SharePoint RFI Questions and Answers.pdf

# Questions Company Response 1 May a respondent respond to only a subset of the items in Section 4.b (for example, staff communications, adoption, and training) and indicate that the remaining items are outside its scope?

P3 Innovations medgina canal

No, a prospective vendor will be responsible for all required aspects of the SharePoint migration.

2 Does DOR anticipate that a future RFQ or RFR resulting from this RFI will be limited to vendors holding a Commonwealth statewide contract, or will it be open to all registered vendors?

P3 Innovations medgina canal

To be determined.

3 Will the business and technical analysis document referenced in Section 4.a be released to respondents before the RFI response deadline of November 5, 2026?

If not, should responses assume it will be provided only with a future solicitation?

P3 Innovations medgina canal

The Business and Technical Analysis document (“Requirements Document”) referenced in the RFI will be provided with any future solicitation.

4 Does DOR currently have licenses for SharePoint migration tools, such as Sharegate or equivalent solutions, or will the selected vendor be responsible for providing and licensing the necessary migration software? Additionally, are there any restrictions on using third-party migration tools within DOR's Microsoft 365 environment?

YT Global LLC

Yonatan Mengistu

EOTSS has Microsoft Migration Manager and Sharegate licenses which will be available for the project. DOR and A&F IT will need to vet any third-party tools.

5 Section 4.a indicates that A&F IT has an established project team consisting of a project manager, technical architect, technical support staff, and business analyst.

Could DOR clarify the specific responsibilities expected of the selected vendor versus the internal A&F IT team?

Specifically, will the vendor be responsible primarily for executing the migration, or will the scope also include SharePoint architecture and design, data cleanup, permissions restructuring, governance configuration, user training, and post-migration support?

YT Global LLC

Yonatan Mengistu

A&F IT is developing a Requirements Document (see response to question 3), which will be used by A&F IT to create the SharePoint architecture. The vendor will be responsible for reviewing and commenting on the Requirements Document and SharePoint architecture.

The vendor will also be responsible for:

• executing the SharePoint migration

• project planning, including maintaining a

Microsoft project plan (in the DOR network)

• sending staff migration scheduling notifications

• executing pilot migrations

• executing migrations by wave

• wave closeout reports by wave

• governance configuration

• permissions restructuring

• post migration support

• project closeout reports and documentation

A&F IT will provide Tier 1 support for DOR staff. The vendor will provide Tier 2 support for DOR staff.

6 Section 4.a identifies approximately 30 TB of data across 23 servers and 730 top-level folders. Could DOR provide additional information regarding the total number of files, existing folder-level permissions, file types, and any known migration challenges?

Additionally, does DOR anticipate that all 30 TB will be migrated, or will data assessment, cleanup, archiving, and retention activities be completed before migration?

YT Global LLC

Yonatan Mengistu

Additional information regarding the data will be provided with any future solicitation.

It is anticipated that all 30 TB will be migrated.

7 Could DOR provide the anticipated project start date, preferred completion timeframe, and whether an estimated budget range has been established for the SharePoint Migration Project? Additionally, does DOR anticipate that migration activities can be performed remotely, or will onsite resources be required at DOR facilities?

YT Global LLC

Yonatan Mengistu

Anticipated project start date, preferred completion timeframe, and estimated budget are to be determined; one purpose of the RFI is for vendors to supply an estimated project duration and budget.

Remote work is expected, provided all vendor staff are located in the continental U.S.

8 Does DOR anticipate a statewide-contract RFQ or another procurement route, and is there an indicative budget range vendors should use when developing cost estimates?

AK Technical Solutions

Procurement vehicle is to be determined.

Estimated budget range is to be determined. See response to question 7.

9 Would DOR be receptive to a pilot that measures how quickly staff can find and use key records before and after migration, alongside security validation, so each migration wave demonstrates a measurable improvement in day-to-day work?

AK Technical Solutions

DOR anticipates utilizing pilots to validate the migration process.

10 Which Microsoft 365 cloud environment will host the content, and which migration tools, Purview capabilities, licenses, and SharePoint storage capacity should vendors assume DOR will provide?

Ashkore Technical Solutions

Skyler Gregory

The Microsoft cloud environment is contained on the mass.gov tenant which has a G5 license; the tenant is managed by EOTSS.

For migration tools, see response to Question 4.

EOTSS will provide the required storage capacity.

A&F IT will implement Purview SharePoint DLP prior to the start of the project.

11 What evidence and approval will DOR require before each migration wave proceeds, particularly for existing classification and DLP controls, effective permissions, and applicable retention or legal-hold requirements?

Ashkore Technical Solutions

Skyler Gregory

Data classification, data loss prevention, retention and legal hold are out of scope for the project.

