Secure Educational Technology System RFI.docx

Office of Technology Services Request for Information related to Implementation of a Secure Educational Technology System for OJJ

RFI#3000026601

State of Louisiana Division of Administration / Office of Technology Services

Request for Information (RFI) related to the Implementation of a Secure Educational Technology System for Louisiana Office of Juvenile Justice

*** This is NOT a solicitation ***

RFI # 3000026601

This Request for Information is not a solicitation and is issued for informational and market-research purposes only. It is not an Invitation to Bid, a Request for Proposals or any other method of source selection available under La. R.S. 39:1593 – 1600.2. The State will not score, evaluate, rank, or make any award solely on the basis of responses. Responding or declining to respond will neither provide an advantage nor disadvantage to any party in any future formal solicitation and is not a condition of eligibility to compete. Responses may be subject to the Louisiana Public Records Law.

Overview

1.0 Purpose of the Request for Information

The State of Louisiana, Division of Administration/Office of Technology Services, (DOA/OTS) on behalf of The State of Louisiana, Office of Juvenile Justice (OJJ), collectively referred to throughout this document as “The State” is seeking to establish a comprehensive, secure educational technology system that supports instruction for youth ages 12 through 21 enrolled in OJJ K-12 and post-secondary educational programs.

The State is seeking information from vendors who are capable and willing to enter into a contract to provide and support an enhanced technology system capable of:

· Providing secure, reliable, and high-speed internet connectivity throughout all designated educational and administrative areas.

· Supporting instructional technology solutions that enhance teaching, learning, and student engagement in secure educational environments.

· Providing classroom management tools that enable educators to monitor, manage, and facilitate student learning activities in both traditional and technology-enhanced classrooms.

· Supplying and managing student devices, including Chromebooks, laptops, tablets, or other approved instructional devices, to support daily instructional and assessment needs.

· Providing secure, reliable, and state-approved assessment platforms that support online testing, progress monitoring, and student achievement reporting.

· Delivering comprehensive technical support services, including installation, configuration, maintenance, troubleshooting, and timely resolution of hardware, software, and network issues.

· Implementing learning management system (LMS) capabilities specifically designed to support secure juvenile correctional educational settings, including curriculum delivery, assignment management, progress monitoring, communication, and reporting while maintaining compliance with all applicable security, privacy, and educational requirements.

2.0 Objectives of the Request for Information

The State is seeking information to:

· Understand the level of interest and availability of qualified vendors capable of providing a comprehensive Commercial-Off-The-Shelf (COTS) or Software as a Service (SaaS) technology solution that supports educational services within secure juvenile correctional facilities.

· Assess vendors' experience in implementing and supporting integrated educational technology solutions, including secure internet connectivity, instructional technology, student devices, classroom management tools, assessment platforms, learning management systems, and ongoing technical support.

· Identify industry best practices for deploying secure, scalable, and sustainable educational technology solutions that improve instructional delivery, student engagement, data security, regulatory compliance, and operational efficiency across OJJ educational facilities.

The State is seeking information regarding:

· Vendor experience and demonstrated success in implementing and supporting comprehensive educational technology solutions within K-12 schools, alternative education programs, juvenile justice settings, correctional facilities, or similarly secure environments.

· Vendor experience and success in planning, deploying, configuring, and transitioning organizations to modern educational technology ecosystems while minimizing disruption to instructional operations.

· Vendor capability to meet or exceed the functional, technical, security, and service requirements outlined in the Scope of Services.

· Vendor ability to provide a turnkey or configurable solution that can be implemented efficiently and scaled to support multiple secure educational facilities throughout the State.

· Vendor approach to providing ongoing technical support, system maintenance, software updates, user training, and customer service following implementation.

· Vendor experience integrating learning management systems, classroom management software, student devices, assessment platforms, and secure wireless infrastructure into a unified technology environment.

· Vendor strategies for ensuring compliance with federal and state requirements, including Children’s Internet Protection Act (CIPA), Family Educational Rights and Privacy Act (FERPA) student data privacy standards, cybersecurity best practices, and accessibility requirements.

· Vendor recommendations for future-ready technologies that enhance instructional effectiveness, improve system reliability, support online learning and assessment, and accommodate future growth and expansion.

3.0 RFI Coordinator

RFI responses must be directed to the RFI coordinator:

Charmetra Wells, Office of Technology Services P.O. Box 94095 Baton Rouge, LA 70804-9095 Phone: 225-342-9186 Email: pmo@la.gov

All communications relating to this RFI must be directed to the RFI Coordinator named above. All communications between respondents and State staff members, other than the RFI Coordinator, concerning this RFI are strictly prohibited.

