP is negotiable, but DAS SPS anticipates that the initial term may be from five to ten years, with options to renew for additional periods.

SCHEDULE

The table below represents a tentative schedule of events. All times are listed in Pacific Time. All dates listed are subject to change.

SINGLE POINT OF CONTACT (“SPC”)

The SPC for this RFP is identified on the Cover Page, along with the SPC’s contact information. Proposer shall direct all communications related to any provision of the RFP only to the SPC, whether about the technical requirements of the RFP, contractual requirements, the RFP process, or any other provision.

AUTHORITY, OVERVIEW, AND SCOPE

AUTHORITY AND METHOD

DAS SPS is issuing this RFP pursuant to its authority under Oregon Administrative Rule (“OAR”) 125-246-0170(3)(b).

DAS SPS is using the Competitive Sealed Proposal method, pursuant to ORS 279B.060 and OAR 125-247-0260. Agency may use a combination of methods for Competitive Sealed Proposals, including optional procedures: a) Competitive Range; b) Discussions and Revised Proposals; c) Revised Rounds of Negotiations; d) Negotiations; e) Best and Final Offers; and f) Multistep Sealed Proposals.

DEFINITION OF TERMS

General Definitions For the purposes of this RFP, capitalized words are defined in OAR 125-246-0110 or as defined below.

Terminology specific to the OregonBuys system may be found at: OregonBuys® Project Specific Acronyms and Definitions.

Each of the following capitalized acronyms and terms have the following meanings:

ACIP: Advisory Committee on Immunization Practices ACR: Accessibility Conformance Report ADOS: Azure DevOps On-premise Server, which is a Microsoft IT service utilized by OIP, through Agency.

AIRA: American Immunization Registry Association ALERT IIS: ALERT Immunization Information System API: Application Program Interface; examples of API include REST, SOAP, XML-RPC, and JSON-RPC.

CDC: Centers for Disease Control and Prevention CDC Endorsed Data Elements: The data elements that are needed by an IIS to record patient demographics and vaccination events to meet the IIS Functional Standards v4.0. Also called “Core Data Elements.”

CDC IIS Functional Standards: The Immunization Information System (IIS) Functional Standards describe the operations, data quality, and technology needed by IISs to effectively support immunization programs, vaccination providers, and other partners and their immunization-related goals.

CDC IZ Gateway: A program that includes a technology solution and infrastructure that facilitates immunization data exchange. It securely supports efficient exchange of immunization data among jurisdictional immunization information systems (IIS) and between IISs and public and private vaccine-providing organizations (e.g., Veterans Health Administration, physician’s offices, pharmacies).

Configurability: the capability of a software application or hardware device to be tailored, modified, or arranged to meet specific user needs, requirements, preferences, or operating environments without changing the underlying source code.

DAS: Department of Administrative Services, an agency of the State of Oregon.

EDI: Enhanced Demographic Information ETL: Extract, Transform and Load, which means (a) the extraction of data from Agency’s multiple legacy IIS systems, (b) the transformation and clean-up of the extracted data of (a), and (c) the loading of this transformed, cleaned-up data into the proposed Solution.

ExIS: External Information System – What CDC calls an IIS in its documentation FHIR: Fast Healthcare Interoperability Resources HEDIS: Healthcare Effectiveness Data and Information Set HL7: Health Level 7, which means a type of standard immunization messaging IIS: Immunization Information System Interested Parties: Individuals, groups, or organizations that have a role in, are impacted by, participate in, or have a legitimate interest in the project, the proposed Solution, or the Services.IQIP: Immunization Quality Improvement Providers IQMS: Independent Quality Management Services, which means services performed by an independent contracting entity to provide quality assurance and control as per Statewide IT Policy and Procedure No. 107-004-030.

IRIS: Immunization Record Information System LMS: Learning Management System LPHA: Local Public Health Authorities NPI Number: National Provider Identifier OCM: Organizational Change Management.

ODE: Oregon Department of Education OWASP: Open Worldwide Application Security Project Peds: Pediatrics PHII: Public Health Informatics Institute PMI: Partner Management Interface POAMs: Plan of Action and Milestones POST: Partner Organization System Tracking Program: means Oregon Immunization Program or OIP, a program within Agency PRS: Primary Review Summary QA: Quality Assurance, which means the systematic process of ensuring products, services, or processes consistently meet defined quality standards and expectations by preventing defects, monitoring processes, and building in quality from the start, providing confidence to both internal teams and external stakeholders.

