S000000418 RFP Financial Software Final REVISED 6.09.25.pdf

STATE OF ARKANSAS

DEPARTMENT OF TRANSFORMATION AND SHARED SERVICES

OFFICE OF STATE PROCUREMENT

501 Woodlane St., Ste. 220

Little Rock, Arkansas 72201-1023

REQUEST FOR PROPOSAL

REVISED 6/09/2025

SOLICITATION DOCUMENT

SOLICITATION INFORMATION

Solicitation Number: S000000418 Solicitation Issued: May 23, 2025

Description: Financial Software

Department: Department of the Military

SUBMISSION DEADLINE AND DELIVERY OF RESPONSE DOCUMENTS

Proposal Opening Date: June 25, 2025 Proposal Opening Time: 1:00 PM, Central Time

Proposal submissions for this Request for Proposal must be submitted through ARBuy, the State’s eProcurement system. It can be accessed at arbuy.arkansas.gov. Proposals received after the submission deadline may be rejected as untimely.

LIVE PROPOSAL OPENING INFORMATION

Teams Meeting Link: Join the meeting now

Meeting ID: 272 862 791 098 1 Passcode: rr6EM6Nf Call in (audio only): 501.244.3310 or find a local number Phone Conference ID

TSS OFFICE OF STATE PROCUREMENT CONTACT INFORMATION

TSS OSP Procurement Specialist: Wendy Hickok Procurement Specialist’s

Direct Phone Number: 501-324-9314

Email Address: Wendy.hickok@arkansas.gov TSS OSP’s Main Number: 501-324-9316

TSS OSP Website: transform.ar.gov/procurement/ https://arbuy.arkansas.gov/ https://dialin.teams.microsoft.com/6b6513dc-a034-48d2-8d06-7e711c4ecc0b?id=719036839 https://www.transform.ar.gov/procurement/

Rev 12/2024

SECTION 1 – GENERAL INFORMATION AND INSTRUCTIONS

1.1 INTRODUCTION

This Request for Proposal (RFP) is issued by the TSS Office of State Procurement (TSS OSP) for the Department of the Military (“DOM” or “Department”) to obtain pricing and a contract for financial software that addresses operational inefficiencies and enhances compliance of security requirements.

Contract will be awarded to the Prospective Contractor determined to have submitted the proposal that is the most advantageous to the State. Direct all questions, comments, or concerns regarding this solicitation to the TSS OSP, not the Department.

1.2 TYPE OF CONTRACT

A. As a result of this RFP, TSS OSP intends to award a contract to a single Contractor.

B. The anticipated starting date for any resulting contract is September 1, 2025, except that the actual contract start date may be adjusted unilaterally by the State for up to three (3) calendar months. By submitting a signed proposal in response to the RFP, the Prospective Contractor represents and warrants that it will honor its proposal as being held open as irrevocable for this period.

C. The initial term of a resulting contract will be for two (2) years. Upon mutual agreement by the Contractor and Department, the contract may be renewed by TSS OSP for up to five (5) additional one-year terms or portions thereof, not to exceed a total aggregate contract term of seven (7) consecutive years.

1.3 DEFINITION OF TERMS

A. Unless otherwise defined herein, all terms defined in Arkansas Procurement Law have the same meaning herein.

B. “Prospective Contractor” means a responsible offeror who submits a proposal in response to this Solicitation.

C. The terms “Request for Proposal,” “RFP,” and “Solicitation” are used synonymously in this document.

D. “Requirement” means a term, condition, provision, deliverable, Specification, or a combination thereof, that is obligated under the Solicitation, resulting contract, or both.

E. “Responsive Proposal” means a proposal submitted in response to this Solicitation that conforms in all material respects to this RFP.

F. “Shall” and “must” mean the imperative and are used to identify Requirements.

G. “Specification” means any technical or purchase description or other description of the physical or functional characteristics, or of the nature, of a commodity or service. “Specification” may include a description of any Requirement for inspecting, testing, or preparing a commodity or service for delivery.

H. “State” means the State of Arkansas. When the term “State” is used herein to reference any obligation of the State under a contract that results from this Solicitation, that obligation is limited to the Department using such a contract.

1.4 SOLICITATION SCHEDULE

For informational purposes, TSS OSP is providing a Solicitation Schedule; however, dates listed and noted with an asterisk (*) are anticipated dates only and are subject to change at the discretion of the State. All times are listed in Central Time.

TABLE A: TENTATIVE SOLICITATION SCHEDULE

ACTIVITY DATE

RFP Release to Prospective Contractors May 23, 2025 Deadline for Prospective Contractor Questions June 2, 2025

Answers to Questions Posted to ARBuy* June 12, 2025 Proposal Due Date June 25, 2025 Initial Proposal Evaluation* June 27, 2025 Interviews* July 8-9, 2025 Final Proposal Evaluation* July 9, 2025 Discussions Kick Off Meeting* July 21, 2025 Finalize Discussions* July 30, 2025 Post Anticipation to Award* July 31, 2025 Award Contract* September 1, 2025

1.5 CLARIFICATION OF SOLICITATION

A. Submit questions requesting clarification of information contained in this Solicitation via the Solicitation posting in ARBuy by the date and time listed in Table A.

