State of Oregon

Cover Page Department of Administration Services, State Procurement Services on behalf of Enterprise Information Services Is issuing this Request for Proposals (RFP) under OregonBuys Bid Number S-DASOBO-00017534 for Secure service edge solution Date of Issue: September 30, 2026 Opening Date and Time: October 30, 2026, 4:00 PM PST

Phone: (971) 375-5158 E-mail: jennifer.alton@das.comcast.net The State of Oregon promotes equal opportunity for all individuals without regard to age, color, disability, marital status, national origin, race, religion or creed, sex or gender, sexual orientation, or veteran status.

EIS_SECURE SERVICE EDGE SOLUTION S-DASOBO-00017534 Page 2 of 27 Table of Contents

LIST OF ATTACHMENTS

EXHIBIT A SECURE SERVICES EDGE (SSE) SCOPE OF WORK

EXHIBIT B SECURITY REQUIREMENTS RESPONSE

ATTACHMENT A SAMPLE PRICE AGREEMENT

ATTACHMENT B DISCLOSURE EXEMPTION AFFIDAVIT

ATTACHMENT C PROPOSER INFORMATION AND CERTIFICATION SHEET

ATTACHMENT D REFERENCE CHECK FORM

ATTACHMENT E PRICE PROPOSAL FORM

ATTACHMENT F CERTIFIED DISADVANTAGED BUSINESS / OUTREACH PLAN

ATTACHMENT G RESPONSIBILITY INQUIRY

ATTACHMENT H SECURE SERVICE EDGE SOLUTION REQUIREMENTS MATRIX

ATTACHMENT I ACCESSIBILITY COMPLIANCE REPORT (ARC)

ATTACHMENT J STATEWIDE SECURITY STANDARDS

GENERAL INFORMATION

INTRODUCTION

The State of Oregon, acting by and through the Department of Administrative Services, State Procurement Services (“DAS SPS”), is issuing this Request for Proposal for a Secure Service Edge (“SSE”) solution that meets the State’s technical, security, and operational requirements on behalf of Enterprise Information Services (“EIS” or the “Agency”), and all other State of Oregon Authorized Agencies, board, commission, or other government entity.

As the State continues to modernize its information technology infrastructure through cloud-first strategies and hybrid work models, the need for a robust, secure, and scalable secure access solution has become increasingly important. A Secure Service Edge solution addresses these challenges by providing a unified platform that enforces security policies, protects sensitive data, and enables secure, seamless access to cloud-based and on-premises applications and resources.

Additional details on the Scope of the goods or services or both are included in Exhibit A – Secure Services Edge (SSE) Scope of Work.

DAS SPS and EIS will evaluate Responsive Proposals through two (2) or more evaluation rounds (Round) but reserve the option to issue a Notice of Intent to Award after any Round depending upon scoring results from such Round. Round 1 Proposal submissions must include the following three components:

1. Administrative Proposal

2. Technical Proposal

3. Price Proposal DAS SPS anticipates the award of more than one (1) Price Agreement for the benefit of EIS and participating State agencies from this RFP. One (1) contractor will be selected as the primary contractor for EIS and EIS Governed Agencies. The initial term of the Price Agreement is negotiable, but DAS anticipates that the initial term of the Price Agreement will be five (5) years, with options to renew. The State anticipates a five (5) year agreement, but that term does not prevent the State from taking action if the Contractor materially fails.

Although the preference is for acquisition of the SSE solution and related Services through a single Contractor, The State may, however, elect to award to more than one Contractor if the State determines that doing so is in the best interests of the State

SCHEDULE

The table below represents a tentative schedule of events. All times are listed in Pacific Time. All dates listed are subject to change.

RFP Protest Period Ends

7 calendar days prior to RFP Opening

SINGLE POINT OF CONTACT (SPC)

The SPC for this RFP is identified on the Cover Page, along with the SPC’s contact information. Proposer shall direct all communications related to any provision of the RFP only to the SPC, whether the technical requirements of the RFP, contractual requirements, the RFP process, or any other provision.

AUTHORITY, OVERVIEW, AND SCOPE

AUTHORITY AND METHOD

DAS SPS is issuing this RFP pursuant to its authority under ORS 279A.050 and OAR 125-246-0170(2).

DAS SPS is using the Competitive Sealed Proposal method, pursuant to ORS 279B.060 and OAR 125-247-0260. DAS SPS may use a combination of the methods for Competitive Sealed Proposals, including optional procedures: a) Competitive Range; b) Discussions and Revised Proposals; c) Revised Rounds of Negotiations; d) Negotiations; e) Best and Final Offers; and f) Multistep Sealed Proposals.

DEFINITION OF TERMS

For the purposes of this RFP, capitalized words will refer to the following definitions. Terminology specific to the OregonBuys® System may be found at: OregonBuys®.

General Definitions Capitalized terms not specifically defined in this document are defined in OAR 125-246-0110 Proposer: is an individual, organization, or firm that submits a formal response to a Request for Proposal (RFP). The Proposer is responsible for delivering all required documentation and information in accordance with the RFP instructions, with the intent of being considered for Price Agreement award.