Permissions are in scope for the vendor. A&F IT and DOR subject matter experts must approve effective permissions for each wave.

12 Are there required completion dates or business blackout periods? What availability should vendors assume from business-unit owners for cleanup decisions, pilot testing, and migration sign-off?

Ashkore Technical Solutions

Skyler Gregory

The completion date is to be determined. Blackout periods for business units will be identified based on the project start date.

Business staff will be available when necessary.

13 Can the work be delivered remotely through DOR-approved access? Which activities, if any, require on-site attendance, and what personnel-location or screening restrictions should vendors account for?

Ashkore Technical Solutions

Skyler Gregory

See response to Question 7.

14 Given the existing A&F IT project team, which deliverables should the vendor own for SharePoint information architecture, permission remediation, Ashkore Technical Solutions

See response to Question 5.

content cleanup, and business-unit acceptance, and which will remain with DOR?

Skyler Gregory

15 Beyond the storage volume and folder count, can DOR provide aggregate file counts, file-size and age distributions, and information about files or applications that depend on network-drive paths?

Ashkore Technical Solutions

Skyler Gregory

See response to Question 6.

16 1. Has DOR assessed the network shares for duplicate, obsolete, corrupted, unsupported, or excessively large files? If not, should vendors include data cleanup and remediation in the proposed scope and cost?

2. Should the entire approximately 30 TB be migrated to SharePoint, or may some content be archived, deleted, consolidated, or excluded based on business-unit requirements?

3. Will DOR provide the business and technical analysis document and any available target-state SharePoint architecture, site structure, storage/capacity assumptions, and design standards with the future RFQ?

4. Does DOR anticipate a phased migration by server, business unit, or bureau, and are there blackout periods or business dates that must be avoided?

AdaptivEdge LLC

Sara Majeed

1. A&F IT is currently examining the contents of network shares.

2. It is expected that the 30 TB will need to be migrated. Content disposition is/will be determined through business validation.

3. See response to Question 3.

4.This will generally be a phased migration by business unit. Blackout periods and business unit needs may impact some of the phases. Regarding timing of blackout periods, see response to question 12.

17 9. Should the cost estimate include all project phases, migration tooling/licensing, remediation, testing, training, post-migration support, and decommissioning, or should vendors identify these as separate optional costs?

AdaptivEdge LLC

Sara Majeed

9. The cost estimate should include all project phases with the cost for each phase. Training is out of scope.

10. Is holding an existing Commonwealth statewide contract a prerequisite for participating in any potential future procurement for the SharePoint Migration Project, or is this information being collected for market research purposes only?

10. See response to question 2.

18 5. What existing Microsoft Purview classification labels and DLP policies must be preserved or applied during migration, and will DOR provide the applicable configuration and mapping requirements?

6. Does DOR have a preferred or approved migration tool, or should vendors propose and include licensing for the tools required to assess, migrate, and validate the content?

7. What level of end-user communication, training, and post-migration support is expected from the vendor, and what support will DOR provide?

8. In addition to the Microsoft Purview data classification labels and Data Loss Prevention (DLP) policies currently implemented for SharePoint, has DOR also implemented records management capabilities, including retention labels and retention policies, that will apply to the migrated content?

If not, should respondents include the configuration or implementation of these capabilities within the scope and cost of the SharePoint Migration Project?

AdaptivEdge LLC

Sara Majeed

5. SharePoint DLP will be deployed prior to project start. Data classification labels have been deployed across DOR. These are out of scope for the vendor.

6. The approved tools are Microsoft Migration Manager or Sharegate.

7. See response to Question 5.

8. Records management is out of scope;

configuration or implementation of these capabilities should not be included.

19 Does DOR anticipate a statewide-contract RFQ or another procurement route, and is there an indicative budget range vendors should use when developing cost estimates?

Ashkore Technical Solutions

Skyler Gregory

See responses to Question 2, 7, and 8.

20 Would DOR be receptive to a pilot that measures how quickly staff can find and use key records before and after migration, alongside security validation, so each migration wave demonstrates a measurable improvement in day-to-day work?

Ashkore Technical Solutions

Skyler Gregory

See response to Question 9.

21 Are ownership structures, access permissions, and shared-drive access models currently documented, and should permissions be migrated as-is or redesigned as part of the migration effort?

Cloud Navigator Sales Team

See response to Question 5.

22 Can DOR clarify the expected division of responsibilities between A&F IT and the selected vendor, including project management, communications, testing, training, cutover support, and post-migration activities?

Cloud Navigator Sales Team

See response to Question 5.

