SRA 20-08 - Minutes for Pre-Proposal Conference held 08.05.20 mg.pdf

MARYLAND STATE RETIREMENT AND PENSION SYSTEM

PRE-PROPOSAL MEETING

RFP NUMBER SRA 20-08

IDENTITY PROOFING SOFTWARE-AS-A-SERVICE

Maryland State Retirement and Pension System

120 East Baltimore Street

Baltimore, Maryland 21202-6700

August 5, 2020

1:00 p.m.

(VIA MICROSOFT TEAMS)

ATTENDANCE:

AGENCY:

Margie Gordon, Senior Procurement Officer

John Haynes, Procurement Officer

Ira Greenstein, Chief Information Systems Officer

Robert Diehl, Deputy Chief Systems Officer

Thomas Montanye, Director, Systems Development

Harris Kaplan, Deputy Director Business

Operations

Officer

Chandra Puranam, Director Business Operations

Office

William Morrow, Senior Consultant with Segal and

MPAS 3 Project Manager

ATTENDEES:

Entrust Datacard

Nick.sanschagrin@entrustdatacard.com (Nick

Sanschagrin)

Vincent Ross

TransUnion

Bryan.fawcett@transunion.com

Brian.worley@transunion.com

Jeff.johnston@transunion.com

Stuart.levy@transunion.com iddataweb

Jason.ludicke@iddataweb.com

Tim Snyder

Matt Cochran

IDology

Robert Pearsall

Acuant, Inc.

Ptownsend@acuant.com

Hub City Media

Jkegelmeyer@hubcitymedia.com (James)

Onfido

Chris.jungles@onfido.com

Imageware Systems

Gmonett-ctr@iwsinc.com (Gary)

Darren Semel

Giact Systems, LLC

Michael.sulkin@giact.com

LexisNexis

Trey.harrison@lexisnexisrick.com

Valerie.tucci@lexisnexisrisk.com

Marcy Lisle

Idemia

Tony.lawrence@us.idemia.com

Lorie Davis

Tim Brown

Andria Lego

Cisco mgister.cicso.com

Forge Rock

John.barisich@foregerock.com

Jeff Delong

UVS Infotech

Sam@uvsit.net (Surendra Singh)

Plus 1 other

Onespan david.hemens@onespan.com timothy.lew@onespan.com

Public Consulting Group, Inc.

PCheesman@pcgus.com (Peter)

Biocatch jay.whoriskey@biocatch.com

Alpha Technologies USA, Inc.

Barbara.Martinez@alphait.us

Amrit Gurung

Raghvendra Dubey

Nuance Communications, Inc.

Marianne.Marvosa@nuance.com

Christian Moreno

IBM

Mlenaha@us.ibm.com (Michael Lenahan)

Eric Geller

Eli Shapurov

SecureAuth

Mrodzinka@secureauth.com (Mike)

Jason McHugh

Don Scott

Buguroo

Tayling@buguroo.com (Tim)

Gareth Evans

Optiv don.pope@optiv.com

KOUNT

Scott.przybyla@kount.com

Will Mavromchalis

Transcribed by: Carol O’Brocki, Notary Public

Hunt Reporting Company, Glen Burnie, Maryland

P R O C E E D I N G S 1

(1:13 p.m.) 2

MS. GORDON: I guess we can get started. As 3 you all know, my name is Margie Gordon. I’m Senior 4

Procurement Officer. My associate is John Haynes, and 5

I’m going to let everyone from our panel announce 6 themselves, and as I said, we have Hunt Reporting here 7 to record this Pre-Proposal Conference, and when you 8 ask a question we request that you say your name and 9 the company that you are with so that it will be 10 transcribed onto the minutes. 11

I will email the minutes to everyone once we 12 get them, read them, and they will be emailed to you. 13

The sign-in sheet of the emails that I have will also 14 be on the minutes when I send to Hunt Reporting. 15

We’ll start with the introduction of the 16 panel and then go around and introduce yourselves, but 17 the vendors we’re already -- contractors and vendors 18 we’ve already spoken with you. So, Ira? 19

HUNT REPORTING COMPANY

Court Reporting and Litigation Support

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

MR. GREENSTEIN: Okay. Ira Greenstein. I’m 1 the Chief Information Systems Officer for the State 2

Retirement Agency. 3

MR. DIEHL: Hello. Good afternoon, 4 everyone. My name is Bob Diehl, and I’m the Deputy 5

Chief Information Systems Officer for the Agency, and 6 will also have the role of Contract Manager. 7

MR. MONTANYE: And my name is Tom MONTANYE. 8

I’m the Director of Systems Development for the 9

Agency. 10

MR. PURANAM: Good afternoon, all. This is 11

Chandra Puranam. I’m the Director of Business 12

Operations Office. 13

MR. KAPLAN: Good afternoon. My name is 14

Harris Kaplan. I am the Deputy Director of Business 15

Operations Office. 16

MS. GORDON: Mr. Morrow? 17

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

MR. MORROW: Good afternoon. This is Will 1

Morrow. I’m a Senior Consultant with Segal and the 2

MPAS-3 Project Manager. 3

MS. GORDON: John, are you online? 4

MR. HAYNES: Yes, I am. I’m John Haynes. 5

I’m the Procurement Officer here at the State Agency. 6

MS. GORDON: Okay. So, we’re here for the 7

Identity Proofing Software-As-A-Service RFP. The 8 closing time and date for this RFP is due on 9