Round: means a specific stage within the RFP process where proposals or vendor responses are reviewed, evaluated, and shortlisted based on predefined criteria. Each round may involve progressively more detailed assessments, clarifications, or negotiations, with vendors being narrowed down or advanced to subsequent rounds until a final selection is made.

Project Specific Definitions Secure Service Edge (SSE): is a cloud-delivered security framework that focuses on protecting access to web, cloud, and private applications, irrespective of user location or device. SSE consolidates multiple security services into a unified, scalable solution designed to support modern hybrid work environments and digital transformation initiatives.

OVERVIEW AND PURPOSE

Agency Overview and Background The State of Oregon provides a broad range of public services that support the health, safety, education, and well-being of Oregonians. From enrolling in healthcare programs, managing the criminal justice system, to tracking students’ progress in school, Oregonians depend on software systems to deliver these services.

Enterprise Information Services provides enterprise technology leadership, governance, and shared services that enable agencies to modernize service delivery while maintaining consistent security, operational, and technology standards. The enterprise includes approximately 80 executive branch agencies, boards, and commissions, representing a statewide workforce of 40,000+ employees, as well as contractors and authorized third parties requiring secure access to state systems and applications. These agencies will be required to work directly with EIS to ensure adherence to enterprise baseline configurations, use of a shared and centrally administered tenant architecture, and compliance with security, operational, and integration standards for the SSE solution.

Project Overview and Background The State is seeking a qualified Contractor to provide a comprehensive Secure Service Edge (SSE) solution and associated implementation, integration, testing, training, support, maintenance, and transition services. The solution will support the State’s security modernization objectives by providing secure and consistent access to State applications, data, and resources across cloud, on-premises, remote, and hybrid environments while supporting Zero Trust principles, identity- and context-aware access, threat prevention, data protection, centralized policy administration, monitoring, logging, reporting, scalability, and resilience. The complete Scope of Work, including Contractor and State responsibilities, required services, deliverables, milestones, performance expectations, and acceptance criteria, is provided in Exhibit A – Secure Services Edge (SSE) Scope of Work.

Additional Requirements – WCAG Compliance The Solution must meet standards for digital accessibility in conformance with Title II of the ADA. The current compliance standard is Web Content Accessibility Guidelines (“WCAG”) 2.1 (“Level AA”).

The successful Proposer will ensure its Solution, including all documentation, and Deliverables each meet all applicable standards for digital accessibility on or before April 24, 2027, or at the time the Solution is submitted to Agency for testing, whichever date is sooner.

PROCUREMENT REQUIREMENTS

MINIMUM SUBMISSION REQUIREMENTS

ROUND 1 Proposal Submissions To be considered for evaluation, Proposal must contain each of the following elements (further detailed in Proposal Requirements section below):

Administrative Proposal

1. Executive Summary

2. Proposer’s Organizational Profile

3. Experience and Capabilities

4. Key Persons, Organizational Chart, Subcontractors

5. Security Requirements Response

6. Disclosure Exemption Affidavit (Attachment B)

7. Proposer Information and Certification Sheet (Attachment C)

8. Reference Check Form (Attachment D)

9. Certified Disadvantage Business/ Outreach Plan (Attachment F)

10. Responsibility Inquiry (Attachment G)

11. Digital Accessibility Narrative (Attachment I)

12. Statewide Security Standards (Attachment J) Technical Proposal Statement of Work, Proposer shall describe how it will deliver the Services described in Exhibit A.

· Solution Overview

· Implementation Plan

· Support Documentation

· Training Plan

· Monitoring and Reporting Plan

· Support and Maintenance

· Trial of Proof of Concept (PoC)

· Compliance and Security Documentation

· Digital Accessibility and WCAG compliance

· Cost and Licensing Details Documentation Secure Services Edge (SSE) Solution Requirements Matrix (Attachment H) Proposer shall address and describe how the proposed Solution meets the Solution Requirements set forth in Attachment H, Solution Requirements. Please use the Comments section of Attachment H to provide information on the time of availability of the requirement if feature does not currently exist in Proposer’s Solution or to provide any other relevant details regarding the requirement.

Price Proposal (Attachment E) Proposal Page Limits Proposal is limited to 60 pages. Any pages exceeding this limit will not be provided to the evaluation committee or considered in the evaluation. The following items do not count toward the page limit:

1. Disclosure Exemption Affidavit (Attachment B)

2. Proposer Information and Certification Sheet (Attachment C)

3. Reference Check Form (Attachment D) – Reference Check Forms to be included in the Proposal.

4. Key Persons, Organizational Chart, Subcontractors (not to exceed two (2) pages per each)

5. Price Proposal (Attachment E)

6. Certified Disadvantage Business/ Outreach Plan (Attachment F)

7. Responsibility Inquiry (Attachment G)

8. Accessibility Compliance Report (ARC) (Attachment I)

9. Statewide Security Standards (Attachment J)

Proposal Format and Quantity Proposal should follow the format and reference the sections listed in the Round 1 Proposal Requirements section. Responses to each section and subsection should be labeled to indicate the item being addressed.