23 Can DOR provide repository metrics including total file count, average and maximum file sizes, file type distribution, content age, and estimates of inactive, archival, redundant, or obsolete content?

Cloud Navigator Sales Team

See response to Question 5.

24 Does DOR anticipate a phased migration approach that includes pilot migrations, business validation activities, and user acceptance testing prior to enterprise deployment?

Cloud Navigator Sales Team

Yes, DOR anticipates a phased migration, including pilots, business validation, and acceptance testing before a broader deployment.

25 Does DOR expect data cleanup, archival, records disposition, or content remediation activities prior to migration, and if so, will those activities be performed by DOR, the selected vendor, or jointly?

Cloud Navigator Sales Team

See response to Question 5.

26 Does the repository contain Federal Tax Information (FTI) or other regulated data that may require specific personnel screening, handling procedures, resource-location restrictions, or additional compliance considerations?

Cloud Navigator Sales Team

Yes.

27 For any future RFQ, does DOR have a preferred contract approach such as fixed-price, milestone-based, or time-and-materials pricing?

Cloud Navigator Sales Team

It is anticipated to be a fixed price engagement with milestone-based payments.

28 Has DOR defined a target SharePoint information architecture, or should respondents propose one?

Specifically, should the existing top-level folder

Cloud Navigator Sales Team structure be retained, consolidated, or transformed into SharePoint sites, libraries, and other organizational constructs?

29 Should the future solicitation be viewed primarily as a file migration initiative, or should respondents anticipate broader information architecture, metadata, records management, governance, and content modernization activities?

Cloud Navigator Sales Team

It is anticipated to be primarily a file migration project; there may be some governance.

30 What level of change management, end-user training, adoption support, and communication services does DOR expect the selected vendor to provide throughout the migration effort?

Cloud Navigator Sales Team

See response to Question 5.

31 Does DOR anticipate including a distinct information-readiness phase before technical migration, covering assessment of existing folder structures, identification of redundant or obsolete content, clarification of document ownership, and organization of information across business units? If so, would these activities be included within the scope of work?

Crown & Compass Global

Trevene Thomas

See response to Question 5.

32 Does DOR anticipate procuring a single vendor to deliver all phases of the SharePoint Migration Project, or would the Commonwealth consider a delivery approach involving specialized providers for information assessment, business-unit readiness, and technical migration activities?

Crown & Compass Global

Trevene Thomas

DOR prefers a single prime vendor. Partnering with other vendors may be allowed, subject to the relevant Commonwealth Terms and Conditions for the engagement.

33 Can DOR describe the current permission model, including Active Directory groups, nested groups, direct user permissions, broken inheritance, service accounts, and access granted across business units or bureaus?

Does the source environment contain Federal Tax Information, Personally Identifiable Information, payment information, child-support information, or other regulated data that requires additional migration or personnel controls?

What records-retention schedules, legal holds, litigation holds, or regulatory disposition requirements apply to the source data?

Can DOR provide details of the Microsoft Purview sensitivity labels, retention labels, auto-labeling rules, and DLP policies that will apply to migrated content, and should those labels and policies be applied before migration, during ingestion, or after migration?

What background checks, confidentiality agreements, security training, or residency requirements will apply to vendor personnel?

Are offshore or remote resources permitted to access DOR systems or data?

Must all project work and data processing occur within the United States or within Commonwealth-managed environments?

Will DOR provide privileged accounts, or must the solution use delegated access, just-in-time access, HexaCorp

Daniel Vimal

Questions are answered below in the order they are asked.

Yes.

See response to Question 11.

SharePoint DLP will be deployed prior to project

DOR background checks, fingerprinting, and security training will be required for all vendor staff.

Offshore resources are not allowed. Remote work is allowed provided all vendor staff are located in the continental U.S.

All vendor staff will be provided with a DOR laptop on which all work must be performed. No data or information shall be removed from the laptop or DOR network.

Privileged accounts at the server level will be provided.

privileged identity management, or another controlled-access process?

What audit evidence, security documentation, and migration activity logs must be delivered to satisfy DOR, A&F IT, Commonwealth, and IRS requirements?

How should files blocked or quarantined by DLP, malware scanning, sensitivity policies, or file-type restrictions be handled and reported?

To be contained in any future solicitation.

SharePoint DLP will be deployed prior to project

34 Can DOR provide an expected deliverables list, or should respondents recommend deliverables for discovery, design, pilot, migration waves, validation, training, transition, and closure?

Should the vendor include creation of standard operating procedures, governance documentation, administrator guides, support runbooks, and knowledge-transfer materials?

May respondents structure the estimate with an initial fixed discovery and assessment phase followed by a refined implementation estimate based on validated findings?