1. For each question submitted, the Prospective Contractor should reference the specific Solicitation item number to which the question refers, as applicable.

2. Prospective Contractors’ written questions will be consolidated and responded to by the State as deemed appropriate. The State’s consolidated written response is anticipated to be posted to the Solicitation posting in ARBuy by the close of business on the date provided in Table A. If Prospective Contractor questions are unclear or non-substantive in nature, the State may request clarification of a question(s) or decline to answer.

B. The Prospective Contractor should notify the TSS OSP Procurement Specialist of any Requirements that precludes the Prospective Contractor from submitting a Responsive Proposal.

C. Prospective Contractors may contact the TSS OSP Procurement Specialist with non-substantive questions at any time prior to the proposal opening.

D. An oral statement by TSS OSP will not be part of any contract resulting from this Solicitation and may not reasonably be relied on by any Prospective Contractor as an aid to interpretation unless it is reduced to writing and expressly adopted by TSS OSP.

E. Only an addendum written and authorized by the State will modify the Solicitation.

1.6 RESPONSE DOCUMENTS

A. All proposal responses must be submitted through ARBuy, the State’s eProcurement system. The system can be accessed at arbuy.arkansas.gov.

1. Prospective Contractors must be registered in ARBuy to submit proposals responses.

B. Technical Proposal Packet

1. Prospective Contractors shall utilize the Technical Proposal Packet to submit their responses.

2. The following items are proposal Submission Requirements and must be submitted as part of a Prospective Contractor’s proposal response.

a. Signed Proposal Signature Page; signature may be ink or digital.

b. Technical Proposal response to the Information for Evaluation section included in the Technical Proposal Packet, which must be in the English language.

c. Completed Official Solicitation Price Sheet attached to the Solicitation in ARBuy.

i. Pricing must be proposed in U.S. dollars and cents.

https://arbuy.arkansas.gov/

ii. Quantities stated are estimates only and are not guaranteed. Prospective Contractor must submit unit price on the estimated quantity and unit of measure specified.

• The State may order more or less than the estimated quantity on term contracts, and the Contractor shall sell to the Department quantities ordered at no more than the submitted price.

iii. If pricing documents do not allow for accurate pricing, Prospective Contractor should notify the OSP Procurement Specialist at least seventy-two (72) hours before the proposal opening time.

iv. Prices must be firm offers and adjustments may be negotiated at the time of contract renewal.

• A request for a price increase must include supporting documentation demonstrating that the increase in contract price is based on an increased cost to the Contractor and that the proposed pricing is still competitive in the marketplace. The State has the right to approve or deny any request for a price adjustment.

v. Discount from list pricing is not acceptable unless requested elsewhere in the Solicitation.

vi. State or local sales taxes should not be included in the price. Trade discounts should be deducted from the unit price and the net price should be shown in the pricing response.

d. Recommended Options Form

i. The Recommended Options form included in the Technical Proposal Packet allows Prospective Contractors to identify any recommended options or optional service ideas that may benefit the State that were not included in the Requirements and the proposed solution.

e. Copy of Prospective Contractor’s Equal Opportunity Policy

i. Pursuant to Arkansas Code Annotated § 19-11-104, OSP requires a Prospective Contractor bidding on a state contract to submit a copy of the Prospective Contractor’s Equal Opportunity (EO) Policy.

ii. Prospective Contractors not required by law to have an EO Policy must submit a written statement to that effect.

f. Proposed Subcontractors Form (see SRV-1, section 14)

3. The following items, which must be submitted prior to a contract award to the Prospective Contractor, may also be included with the Prospective Contractor’s proposal:

a. EO 98-04: Contract and Grant Disclosure Form (see SRV-1, section 11)

b. Voluntary Product Accessibility Template (VPAT), if applicable

4. Prospective Contractors should not include any other documents or ancillary information, such as a cover letter or promotional/marketing information.

C. Redacted copy of the Technical Proposal Packet

1. One (1) redacted (marked Redacted) copy of the Prospective Contractor’s proposal response (see Proprietary Information), if applicable.

D. Prospective Contractors should not alter language in Solicitation document(s) or Official Solicitation Price Sheet provided by the State.

E. Prospective Contractor’s proposals cannot be altered or amended after the proposal opening except as permitted by law or rule.

https://transform.ar.gov/procurement/forms-and-reporting/#:%7E:text=Services%20Contract%20(SRV-1)%20Fillable%20Form:%7E:text=Services%20Contract%20(SRV%2D1)%20Fillable%20Form https://transform.ar.gov/procurement/forms-and-reporting/#:%7E:text=Services%20Contract%20(SRV-1)%20Fillable%20Form:%7E:text=Services%20Contract%20(SRV%2D1)%20Fillable%20Form https://www.section508.gov/sell/vpat/

F. Prospective Contractors may submit multiple proposals.

SECTION 2 – REQUIREMENTS

2.1 BACKGROUND & CURRENT ENVIRONMENT

As the Department continues to expand its footprint, it seeks to streamline and unify processes and technology platforms. Overarching challenges are highlighted below:

• Cost allocations are calculated manually, with no dedicated tool, and there is no automated dissemination across domains or systems.

• All procurement-related transactions are processed in the Arkansas Administrative Statewide Information System (AASIS).