OregonBuys Electronic Response. Proposer should submit its Proposal electronically through OregonBuys.

The Price Proposal (Attachment E) must be submitted as a separate /standalone electronic response file. Attached files cannot be encrypted or otherwise require third-party encryption software.

Proposer shall submit one (1) copy of its Proposal and all required submission procedure outlined in this RFP, Proposal Delivery: Acceptable electronic formats include the following: Adobe Acrobat (pdf), Microsoft Word (.doc or .docx) or Microsoft Excel (.xls or .xlsx).

If Proposer believes any of its Proposal is exempt from disclosure under Oregon Public Records Law (ORS 192.311 through 192.478), Proposer shall complete Attachment B, detailing the exempt provisions and reason for the exemption, and Proposer shall submit a fully redacted version of its Proposal, clearly identified as the redacted version.

Authorized Representative The Proposer Information and Certification Sheet (Attachment C) must bear the Proposer’s authorized representative’s Signature. Failure of the authorized representative to sign the Proposal may subject the Proposal to rejection by DAS SPS.

ROUND 1 PROPOSAL REQUIREMENTS

Proposal must address each of the items listed in this section and all other requirements set forth in this RFP. Proposer shall describe the System to be provided or the Services to be performed or both. A Proposal that merely offers to provide the System or services as stated in this RFP may be considered non-Responsive to this RFP and will not be considered further.

Proposal should not include extensive artwork, unusual printing or other materials not essential to the utility and clarity of the Proposal. Do not include marketing or advertising material in the Proposal, unless requested. Proposal should be straightforward and address the requests of the RFP. Proposal containing unsolicited marketing or advertising material may receive a lower evaluation score if required information is difficult to locate.

Administrative Proposal Executive Summary (Mandatory) Proposer shall briefly describe how the proposed solution addresses the high-level requirements listed in this RFP. These requirements form the basis for a comprehensive yet succinct Executive Summary that summarizes the proposed solution, its distinctive features, and how it will fulfill the State’s requirements. In addition, summarize:

1. The significant factors of Proposer’s design, implementation, and technical approach.

2. Where comparable software projects and implementation services have been provided by the Proposer.

3. The project management methodology Proposer will use to reduce risk and maximize the potential success of the integrated solution implementation, deployment, and operation.

4. Uniquely compelling features/functionalities offered in the proposed Integrated Solution.

5. If Proposer is planning to propose a subcontracting relationship to meet all Requirements, please describe the unique value of each relationship to the Project’s success.

Proposer’s Organization Profile (Mandatory) Proposer must provide a profile of its organization. This is Proposer’s opportunity to give an overview of its organization, describe the structure of its business, and discuss how the organization can effectively deliver the Services described in this RFP. The Profile must include at a minimum:

1. Ownership. If incorporated or formed as another entity, the state in which the organization is incorporated or formed and the date of the incorporation or formation;

2. Location of the organization’s offices (headquarters and branches);

3. Location of the office from which employees will be assigned to work on the Project for the DAS SPS;

4. Number of employees located in the Pacific Northwest, nationally, and internationally;

5. Description of the established business relationships with proposed subcontractors (e.g., data conversion contractor); and

6. Organization’s client base.

Experience and Capabilities (Mandatory) Proposer must include a brief description of Proposer’s history, experience, and services provided. The description must include the Proposer’s number of years of experience providing similar services to those required by this RFP Key Persons, Organizational Chart, and Subcontractors (Mandatory) Key Persons. Specify key persons, including subcontractor key personnel if applicable, to be assigned to perform and manage the Services; for each individual include a current resume (not to exceed two (2) pages each) that demonstrates qualifications and experience relevant to the Services proposed.

At minimum, Proposer must provide the following Key Persons:

1. Vendor Project Manager will be the primary contact for implementation schedule, tracking milestones, coordinating vendor and state resources, managing risks and dependencies, and providing regular status reporting to ensure successful delivery.

· Experience Requirements: The Project Manager shall have demonstrated experience managing enterprise security or network implementations of comparable scope, including multi-tenant or multi-agency environments. Experience supporting government or regulated environments is preferred.

2. Vendor Technical Team responsible for design, configuration, integration, and testing of the SSE solution. This includes implementing policy frameworks, integrating with identity and networking components, validating connectivity, and ensuring the solution operates as designed within the State’s environment.

· Experience Requirements: Technical staff shall have hands-on experience implementing the proposed SSE platform in enterprise environments. Experience integrating with cloud platforms, identity providers, and secure network architecture is required. Government or regulated industry experience is preferred.

3. Vendor Security Specialist will ensure the SSE implementation aligns with State security standards and applicable regulatory requirements. This role includes validating security configurations, supporting compliance assessments, and assisting with documentation related to Criminal Justice Information Services (CJIS), Centers for Medicare and Medicaid Services (CMS), Health Insurance Portability and Accountability Act (HIPAA), Internal Revenue Service (IRS) 1075, or similar frameworks as applicable.