Should the requested cost estimate be presented as a rough-order-of-magnitude estimate, a fixed-price estimate, a time-and-materials estimate, or multiple pricing options?

Should software licensing, migration infrastructure, travel, after-hours support, training, remediation, and post-migration support be shown as separate cost components?

What Microsoft 365 and Microsoft Purview licensing is currently available for users and administrators?

Should respondents include any additional Microsoft or third-party licensing costs in the estimate?

Should the estimate include optional services such as data cleanup, records remediation, information architecture redesign, custom development, workflow replacement, or extended support?

HexaCorp

Daniel Vimal

See response to question 5.

See response to question 27.

See response to question 27.

The budget should be broken down by phases. There will be no travel involved as work will be conducted remotely.

See response to question 10. Microsoft Purview is out of scope.

No.

Is membership on a Commonwealth statewide contract a requirement for any potential future award, or is DOR requesting this information only to evaluate available procurement options?

Will DOR identify the anticipated contract type, procurement vehicle, budget range, and evaluation criteria in the future RFQ?

See response to question 2.

The RFQ will contain this information.

35 Does DOR expect pilot migrations followed by phased production waves and incremental or delta migrations before cutover?

Are there defined blackout periods, tax-season restrictions, financial close periods, or other operational windows during which migrations cannot occur?

Is after-hours, weekend, or holiday migration support expected? If so, should respondents separately identify this cost?

What level of migration validation is required-for example, file counts, byte counts, hashes, permissions, metadata, version history, or business-owner sampling?

Yes, DOR anticipates a phased migration, including pilots, business validation, and acceptance testing before a broader deployment.

Blackout periods for business units will be identified based on the project start date.

End user support will be conducted during normal business hours. SharePoint migrations will be executed after business hours.

The following are required: Detailed success reports, failure reports, count of files migrated, count of files not migrated, permissions issues, business owner migrated file sampling.

Is file version history currently present in the source environment or another repository, and must any prior versions be migrated?

Will DOR permit temporary read-only access to source shares during cutover, and what is the expected duration of the final delta and business-validation period?

What rollback expectations should respondents include if a migration wave does not meet acceptance criteria?

There is no history.

The file server folders will be set to read-only as they are migrated. The expected duration of the final delta and business-validation period is to be determined.

Any failed SharePoint site, libraries, or folders will have to be re-migrated.

36 Does DOR expect the selected vendor to design the SharePoint information architecture-including sites, hubs, libraries, metadata, content types, navigation, search, and ownership-or will DOR provide an approved target design?

Does DOR already have an established SharePoint Online governance model covering site provisioning, naming conventions, ownership, external sharing, lifecycle management, storage, and inactive-site management?

Are SharePoint sites and libraries already provisioned for the migration, or is the vendor expected to configure the target environment?

Should the target design preserve the existing business-unit and bureau structure, or may the vendor recommend consolidation and restructuring based on collaboration and security requirements?

DOR does not have a SharePoint governance model.

No, the vendor will work with A&F IT on configuring the target environment.

This will be determined after vendor review of the Requirements Document and SharePoint architecture.

This information will be part of the Requirements Document.

Are any existing drive mappings, file paths, shortcuts, hyperlinks, macros, scripts, applications, scheduled tasks, or business processes dependent on the current network-share locations?

Is remediation or replacement of applications, scripts, macros, and integrations that depend on network shares included in scope?

Does the scope include Teams integration, OneDrive shortcuts, or synchronization of SharePoint libraries to users' devices?

Yes. A&F IT will provide Tier 1 support on this.

Guidance will have to be given to staff on these items. A&F IT will provide Tier 1 support on this.

37 Does DOR expect the vendor to develop and deliver the complete communication and change-management plan, or only provide templates and recommendations to DOR?

What communications are expected for business leadership, content owners, end users, help-desk personnel, and technical administrators?

Is end-user or administrator training included in scope?

If so, what delivery formats, number of sessions, audience sizes, and training materials are expected?

What post-migration hypercare period and support coverage should be included?

Will DOR's existing help desk provide Level 1 support, with the vendor handling escalations, or should the vendor provide direct end-user support?

HexaCorp

Daniel Vimal

Vendor will be responsible for migration scheduling notifications. See response to question 5.

The vendor is responsible for sending scheduling and migration result communications.

End user training is out of scope. Administration training (size to be determined) may be in scope.

The scope of services required post migration is to be determined.

A&F IT will provide Tier 1 support, and the vendor will provide Tier 2 support.

38 Has DOR already completed an inventory using ShareGate, Microsoft tools, or another assessment utility? If so, will the resulting reports be made available with the future RFQ?