4.0 Schedule of Events

The State reserves the right to revise this Schedule of Events.

5.0 Response Preparation Cost

The State will not pay for the preparation of any information or response submitted in reference to this RFI, nor will it pay for any use of response information. The respondent assumes sole responsibility for any and all costs and incidental expenses associated with the preparation and reproduction of any materials submitted in response to this RFI. This includes preparations for approved discussions, demonstrations, or vendor marketing materials.

6.0 RFI Addenda/Cancellation

The State reserves the right to revise any part of this RFI by issuing an addendum to this RFI at any time. Issuance of this RFI, or subsequent addendum (if any), does not constitute a commitment by the State to issue an RFP or any other process resulting in award of a contract of any type or form. In addition, the State may cancel this informal process at any time, without penalty or prior notice.

7.0 Proprietary and/or Confidential Information

Pursuant to the Louisiana Public Records Act (La. R.S. 44:1 et. seq.), all public proceedings, records, contracts, and other public documents relating to this RFI shall be open to public inspection. Respondents should refer to the Louisiana Public Records Act for further clarification, including protections sought for proprietary and/or trade secret information. Respondents are reminded that any material within a response to this RFI identified as confidential or proprietary must be clearly marked. Any response marked as confidential or proprietary in its entirety may be rejected without further consideration or recourse.

8.0 Written Inquiry/State Response Process

Respondents may submit written inquiries to the RFI Coordinator via email according to the Schedule of Events herein. Inquiry emails should use the following subject line format: RFI # 3000026601- QUESTION - <Vendor Name>.

The State shall provide responses to all written inquiries, according to the Schedule of Events, in the form of an RFI addendum, posted to the LaPAC at https://wwwcfprd.doa.louisiana.gov/osp/lapac/pubMain.cfm.

9.0 Response Submission

All responses to this RFI must be received by the due date and time indicated on the Schedule of Events. Responses received after the due date and time will not be considered. It is the sole responsibility of each respondent to assure that its response is delivered at the specified location prior to the deadline. Responses which, for any reason, are not so delivered will not be considered.

Electronic Submissions Electronic submissions are the preferred format. Electronic submissions may be made using the Dropbox File Request system via the following link. Electronically submitted responses should be in Microsoft Word and/or PDF format.

https://www.dropbox.com/request/dgsxi4smclc1pfavg8lu

No submissions will be accepted via email.

Hard Copy Submissions Hard copy response submissions, which should include at least one (1) hard-copy and one (1) digital (flash drive) copy, may be submitted via the U.S. Mail, courier, or hand-delivered:

If courier mail or hand-delivered

Charmetra Wells Office of Technology Services Galvez Building 602 N. 5th St., 2nd Floor Office 225 Baton Rouge, LA 70802

If delivered by U.S. Mail

Charmetra Wells Office of Technology Services P.O. Box 94095 Baton Rouge, LA 70804-9095

10.0 Ownership of Responses

All materials submitted become the property of the State and will not be returned to the respondent. The State retains the right to use any and all ideas or adaptations of ideas contained in any response received through this RFI process.

11.0 Format of Response

All responses shall be submitted in hard-copy and digital format (PDF or Word is preferred), not to exceed 50 pages, in 10pt. font or larger according to the following outline:

Corporate Background and Experience Respondent shall provide a brief description of the company, including a brief history, corporate structure, and organization and the number of years in business.

Business Model for Contracting of Services Respondent shall describe its approach to a contract for its services should it be awarded a contract (via RFP or non-competitive contract), but without providing any cost information in its response.

If a Commercial- Off-the-Shelf or Software-as-a-Service solution is proposed, the respondent should indicate if proposed products are available through NASPO ValuePoint or similar cooperative purchasing agreements.

Approach and Methodology Respondent shall describe its proposed solution and approach for delivery of services, specifically identifying the use of specific delivery methodologies, or other methods to address evolving system needs.

Implementation Timeframe of Solution Respondent shall indicate the minimum time frame from contract execution for full implementation of its solution, inclusive of equipment acquisition, configuration, and testing.

Technical System Implementation Requirements Respondents should be aware of the following requirement for Contractors:

Contractor shall adhere to the State’s Information Security Policy (ISP) - https://ots.la.gov/policies-forms/information-security.