REAL-D: Race, Ethnicity, Language, and Disability RPO: Recovery Point Objective, which is the maximum acceptable amount of data loss measured in units of time. It is the age of the files or data in backup storage required to resume normal operations if a computer system or network failure occurs. RPO may vary based on the platform or technology.

RTO: Recovery Time Objective, which is the duration of time allowed between an outage and the resumption of normal operations and service levels. The RTO defines the point in time after a failure or disaster at which the consequences of the interruption become unacceptable.

SAR/RAR: Security controls and risk assessment report(s).

SDLC: Software Development Life Cycle SFTP: Secure File Transfer Protocol SIS: Student Information System SmartyStreets: Company name, refers to an address validation and geocoding service used by IIS to improve data quality. Maintained by AIRA and CDC.

SMILER: School Module for Immunization Law Electronic Reporting SP: Special Publication SQL: Structured query language SSDLC: Secure Software Development Life Cycle UAT: User Acceptance Testing UI: User Interface VAERS: Vaccine Adverse Event Reporting System VAP: Vaccines Access Program VFC: Vaccines For Children VIS: Vaccine Information Statement VTrckS: Vaccine Tracking System, which is the CDC system for managing federally funded vaccine WCAG: Web Content Accessibility Guidelines

OVERVIEW AND PURPOSE

Agency Overview and Background OHA consists of many programs focused on ensuring that those living in Oregon are able to “achieve optimum physical, mental, and social well-being.” OHA’s vision is, simply put, “A healthy Oregon.” One such program is the OIP.[footnoteRef:2] [2: https://www.oregon.gov/oha/Pages/Portal-About-OHA.aspx]

OIP works to reduce the incidence of vaccine-preventable diseases in Oregon by identifying and promoting evidence-based public health best practices to both the public and healthcare professionals statewide. Alongside education, OIP provides technical assistance and quality improvement support to both public and private healthcare providers and their practices, as well as to schools and local public health authorities (“LPHAs”), to assist in their compliance with relevant school law requirements.

At the core of OIP’s efforts is ALERT IIS, a confidential, population based, computerized database that records all immunization doses administered and reported by participating providers in Oregon. With approximately 90% of Oregon’s immunizing providers contributing data, ALERT IIS serves as a powerful tool for managing immunization records, supporting healthier communities, guiding clinical decision-making, and enabling effective public health interventions.

The COVID-19 pandemic highlighted the importance of addressing systemic bias by ensuring individuals have access to their own immunization records. It also underscored the growing interest among partner organizations in using data to better support the communities they serve.

Project Overview and Background ALERT IIS is a Mission Critical System leveraged by OIP for their work. Immunizing providers rely on ALERT IIS for clinical decision making and can utilize its built-in functionality to generate a variety of reports about their patient populations. These reports include reminder/recall notices, which identify patients who are due to overdue for immunizations. Additionally, ALERT IIS offers schools and childcare centers online access to student’s immunization records, simplifying the enrollment process for parents while ensuring compliance with relevant Oregon statutes.

ALERT IIS also plays an essential role in supporting the Federal Vaccines For Children (“VFC”) Program and all other programs within the State of Oregon Immunization Program. By ensuring that immunization providers have access to patient data at the point of care, ALERT IIS helps improve vaccination schedules and uptake.

The number of data records, data exchange transactions and user interface (“UI”) user accounts in Agency’s multiple legacy systems is significant. As of January 1, 2026:

A. Data records are estimated to number:

· 8,162,429 patients, increasing about 6% annually;

· 105,256,654 immunizations, increasing about 14% annually;

B. Electronic data exchange transactions have a daily average of about 206,000 and a daily peak of about 320,000, with about 85-90% being queries for immunological history and about 10-15% being vaccination reports; the number of such transactions is increasing about 5% annually, but in the future may increase significantly for Healthcare Effective Data and Information Set (HEDIS) reporting by query, rather than batch files; and, C. UI user accounts are estimated to number about 20,860, with no current estimate of growth rate.

OIP will be replacing the current ALERT IIS, which was built and is maintained by a third party, to provide a more modern, scalable, and accessible solution to partners and Oregonians. The desired Solution must include the integration of enhanced demographic information (“EDI”) data requirements set by the state of Oregon and functionality for school immunization program reporting. The Solution also must incorporate components supporting features such as user identity management, data integration, and immunization assessments for school reporting.

The Solution further must integrate functionality from both IRIS and POST, which are both Agency-developed and -maintained systems, while incorporating lessons learned from the COVID-19 pandemic. Key features of the Solution must include consumer access modules and the ability to collect EDI to meet Oregon requirements and to better address emerging public health needs.