Has DOR identified files with unsupported extensions, encrypted or password-protected files, excessive path lengths, invalid characters, duplicate files, zero-byte files, corrupted content, or files exceeding SharePoint Online limits?

Is the expectation to migrate all 30 TB, or should the vendor include data classification, duplicate identification, archival, remediation, and disposition activities before migration?

Does DOR require or prefer a specific migration tool? Are there restrictions on third-party migration tools, cloud-hosted processing, external telemetry, temporary storage, or data leaving the Commonwealth environment?

What network bandwidth and connectivity are available between the 23 file servers and Microsoft 365, and are there restrictions on migration activity during business hours?

Will migration agents or supporting infrastructure be installed within DOR's environment, and will DOR provide the required servers, virtual machines, service accounts, firewall rules, and administrative access?

HexaCorp

Daniel Vimal

Inventory is part of requirements gathering. See response to Question 3.

This will be included in the inventory.

See response to question 6.

See response to question 4.

Bandwidth is to be determined but has been sufficient for other M365 migrations. Migrations will be performed outside of business hours.

39 Will DOR assign a business owner and subject-matter expert for each of the 12 business units and their respective bureaus?

Approximately how many users currently access the shared drives, and how are those users distributed across business units, bureaus, locations, and working arrangements?

Who will be responsible for approving the target folder-to-site/library mapping, access model, retention decisions, and migration-wave schedule?

Will DOR provide timely access to business stakeholders for discovery workshops, validation sessions, user-acceptance testing, and migration sign-off?

Does DOR expect the vendor to establish project governance, status reporting, risk and issue management, change control, and executive reporting, or will these activities be managed by the existing A&F IT project manager?

Does DOR have a preferred project start date, target completion date, maximum migration duration, or required deadline for decommissioning the 23 file servers?

What technical and business acceptance criteria will DOR use to determine that a migration wave-and the overall project-has been successfully completed?

HexaCorp

1,800 users

DOR and A&F IT

Vendor will be responsible for everything except for executive reporting; however, vendor may need to provide A&F IT with information for executive reports.

To be determined.

40 Can DOR provide additional details about the approximately 30 TB of source data, including file counts, file types and file-size ranges,?

NGenious Solutions Inc.

Nilesh Mehta

41 Does DOR anticipate a phased migration by business unit or site, including a pilot, initial migration, delta migration, and final cutover? Are there mandatory milestones, a target completion date, business blackout periods, or other scheduling constraints that vendors should consider?

NGenious Solutions Inc.

Nilesh Mehta

See responses to questions 12 and 24.

42 Does DOR have a target budget range or preferred commercial structure for a potential subsequent procurement?

Would DOR consider a phased approach with discovery and architecture completed first, followed by implementation pricing based on the validated inventory and agreed scope?

Are any specific Commonwealth contract vehicles or teaming requirements anticipated for a future solicitation?

NGenious Solutions Inc.

Nilesh Mehta.

See responses to questions 2, 8, and 24.

43 Does DOR have an approved or preferred migration tool, or may vendors recommend a suitable platform such as ShareGate?

If a third-party migration tool is used, will DOR provide the required licenses for the duration of the project, with tool licensing costs excluded from the vendor's estimate?

NGenious Solutions Inc.

Nilesh Mehta.

See response to question 4.

44 Does the source environment contain Federal Tax Information subject to IRS Publication 1075 or other specially regulated information?

If so, what additional security, access, handling, encryption, or migration requirements should vendors address?

NGenious Solutions Inc.

To be contained in any future solicitation.

45 For the business-driven restructuring option, may content from a single top-level source folder be distributed across multiple destination SharePoint sites and libraries?

Would DOR provide business rules and decisions for this mapping, or should vendors include workshops and business analysis to define the target structure?

NGenious Solutions Inc.

See responses to question 5 and 28.

46 Given the approximately 12 business units and 730 top-level source folders, does DOR have a preferred number of destination SharePoint sites?

For planning purposes, should vendors consider approximately 12 business-unit sites, a consolidated structure of approximately 30-50 sites based on business functions and access requirements, or recommend the site count following discovery?

NGenious Solutions Inc.

47 Has DOR established the target SharePoint information architecture, including site and document library structure, metadata, naming conventions, ownership, and governance?

If not, should vendors include architecture and design activities in the proposed scope?

NGenious Solutions Inc.

See responses to questions 5 and 28.

48 Should existing network file share permissions be maintained and mapped to SharePoint where possible, or should vendors incorporate redesigning access management using Microsoft Entra ID security groups and SharePoint permissions?

Our recommendation: don't migrate file share permissions to SPO

NGenious Solutions Inc.

It is expected that new Entra ID Azure groups will be created.