• No centralized Enterprise Resource Planning (ERP) that serves as a single source of truth for financial records

• Disparate ERP’s driving numerous ledgers and Chart of Accounts (COA) mappings for consolidated reporting; lack of secondary ledger setup to address statutory reporting

• Lack of capability in current systems to meet federal financial requirements, including multi-entity capabilities to accommodate Arkansas Department of Military’s international operations

• Vendor invoice entry is highly manual without Optical Character Recognition (OCR) processing or portal submission capabilities in place

• Limited automation of approval workflows for contract renewals, project billing, and Time and Expense (T&E), which are essential to reduce manual effort, streamline processes, and improve data accuracy

• Reporting capabilities in current systems are limited without the ability to dynamically leverage financial dimensions to produce cross-cutting insights within foundational reports (e.g., viewing Aged AR Report by Business Unit)

2.2 OBJECTIVES AND GOALS

The objective is to implement financial software that automates document workflows and utilizes analytics to streamline operations across the Procurement and Cooperative Agreement teams.

The goals of this implementation include:

• Reduction manual processing

• Improvement of accuracy and compliance

• Enhancement of data driven decision making through real time insights and reporting

2.3 PROSPECTIVE CONTRACTOR MINIMUM QUALIFICATIONS

A. The Prospective Contractor shall have implemented financial software similar to that specified in this RFP for at least three (3) clients similar in size, scope, and industry to the Department.

2.4 SYSTEM ARCHITECTURE AND TECHNOLOGY

A. The system must not include Java.

2.5 PROCUREMENT AND FINANCIAL PROCESSES

A. The system must enable electronic purchase requisition and position vacancy coding/signature routing.

B. The system must provide an electronic Standard Form 270–Request for Advance or Reimbursement (see Attachment A) capable of auto-populating 270 forms, maintaining running totals/calculations, and including Lines of Accounting, Funding Worksheets, and Advances Lines of Accounting information.

C. The system must automate construction-related processes, including purchase requisition coding/signature routing, contract signature routing, invoice payments, and change orders.

D. The system must include an Automated Cost Allocation System for annual Centralized Personnel Plan (CPP) calculations that tracks how salaries are allocated across multiple cooperative agreements, including support for 14 different groups that are part of the CPP.

a. Each group represents a separate funding source, and collectively, they share a percentage of salary expenses for 17 employees. The system must support tracking the duties these employees perform under each group in relation to payroll, procurement, and bill payment activities.

E. The system must include automated purchase requisition forms with workflow routing and approval processes integrated into the procurement system.

F. The system must enable the creation and submission of purchase orders directly into AASIS, the State of Arkansas’ SAP based ERP system.

G. The system must automate the generation and maintenance of Purchase Order (PO) logs, including real-time updates and audit trails.

2.6 DATA ENTRY & AUTOMATION

A. The system must eliminate multiple data entries for invoice payments and other transactions.

B. The system must replace the use of multiple manually updated spreadsheets with automated processes. The following functions must be automated:

1. Voucher registers for tracking vendor payments

2. Purchase Order logs

3. Advanced Lines of Accounting

4. 270 rosters and manual crosswalks

5. Construction project tracking

6. Advanced drawdown workbooks

C. The system must utilize AASIS data to reconcile payment entries and send alerts for discrepancies:

1. Email alerts if web based

2. Pop-Up alerts if application based

D. The system must support bi-directional communication with AASIS to ensure real-time data synchronization and enable updates to flow between both systems.

E. The system must support invoice data uploaded through integration with AASIS or entered manually by users.

F. The system must include Optical Character Recognition capabilities to detect and flag discrepancies between source documents and entered data.

2.7 DATA MIGRATION

The Prospective Contractor must describe the approach for creating comprehensive data migration and validation plans. This includes, but is not limited to, the following requirements:

A. Provision of a detailed data migration plan that outlines phases, data mapping logic, transformation rules, and migration tools to be used

1. The Department anticipates migration of a minimum of 2 years of historical data, including but not limited to, cost allocations, procurement records, cooperative agreement data, and financial transactions.

B. Description of the strategy for accessing and extracting legacy data from current systems, including any dependencies, required credentials, or third-party support.

C. Definition of data validation procedures, including reconciliation reports, test scenarios, and verification methods to ensure accuracy and completeness of migrated data

D. Identification and classification of all legacy data types (e.g., transactional, master, historical) and a plan for handling each category

E. Archival strategy for legacy data not migrated into the new system, including retention policies, security controls, and access methods for historical reference

F. Recommendations for ongoing management of legacy system access, including whether systems will remain read-only, be decommissioned, or integrated as reference sources.

G. Explanation of how the Prospective Contractor will engage with Department staff during migration, including communication of cutover plans, freeze periods, and rollback procedures if issues arise.

2.8 REQUIRED INTERFACES

A. The system must support real-time or near-real-time bi-directional integration with required external systems, including but not limited to AASIS and legacy financial systems, such as NAS, Sharepoint, S4/HANA, and ARIBA), to ensure data consistency and minimize manual reconciliation.

1. The solution must act as a conduit between the federal domain and AASIS, while maintaining

AASIS as the system of record.

2. The solution should interface with Power BI for visualization, analytics, and reporting.

B. The system must include built-in error handling and logging functionality for all interface transactions, including automated retry logic, failure alerts, and exception reporting.