IRIS is a system designed to issue exclusion orders and collect data for reporting immunization and exemption rates for schools and children’s facilities across the state. It also generates a grant required report submitted annually to the CDC. IRIS enables LPHAs to comply with reporting requirements outlined in ORS 433.235 to 433.284 and OARs 333-050-0010 to 333-050-0140. With the implementation of the Solution to replace the current ALERT IIS, OIP plans to retire IRIS while integrating most of its functionality into the Solution.

POST and ALERT IIS currently share organization level data and are interoperable. POST serves primarily as an internal facing system used to manage information about providers participating in OIP programs. It supports key functions for OIP staff, including email integration, while also offering an external component for partners to enroll in OIP programs and manage annual recertification for immunization providers in the VFC and the Vaccine Access Program (“VAP”).

The current ALERT IIS plays a critical role in responding to large-scale outbreaks of vaccine preventable diseases, such as the COVID-19 pandemic. In addition to its use by medical providers, ALERT IIS has been instrumental in providing vaccination data to various stakeholders to meet their needs. During the pandemic, ALERT IIS handled a significant exchange of vaccination data and was a key driver of system growth over the past two years.

SCOPE OF WORK AND SOLUTION REQUIREMENTS

The successful Proposer will be responsible for delivering, deploying, implementing, hosting, and supporting the Immunization Information System (“IIS”) Solution throughout the duration of Agency’s use. This includes providing all professional consulting, implementation, data migration, integration, training, and operational Services necessary to configure the Solution to meet Agency Requirements and to prepare Agency staff, partners, and end users for successful adoption. The successful Proposer will ensure the Solution is implemented using an approach consistent with State expectations, provides all required documentation, adheres to applicable laws and policies, and integrates seamlessly with Agency’s project management, oversight, and Independent Quality Management Services (“IQMS”) activities.

The successful Proposer is also expected to support the full lifecycle of the Solution, including preparation and maintenance of all Environments, execution of data conversion and validation activities, establishment and testing of Interfaces and Integrations, completion of testing and Go‑Live readiness activities, and a smooth transition from implementation into ongoing Operations and Maintenance. Ongoing Services include maintaining Solution reliability, security, and performance; ensuring compliance with Statewide Information Technology Control Standards; providing timely updates and Enhancements; and supporting Agency’s ability to continuously use, configure, and manage the Solution. More detailed information is provided in Attachment I, Scope of Work.

The Solution must meet Agency’s needs as documented in this RFP, and more specifically in Attachment H, Business Needs / Solution Requirements, Attachment J, Statewide Information Technology (IT) Control Standards Spreadsheet, and Attachment A, Sample Contract.

PROCUREMENT REQUIREMENTS AND EVALUATION

MINIMUM SUBMISSION REQUIREMENTS

To be considered Responsive for evaluation, Proposer’s Round 1 Proposal must substantially comply with all minimum qualifications and submission requirements set forth in this RFP, including in Section 3, Procurement Requirements and Evaluation. Failure to meet minimum qualifications and submission requirements may result in Proposal rejection. DAS will conduct the preliminary responsiveness check. All Proposals deemed Responsive will be forwarded to an evaluation committee, made up of evaluators who will score the proposals as well as subject matter expert acting as advisers, for evaluation. To be considered for evaluation, a Proposal must contain an Administrative Proposal, a Technical Proposal and a Preliminary Price Proposal including the applicable attachments.

ROUND 1 Proposal Submissions The following table outlines the required content of the Round 1 Proposal:

Round 1 Proposal Requirements

Proposal Page Limits A Round 1 Proposal is limited to 150 pages, less items excluded from this limit. Any pages exceeding this limit will not be provided to the evaluation committee or considered in the evaluation. The following items do not count toward this page limit:

Attachment B, Affidavit of Exemption from Disclosure Attachment C, Proposer Information and Certification Sheet Attachment D, Reference Check forms Attachment E, Preliminary Price Proposal Attachment F, Certified Disadvantaged Business Outreach Plan Attachment G, Responsibility Inquiry Key Persons and Resumes Accessibility Compliance Report Work samples – Limited to three samples for each type of plan. Each sample must not exceed 50 pages.

Proposal Format and Quantity The Proposal should follow the format and reference the sections listed in Section 3.2, ROUND1 PROPOSAL REQUIREMENTS. Responses to each section and subsection should be labeled to indicate the item being addressed.