· Experience Requirements: The Security Specialist shall have experience supporting compliance-driven security implementations and familiarity with regulated data environments. Prior experience supporting public sector or highly regulated customers is preferred.

4. Vendor Training Team will develop and deliver training to State personnel to support operational readiness. Training must address platform administration, policy management, troubleshooting, and ongoing operations.

· Experience Requirements: Trainers must have direct experience with the proposed SSE platform and prior experience delivering technical training to enterprise or government customers.

5. Vendor Support Team will provide technical support during implementation to address issues, troubleshoot problems, and support stabilization of the environment as agencies are onboarded.

· Experience Requirements: Support personnel must be qualified to support the proposed SSE platform and have access to escalation paths as needed to resolve critical issues.

Organizational Chart. Provide an organizational chart identifying the staff who will provide the Services required by this RFP, illustrating the lines of authority as appropriate.

Subcontractors. If Proposer intends to work with subcontractor(s), Proposer shall include a statement detailing any subcontracting firms or individual subcontractors that may be engaged as part of the Proposal to this RFP, with those entities and the Services they will provide clearly identified.

Security Compliance (Mandatory, Not Scored) The Contractor and proposed solution must comply with all applicable State information security, privacy, cybersecurity, data protection, and related compliance requirements identified in this RFP. Detailed security requirements, including applicable security controls, technical safeguards, security documentation, certifications and attestations, incident management requirements, data protection requirements, and other security obligations applicable to the solution and services, are provided in Exhibit B – Security Requirements Response. Proposers are responsible for reviewing Exhibit B in its entirety and demonstrating compliance with all applicable requirements as instructed in the RFP.

Underlying Agreements (Mandatory, Not Scored) Proposer will submit any additional documents required for this project (e.g., End User License Agreement (EULA), Maintenance Agreement, etc.)

Value Added Services (Not Mandatory, Not Scored) If Proposer is proposing any value-added services, Proposer shall include a statement describing these services as well as the corresponding prices and subcontractors and/or resellers available to provide said services. Proposer may submit services including solution engineering, installation, configuration, training, and maintenance/support. Optional SSE modules, including AI-assisted security capabilities, shall be listed separately and shall include their purpose, current availability, dependencies, data processed, human oversight, security and privacy controls, license and professional services costs, and any effect on existing SSE functions. Roadmap items shall be identified as future capabilities and shall not be represented as presently available. Proposer should include in their proposal a description of how available configurations, workflows, and templates will streamline Agency’s existing business processes.

Disclosure Exemption Certification (Mandatory, Not Scored) Proposer shall complete and submit the Attachment B, Disclosure Exemption Certification as part of the Proposal. Submission is required even if Proposer is not identifying confidential or proprietary information and data for nondisclosure. If Proposer is identifying items for nondisclosure as confidential or proprietary, in addition to the original Proposal and copies, Proposer must submit a redacted electronic copy of the complete, original Proposal submission.

Proposer Information and Certification Sheet (Mandatory Not Scored) Proposer shall complete and submit the Proposer Information and Certification Sheet (Attachment C).

Failure to demonstrate compliance with Oregon Tax Laws and sign the Proposer Information and Certification Sheet (Attachment C) may result in a finding of non-Responsibility.

References (Mandatory, Scored) Proposer must provide a minimum of three (3) customer references for comparable SSE or ZTNA deployments. At least two (2) references must be government or public sector customers, and at least one (1) must represent a deployment of similar size and complexity (generally 10,000+ users or multi-agency scope). (Attachment D), Reference Check Form.

Proposer shall send the Reference Check Form (Attachment D) to its references. Reference forms must be completed and included in the Proposal when submitted.

Certified Disadvantaged Business/Outreach Plan (Mandatory, Not Scored) Proposer shall complete and submit a Certified Disadvantaged Business Outreach Plan (Attachment F).

Responsibility Inquiry (Mandatory, Not Scored) Proposer shall complete and submit the Responsibility Inquiry form (Attachment G).

Digital Accessibility Narrative (Mandatory, Not Scored)

1. Proposer must demonstrate its proposed Solution meets all applicable digital accessibility requirements in all material respects. Complete and return Attachment I, Accessibility Compliance Report, including the embedded narrative discussing the proposed Solution’s conformance with WCAG 2.1 (Level AA), and applicable attachments. Proposer’s response to this section must be based on the latest version of the WCAG Voluntary Product Accessibility Template (VPAT®) that evaluates conformance with WCAG 2.1 (Level AA) success criteria.

1. The ACR submitted as part of Attachment I should be no more than 12 months old at the time of submission, accurately reflect the Solution’s current state of accessibility, be specific to the product or service and the version(s) proposed for use, be completed by qualified personnel knowledgeable in digital accessibility and the proposed Solution, and be provided in an accessible format.