C. The system must adhere to AASIS data standards and validation rules to ensure seamless interoperability and eliminate the need for manual formatting or data cleansing.

D. The system must provide update reconciliation and synchronization alerts to inform users of any mismatches or failed transactions between systems in a timely manner.

E. The system must maintain a complete audit trail and chain of custody for all transactions, recording user actions, timestamps, and system events.

F. The system must automatically alert designated users and their supervisors when transactions remain unprocessed beyond a defined time threshold. This functionality must work in conjunction with the system's automated retry logic to ensure timely resolution of issues.

2.9 HOSTING

A. Prospective Contractors shall propose a Contractor hosted solution. Contractors proposing a Software as a Service (SaaS) solution will be considered under the Contractor Hosted model.

B. All servers and data associated with the Arkansas instance of the Contractor Hosted Solution must reside in the continental United States.

C. The State prefers the proposed system to be hosted on a private cloud or a virtual private cloud. For the purposes of this RFP, a private cloud is either a single-tenant environment where the hardware, storage, and network are dedicated to the State; or a virtual private cloud, a multi-tenant environment with network isolation and private subnets.

D. The Contractor shall perform all work on the proposed system from within the continental United States of America. The system must not be accessed from outside of the U.S.

E. The Contractor shall be responsible for the acquisition and operation of all hardware, software, and network support related to the hosting services being provided.

F. The Contractor shall develop and implement the system and all dependent hosted hardware in such a manner that allows for direct network communications with the Contractor’s system and the exchange of data via approved industry standard protocols for interfacing with other systems as deemed necessary.

G. The Contractor shall provision all environments including, at minimum, the following:

1. Development

2. Testing

3. Production

H. The Contractor shall provision all the standard environments, such as development, testing, staging, and production.

I. The Contractor shall keep all hosting-related software up to date.

2.10 SYSTEM UPTIME AND PERFORMANCE

A. The Contractor shall provide a proposed System Uptime and Performance Plan during the

Discussions phase.

B. Department will not provide dedicated bandwidth for the proposed system and the system must not negatively impact or interfere with services from the Department’s other existing systems.

C. The Contractor shall provide a monthly System Usage and Performance Report which shall include, at minimum, data related to the requirements set forth in this section of the RFP. The System Usage and Performance Report must be provided to the Department’s designee on the first business day of the month following the previous reporting period in a Microsoft Excel format

2.11 SYSTEM ACCESS

A. The Contractor shall provide user access to the system through a secure, web-based portal.

B. The system must provide a user-friendly interface with automated workflows for common functions.

C. The system must stress consistency across all the different modules so that the business process is easy to learn and understand.

D. The system must be browser and operating system neutral for all user types.

E. The system must function accurately on common modern browsers such as Microsoft Edge, Mozilla Firefox, Google Chrome, and Safari.

F. The system must not require additional browser plug-ins, add-ons, or helper applications.

G. The system must allow users with multiple roles/accounts to switch between roles/accounts to view/update/create data under the same login ID.

H. The system must require a unique username and password to access the system.

I. The system must allow users to reset passwords by email.

J. The system must have a Responsive User Interface (RUI) and be accessible and function normally for all features from mobile devices such as tablets, smartphones, and chrome books. This must include, but is not limited to, iPhones, iPads, Android based phones and tablets.

2.12 USER ROLES

A. The system must authenticate and assign the appropriate level of access to users based on the appropriate user roles.

B. System Administrators shall be able to create custom user roles with security parameters that define access.

C. The system must be able to assign controls for multiple users via work group and/or roles.

D. The system must allow access levels to be custom defined.

2.13 REPORTING REQUIREMENTS

A. The system must produce various reports and logs using entered data and AASIS data, including at a minimum:

1. Cost Allocation Summaries

2. Budget vs. Actual Reports

3. Vendor Spend Analysis

4. Audit Trails

5. Graphical Reports and Dashboards

6. CPP Reports

B. The system must include a robust ad-hoc and pre-defined reporting functionality for Department’s use.

C. The system must allow the Department to define new reports in the system and edit as needed without assistance or ongoing support from the Contractor.

D. The system must be able to export report data to a variety of formats including, but not limited to the following:

1. .xls

2. .csv

3. .txt

4. .pdf

E. If the Contractor’s proposed solution requires the use of a third-party reporting tool such as Crystal Reports, the costs of any and all required licenses to operate the reporting tool with the System must be included in the licensing cost proposed in the Official Bid Price Sheet.

F. The system must have the ability to batch print reports, allow advanced filtering, and set customized printouts.

G. The system must provide a detailed report of all security violations or attempts to gain access to the system.

H. The system must meet all State and Federal reporting requirements.

2.14 AUDIT FUNCTIONALITY

A. The system must track all inquiries and data changes including, but not limited to, the following:

1. Date and time of inquiry and/or modification

2. Type of activity

3. Identification of the user

4. All fields inquired and/or modified

B. The system must provide a searchable log for every record viewed

C. Only Authorized users shall have the ability to login and view the audit details online.

2.15 IMPLEMENTATION AND TESTING

A. The Contractor shall provide a proposed Implementation and Testing Plan during the Discussions phase.

B. The Implementation & Testing Plan must include a final acceptance testing phase in which the State can confirm that the system adheres to all contractual requirements. In the event that the solution does not conform with Contract requirements, the State may:

1. Grant the Contractor an opportunity to repair and/or modify the system and restart the testing; or

2. Upon mutual agreement, perform additional acceptance tests until the system(s) have operated within the specifications as stated in the Contract for thirty (30) consecutive days; or

3. Accept minor deviations from the specifications; or

4. Terminate the contract in its entirety

C. The Contractor shall provide a plan by which all implementation and testing activities are complete, and the system Go-Live date is no later than date to be determined by Department in collaboration with the awarded vendor.