49 Should vendors assume all identified source content will be migrated, or should the proposed scope include identifying content for exclusion, archival, or remediation before migration?

NGenious Solutions Inc.

50 The RFI indicates that Microsoft Purview classification/sensitivity labels and DLP policies have been implemented. Should vendors assume these controls are configured for the destination environment and include migration-related validation only, or should policy refinement and remediation also be included?

NGenious Solutions Inc.

Nilesh Mehta

A&F IT is responsible for MS Purview. It is out of scope for the vendors.

51 What acceptance criteria will DOR require for file completeness, metadata, permissions, sensitivity labels, DLP behavior, and business-user validation?

What approvals must be obtained before the original network file shares can be decommissioned?

NGenious Solutions Inc.

Nilesh Mehta

To be determined.

52 Will DOR identify business owners for the source folders and provide business and technical representatives for discovery, content mapping, permissions review, user acceptance testing, and migration sign-off?

NGenious Solutions Inc.

Nilesh Mehta

Yes.

53 Would DOR prefer vendors to present two migration options with separate approaches, schedules, and cost estimates?

Option 1: an as-is migration that preserves the existing folder structure where practical, with logical consolidation into the agreed SharePoint sites and libraries.

Option 2: business-driven restructuring, where source folders and their contents may be reorganized across multiple sites and libraries based on business function, ownership, permissions, and governance requirements.

NGenious Solutions Inc.

Nilesh Mehta

To be determined based on the findings in the Requirements document.

54 Can DOR provide details of its existing Microsoft Purview sensitivity labels, data classification policies, DLP rules, and applicable migration-related restrictions?

What validation and evidence will DOR require to demonstrate that these controls remain effective after migration?

Sparient Inc

Jayant Bhat

See responses to questions 11 and 33.

This is an A&F IT task.

55 Can DOR provide details of the existing network file-share environment, including the operating systems and file systems used by the 23 servers, current storage architecture, and any dependencies on legacy applications?

Sparient Inc

Jayant Bhat

To be contained in any future solicitation.

56 Does DOR have a target start date, completion date, or required duration for the migration?

Will the forthcoming business and technical analysis document include schedule constraints and major milestones?

Sparient Inc

Jayant Bhat

See responses to question 7 and 12.

57 Does DOR have preferred or approved migration tools, or may respondents recommend commercial tools and Microsoft-native utilities based on the inventory, security, and migration requirements?

Sparient Inc

Jayant Bhat

See response to question 4.

58 For the requested RFI cost estimate, should vendors provide a planning-level estimate based on the currently available information, with explicit assumptions and exclusions, or is DOR expecting a more detailed estimate based on a defined migration scope?

Sparient Inc

Jayant Bhat

See response to question 17.

59 Has DOR established the target SharePoint Online architecture, including site collections, sites, hub sites, document libraries, metadata, and information architecture?

If not, should respondents include architecture design and planning in their proposed scope and cost estimates?

Sparient Inc

Jayant Bhat

See response to questions 5 and 36.

60 Sections 3 and 4(b), pages 2-3 - Department of Revenue;

Information Solicited. Section 5, page 4 - General Instructions.

Question: Are there specific IRS, Massachusetts records-retention, legal-hold, audit-trail, or other

Sparient Inc

Jayant Bhat

This information should not be incorporated into the migration plan.

regulatory requirements that must be incorporated into the migration plan?

If so, will DOR provide the applicable requirements and acceptance criteria?

61 What is the expected approach for migrating existing NTFS permissions and shared-folder access controls into SharePoint Online?

Should the migration vendor assess, redesign, and validate permissions where the existing structure does not align with SharePoint security best practices?

Sparient Inc

Jayant Bhat

See response to question 5.

62 What reconciliation and acceptance criteria will DOR require, including file counts, file integrity, metadata, permissions, sensitivity labels, DLP behavior, exception reporting, and business-owner sign-off?

Sparient Inc

Jayant Bhat

See responses to question 35.

63 Will DOR provide a detailed inventory of the approximately 30 TB of data, including file counts, file types, file sizes, duplicate files, unsupported file types, and files requiring special handling?

Sparient Inc

Jayant Bhat

See response to question 6.

64 Has DOR set a budget or budget range for this project?

2. When do you expect to release the RFQ and start work?

3. Is there a target date to finish the migration?

STOIC

TECHNOLOGIES

CORPORATION

Leonid Lyublinski

See responses to questions 7 and 8.

65 1. IRS Publication 1075 does not allow federal tax data to leave the United States. Will the RFQ require all vendor staff to work only from within the United States?