1. If Proposer is proposing a SaaS Solution, the ACR must cover core application functionality, authentication and onboarding flows, help documentation, and any third-party components or integrations with which users will interact. If mobile or responsive access is common, include those experiences. Define that scope explicitly and document what is excluded.

1. If the ACR indicates deficiencies, Proposer must include a proposed mitigation plan.

Statewide Security Standards (Mandatory, Pass/Fail) The Proposer will submit the completed Statewide Security Standards Spreadsheet (Attachment J).

Solution Security is extremely important to the State. Yet, the State recognizes that security is a joint obligation between the State and the successful Proposer and that the security requirements may be satisfied using more than one approach. In order to assist the State in its evaluation of the Solution, Proposer shall address the security requirements set forth in Attachment J, Statewide Security Standards Spreadsheet for the proposed Solution. Proposer shall complete the spreadsheet and insert comments on Attachment J.

The Statewide Security Standards will be evaluated during Round 1. It will be reviewed as Pass/Fail by a Business Security Adviser (“BSA”). If the Proposer solution does not meet the State’s security requirements, DAS SPS may reject the Proposal.

Technical Proposal Technical Proposal (Mandatory, Scored) Price Proposal (Mandatory, Scored) Proposer shall submit a separate Price Proposal (Attachment E) in Round 1. Initial pricing will be scored in Round 1. Finalists may submit a revised best and final price proposal in Round 2 after the demonstrations, using the same form and written deadline established by DAS SPS for all finalists. Do not add columns or otherwise change the form.

· Proposer must provide a detailed breakdown of all costs, including implementation, licensing, maintenance, and support. Pricing must distinguish between one-time and recurring charges.

· For professional services, Proposer must itemize costs by role classification, including estimated hours, hourly rates, and total cost by phase.

· Scalability options, ensuring that the state can expand the SSE solution cost-effectively as agency needs evolve.

· Flexible licensing models, such as per-user, per-device, or consumption-based pricing, allowing agencies to choose the most cost-effective approach.

· Clear cost implications for future upgrades and additional features, ensuring predictable financial planning in support of limitations imposed by state budget.

ROUND 1 SOLICITATION PROCESS

PUBLIC NOTICE

The RFP and attachments are published in the State of Oregon’s electronic procurement system OregonBuys at The RFP and attachments are published in the State of Oregon’s electronic procurement system OregonBuys at https://oregonbuys.gov/. Documents will not be mailed to prospective Proposers.

Modifications, if any, to this RFP will be made by written Amendment(s) published in OregonBuys. Prospective Proposer is solely responsible for checking OregonBuys to determine whether or not any Amendment(s) have been issued. Amendment(s) are incorporated into the RFP by this reference.

OREGONBUYS

All Proposers must be registered in OregonBuys to do business with the State. Registration is free. To create a vendor account, click the blue “Register” button in the top right corner of the OregonBuys website: https://oregonbuys.gov/bso. For registration assistance, see vendor registration guidance.

PROPOSERS ARE SOLELY RESPONSIBLE FOR ENSURING THEIR VENDOR INFORMATION IS CURRENT AND CORRECT IN OREGONBUYS. DAS SPS WILL ACCEPT NO RESPONSIBILITY FOR MISSING OR INCORRECT VENDOR INFORMATION OR ALTERNATIVE ACCESSIBILITY TO AMENDMENT(S), ATTACHMENTS AND EXHIBIT OregonBuys Assistance. Parties needing assistance with OregonBuys may contact the OregonBuys Helpdesk by telephone at (855) 800-5046 or by email at support.oregonbuys@oregon.gov.

PRE-PROPOSAL CONFERENCE

A pre-proposal conference will be held at the date and time listed in the Schedule. Prospective Proposers’ participation in this conference is VOLUNTARY. Prospective Proposers may attend via conference call.

The purpose of the pre-Proposal conference is to:

· Provide additional description of the project;

· Explain the RFP process; and

· Answer any questions Proposers may have related to the project or the process.

· Prospective Proposers must notify the SPC via email concerning planned participation in the conference. Email notifications must be received no later than the date and time listed in the Schedule and provide:

1. Email subject line: S-DASOBO-0017534 Pre-Proposal Conference Participation

2. Company Name; and

3. Name and Contact Information for each company representative participating The SPC will reply via email with conference details (telephone number and access code) and conference agenda material (if any).

Statements made at the pre-Proposal conference are not binding upon DAS SPS. Proposers may be asked to submit questions in Writing.

QUESTIONS / REQUESTS FOR CLARIFICATIONS

All inquiries, whether relating to the RFP process, administration, deadline or method of award, or to the intent or technical aspects of the RFP must:

Be delivered to the SPC electronically via email Reference the RFP number Identify Proposer’s name and contact information Refer to the specific area of the RFP being questioned (i.e. page, section and paragraph number); and Be received by the due date and time for Questions/Requests for Clarification identified in the Schedule

SOLICITATION PROTESTS

Protests to RFP Prospective Proposer may submit a written protest of anything contained in this RFP, including but not limited to, the RFP process, Specifications, Scope of Work, and the proposed Price Agreement. This is prospective Proposer’s only opportunity to protest the provisions of the RFP, except for protests of Addenda as provided below.

