SOM Responses to Bidder Questions - RFP 250000001887.pdf

Bidder Questions & Answers

School Bond Loan System Request for Proposal 250000001887

Q# Document and Section Bidder Question

Answer (to be completed by the State)

1 Technical Requirements Are there any preferred technology stacks or frameworks that the solution must adhere to?

The State is seeking a COTS or SaaS solution. The technology must comply with all applicable public and non-public State IT policies and standards, of which the publicly available ones are at https://www.michigan.gov/dtmb/policies/it-policies. As stated in the RFP in section 27.4 ,on page 55, Contractor will utilize only currently supported versions of all Third-Party or Open Source Components and will notify the State when not using the most recently published Third-Party and Open Source Components.

2 Security and Compliance

What specific security certifications or compliance requirements must the vendor meet?

As stated in the RFP , page 171 the contract must at all times comply with all applicable public and non-public State IT policies and standards, of which the publicly available ones are at https://www.michigan.gov/dtmb/policies/it-policies. This typically requires the vendor to be FedRAMP compliant;

however, it is possible for the contractor to meet these standards and for the application to achieve Authority to Operate without FedRAMP certification. No other security certification is required unless specifically referenced in aforementioned State IT polices.

STATE OF MICHIGAN

CENTRAL PROCUREMENT SERVICES

Department of Technology, Management & Budget Elliot Larsen 320 S. Walnut St., 2nd Floor.

Lansing, MI 48933 https://www.michigan.gov/dtmb/policies/it-policies https://www.michigan.gov/dtmb/policies/it-policies

Q# Document and Section Bidder Question

Answer (to be completed by the State)

3 Integration Requirements

Can you provide details on existing systems and APIs that the proposed solution must integrate with?

The APIs would include school district information from the School Bond Loan system to the School Loan Revolving Fund (SLRF) system.

4 Budget and Pricing

Is there a defined budget range for this project, and should pricing include optional add-ons or enhancements?

A budget range for this project is not necessary in order to submit a proposal.

Please see Optional Requirement 1.0 under Schedule A – Business Specification Worksheet on page 154.

5 Vendor Responsibilities

What level of ongoing support and maintenance is expected from the vendor post-implementation?

Please see Schedule E Data Security Requirements Section 3 Contractor Responsibilities on page 173.

6 Technical Requirements

Are there any restrictions on the hosting environment, such as preferred cloud providers (AWS, Azure, GCP)?

Please see Schedule E Data Security Requirements Section 5.1 on page172.

7 Technical Requirements What authentication protocols must be supported (e.g., SAML, OAuth, LDAP, Active Directory)?

Please see RFP, Section 7, Access Control and Authentication on page 70.

SAML or OpenID – the State has made changes since the RFP was posted, OAuth will no longer be accepted in 2025.

8 Integration Requirements

Are there any proprietary or legacy systems that require special integration considerations?

Please see RFP, Section 11 Integration on Page 73.

9 Integration Requirements Will vendors have access to a sandbox or test environment for integration testing?

Access can be provided to the contractor. Resources must not be offshore. People granted access must take IRS Safeguard training and be fingerprinted for background checks.

10 Integration Requirements

Will the vendor be responsible for migrating existing data into the new system? If so, what are the data formats and volume?

Please see RFP, Section 12 Migration on page 74.