2. Will vendor staff have to be US citizens or permanent residents to access DOR systems or tax data?

3. Will all vendor systems, laptops and migration tools that touch DOR data have to stay in the United States?

STOIC

TECHNOLOGIES

CORPORATION

Leonid Lyublinski

For questions 1-5, see response to question 33.

4. Will offshore work be banned for every part of the project, including support, testing and reporting?

5. Will subcontractors have to follow the same US only and security rules as the main vendor?

6. Will vendors have to show that their security practices meet IRS Publication 1075 and the Massachusetts Enterprise Information Security Policies?

7. Will vendors with experience protecting federal tax data get extra points?

8. What background checks will vendor staff need, and how long do they take?

6. Vendors will have to be compliant with these practices and policies.

7. Evaluation criteria will be contained in any future solicitation.

8. See response to question 33. The timeframe generally depends upon a contractor’s ability to timely submit requested paperwork and meet any other requirements.

66 1. Will small, women owned or veteran owned businesses get extra points or a price preference?

2. Will you accept a federal certification, such as the SBA Women Owned Small Business certification, from an out of state business?

STOIC

TECHNOLOGIES

CORPORATION

Leonid Lyublinski

Evaluation criteria will be contained in any future solicitation.

Please refer to the Supplier Diversity Office website for further information on Small Business Purchasing Program (“SBPP”) status and Supplier Diversity Office (SDO) certification.

67 1.Will the RFQ be open to all vendors, or only to vendors on statewide contract ITS75?

2. Can a vendor that is not on ITS75 work as a subcontractor to an ITS75 vendor?

STOIC

TECHNOLOGIES

CORPORATION

Leonid Lyublinski

See response to Question 2.

See response to Question 32.

68 Does DOR expect existing NTFS permissions and access-control structures to be preserved during migration, or will access permissions be redesigned for SharePoint?

SUBOIT LLC

VISHNU

VANDANA

PASUPULETI

This will be determined by the findings in the Requirements Document.

Also, are there additional IRS-specific security, retention, or migration-validation requirements beyond the Microsoft Purview classification labels and DLP controls already implemented?

Microsoft Purview is out of scope for the vendors.

69 Regarding the approximately 30 TB of data across 23 file servers and 730 top-level folders, has DOR completed an assessment of obsolete, duplicate, or archival files, or should vendors assume the entire volume requires migration?

Additionally, have SharePoint target sites and information architecture been defined, or should vendors include their design and configuration in the proposed approach?

SUBOIT LLC

VISHNU

VANDANA

PASUPULETI

See response to Question 6.

No, see reponse to Question 5.

70 Will DOR provide the licenses for SharePoint migration tools, or should vendors include third-party migration software and licensing costs in their estimates?

Additionally, what level of support is expected from the vendor for testing, end-user communications, post-migration support, and decommissioning of the existing network file shares?

SUBOIT LLC

VISHNU

VANDANA

PASUPULETI

See responses to question 4, 5, and 37.

71 Does the Department anticipate migrating the full approximately 30 TB described in Section 4(a), or will content eligible for archival or disposition be identified and excluded prior to migration?

If disposition is contemplated, will that analysis be performed by the Department or fall within the vendor scope?

Sulphoor LLC

Pheelamillo Ghajiga

Archiving is out of scope.

72 May migration work be performed remotely, or will the Department require vendor personnel on site in Chelsea or Boston?

Sulphoor LLC

Pheelamillo

See response to question 7.

If on-site presence is required, at what frequency and during which project phases?

73 Section 4(b) notes that DOR has implemented Microsoft Purview data classification labels and data loss prevention for SharePoint, as required by the IRS prior to migrating files to a cloud environment. Will any portion of the in-scope content constitute Federal Tax Information subject to IRS Publication 1075?

If so, does the Department anticipate that a future solicitation will require vendor personnel background investigations, or impose citizenship, residency, or remote-access restrictions?

Sulphoor LLC

Pheelamillo

See response to question 33.

74 This RFI is identified as eligible under the Small Business Purchasing Program. Does the Department anticipate issuing a future solicitation as a small business set-aside, or under an existing statewide contract vehicle restricted to current contract holders?

Sulphoor LLC

Pheelamillo Ghajiga

See response to question 2.

75 Will migration platform licensing be vendor-furnished and priced within a future response, or procured separately by the Commonwealth?

Licensing at this data volume is material to cost, and a consistent assumption would improve comparability across responses.

Sulphoor LLC

Pheelamillo Ghajiga

The migration platform will be provided by the Commonwealth.

76 Are all required users and security groups available in Microsoft Entra ID, and who will remediate inactive users, orphaned accounts, nested groups, direct permissions, and broken inheritance?

TrnDigital

Vikrant Shinde

See response to questions 5.