Protests to Addenda Prospective Proposer may submit a written protest of anything contained in the respective Addendum. Protests to Addenda, if issued, must be submitted by the date/time specified in the respective Addendum, or they will not be considered. Protests of matters not added or modified by the respective Addendum will not be considered.

Requirements for Protests All protests must:

Be delivered to the SPC via email;

Reference the OregonBuys bid number;

Identify prospective Proposer’s name and contact information;

Be sent by an authorized representative;

State the reason for the protest, including:

the grounds that demonstrate how the Procurement Process is contrary to law, Unnecessarily Restrictive, legally flawed, or improperly specifies a brand name; and evidence or documentation that supports the grounds on which the protest is based; and State the proposed changes to the RFP provisions or other relief sought.

Protests to the RFP must be received by the due date and time identified in the Schedule.

Protests to an Amendment must be received by the due date identified in the Amendment.

PROPOSAL DELIVERY

OregonBuys® Electronic Submission The Proposal must be submitted electronically through OregonBuys®. Detailed instructions on how to submit a Proposal can be found at: OregonBuys®.

Proposer is solely responsible for ensuring its Proposal is received by the SPC in accordance with the RFP requirements before Opening (Proposal Due) Date and time outlined in Section 1.2. DAS SPS is not responsible for any delays in transmission errors, or for any mis-delivery for any reason. Proposer is responsible for making sure all documents are uploaded in OregonBuys® prior to the Opening (Proposal Due) Date and Time.

A Proposal submitted by any means not authorized below will be rejected.

PROPOSAL MODIFICATION OR WITHDRAWAL

If a Proposer wishes to make modifications to a submitted Proposal, the Proposer must submit its modification electronically through OregonBuys®.

If a Proposer wishes to withdraw a submitted Proposal, it must submit a Written notice signed by an authorized representative of its intent to withdraw to the SPC via email, prior to the Opening in accordance with OAR 125-247-0440. To be effective the notice must include the OregonBuys bid number.

PROPOSAL DUE

A Proposal (including all required submittal items) must be received by the SPC on or before Opening. All Proposal modifications or withdrawals must also be received prior to Opening.

A Proposal received after Opening is considered LATE and will NOT be accepted for evaluation. A late Proposal will be returned to the Proposer or destroyed.

PUBLIC OPENING

There will be no public Opening of Proposals. Proposals received will not be available for inspection until after the evaluation process has been completed and the Notice of Intent to Award is issued pursuant to OAR 125-247-0630. However, DAS SPS will record and make available the identity of all Proposers after Opening.

PROPOSAL REJECTION

DAS SPS may reject a Proposal for any of the following reasons:

Proposer fails to substantially comply with all prescribed RFP procedures and requirements, including but not limited to the requirement that Proposer’s authorized representative sign the Proposal.

Proposer has liquidated and delinquent debt owed to the State or any department or agency of the State.

Proposer fails to meet the responsibility requirements of ORS 279B.110.

Proposer makes any contact regarding this RFP with State representatives such as State employees or officials other than the SPC or persons authorized by the SPC, or inappropriate contact with the SPC.

Proposer attempts to influence a member of the Evaluation Committee.

Proposal is conditioned on DAS SPS’s acceptance of any other terms and conditions or rights to negotiate any alternative terms and conditions that are not reasonably related to those expressly authorized for negotiation in the RFP or Amendment(s).

ROUND 1 EVALUATION PROCESS

Responsiveness and Responsibility Determination Responsiveness determination The SPC will conduct an initial Responsiveness check of each Proposal received prior to Opening/Closing to determine if Proposer has submitted all required documents and information in compliance with the Minimum Submission Requirements section.

DAS SPS reserves the right to determine is a Proposal is Responsive to all RFP requirements including meeting or exceeding the State’s security requirements and all other System and Services requirements as set forth in the Minimum Submission Requirement and all requirements in subsequent Rounds submittals and in any and all other requests for information from DAS SPS. At any time prior to award, DAS SPS may reject a Proposal found not to be Responsive.

If the Proposal or information contained is unclear, the SPC may request clarification from Proposer. However, clarifications may not be used to rehabilitate a non-Responsive Proposal. If the SPC finds the Proposal non-Responsive at any time during the evaluation process, the Proposal may be rejected. DAS SPS may waive mistakes in accordance with OAR 125-247-0470.

Responsibility Determination DAS SPS will determine if an apparent successful Proposer is Responsible prior to award and execution of the Price Agreement. Selected Proposer(s) shall submit a signed Responsibility Inquiry form (Attachment G) with Proposal and will be required to resubmit prior to Price Agreement execution.

At any time prior to award, DAS SPS may reject a Proposer found to be not Responsible.

Evaluation Criteria Each Proposal meeting all Responsiveness requirements will be independently evaluated by members of the Evaluation Committee. Evaluation Committee members may change, and DAS SPS may have additional or fewer evaluators for optional rounds of competition. Evaluators will assign a score for each evaluation criterion listed below in this Section 4.11.2 up to the maximum points available as specified in Section 4.12 (Point and Score Calculation).

