S000000311 Q & A REVISED.pdf

Question Number

Question Subject Question Text Answer

1 2.4(C) HOSTING

2.4.C: Could the State clarify if a dedicated VPC hosted by the vendor within AWS GOV Cloud will count as a VPC?

Yes, if the "dedicated VPC" is dedicated to the State for the purpose of providing the services anticipated by this RFP.

2 2.4(F) HOSTING

2.4.F: Could the State clarify if the typically used method, of dedicated VPN or MPLS access to the hosted VPC, allows the direct network communications requested?

The State cannot speak to communications necessary between the VPC and other systems that are non-state systems. With this said, the state anticipates a site-to-site vpn for facilitation of communication between the Contractor's private cloud or VPC and network housing the state system of record.

2.6(C) mDL

SOLUTION AND APP

2.6 C Who will be the owner of the Apple/Google

accounts for hosting the apps? We recommend the State to be the owner of the app so the general public can trust the app in the app store.

This will be addressed with the successful Contractor during the Discussions Phase.

2.6(G) mDL

SOLUTION & APP

How do you define device retrieval mode and server retrieval mode?

Device retrieval - This works without outside connectivity (for both the mDL holder’s device and the mDL reader) at the time the transaction takes place, thus requiring the mDL data to reside on the mDL holder’s device and retrieve the information from the device.

Server retrieval - mDL data is retrieved in real time directly from the Issuing Authority. Changes in the Issuing Authority’s database regarding a specific person’s mDL are immediately available to mDL verifiers upon reading the associated mDL.

2.6(G) mDL

SOLUTION & APP

Please elaborate on the use case and need for server retrieval given that it potentially violates the privacy model of the application.

This works without outside connectivity (for both the mDL holder’s device and the mDL reader) at the time the transaction takes place, if there is no connectivity, the mDL verifier must be able to retreieve the mDL holder information directly from the SOR through the server retrieveal mode. Privacy model concerns can be mitigated by placing regulatory limitations on the Issuing Authority (DFA), and will be of value to the extent an mDL holder trusts the Issuing Authority’s adherence to the regulatory limitations.

2.6(J) mDL

SOLUTION AND APP

2.6 J Contracator shall be using the portrait and

signature provided by DFA SOR. Can the State confirm the compliancy?

The portrait image and the signature of the mDL holder must follow AAMVA standards. When registering, the citizen will take photo and that photo is matched with the current photo in SOR and if it matches the system will allow the citizen to register the mDL. Once mDL is registered by the holder, the contractor will use the portrait and the signature from SOR for the credentiling purpose.

2.6(U) mDL

SOLUTION AND APP

2.6.U Can the State clarify that verifier decides the information requested?

The mDL holder will have complete control over which data elements are shared with the mDL verifier.

2.6(X) mDL

SOLUTION & APP

Please confirm the user of the mDL solution can choose to use either facial recognition OR PIN entry to gain access to the application.

The mDL must support both facial recognition and PIN. Facial recognition must be required upon intial registration, but after that access may be gained by either facial recognition or PIN. See revised RFP.

2.6(Z) mDL

SOLUTION AND APP

2.6.Z Could the State clarify what is kept as an audit log for the mDL holder if that holder were to have disabled log storage.

There would not be any information in the audit log if the user has disabled it.

10 2.7(A) MDL FEE

Please confirm the DFA SOR will maintain a record of which applicants have previously paid for the mDL to allow for re-registration (e.g. replacement of device) and the mDL application can check to see if the payment has already been collected before attempting to collect.

Yes

11 2.7(B) MDL FEE

2.7.B If a contractor payment solution is used, how is the amount collected adjusted between State and the contractor?

This will be an interface between mDL solution and SOR, and for reconciliation purpose. The money collected will be deposited in a DFA owned bank account.

REVISED The Revisions To This Document Are In Red

12 2.7(C) MDL FEE

2.7.C Is it possible to get more details on the State's payment solution?

DFA currently utilizes a product called Corporate Checkpoint Platform by Tyler Technologies.

2.9(D) WEB

SERVICES

REQUIREMENTS

2.9.D Can VPN be used between the SOR and vendor solution?