2.16 TRAINING

A. The Contractor shall provide a proposed Training Plan during the Discussions Phase.

B. The Contractor shall provide all training up to two (2) weeks in advance to the “Go-Live” of the proposed System such that all Users required to be trained have had a sufficient amount of exposure to capably use the system.

C. The Contractor shall provide training for approximately fifty (50) Department users.

D. The Contractor shall provide training that consists of “Train the Trainer” type sessions, so that users trained directly by the Contractor may go out and serve as trainers for other users

E. The Contractor shall develop and provide curriculum and training materials for the Train the Trainer Sessions, as well as the curriculum and materials that will then be used by State Trainers to train each specific user type.

Training materials must include, but not be limited to:

1. User manual

2. Frequently asked questions (FAQs)

3. Helpline phone numbers and how to submit an electronic request for help

4. Web-based tutorials or instructional videos that must be available for the life of the contract

5. Website URLs or location information for all other online and printed resources

F. All training and training materials, whether online or in person, must be accessible to persons with disabilities, such as blindness or deafness. A current Voluntary Product Accessibility Template (VPAT) demonstrating conformance must be provided upon request.

2.17 STAFFING

A. The Contractor shall provide a Staffing Plan during the Discussions phase.

B. The Contractor shall include in the Staffing Plan a Project Manager. The Project Manager shall, at a minimum:

1. Have three (3) years of project management experience working with the implementation of projects of similar size and scope to this RFP.

2. The Contractor Project Manager shall report to the State assigned Project Manager and manage the Contractor resources, produce project schedule/plan, status reports, attend meetings, and manage the software development life cycle.

3. Coordinate with the Department through a staff team to finalize a solution, implement technology components, and manage needed changes to project scope.

C. The Contractor shall include, in the Staffing Plan, individuals with sufficient technical expertise and experience to accomplish the Implementation Plan.

D. Department shall have the right to approve or reject proposed staff members prior to the finalization of the plan after Contract Award.

E. The Contractor shall include, in the Staffing Plan, a provision to address the vacancies of the Project Manager or other key personnel. In the event of the vacancy of a key person, the Contractor shall provide replacement candidates to Department for review within fifteen (15) calendar days of the Contractor learning of the vacancy. Department will have the right to approve or reject proposed replacements if they do not meet the minimum requirements set forth in the RFP.

F. The Contractor shall replace key personnel upon request by Department for justified reasons including, but not limited to, performance, behavior, and security.

G. Department shall have the right to refuse personnel based on results of criminal background checks.

H. The Contractor shall provide and maintain sufficient staffing resources to provide timely service for the life of any resulting contract.

I. The Contractor shall not propose resources who are currently engaged full time on other contracts with the State. A single resource shall not hold more than one full-time position with the State.

J. At commencement of any resulting contract and prior to the hiring of staff, the Contractor shall provide proof of the background checks for all personnel involved in any aspect of the process described in this RFP at the Contractor’s expense as a requirement of any resulting contract.

K. The Contractor shall provide information necessary to conduct Criminal Background Checks on all key personnel and subcontractors who perform or supervise work on any resulting contract for purposes of auditing.

2.18 MAINTENANCE AND SUPPORT

A. The Contractor shall provide a proposed Maintenance & Support Plan during the Discussions phase.

B. The Contractor shall provide ongoing maintenance of the Solution for any resulting the contract.

C. The Contractor shall provide ongoing user and technical support beginning at the time of soft launch and continuing for any resulting contract.

D. The Contractor shall provide Emergency Support twenty-four (24) hours a day, seven (7) days a week. Emergency Support shall include but not be limited to an event such as a complete system failure.

E. The Contractor shall provide technical support between Monday – Friday 8:00 a.m. – 4:30 p.m.

Central Time, excluding State holidays.

F. The Contractor shall provide English speaking telephone support staff.

G. The Contractor shall provide properly trained user and technical support staff in sufficient quantities to support Department.

H. The Department may, at its discretion, choose to cancel or reduce technical support at any time during the life of any resulting contract.

2.19 DATA SECURITY REQUIREMENTS

A. The Contractor shall provide a proposed Data Security Plan during the Discussions phase.

B. The Contractor shall provide the name and contact information for an employee who shall serve as the State’s primary security contact and be available to assist the State twenty-four (24) hours per day, seven (7) days per week as a contact in resolving obligations associated with a Security Breach.

The security contact must be able to give a detailed explanation of the breach and the impact of the breach. The security contact must also provide a detailed resolution so that the breach will not be repeated

C. The Contractor shall notify the State of a security breach as soon as practicable, but no later than four (4) hours after the event is identified and the Contractor becomes aware of it.