SPC may request further clarification to assist the Evaluation Committee in gaining additional understanding of a Proposal. A response to a clarification request may only clarify or explain portions of the already submitted Proposal and may not contain new information not included in the original Proposal.

The Proposals will be scored as follows for Round 1.

Technical and Functional Requirements (400 Points) Evaluates how well the proposed SSE solution meets the State’s technical and operational requirements, including integration with existing identity, endpoint, network, and cloud environments; application compatibility; centralized policy management; and support for phased deployment across agencies. Consider the flexibility to acquire and implement SSE components based on available funding and business priorities.

Security and Compliance Features (250 Points) Evaluates the solution’s ability to enforce Zero Trust principles, provide identity- and context-based access, protect sensitive information, and detect and prevent threats. Includes assessment of least-privilege controls, continuous session evaluation, encryption, logging, auditability, and support for applicable State security policies and regulatory requirements.

Performance, Scalability, and Resilience (200 Points) Evaluates the solution’s ability to deliver reliable, responsive service at enterprise scale. Considers latency, throughput, concurrent-user capacity, geographic coverage, high availability, failover, disaster recovery, and service-level commitments, including the ability to support agency growth while maintaining consistent performance and security.

Vendor Reputation, Support Quality, and Ease of Use (50 Points) Evaluates demonstrated experience supporting comparable enterprise and public-sector environments, supported by customer references and delivery history. Considers technical support availability, response and escalation processes, implementation assistance, documentation, and training, along with the ease of administration and the end-user experience.

Price Proposal (100 Points) Evaluates the full cost of acquiring, implementing, operating, and sustaining the proposed solution over the specified evaluation period. Includes licensing, professional services, migration, training, support, infrastructure dependencies, and ongoing administrative effort. Considers pricing transparency, renewal terms, and the cost of adding users, agencies, or SSE capabilities.

This Price Proposal is meant to provide an understanding of services required to meet the mandatory requirements and additional costs associated with added benefit features that are either included in a package or services or available at an additional rate.

Price Proposal will be evaluated based on the total 5-year cost for Software, Maintenance, Hosting, and Implementation services.

price being scored

PREFERENCES

Reciprocal Preference For evaluation purposes per OAR 125-246-0310, Agency shall add a percent increase to each out-of-state Proposer's Proposal price that is equal to the percent preference, if any, given to a Resident Offeror in the Proposer's state.

Recycled Materials In comparing Goods from two or more Proposers, if at least one Proposer offers Goods manufactured with Recycled Materials, and at least one Proposer does not, Agency will select the Proposer offering Goods manufactured from Recycled Materials if each of the conditions specified in ORS 279A.125 (2) exists following any adjustments made to the price of the Goods according to any applicable reciprocal preference.

Tiebreakers Oregon Supplies: If DAS SPS receives Proposals identical in price, fitness, availability and quality and chooses to award a Price Agreement, Agency shall award the Price Agreement in accordance with the procedures outlined in OAR 125-246-0300.

ROUND 1 POINT AND SCORE CALCULATIONS

Scores are the points assigned by each evaluator. The maximum points possible for each evaluation item are listed in the table below.

Total Score Round 1 (TELL ME)

Total Score Round 2 (SHOW ME) Demonstrations, interviews, and scenario validations

Best and Final Offer (Round 2): Due three business days after the final vendor demonstration.

Total Possible Points for all 2 Rounds

Each criteria listed above will be given a weighted score from 0 to 5 based on the points listed above to determine their overall value. The 0 to 5 scores represent the following:

0 = 0% Did not provide a response to the requirement.

1 = 20% Far below expectations, a poor response that minimally meets the requirements.

2 = 40% Below expectations, a fair response that meets the requirements in an adequate manner. Demonstrates an ability to comply with guidelines, parameters, and requirements with no additional information put forth by the proposer.

3 = 60% Meets expectations, a good response that meets all the requirements and has demonstrated in a clear and concise manner a thorough knowledge and understanding of the subject matter. An average or slightly above average performance with no apparent deficiencies noted.

4 = 80% Exceeds expectations, a very good response that provides useful information, while showing experience and knowledge within the category. Proposal is well thought out and addresses all requirements set forth. The proposer provides insight into their expertise, knowledge, and understanding of the subject matter 5 = 100% Far exceeds expectations, a superior response that is highly comprehensive, excellent reply that meets all requirements of the areas within that category. Considered to be an excellent standard, demonstrating the proposer's authoritative knowledge and understanding of the project.

ROUND 1 RANKING OF PROPOSERS

The SPC, in its sole discretion, may conduct an evaluation committee meeting at the end of Round 1 or at the end of any round, and the evaluators may review their scores. In each round, an evaluator may change a score up until the time the SPC has requested final scores for that round. If an evaluator elects to change any score, the evaluator must date and initial the change and include a reason for the change. The evaluator’s final score is the score the SPC will document.