Yes

2.10(A) PUBLIC AND

PRIVATE KEY

INFRASTRUCTURE

(PKI)

2.10.A. Who will host the Issuing Authority Certificate Authority (IACA)? Should the vendor operate, or should the vendor provide a solution for DFA to operate the IACA?

The Contractor shall be responsible for hosting the IACA. See revised RFP.

2.10(D) PUBLIC AND

PRIVATE KEY

INFRASTRUCTURE

(PKI)

Please confirm that DFA will be obtaining the IACA certificates.

The Contrator shall work with DFA to obtain the IACA certificates. See Section 2.10(D) of the RFP.

2.10(D) PUBLIC AND

PRIVATE KEY

INFRASTRUCTURE

(PKI)

Please confirm DFA will provide the secure enclave to store certificates (e.g. Hardware Security Module) as required under the proposed rule for TSA acceptance.

The Contractor shall be responsible for providing the secure enclave to store certificates. See Section 2.10(E) in the revised RFP.

2.10(E) & 2.10(F)

PUBLIC AND

PRIVATE KEY

INFRASTRUCTURE

(PKI) and

2.12(A)(6) ONLINE

DASHBOARDS

Regarding requirements 2.10E, 2.10F and 2.12A(6), would the State please explain how the Contractor may report on device characteristics if they are not allowed to track the user's usage or location or cache and store any mDL registrant information.

Section 2.10(E) and 2.10(F) are in regards to any personally identifiable information about the mDL holder.

Section 2.12(A) is merely about the users device information at the time of registration and would not contain any personally identifiable information.

2.11(F)

REGULATORY

COMPLIANCE

It is our experience that the NIST interoperability testing does not result in a certificate. Please confirm that providing the results of the NIST interoperability testing would be sufficient to satisfy this requirement?

Confirmed. See revised RFP.

2.11(F)

REGULATORY

COMPLIANCE

2.11.F This statement requires a certification by United Laboratories (UL), which is currently the only organization who is certifying mDL. Does the State expect all vendors to include costing for UL to certify their proposed mDL solution?

DFA does not require a certification from United Labs. Per the answer to #18, providing results of NIST interoperability testing will be suffficient to satisfy this requirment. See revised RFP.

2.12(A)(6) ONLINE

DASHBOARDS

2.12.A.6 Geography not possible without location services enabled by the end-user. Can the State please elaborate more on this requirement?

The State is looking for the geopraphic location by the zip code of the mDL holder.

2.13(B) STAFFING

and 3.5(D)(1)(b)

EXPLANATION OF

THE SUB-SECTIONS

OF THE TECHNICAL

PROPOSAL

Please confirm that the Project Manager and Project Lead are two different roles.

Project Lead in Section 3.5.D. refers to key staff member(s) who will attend the required interview to address the State's questions. The project lead could be the project manager or other key staff member(s) identified by the Prospective Contractor to attend the interview.

22 2.15 TRAINING

Can you specify the desired level of training for DFA employees and managers on mDL administration and the mDL App?

Prospective Contractor should propose their standard training offering provided that it meets the minimum requirements set forth in Section 2.15 of the RFP.

The State looks forward to discussing the proposed plan with the successful Contractor during the Discussions Phase.

23 2.15 TRAINING

What are the expectations for the content and duration of the online manuals for DMV staff and business partners?

At a minimum, the following training materials are required for the life of the contract:

1. User Manual

2. Frequently Asked Questions (FAQ) list

3. Helpline phone numbers and how to submit an electronic request for help

4. Website URLs or location information for all other online and printed resources

See revised RFP.

2.16 MAINTENANCE

AND SUPPORT

Can you clarify the specific metrics that will be used to measure customer support response times and resolution rates?

The State will discuss response times and resolution rates more in depth with the successful Contractor during the Discussions Phase.

2.16 MAINTENANCE

AND SUPPORT

Will the Contractor be required to provide support for multiple languages besides English?

No

2.16 MAINTENANCE

AND SUPPORT

What is the process for the State to report maintenance and support issues to the Contractor?

Prospective Contractor should propose their standard offering provided that it meets the minimum requirements set forth in Section 2.16 of the RFP. The State looks forward to discussing the proposed plan with the successful Contractor during the Discussions Phase.

2.17 DATA

SECURITY

Does the State have any specific data security standards or certifications that the Contractor must comply with?