D. Any data located on servers must be physically and virtually secure from any unauthorized access using the strictest of accepted principles adhering to the International Information Systems Security Certification Consortium ((ISC)²) body of knowledge

E. All log files that may contain transactional data that could contain personally identifiable data or demographic data related to the transaction must be encrypted using Advanced Encryption Standard with a 256-bit key (AES-256).

F. All data being transmitted must be encrypted and all stored data must be encrypted at rest.

Encrypting must be done with AES-256.

G. The system must meet or exceed applicable Federal and State privacy and security standards, including but not limited to, the Family Educational Rights and Privacy Act (FERPA), the Children’s Online Privacy Protection Act (COPPA), the Health Insurance Portability and Accountability Act

(HIPAA).

H. The system must be configurable to lock out an operator after a State-assigned number of failed attempts to log in.

I. The Contractor shall ensure all the authorized Users have a unique user-id and password to access the Contractor’s solution.

J. The system must adhere to Active Directory Password Policies and Procedures.

K. The system must have the ability to establish “timeout” and terminate session” limits by User Role.

L. The system must use Multi-Factor Authentication.

M. Department must have the ability to administer access rights

N. In provision of the services anticipated by this RFP, the Contractor shall adhere to all applicable regulatory and statutory security requirements in the National Institute of Standards and Technology (NIST) SP 800-53 Rev 5. Framework (https://csrc.nist.gov/pubs/sp/800/53/a/r5/final), moderate baseline, or later revision (https://csrc.nist.gov/pubs/sp/800/53/b/upd1/final).

1. Date and time of discovery.

2. Scope of unauthorized access and/or disclosure of data

3. Initial mitigation actions taken.

4. Any long-term mitigation action taken; and,

5. Date of resolution of closure of incident.

O. The system must meet security requirements for both Department of Defense and state networks, in accordance with applicable policies found at https://www.dodcui.mil/Policy/Information-Security- Policies/.

P. The System must demonstrate compliance with the latest penetration tests and current cybersecurity settings.

Q. The system must be augmented by monitoring and cybersecurity tools.

R. The security controls employed within the Solution must meet or exceed the requirements specified within this RFP and any other applicable regulatory requirements.

S. The Contractor shall provide the following during the Discussions phase: Change Control Policy, Cloud Security Policy, and Server Farm Architecture (separate technical documents with diagrams).

T. The Contractor shall provide configuration information, evidentiary documentation, or other information as is required in the event the State requires such information as to satisfy regulatory audit requirements in relation to the solution.

2.20 DISASTER RECOVERY

A. The Contractor shall provide a proposed Disaster Recovery Plan (DRP) during the Discussions phase.

B. The Contractor shall include the following in the final DRP:

1. Plan Objectives

2. What situations and conditions are covered by DRP

3. Technical considerations

4. System fail over plans

5. Roles and responsibilities of Contractor staff

6. How and when to notify the Contract Monitor https://csrc.nist.gov/pubs/sp/800/53/a/r5/final https://csrc.nist.gov/pubs/sp/800/53/b/upd1/final https://www.dodcui.mil/Policy/Information-Security-Policies/ https://www.dodcui.mil/Policy/Information-Security-Policies/

7. Recover procedures

8. Procedures for deactivating the Disaster Recovery Plan

C. The solution must frequently and automatically back up data. All backup servers and backup data associated with the Arkansas instance of the Contractor-hosted solution must reside in the continental United States. The system must backup and completely restore key system data files.

Backup media should be common media readable by readily available hardware

D. The Contractor shall provide a complete Disaster Recovery solution equivalent to production setup.

E. Testing must include a complete fail-over of all test/production systems to Disaster Recovery (DR) systems.

F. Any changes made to the production environment must have a demonstrated way to be replicated in the Contractor’s DR environment and must have a way of testing to be verified.

G. The DR site must be back in operation within four (4) hours of down time.

H. Changes to the DRP shall require the review and approval of the Department.

I. The DRP must be tested annually.

2.21 DATA OWNERSHIP AND END OF CONTRACT TRANSITION

A. The State shall retain sole ownership, right, title, and interest to all data collected and stored by the Contractor under any resulting contract, excluding intellectual property and exclusions governed by applicable State and Federal laws.

B. Data use by the Contractor shall be limited to its sole use in the provision of the services anticipated by this RFP. Any other use of State data collected by the Contractor shall require the express written approval of the Department.

C. At the end of any resulting contract and after confirmed transfer of 100% of the State-owned data, deliverables, and products the Contractor has created, developed, produced, and managed while performing the services outlined in this RFP back to the State or their designee, the Contractor shall destroy all copies of the State-owned data the Contractor possesses.

D. The Contractor shall ensure all data received as part of any resulting contract is used solely for the purpose of any resulting contract and not shared, reused, or disseminated to any other party or entity without the express written consent of the Department representative or as otherwise required under applicable State and Federal laws.

E. Upon termination or expiration, should any subsequent contract for this or similar services be awarded to a provider other than the Contractor, the Contractor shall, to the greatest extent possible and reasonable, cooperate with the Department in initiating a smooth and orderly transition to the next Contractor.

2.22 PERFORMANCE STANDARDS

A. State law requires that qualifying contracts for services include Performance Standards for measuring the overall quality of services that a Contractor shall provide.