The completed Attachment E, Preliminary Price Proposal must be submitted as a separate/stand-alone electronic response file. Attached files cannot be encrypted or otherwise require a third-party encryption software.

Proposer must submit one electronic copy of its Proposal which must include all required submissions outlined in Section 3.1.1, ROUND 1 Proposal Submission. Acceptable electronic submission formats are: Adobe Acrobat (pdf), Microsoft Word (docx), or Microsoft Excel (xlsx).

If Proposer believes any of its Proposal is exempt from disclosure under the Oregon Public Records Law (ORS 192.311 through 192.478), Proposer shall complete and submit Attachment B, Affidavit of Exemption from Disclosure. Proposer shall also submit a second copy of its proposal with redacted information and shall mark as “Confidential” in OregonBuys® all attachments to its Proposal that Proposer believes are exempt from disclosure.

Proposer must not include any weblinks within its Proposal.

Authorized Representative Failure of Proposer’s authorized representative to sign the Proposal may result in rejection of the Proposal by DAS SPS.

ROUND 1 PROPOSAL REQUIREMENTS

Proposer’s Round 1 Proposal must address all Round 1 requirements set forth in this RFP, Proposer shall describe the Services to be performed. A Proposal that merely offers to provide the services as stated in this RFP may be considered non-Responsive to this RFP and not considered further.

The Proposal should be straightforward and address the requests of the RFP. Proposal should not include extensive artwork, unusual printing or other materials not essential to the utility and clarity of the Proposal. Do not include marketing or advertising material in the Proposal, unless requested. Proposal containing unsolicited marketing or advertising material may receive a lower evaluation score if required information is difficult to locate.

ADMINISTRATIVE PROPOSAL

Executive Summary (Mandatory, Not Scored) Briefly describe how the proposed Solution addresses high level requirements listed in this RFP. These requirements form the basis for a comprehensive yet succinct Executive Summary, that summarizes the proposed Solution, its distinctive features, and how it will fulfill the State’s requirements.

If Proposer relied on generative artificial intelligence (AI) to prepare any component of its Proposal, identify those component(s), and include a statement verifying that Proposer reviewed the AI-generated component(s) and verified they are factual and accurately represent Proposer’s Offer.

Proposer’s Organization Profile (Mandatory, Scored) Proposer must provide a profile of its organization. This is Proposer’s opportunity to give an overview of its organization, describe the structure of its business, and discuss how the organization can effectively provide the Services and the Deliverables (including the proposed Solution) described in this RFP. The Profile must include:

1. Ownership structure of Proposer. If incorporated or otherwise organized and registered as a business entity under the laws of a state, the state in which the organization is incorporated or organized, the date of the incorporation and initial registration, and a statement that such incorporation and registration has all fees due thereon fully paid to Proposal date;

2. Number of years Proposer has been in business;

3. Location of the Proposer’s offices (headquarters and branches);

4. Location of the office(s) in which are based Proposer employees and subcontractors who will be assigned to work on the project for Agency;

5. Number of Proposer employees located in the Pacific Northwest, nationally, and internationally;

6. Proposer’s client base; and

7. Proposer’s experience working with governmental agencies; at what level and for how many years.

Proposer’s Experience and Capabilities (Mandatory, Scored) Proposer must demonstrate it has a minimum of, with additional preference being given to more than, two (2) years’ experience delivering comparable projects, i.e., projects with similar size, scope, and/or complexity as the proposed Solution for which Proposer is responding in this RFP. For such demonstration, Proposer may provide comparable experience narratives related to current or former client organizations for which Proposer provided or is providing services and deliverables on comparable projects within the last five years. Agency prefers one such experience narrative be directed to a comparable system having been successfully implemented by Proposer in the past three years. Proposer must include examples of experience and capabilities of implementing the proposed Solution (or the SaaS on which is based the proposed Solution) for purposes of data matching and cross-checking. Proposer must provide relevant experience in addressing each Task within the Scope of Work.

For each identified client organization, a completed Attachment D, Reference Check Form (comparable experience narratives must align with submitted reference check forms);

1. Identity and type of Proposer’s client organization;

2. Client point of contact name, title, email address, and phone number;

3. Products and services provided by the Proposer to the client organization;

4. Contract number;

5. Contract value;

6. Period of performance;

7. Status of Proposer as prime or subcontractor on the implementation experience;

8. Summary of services delivered and their applicability to the requested scope of Services and requirements for this RFP;

9. Description of size and complexity of the services provided and status of the implementation, e.g. is Proposer still involved with such effort in some capacity; and

10. Any lessons learned that Proposer would apply to the requirements of the work described in this RFP.

Key Persons, Staffing and Management Plan and Organizational Chart (Mandatory, Scored) Key Persons. Proposer must identify all Key Persons assigned to provide the Services and Deliverables and shall specify whether each individual is an employee or contractor. A résumé not exceeding two pages must be submitted for each Key Person and must demonstrate education, certifications, and relevant experience necessary to perform the work described in this RFP.