RFI Response Guidance and Questions Purpose The State is requesting information to better understand available solutions, services, implementation approaches, risks, costs, technical capabilities, security posture, accessibility, operational support, and alignment with State technology expectations.

These questions are intended to apply broadly across different response types, including SaaS, COTS, custom development, implementation services, managed services, State-hosted solutions, vendor-hosted solutions, and hybrid approaches.

Response Instructions Respondents should answer each question based on the proposed solution, service, or delivery model. Not every question will apply to every response.

If a question does not apply, state “Not applicable” and briefly explain why. Where possible, provide the closest relevant equivalent. For example, if the State would not receive source code for a SaaS solution, describe the vendor’s release management process, security testing practices, customer notification process, and available audit evidence instead.

Responses should distinguish between capabilities that are:

· Currently available

· Configurable

· Custom-developed

· Partner-provided

· Available through an optional module

· Planned for a future release If documentation, audit reports, architecture diagrams, screenshots, or other artifacts cannot be provided during the RFI stage, describe what can be made available later in the procurement process, under NDA, during security review, or during contract negotiation.

State Technology Detail and Security Disclosure Respondents should not assume that the State will disclose detailed internal technology implementation information during the RFI stage. This includes specific product names, vendor names, tenant details, network diagrams, IP ranges, firewall configurations, identity provider configuration, monitoring platform configuration, security tool configuration, vulnerability information, or other internal infrastructure details.

Respondents should answer based on supported standards, protocols, configuration options, security controls, and integration capabilities.

If additional State-specific technical details would be required later, identify:

1. The category of information needed.

2. Why the information is needed.

3. When it would be required.

4. Whether it is needed for procurement, contracting, implementation, or operational support.

The State may decline to answer questions that request sensitive internal implementation details or information not necessary to respond to the RFI. In those cases, the State may instead provide the applicable standard, requirement, protocol, or desired capability.

Questions

Solution Overview and Business Fit

1. Describe the proposed solution or service. Include whether it is SaaS, COTS, custom development, implementation services, managed services, State-hosted, vendor-hosted, or a hybrid approach.

2. Provide examples of comparable implementations, preferably in the public sector. Include scope, timeline, customer type, implementation approach, and measured results where available.

3. Identify the major capabilities of your solution or service. Clearly distinguish between capabilities that are available today, configurable, custom-developed, partner-provided, optional, or planned for a future release.

Implementation and Delivery

4. Describe your recommended implementation approach. Include major phases, milestones, decision points, dependencies, risks, estimated timeline, and what must be true before moving between phases.

5. Describe expected roles and responsibilities. Include what would be expected from the State, OTS, the customer agency, the vendor, subcontractors, and any third-party partners.

6. Describe your approach to project governance, status reporting, issue escalation, risk management, training, knowledge transfer, and operational readiness. Include examples of artifacts that would be provided.

Architecture, Integration, and Interoperability

7. Describe your reference architecture. Include major components, hosting boundaries, trust boundaries, data flows, integrations, administrative functions, and user access paths.

8. Describe how your solution integrates with external systems. Include supported APIs, webhooks, file exchanges, batch processes, eventing, authentication patterns, data formats, rate limits, error handling, retry logic, and available documentation.

9. Identify any infrastructure, network, hosting, middleware, agent, certificate, privileged access, or environment requirements. If this does not apply because the solution is fully vendor-hosted or self-contained, state that and describe any import, export, reporting, or data access options.

Identity, Security, Data, and Compliance

10. Describe your identity and access management capabilities. Include SSO, MFA, role-based access control, privileged access, user provisioning and deprovisioning, session management, audit logging, delegated administration, and periodic access review.

11. Describe what State data your solution would store, process, transmit, generate, or access. Identify whether the solution may involve PII, PHI, FTI, CJIS, PCI, education records, payroll records, tax data, credentials, source code, audit findings, or other regulated or sensitive data.

12. Describe how data is protected and governed. Include data ownership, data residency, encryption in transit and at rest, backup protection, retention, export, deletion, destruction, tenant segregation, and post-termination data handling.

13. Describe your security posture and available security evidence. Include certifications, attestations, SOC reports, FedRAMP/GovRAMP status, penetration testing, vulnerability management, dependency scanning, SBOM availability, remediation timelines, incident response, breach notification, customer coordination, and audit evidence.

Accessibility and User Experience

14. Describe the accessibility and user experience capabilities of your solution. Include WCAG conformance level, accessibility testing practices, known limitations, remediation process, mobile responsiveness, available Accessibility Conformance Reports, and any third-party accessibility audits.