B. The State may be open to negotiations of Performance Standards prior to contract award, prior to the commencement of services, or at times throughout the contract duration.

C. Performance Standards shall not be amended unless they are agreed to in writing and signed by the parties.

D. Failure to meet the minimum Performance Standards as specified will result in the assessment of damages.

E. In the event a Performance Standard is not met, the Contractor will have the opportunity to defend or respond to the insufficiency. The State has the right to waive damages if it determines there were extenuating factors beyond the control of the Contractor that hindered the performance of services. In these instances, the State has final determination of the performance acceptability.

F. Should any compensation be owed to the Department due to the assessment of damages, Contractor shall follow the direction of the Department regarding the required compensation process.

SECTION 3 – SELECTION

3.1 SELECTION PROCESS

A. TSS OSP will review each Technical Proposal Packet to verify Submission Requirements have been met. Technical Proposal Packets that do not meet Submission Requirements will be rejected and will not be evaluated.

1. The State may conduct cost checks based on the cost submitted by each Prospective Contractor on the completed pricing response.

a. Prospective Contractors submitting Responsive Proposals with a proposed cost that falls twenty-five percent (25%) or more from the average submitted cost may be asked to justify their submitted cost.

b. Should TSS OSP request clarification and/or additional information regarding cost, Prospective Contractors shall provide clarification and/or additional information as specified by the request.

B. A Department-appointed Evaluation Committee will evaluate and score Responsive Proposals.

Evaluation will be based on Prospective Contractor’s response to the Information for Evaluation section included in the Technical Proposal Packet and the pricing submitted by the Prospective Contractor.

1. Cost information will be provided to the members of the Evaluation Committee (Evaluators) to allow them to determine which proposal(s) is the most advantageous to the State.

2. Evaluators will individually review and evaluate proposals and complete an Individual Score Worksheet for each proposal. Individual scoring for each Evaluation Criteria will be based on the scoring description in Table B: Scoring Table.

TABLE B: SCORING TABLE

SCORE DESCRIPTION

10 The response provides metrics clearly establishing that the Prospective Contractor is reliable and capable of fully performing the required services.

The response provides metrics suggesting that the Prospective Contractor’s level of performance may be acceptable, but it does not clearly establish that the Prospective Contractor is reliable and capable of fully performing the required services.

0 The response provides metrics clearly establishing that the Prospective Contractor is unreliable and incapable of fully performing the required services.

3. After initial individual evaluations are complete, the Evaluators will meet to discuss their individual scores. At the initial consensus meeting, each Evaluator will be afforded an opportunity to discuss his or her score for each evaluation criteria.

4. After Evaluators have had an opportunity to discuss their individual scores with the committee, the Evaluators will be given the opportunity to change their initial individual scores, if they feel that is appropriate.

5. The final individual scores of the Evaluators will be recorded on the Consensus Scoresheets and averaged to determine the group or consensus score and rank for each proposal.

6. Other agencies, consultants, and experts may also examine documents at the discretion of the Department.

C. Prospective Contractors submitting Responsive Proposals will be contacted by TSS OSP to schedule an interview.

1. Prospective Contractors shall attend the interview as scheduled by TSS OSP.

2. Evaluators will complete an Individual Score Worksheet for each interview. Evaluation will be based on Prospective Contractor’s responses to questions presented during the interview.

Individual scoring for each interview will be based on the Scoring Descriptions in 3.1.B.2, Table B.

3. During a final consensus meeting, after all interviews are complete, Evaluators will have the opportunity to discuss the interviews and change their individual interview scores on the Consensus Scoresheet, if they feel that is appropriate.

a. The final individual scores of the Evaluators will be recorded on the Consensus Scoresheets and averaged to determine the group or consensus score and rank for each proposal.

4. Should the State receive only one (1) Responsive Proposal, the State may forgo the interview portion of the evaluation if the proposal has received the Maximum Weighted Score Possible for the Experience, Solution, and Risk subsections.

a. In this scenario, the proposal would automatically receive the maximum weighted score possible for the interview subsection.

D. Should the State request clarification and/or additional information Prospective Contractors’ responses, Prospective Contractors shall provide clarification and/or additional information as specified by the State.

E. TSS OSP will submit responses and pricing received from the interviewed Perspective Contractors, along with the Evaluation Committee’s recommendation to the Department for review and approval to move into Discussions.

3.2 TECHNICAL PROPOSAL SCORE

A. The Information for Evaluation section has been divided into subsections.

1. Each subsection has been assigned a maximum point value of ten (10) points. The total point value for each subsection is reflected in the table below as the Maximum Raw Points Possible.

2. The Department has assigned Weighted Percentages to each subsection according to its significance.

INFORMATION FOR EVALUATION

SUBSECTIONS

MAXIMUM

RAW

POINTS

POSSIBLE

SUBSECTION’S

WEIGHTED

PERCENTAGE

* MAXIMUM

WEIGHTED

SCORE

POSSIBLE

Experience 10 20% 140 Solution 10 30% 210 Risk 10 20% 140 Interview 10 30% 210

Total Technical Score 40 100% 700 *Subsection’s Percentage Weight x Total Technical Maximum Weighted Score = Maximum Weighted Score Possible for the subsection.