Key Person(s) requirements and Agency’s preferences for the Proposer’s team are:

1. REQUIRED: A Project Management Institute’s Project Management Professional (PMP) Certification for individuals serving as project managers.

2. REQUIRED: Within the past three (3) years, experience advising business and IT leadership on project management strategies for large, multi-million-dollar IT system projects, including developing or refining procedures, applying mature project management practices, and ensuring compliance with project requirements.

3. REQUIRED: Within the past three years, experience conducting or facilitating system testing; performing business analysis activities for complex IT projects; and supporting data conversion, data migration, and system integration activities, preferably involving the proposed Solution.

4. REQUIRED: Experience working within the hosting environment proposed as part of the Solution.

5. REQUIRED: Experience with school immunization modules, student information systems, and FERPA requirements.

6. PREFERRED: Within the past three years, experience in Organizational Change Management and in delivering training and education for complex IT projects, preferrably in public health settings.

7. PREFERRED: Experience (and corresponding qualifications) in managing development processes using standard methodologies (such as Agile/Scrum or SDLC); using DevOps and requirements-tracking tools (such as ADOS or Jira); applying the most recent Business Analysis Body of Knowledge (BABOK) guidelines; understanding public sector environments and immunization information systems; and applying regulatory standards related to public health, data exchange, and CDC requirements.

8. PREFERRED: A bachelor’s degree or higher in a relevant field.

Requirements and preferences may be met by a team of proposed Key Persons; not every individual on Proposer’s team needs to meet all elements.

Staffing and Management Plan and Organizational Chart. Proposer shall submit a proposed staffing and management plan, including an organizational chart, that demonstrates:

4. Proposed team organization structure, illustrating lines of authority as appropriate, and including total full-time equivalent (FTE) Proposer employees and contractors required to provide the Services and the Deliverables (including the proposed Solution) and a summary of Proposer staff skills and qualifications.

NOTE: Agency expects the successful Proposer’s original project and development team will stay with the project through the conclusion of the Implementation Phase. Proposer must include its “back up” staffing plans in support of unanticipated staff changes that may occur during the term of the Contract.

Subcontractors. If Proposer intends to work with subcontractor(s), Proposer shall include as part of its Proposal (i) a statement detailing any subcontracting firms or individual subcontractors that may be engaged, clearly identifying both those entities and the Services they will provide, and (ii) to what extent each of the proposed subcontracting relationship(s) will be utilized by Proposer to meet any or all Requirements.

References (Mandatory, Not Scored) Proposer shall complete and submit Attachment D, Reference Check Form.

Proposer shall provide three (3) references from current or former client firms for similar projects performed for any clients within the last five (5) years. References must be able to verify the quality and the completion status of previous, related work.

Agency or DAS SPS may check to determine if references provided support Proposer’s ability to comply with the requirements of this RFP. Agency or DAS SPS may use references to obtain additional information, or verify any information needed. Agency or DAS SPS may contact any reference (submitted or not) to verify Proposer’s qualifications.

Affidavit of Exemption from Disclosure (Mandatory, Not Scored) Proposer shall complete and submit Attachment B, Affidavit of Exemption from Disclosure as part of the Proposal. Submission is required even if Proposer is not identifying confidential or proprietary information and data for nondisclosure. If Proposer is identifying items for nondisclosure as confidential or proprietary, in addition to the original Proposal, Proposer must submit a redacted copy of the complete, original Proposal submission (see Section 3.1.3, Proposal Format and Quantity).

Proposer Information and Certification Sheet (Mandatory, Not Scored) Proposer shall complete and submit Attachment C, Proposer Information and Certification Sheet. Attachment C must bear the Proposer’s authorized representative’s Signature.

Failure to demonstrate compliance with Oregon Tax Laws and sign Attachment C may result in a finding of non-Responsibility.

Certified Disadvantaged Business Outreach Plan (Mandatory, Not Scored) Proposer shall complete and submit Attachment F, Certified Disadvantaged Business Outreach Plan.

Responsibility Inquiry (Mandatory, Not Scored) Proposer shall complete and submit Attachment G, Responsibility Inquiry.