15. If the solution includes custom-developed or highly configurable user interfaces, describe how it can align with the State’s design system, branding, reusable components, content standards, and accessibility expectations. If the solution is SaaS or proprietary COTS and cannot fully adopt State design system components, describe what configuration is available.

Operations, Support, and Reliability

16. Describe how the solution is operated and supported after go-live. Include service levels, uptime commitments, support tiers, response times, escalation paths, maintenance windows, release notifications, rollback processes, backup, restore, disaster recovery, RTO, RPO, and business continuity.

17. Describe what operational visibility is available. Include health checks, logs, metrics, traces, alerts, dashboards, audit trails, reports, APIs, exports, customer portals, and options for integrating with external monitoring or ticketing systems.

Source Code, Release Management, and Technical Artifacts

18. Describe your approach to source code, configuration, release management, and technical documentation. If the State would receive custom code, scripts, infrastructure as code, configuration as code, or other technical deliverables, describe source control, branching, code review, CI/CD, testing, security scanning, dependency scanning, documentation, and handoff. If the State would not receive source code, describe your product release process, customer testing options, security testing, release notes, update cadence, rollback process, and customer notification practices.

AI, Automation, and Decision Support

19. Identify any AI, machine learning, automated decisioning, generative AI, chatbot, summarization, recommendation, classification, transcription, notetaking, content-generation, or similar features included in the solution. For each feature, describe whether it is required, optional, enabled by default, configurable, available through an optional module, or can be disabled. Also describe input data, outputs, human review, use of State data for training or model improvement, opt-out controls, safeguards against hallucinations or misuse, and whether the output could influence consequential decisions such as eligibility, enrollment, employment, finances, legal or regulatory compliance, law enforcement, or welfare.

No cost and/or marketing information shall be included in this RFI response.

12.0 Optional Discussion

To solicit feedback and ask follow-up questions based upon vendor RFI responses, The State reserves the right at its sole discretion to conduct a structured discussion for respondents to this RFI only. An agenda, specific questions and other expected topics for discussion will be provided prior to the discussion.

The State is not under any obligation to conduct discussions with any respondent to this RFI.

Scope of Services

1.0 Executive Summary

The Office of Juvenile Justice (OJJ) seeks to identify qualified vendors capable of providing a comprehensive educational technology solution that supports teaching and learning across all OJJ secure care educational facilities.

The proposed solution should provide secure internet connectivity, instructional technology, classroom management tools, student devices, learning management capabilities, online assessment platforms, cybersecurity protections, technical support, and centralized administration designed specifically for secure juvenile correctional educational settings. The solution shall improve instructional delivery, increase operational efficiency, ensure regulatory compliance, and provide a secure, scalable technology infrastructure that supports current and future educational needs.

2.0 Problem Statement

The Office of Juvenile Justice currently operates educational programs across multiple secure care facilities with varying levels of technology infrastructure, instructional resources, internet connectivity, device availability, and technology support.

The absence of an integrated educational technology environment limits instructional consistency, reduces student engagement, impacts online assessment readiness, creates administrative inefficiencies, and increases the burden of maintaining multiple independent technology solutions across facilities.

3.0 Business Need

The State seeks a comprehensive educational technology solution that supports instructional delivery while meeting the unique security requirements of juvenile justice educational environments.

A. Secure Network Infrastructure

· Provide secure, high-speed wireless and wired internet connectivity throughout all instructional and administrative areas.

· Support segmented networks for students, instructional staff, administrators, guests, and technology administrators.

· Maintain enterprise-level cybersecurity protections while allowing instructional flexibility.

· Provide secure remote management and monitoring capabilities.

B. Instructional Technology

· Provide a flexible technology solution capable of supporting current and future educational programs and curriculum platforms, including programs procured through separate contracts, while allowing OJJ to add, modify, or expand instructional applications and services as educational needs change.

· Support interactive classroom instruction.

· Support digital curriculum resources.

· Support multimedia instructional delivery.

· Provide tools that increase student engagement.

C. Student Devices

· Provide secure, break-resistant instructional equipment, including ruggedized laptops and appropriate protective or secured mounting/bonding solutions designed to reduce intentional damage, tampering, and misuse within juvenile correctional facility environments.

· Supply and manage Chromebooks, laptops, tablets, or other approved instructional devices.

· Support centralized device management.

· Provide inventory management and asset tracking.

· Support rapid replacement and warranty services.