The Contractor shall meet or exceed applicable Federal and State privacy and security standards.

2.18 DISASTER

RECOVERY

Can you clarify the timeframe for the Contractor to recover systems and resume normal operations after a disaster event?

Prospective Contractor should propose their standard offering provided that it meets the minimum requirements set forth in Section 2.18 of the RFP. The State looks forward to discussing the proposed plan with the successful Contractor during the Discussions Phase. Four (4) hours to resume functioning in the event of a disaster has been common in many of the State's contracts.

2.18 DISASTER

RECOVERY

How often will the State expect the Contractor to test the disaster recovery plan?

The State anticipates testing the Disaster Recovery Plan annually post-Go- Live. However, per Section 2.18.C. of the RFP, "DFA will evaluate and test the Contractor DRP during testing by requesting that the Contractor completely failover all test/production systems to Disaster Recovery (DR) systems. DFA does not have to give advance notice for these requests."

2.19 NEW

TECHNOLOGY

Can you provide some examples of emerging technologies related to the mDL App and identity validation systems that the State is interested in?

mDL Solution as proof of identification for multiple purposes, including as a login to authenticate and validate authorization to conduct online services.

2.19 NEW

TECHNOLOGY

How will the pricing for new services or commodities added to the contract be negotiated?

The State will negotiate pricing for new commodites or services covered by the scope of this RFP with the successful Contractor if/when such new technologies become available.

3.5(D)(1)(b)

EXPLANATION OF

THE SUB-SECTIONS

OF THE TECHNICAL

PROPOSAL

Please define project lead required expertise and topics required for the interview. For example product, technical, project management.

Expertise in mDL solution and Project Management. Interview questions will be determined at a later stage and provided to Prospective Contractors at time of invitation.

3.5(D)(1)(c)

EXPLANATION OF

THE SUB-SECTIONS

OF THE TECHNICAL

PROPOSAL

Will interview questions be provided to prospective contractor prior to the interview?

Yes

34 General What is the estimated budget for this project? This information is not necessary to respond to the RFP.

35 General Will there be an opportunity for pre-proposal conferences to address any questions from potential Contractors?

No

Technical Specifications

Can you provide more details on the technical specifications for the mDL solution, including any specific requirements for hardware, software, and integrations with existing State systems?

The State is seeking a turnkey Contractor hosted solution. The State has provided relevant specificatons regarding hardware and software functionality in the RFP. Information for integrations with the State's existing systems can be found in Section 2.9 of the RFP for Web Service Requirements.

37 Schedule Will the State please allow for a Proposal Due Date Extension of four (4) weeks?

No

2nd Batch of Questions

Can the State allow a 2nd batch of questions? No

Technical Response Evaluation

Can the State confirm the vendor's technical response consists of only the S000000311 Technical Proposal Packet?

Can the State confirm only a total of 6 pages are intended for the technical evaluation of the RFP?

Information for Evaluation:

Experience (2 pages or less) Solution (2 pages or less) Risk (2 pages or less) In addition to the 6 pages, are the vendors allowed to provide additional documents for elaboration on the proposed technical solution?

See Section 1.6 of the RFP for Response Document information as well as the Submission Requirements Checklist list on the Technical Proposal Packet.

Prospective Contractors should not submit any additional documents in regards to the proposed solution other than those required in Section 1.6 of the

RFP.

Response Attachment File Size

Can the State confirm the maximum file size for the response attachments in ARBuy?

The ARBuy system allows for a maximum file size of 500mb. Prospective Contractors adhering to the State's submission guidelines should not encounter issues in relation to file size. Please allow adequate time prior to the bid opening to upload all files and to contact Supplier Support should any technical issues arise.

Official Bid Price Sheet

2.7 mDL Fee

Would the state kindly clarify how a proposed contract should present any and all potential processing fee(s) above and beyond the state statute $10 fee for the digital id (mDL)?

See the Instructions tab “Table 2” of the Official Bid Price Sheet.

See Section 2.7(G) of the RFP Revised 2.0 document.

42 2.7 mDL Fee In order to assure pricing submittal consistencies among responding contractors, can the state also provide an “estimated” annual volume.

See Section 2.7(G) of the RFP Revised 2.0 document.