Value Added Services or Features (Not Mandatory, Not Scored) Proposer is encouraged to submit information about additional, value-added, new or innovative services or features with respect to the proposed Solution, including corresponding pricing.

TECHNICAL PROPOSAL

Scope of Work Response (Mandatory, Scored) Attachment I, Scope of Work sets forth what Agency is seeking for Services to implement and support the proposed Solution. Agency is open to considering Proposer’s different ideas for how to structure and carry out each Task set forth in Attachment I, Scope of Work, so long as consistent with Agency’s objectives, expectations for Tasks and Task-related Services and Deliverables, and other needs articulated in this RFP including in Attachment I Scope of Work.

Proposer must describe in its Proposal the strategies and activities it will use to deliver the proposed Solution, including all related Services and Deliverables for each Task. The Proposal must either (a) directly address the requirements of the Task, or (b) present alternative approaches for completing the Task, provided those approaches align with Agency’s stated objectives and needs described in this document and within the specific Task. Additional objectives for Proposer’s Services and Deliverables for each Task are outlined in Attachment I, Scope of Work.

Proposer shall include in its Proposal with respect to each Task:

1. A demonstrated understanding of Agency’s objectives and needs for each Task;

2. A demonstrated understanding of the subject matter of each Task as applicable to large scale, cloud-based IT systems generally, IIS more particularly, and the Solution most particularly;

3. A proposed approach to each Task that describes proposed methodologies and processes as well as describes how Proposer anticipates consulting and collaborating with and supporting Agency;

4. Proposed roles and responsibilities of Proposer’s team, any activities of Agency teams (including team(s) from Program, Program’s Agency partners and other vendors), and engagement with external entities, as well as structures or processes to (a) support effective consultation of Agency by Proposer and (b) team collaboration in completing activities for each Task; and,

5. Critical success factors necessary to support the proposed approach to each Task (for example, answers to following questions: What are the expectations for what the Proposer and Agency will each deliver on? And how will success with respect to each such delivery be measured?).

To the extent that Proposer utilizes in its Proposal any term which describes or is related to, in whole or in part, the proposed Solution (or any of its constituent components), the Tasks, the Services, or the Deliverables, and which either (a) is not defined in this RFP or (b) has a different meaning to the Proposer than that described in this RFP, Proposer is expected to make clear in its Proposal its respective definition for each such term.

Proposers are encouraged to provide work samples with their Proposal, including a Project Management Plan, Solution Architecture and Design Plan, Organizational Change Management Plan, Testing Plan, Training Plan, Implementation Plan, or Operations & Maintenance (O&M) Plan. These samples must be provided consistent with Section 3.1.2, Proposal Page Limits, above.

Solution Requirements Response (Mandatory, Scored) Proposer shall complete and return Attachment H, Business Needs / Solution Requirements as part of its Proposal. The completed Attachment H must address and describe how the proposed Solution meets the Requirements contained in the attachment. Please use the “Comments” section of Attachment H for each Requirement to: (a) provide information on the time of availability in the proposed Solution of the feature addressing such Requirement if feature does not currently exist in the proposed Solution, and (b) provide any other relevant details regarding the proposed Solution’s ability to meet such Requirement. If the Proposal includes optional or necessary third party software that is part of the proposed Solution, Proposer must include in its Proposal a statement acknowledging that Proposer will be responsible for any procurement of needed third party software for the proposed Solution, to include sufficient rights to Agency as to such 3rd party software for Agency to operate, maintain and support the proposed Solution in a manner that meets all Requirements and Acceptance Criteria.

The proposed Solution also must satisfy the Statewide Information Technology (IT) Control Standards mentioned in Section 3.2.2.3, Security Requirements Response.

Security Requirements Response (Mandatory, Not Scored) Proposer shall submit a statement addressing its capacity to meet State information security requirements. The statement must reflect the information indicated in this section, and clearly demonstrate that if awarded a Contract:

1. Proposer and Proposer's staff monitoring its systems who will have access to State systems, facilities, and confidential information shall submit to all security checks requested by the State, which may include any combination of fingerprinting, Oregon Law Enforcement Data Systems (“LEDS”) and Federal Bureau of Investigation Criminal Justice Information Services (“FBI CJIS”) background checks.

2. Proposer shall comply with the Statewide Information Technology Control Standards found online at: Enterprise Information Services: Guidance for State Agencies: Cyber Security Services: State of Oregon, specifically:

· Oregon’s Statewide Information Technology Control Standards, by ensuring it maintains security controls that meet or exceed “Moderate” security controls in the National Institute of Standards and Technology (“NIST”) Special Publication (SP) 800-53.