D. Classroom Management

· Provide classroom management software that allows educators to:

· Monitor student screens

· Restrict internet access

· Push instructional content

· Lock student devices when appropriate

· Support classroom engagement E. Learning Management System

· Provide a secure Learning Management System (LMS) supporting:

· Course management

· Assignment distribution

· Student submissions

· Teacher feedback

· Progress monitoring

· Student performance reporting

· Communication between teachers and students F. Assessment Platforms

· Support Louisiana-approved online assessments including LEAP Connect, LEAP 2025, ACT, TABE, HiSET, End-of-Course assessments, and future online testing requirements.

· Ensure sufficient bandwidth and device readiness for simultaneous testing.

· Support secure browser environments.

G. Security & Compliance

· Comply with FERPA.

· Comply with CIPA.

· Protect Personally Identifiable Information (PII).

· Support encryption of data in transit and at rest.

· Provide role-based access controls.

· Maintain audit logs.

· Ensure compatibility with OTS network connectivity and security requirements, including the ability for devices and instructional platforms to operate through OTS-approved internet, network, filtering, authentication, and security protocols without limiting access to approved educational resources.

H. Technical Support

· Provide implementation services.

· Provide installation and configuration.

· Provide ongoing maintenance.

· Provide software updates.

· Provide help desk services.

· Provide on-site support when necessary.

· Provide professional development and ongoing staff training.

4.0 Identified Issues

Current technology challenges include:

· Inconsistent internet connectivity across facilities.

· Limited availability of student instructional devices.

· Aging technology infrastructure.

· Limited centralized management of instructional technology.

· Insufficient classroom management tools.

· Inconsistent technology support across facilities.

· Limited reporting capabilities.

· Challenges supporting online instruction and statewide assessments.

· Difficulty maintaining cybersecurity and compliance requirements across multiple locations.

5.0 Identified Risks

Without modernization, OJJ may continue to experience:

· Interrupted instructional delivery.

· Reduced student engagement.

· Delays during statewide assessments.

· Increased cybersecurity vulnerabilities.

· Increased operational costs.

· Technology downtime affecting instruction.

· Inconsistent educational experiences among facilities.

· Increased administrative workload.

· Limited scalability for future educational technology initiatives.

· Difficulty meeting federal and state compliance requirements.

6.0 Desired Business Goals & Objectives

The State desires to procure a comprehensive educational technology solution that:

· Provides secure, reliable internet connectivity across all educational facilities.

· Standardizes instructional technology resources across all OJJ schools.

· Improves student engagement through modern digital learning tools.

· Supports online instruction and statewide assessments.

· Provides centralized management of student devices and technology assets.

· Enhances cybersecurity and student data privacy.

· Reduces technology downtime through proactive monitoring and technical support.

· Provides centralized dashboards and reporting for instructional and operational decision-making.

· Supports future expansion and emerging educational technology needs.

7.0 Scope of Request

Respondents should address the following:

· Describe your organization's experience implementing educational technology solutions in K–12 schools, alternative education programs, juvenile justice facilities, correctional education environments, or similarly secure educational settings.

· Describe comparable statewide or multi-site educational technology implementations.

· Describe your technology architecture and hosting model.

· Describe your cybersecurity framework.

· Describe your classroom management capabilities.

· Describe your Learning Management System capabilities.

· Describe student device management capabilities.

· Describe assessment platform integration.

· Describe reporting and analytics capabilities.

· Describe implementation methodology.

· Describe training and change management.

· Describe ongoing technical support services.

· Describe disaster recovery and business continuity capabilities.

· Describe system scalability.

· Describe software update procedures.

· Describe integration capabilities with State authentication systems, Single Sign-On (SSO), and future educational applications.

8.0 Technical System Implementation Requirements

Respondents should include detailed information regarding:

· Educational technology implementation timelines.

· Project governance methodology.

· Security architecture.

· Identity Access Management (IAM) and Single Sign-On (SSO) integration.

· API integration capabilities.

· Data migration strategy.

· Disaster recovery planning.

· System monitoring and performance metrics.

· Service Level Agreements (SLAs).

· User roles and permissions.

· Accessibility compliance (WCAG).

· CIPA and FERPA compliance.

· Device management capabilities.

· Software update and release management.

· Cybersecurity incident response procedures.

· Training plans for administrators, teachers, instructional staff, and technology personnel.

· Ongoing customer support and escalation procedures.

· Reporting dashboards and analytics.

· System scalability and future enhancements.

· Total cost of ownership, licensing models, hosting options, and implementation services.

8/14/2026