77 Are any file shares used by applications, services, scheduled jobs, scripts, mapped drives, or other automated processes that must be remediated?

TrnDigital

Vikrant Shinde

That is highly likely. See response to questions 5.

78 Are any legal holds, public-record obligations, active investigations, retention policies, sensitivity labels, DLP

TrnDigital

Vikrant Shinde

This is out of scope.

controls, or records-management requirements applicable?

79 Are there blackout periods, business-event restrictions, after-hours requirements, change-control lead times, or maximum outage limits for cutovers?

TrnDigital

Vikrant Shinde

See response to question 12.

80 Are there duplicate, obsolete, temporary, encrypted, password-protected, inaccessible, or unsupported files that should be excluded or remediated before migration?

TrnDigital

Vikrant Shinde

Yes.

81 Can DOR provide a server-level inventory of the approximately 30 TB of in-scope data, including used storage, file and folder counts, largest file size, growth rate, and any exclusions?

TrnDigital

Vikrant Shinde

See response to question 6.

82 Does DOR require an approved migration tool, and should tool licensing, temporary infrastructure, cloud-processing, and automation costs be included in the estimate?

TrnDigital

Vikrant Shinde

See response to question 4.

83 Does the source contain regulated, tax-related, legal, financial, personally identifiable, or other sensitive information, and is pre-migration classification required?

TrnDigital

Vikrant Shinde

Yes, the source contains such information. Pre-migration classification is out of scope.

84 Has the target SharePoint Online information architecture been designed and approved, or must the vendor design the sites, libraries, metadata, navigation, naming standards, and hub structure?

TrnDigital

Vikrant Shinde

See responses to questions 5 and 36.

85 How are source permissions assigned, and must they be preserved or replaced with a new target permissions matrix?

TrnDigital

Vikrant Shinde

See response to question 5.

86 How should pricing be structured and itemized, and which assumptions, contingencies, optional services, contractual requirements, response templates, and procurement deadlines must be addressed?

TrnDigital

Vikrant Shinde

See response to question 27.

87 Is sufficient SharePoint Online storage already available, and are there limits on the number of sites, libraries, folders, or items that may be created?

TrnDigital

88 Is there an approved mapping of the 730 top-level folders and 12 business units to target SharePoint sites or document libraries?

TrnDigital

Vikrant Shinde

See response to question 5.

89 Should the existing folder hierarchy be retained, simplified, or partially converted to metadata, content types, document sets, and views?

TrnDigital

Vikrant Shinde

See response to question 5.

90 What administrative access and permissions will DOR provide for Microsoft 365, SharePoint Online, Entra ID, file servers, and network resources?

TrnDigital

Vikrant Shinde

The vendor will be granted necessary administrative access.

91 What communications, end-user training, knowledge transfer, and post-migration hypercare deliverables are expected?

TrnDigital

Vikrant Shinde

See responses to questions 5 and 37.

92 What migration methodology, wave structure, pilot scope, desired start date, completion date, and file-server decommissioning deadline does DOR expect?

TrnDigital

Vikrant Shinde

See response to question 5.

Start date is to be determined. A prospective vendor should provide estimated project duration and planned migration methodology, knowledge transfer and other project milestones in their response.

Server decommissioning is out of scope.

93 What network bandwidth, temporary infrastructure, migration-agent deployment, Microsoft 365 capacity, throttling, conditional-access, and MFA constraints must be considered?

TrnDigital

Vikrant Shinde

Microsoft 365 G5, MFA, and conditional access have been provided by EOTSS.

Bandwidth is to be determined but has been sufficient for other M365 migrations. Migrations will be performed outside of business hours.

94 What reconciliation and acceptance thresholds will apply to file counts, data volume, metadata, permissions, errors, and exceptions?

TrnDigital

Vikrant Shinde

See response to question 35.

95 What security, privacy, records-management, data-residency, and vendor-access requirements apply to the migration?

TrnDigital

Vikrant Shinde

To be contained in any future solicitation.

96 What testing, evidence, review periods, exception-management process, and formal sign-off criteria are required for each migration wave and for the overall project?

TrnDigital

See response to question 35.

97 Which responsibilities belong to DOR versus the vendor, including data cleanup, design, permissions remediation, testing, business validation, communications, training, and final approval?

TrnDigital

Vikrant Shinde

See response to question 35.

98 Which source attributes must be preserved, including created and modified dates, authorship, ownership, and permissions?

TrnDigital

Vikrant Shinde

See response to question 5.

99 Will users continue modifying files during migration, and what delta-migration, content-freeze, rollback, and post-cutover validation approach is required?

TrnDigital

Vikrant Shinde

The vendor will be responsible for setting the applicable network folders to read-only prior to migration.