· Oregon’s Statewide Information Technology (IT) Control Standards. Proposer may (but is not required to) provide one of the following to demonstrate compliance with Oregon’s Information Technology Control Standards: Proof of current GovRAMP Authorized status (Ready, Provisionally Authorized, or Authorized) in the form of a GovRAMP Letter, or documentation of a valid GovRAMP Security Snapshot Score.

· Oregon’s Statewide Information Security Program Plan.

3. Proposer shall comply with the Statewide Policy on Cyber and Information Security, DAS Statewide Policy 107-004-052, found online at https://www.oregon.gov/das/Pages/policies.aspx#IT, pertaining to State systems and security, including its restrictions on offshore and foreign services.

· Proposer’s response to this section must specifically address its capacity to meet the policy’s restriction on offshore and foreign services for the duration of the Contract. State if fully compliant services and personnel are available, and part of Proposer’s Proposal. If the Proposal includes optional or necessary offshore or foreign services, Proposer must include in its Proposal a statement describing:

1. The offshore and/or foreign services that Proposer intends to use to deliver the Solution and Services.

2. The benefit to the State of the offshore and/or foreign services.

3. That Proposer will ensure it has systems and controls in place that will protect Agency Data and the State’s networks in the event offshore or foreign services are allowed, and what systems and controls Proposer expects the State to have in place.

4. What steps Proposer is willing and able to take to fully meet the policy’s restrictions on offshore and foreign resources. Describe any additional steps Agency would be requested to take, and any additional costs Agency may incur if Proposer provided the System and Services using fully compliant services.

4. As necessary, Proposer shall sign a non-disclosure agreement regarding information received or processed on its equipment from the State of Oregon.

5. Proposer shall protect at all times State of Oregon sensitive and confidential information.

Digital Accessibility Response (Accessibility Compliance Report for Proposed Solution) (Mandatory, Not Scored) Proposer must demonstrate its proposed Solution meets all applicable digital accessibility requirements. Provide a completed Accessibility Compliance Report (ACR) that provides information on the proposed Solution’s conformance with WCAG 2.2 level A and AA success criteria.

1. Proposer’s submitted ACR must be based on the latest version of the WCAG Voluntary Product Accessibility Template (VPAT®) that evaluates conformance with WCAG 2.2 Level A and AA success criteria.

2. The submitted ACR should be no more than 12 months old at the time of submission, accurately reflect the Solution’s current state of accessibility, be specific to the product or service and the version(s) proposed for use, be completed by qualified personnel knowledgeable in digital accessibility and the proposed Solution and be provided in an accessible format.

3. If Proposer is proposing a SaaS Solution, the ACR must cover core application functionality, authentication, and onboarding flows, help documentation, and any third-party components or integrations with which users will interact. If mobile or responsive access is common, include those experiences. Define that scope explicitly, and document what's excluded to avoid procurement follow-up questions.

4. If the ACR indicates deficiencies, Proposer must include a proposed remediation plan that specifically addresses mitigation measures it will take prior to remediation.

5. If an ACR is not available or is more than 12 months old, Proposer must clearly state this and provide contextual information supporting Agency’s evaluation of the Technical Proposal.

PRELIMINARY PRICE PROPOSAL (Mandatory, Not Scored) Proposer shall complete and submit Attachment E, Preliminary Price Proposal.

The Round 1 Price Proposal will not be scored in Round 1 but must be submitted with the Round 1 Submittals. The Preliminary Price Proposal may be used to help develop additional rounds of competition. Any future price proposal requirements will be communicated via Amendment to the RFP. See Section 4.14, ADDITIONAL ROUNDS for additional information.

ROUND 1 SOLICITATION PROCESS

PUBLIC NOTICE

The RFP and attachments are published in the State of Oregon’s electronic procurement system OregonBuys® at https://oregonbuys.gov/. Documents will not be mailed to prospective Proposers.

Modifications, if any, to this RFP will be made by written Amendment(s) published in OregonBuys®. Prospective Proposer is solely responsible for checking OregonBuys® to determine whether or not any Amendment(s) have been issued. Amendment(s) are incorporated into the RFP by this reference.

PRE-PROPOSAL CONFERENCE

DAS SPS will conduct a Pre-Proposal conference on the date/time listed in the Schedule. Prospective Proposers’ participation in this conference is highly encouraged but not mandatory.