B. The proposal’s weighted score for each subsection will be determined using the following formula:

(A/B)*C =D

A = Actual Raw Points received for subsection in evaluation B = Maximum Raw Points possible for subsection C = Maximum Weighted Score possible for subsection

D = Weighted Score received for subsection

C. The proposal’s weighted scores for subsections will be added to determine the Total Technical Score for the proposal.

3.3 COST SCORE

A. When scores are applied to pricing, the maximum amount of cost points will be given to the proposal with the lowest Total 7 Year Cost as shown in Table Four (4) on the completed Official Solicitation Price Sheet. (See Grand Total Score for maximum points possible for cost score.)

B. The amount of cost points given to the remaining proposals will be allocated by using the following formula:

(A/B)*C =D

A = Lowest estimated cost B = Second (third, fourth, etc.) lowest estimated cost C = Maximum Points for lowest estimated cost D = Total price points received

3.4 GRAND TOTAL SCORE

The Technical Score and Cost Score will be added together to determine the Grand Total Score for the proposal. The State may move forward to Discussions with the Prospective Contractor determined reasonably susceptible of being selected for award.

MAXIMUM

POINTS

POSSIBLE

Technical Proposal 700

Cost 300

Maximum Possible Grand Total Score 1,000

3.5 EXPLANATION OF THE SUBSECTIONS OF THE TECHNICAL PROPOSAL

A. Experience

1. The Experience subsection included in the Technical Proposal Packet allows Prospective Contractors to differentiate themselves based on their experience, technical capability, and understanding of the State’s specific needs.

2. Prospective Contractors should identify expertise in the form of a claim and provide relevant experience to support each claim.

3. Prospective Contractors should use verifiable metrics (number of accounts, size of accounts, years of experience, customer satisfaction ratings) to support each claim.

B. Solution

1. The Solution subsection included in the Technical Proposal Packet allows Prospective Contractors to differentiate themselves based on their proposed solution and/or approach to solve the State’s specific needs.

2. Prospective Contractors should provide a high-level overview of the Prospective Contractor’s proposed solution and/or approach to services using the Requirements outlined in the RFP.

3. Proposed solutions should be non-technical and include the Prospective Contractor’s recommendations for meeting the objectives and Requirements of the RFP.

4. Additional service options and recommendations above and beyond those included in proposed solution should be included in the Recommended Options Form.

C. Risk

1. The Risk subsection included in the Technical Proposal Packet allows Prospective Contractors to identify and prioritize major risks that they reasonably foresee could potentially prevent or impair the Prospective Contractor’s delivery of the solution as offered in the proposal or to otherwise fail to meet the State’s desired outcome, specifications, and performance standards, and how they will mitigate, manage, and/or minimize each risk listed.

a. Prospective Contractors should include sources, causes, or actions that are both within and beyond the control of the Prospective Contractors that they reasonably foresee may cause cost increases, delays, amendments, or dissatisfaction to the State.

b. Risks should be described in simple, clear, and non-technical terms.

c. Prospective Contractor should explain how the Prospective Contractor will mitigate, manage, and/or minimize each risk listed.

i. The Documented Performance cell should include details such as how many times any identified risk was previously mitigated and the impact on the Prospective Contractor’s performance in terms of time, cost, and client satisfaction.

D. Interview

1. The Interview will allow Prospective Contractors to further demonstrate their experience in providing the services outlined in the RFP.

a. Each Prospective Contractor meeting the Submission Requirements will be contacted by TSS OSP to schedule an interview. Prospective Contractors shall attend the interview as scheduled by TSS OSP.

b. Prospective Contractors shall identify one (1) Project Lead at the time of interview confirmation who shall attend the interview as part of the evaluation process.

c. The Evaluation Committee will interview the Prospective Contractor’s identified Project Lead using a pre-determined set of interview questions. Follow up questions may be asked based on responses given by the Project Lead.

3.6 DISCUSSIONS

A. The State will move forward into Discussions with the responsible Prospective Contractor(s) whose proposal(s) have been determined to be reasonably susceptible to being selected for award.

B. Discussions may be conducted with the highest-ranking Prospective Contractor based on the Grand Total Score for each proposal or with multiple Prospective Contractors reasonably susceptible of being awarded a contract.

C. Should the State choose to engage in Discussions with the highest-ranking Prospective Contractor, the Prospective Contractor invited to participate in Discussions shall provide all documents required during Discussions.

1. Should the Department determine, through the Discussions process, that the Prospective Contractor’s solution, approach, timelines, deliverables, expectations of the State, or a combination thereof make the Prospective Contractor no longer reasonably susceptible of being awarded a contract, the Department may abandon Discussions with that Prospective Contractor through a written justification to TSS OSP, and may proceed to additional rounds of Discussions with the next highest-ranking Prospective Contractor.

D. Should the State choose to engage in Discussions with multiple Prospective Contractors contemporaneously, each Prospective Contractor invited to participate in Discussions shall provide all documents required during Discussions.

1. Should a Prospective Contractor not provide the required documents within timeframes requested by TSS OSP or choose not to engage in the Discussions process, the Prospective

Contractor’s proposal will be considered withdrawn and will not be subject to further consideration in the Solicitation process.

E. If Discussions necessitate material revisions…