The SPC will average the final scores for each Proposal in a given round of competition (calculated by totaling the points awarded by each Evaluation Committee member and dividing by the number of members). After preferences, if any, have been applied, the SPC will describe the rank order for each Proposer, with the highest score receiving the highest rank and successive rank order determined by the next highest score.

At the conclusion of Round 1, DAS, in its sole discretion, may determine an Apparent Successful Proposer with no additional rounds of competition. Or, in the alternative, DAS may choose to declare a competitive range as set forth below and conduct additional round(s) of competition, if in the best interest of the State. Additional rounds of competition may consist of, but will not be limited to:

Interviews Presentations/Demonstrations/Additional Submittal Items Discussions and submittal of revised Proposals Serial or simultaneous negotiations Best and Final Offers Competitive Range Determination DAS SPS will select a Competitive Range to indicate the Proposers that will be invited to participate in a subsequent round. The Competitive Range may include all, or at DAS’ sole discretion, some (based primarily on a natural break in the distribution of scores), of the Proposers from a previous round. DAS will post a notice in OregonBuys of its Competitive Range Determination and provide details about the process and schedule for the subsequent round.

Competitive Range Protest Proposers excluded from a round may submit a Written protest of Competitive Range. Protests must be sent by an authorized representative, be emailed to the SPC, and be received within 7 calendar days after issuance of the Notice of Competitive Range (unless a different dues date and time is specified in such notice, and must:

1. Reference the OregonBuys Bid number;

2. Identify Proposer’s name and contact information; and

3. State the reason for the protest.

DAS SPS will address all protests within a reasonable time and will issue a Written decision to the respective Proposer. Protests that do not include the required information may not be considered by DAS.

ROUND 2 DEMONSTRATIONS / ADDITIONAL ROUNDs DAS SPS will conduct a Round 2 evaluation consisting of demonstrations, price proposals, interviews, and security discussions.

If DAS SPS determines that additional rounds of competition are necessary beyond Round 2, a notice will be posted on OregonBuys notifying the Competitive Range of the process and schedule.

Demonstration Proposers progressing to Round 2 may be invited to provide demonstrations. Demonstrations may be conducted in person at a location determined by DAS SPS; however, DAS SPS may elect to conduct demonstrations via teleconference or video conference. Further details will be provided prior to scheduling demonstrations.

Interviews Proposers progressing to Round 2 may be invited to interviews. Interviews may be conducted in person at a location determined by DAS SPS; however, DAS SPS may elect to conduct interviews via teleconference or video conference. Further details will be provided prior to scheduling interviews.

Security Discussion At Proposer’s discretion, Proposer may request a meeting with SPC and CSS to discuss the Statewide Security Standards spreadsheet (Attachment J).

If Proposer requests a meeting, Proposer shall collaborate with the SPC to schedule this discussion for an approximate 30-minute period.

Sandbox DAS SPS may elect to evaluate the Proposer’s Solution via a Sandbox environment. The Proposer will provide a standard operational environment in which the execution, operation, and processes can be evaluated. The evaluation criteria will be based upon both objective and subjective tests with points awarded. The criteria and amount of points awarded will be provided to the selected Proposers when and if the Sandbox is requested.

Best and Final Offers in Round 2 DAS SPS may request revised best and final price proposals from finalists within Round 2. Unless a different uniform deadline is announced in writing to all finalists, BAFO submissions are due three Business Days after the last finalist demonstration. The State will score revised five-year total cost using the published Round 2 price criterion.

Simultaneous Negotiations DAS SPS may elect to enter into simultaneous negotiations with 2 or more Proposers in the Competitive Range. Further details will be provided when and if simultaneous negotiations are conducted.

SCORING AND RANKING OF PROPOSERS FOR SUBSEQUENT ROUNDS

If DAS conducts two or more rounds of competition, the SPC will determine the cumulative score for Proposers advancing through all rounds of competition by adding the scores from each completed round. The Proposer with the highest cumulative score will receive the highest final ranking.

AWARD AND NEGOTIATION

AWARD NOTIFICATION PROCESS

1.1.1 AWARD CONSIDERATION

DAS SPS, if it awards a Price Agreement, shall award a Price Agreement to the highest-ranking Responsible Proposer(s) based upon the scoring methodology and process described in Section 4. DAS SPS may award less than the full Scope defined in this RFP. DAS SPS, in its sole discretion, may make additional award(s) for up to 9 months following the close of this solicitation. DAS SPS may select the next ranked Responsive and Responsible Proposer, issue an Intent to Award notice, and begin a new award protest period. If agreement with that Proposer is not reached, DAS SPS may offer award to the next ranked Proposer and so on until agreement is reached or until DAS SPS terminates the process. DAS SPS may require reconfirmation of the qualifications and staffing of any Proposer.

1.1.2 INTENT TO AWARD NOTICE

DAS will notify all Proposers in Writing that DAS intends to award a Price Agreement to the selected Proposer(s) subject to successful…