The purpose of the Pre-Proposal conference is to:

Provide additional description of the Solution and Services sought under this RFP;

Explain the RFP process; and Answer any questions Proposers may have related to the scope of the Solution or Services, or about the solicitation process.

Potential proposers may participate in the Pre-Proposal conference by notifying the SPC via email concerning planned participation in the conference. Participants should email the SPC no later than the date and time listed in the Schedule and provide:

1. Email Subject Line: S-DASOBO-00012374 Pre-Proposal Conference Participation;

2. Company name; and

3. Name and contact Information for each company representative participating.

Registration is preferred but not required.

Microsoft Teams meeting Join: https://teams.microsoft.com/meet/290323101773951?p=Ur9xzQrsw3AekjKF6h Meeting ID: 290 323 101 773 951 Passcode: 3NM9vC2x

Dial in by phone +1 503-446-4951,,216915073# United States, Portland Find a local number Phone conference ID: 216 915 073# Oral statements made at the pre-Proposal teleconference are not binding upon DAS. Proposers must submit all questions in Writing, and DAS will thereafter respond in writing to all such Written questions.

QUESTIONS / REQUESTS FOR CLARIFICATIONS

Questions about the RFP must be submitted in writing to DAS SPS via OregonBuys®. DAS SPS will answer the questions as soon as possible. If Proposer uses generative artificial intelligence to develop its submitted questions, indicate this information on the submission. All questions must:

Document the question subject;

Refer to the specific area of the RFP being questioned (i.e. page, section and paragraph number); and Be received by the due date and time for Questions/Requests for Clarification identified in Section 1.2, SCHEDULE.

SOLICITATION PROTESTS

Protests to RFP A Prospective Proposer may submit a Written protest of anything contained in this RFP, including but not limited to, the RFP process, specifications (including the Requirements), Scope of Work, and the Sample Contract. This is prospective Proposer’s only opportunity to protest the provisions of the RFP. Note that a Proposer may also protest as provided below.

Protests to Amendment(s) Prospective Proposer may submit a Written protest of anything contained in an Amendment. Protests to an Amendment, if issued, must be submitted by the date/time specified in the respective Amendment, or they will not be considered. Protests of matters not added nor modified by the Amendment will not be considered.

Requirements for Solicitation Protests All protests must:

Be delivered to the SPC via email;

Reference the OregonBuys® bid number;

Identify prospective Proposer’s name and contact information;

Be sent by an authorized representative;

State the reason for the protest, including:

the grounds that demonstrate how the Procurement Process is contrary to law, Unnecessarily Restrictive, legally flawed, or improperly specifies a brand name; and evidence or documentation that supports the grounds on which the protest is based; and State the proposed changes to the RFP provisions or other relief sought.

Protests to the RFP must be received by the due date and time identified in the Schedule.

Protests to an Amendment must be received by the due date identified in the Amendment.

PROPOSAL DELIVERY

Proposer is solely responsible for ensuring its Proposal is received by the SPC in accordance with the RFP requirements before Opening. DAS SPS is not responsible for any delays in mail or by common carriers or by transmission errors or delays, or for any mis-delivery for any reason. A Proposal submitted by any means not authorized below will be rejected. The following delivery options are permitted for this RFP:

Delivery through OregonBuys® Proposal submission should be electronically through OregonBuys® at: OregonBuys.gov Detailed instructions on how to submit a Proposal can be found at OregonBuys Vendor Formal Solicitation Response.pdf

PROPOSAL MODIFICATION OR WITHDRAWAL

If a Proposer wishes to make one or more modifications to a submitted Proposal, the Proposer must submit such modification via OregonBuys® using the instructional document provided in Section 4.5, PROPOSAL DELIVERY. To be effective, the modified Proposal must be resubmitted prior to Opening.

If a Proposer wishes to withdraw a submitted Proposal, it must submit a Written notice signed by an authorized representative of its intent to withdraw to the SPC via email, prior to the Opening in accordance with OAR 125-247-0440. To be effective the notice must include the OregonBuys® bid number.

PROPOSAL DUE

A Proposal (including all required submittal items) must be received by the SPC on or before Opening. All Proposal modifications or withdrawals must also be received prior to Opening.

A Proposal received after Opening is considered LATE and will NOT be accepted for evaluation.

PUBLIC OPENING

There will be no public Opening of Proposals. Proposals received will not be available for inspection until after the evaluation process has been completed and the Notice of Intent to Award is issued pursuant to OAR 125-247-0630. However, DAS SPS will record and make available the identity of all Proposers after Opening.

PROPOSAL REJECTION

DAS SPS may reject a Proposal for any of the following…