Wednesday, August the 26th, no later than 2:00, and 10 that means 2:00 p.m. Not 2:01, not 2:00 and two 11 seconds. 12

So, please have your emails -- your bids to 13 me by no later than 2:00 Eastern -- is it Eastern 14

Daylight Time or Eastern Standard Time. I forgot. 15

No late bids will be accepted. Any 16 questions are to be sent to me at the email address of 17 procurement@sra.state.md.us and that is on the Key 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

Information Summary Sheet that is page 2 in the -- no, 1 page number 3 in the RFP. 2

Please use that as your guide. It tells you 3 who the Procurement Officer is, where the proposal is 4 to be sent to, the questions, due date and time -- the 5 proposal due date and time. 6

There is no MBE subcontracting goal or 7 veteran subcontracting goal. It tells you the 8 contract type, the contract duration, and the place of 9 performance. So that is basically your guide sheet. 10

It’s going to be a five-year contract -- a 11 five-year base contract with two one-year periods and 12 the effective date -- we haven’t really figured that 13 one out. They say it’s going to be next year because 14 of the lateness in this proposal. 15

We also request that you send that -- return 16 a Response Feedback Form which is located on page 2 of 17 this RFP. 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

So, in that, I’m going to send it over to 1

Ira or Robert -- Bob Diehl, whichever one is going to 2 go over the scope of work, the contractor 3 requirements, and other information that you need to 4 know. 5

MR. DIEHL: Okay. Thank you very much, 6

Margie. For the sake of, I guess, time and 7 efficiency, what I wanted to do was kind of just go 8 through a list of key points that we would like to 9 highlight throughout the RFP. 10

First of all, starting on page 2 of the RFP, 11

Section 2.1.3 we state that there will be up to three 12 awards. We’re doing this -- this will give 13 registrants options and allow SRA to shift vendor 14 solutions more smoothly in the event a given solution 15 becomes obsolete or compromised. 16

Staying on that same page, 2.1.4, we prefer 17 not to have resellers but if we have to we want the 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

reseller to fully support the proposed solution. We 1 only want one responsible party to deal with. 2

And staying on the same page, this is for 3

Section 2.2, we’d just like to note we included this 4 because during the review process we were receiving 5 confused questions about single sign-on for internal 6

Agency users. Single sign-on has nothing to do with 7 this and the RFP is for software as a service for 8 external to Agency participants in our retirement 9 programs. 10

Moving on to our next item which is actually 11 on -- oh, let me see here, what do we have here? 12

Section 2.2, which is page 3, the next page, we 13 decided to use ID proofing service as part of the 14 registration process, not as a step-up when a 15 participant wants to perform a more sensitive 16 transaction. 17

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

However, to describe the change, we wanted 1 to be up-front that the volume of use of the software 2 as a service might adjust at some point, okay? 3

Moving on to page 4, Section 2.4, well, at 4 this point because this document was started quite a 5 while ago, we just wanted to let you know that mySRPS 6 is currently in production and has about 40,000 7 participants. 8

Those registrants will likely have to submit 9 to a further process to retro apply the ID proofing 10 solution to themselves, at least before we start 11 allowing riskier transactions and those currently on 12 the mySRPS secure participant portal. 13

And again, this RFP has been a while in 14 development, so just bringing folks up-to-date. 15

Moving on to page -- well, staying on page 16

4, Section 2.3, they will likely require a proof of 17 concept for the proposed ID proofing solutions. We do 18 not want to be surprised to discover that the product 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

integration is clumsy or a vendor is difficult to work 1 with technically. 2

Section 2.4 on page 7, just a general note 3 that we realize that several sections of the State’s 4

RFP template language will not apply to each possible 5 proposed solution. If we felt that a given clause 6 might apply to some solution, we left it in. 7

While it would be helpful for proposals to 8 identify that certain clauses are not applicable to a 9 given solution, that helpful identification is not a 10 requirement. What is a requirement is that if it is 11 required, if it does apply. 12

Then on page 19 of the document, Section 13

3.9, a SOC 2 Type 2 report, a regular independent 14 assessment is required if you’re going to either 15 process or store personally identifiable information 16 that the Agency provides to you even if you already 17 have that information in your existing database. 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

Since you are in IT security space we trust 1 that you understand this. If you have a problem, you 2 need to identify this problem now. This clause will 3 be enforced. 4

Section 3.10 on page 21, we’re looking for 5 an established vendor in this ID proofing space, not a 6 start-up or a service that has a small existing 7 customer base. This is the best language we could 8 come up with to convey that thought. 9

Then on just general -- let me see, what do 10 we have here? Section -- well, I’ll save that for 11 last. Oh, I just wanted to point out that the 12 estimated transaction volumes can be located on page 13

46 of the RFP, Section F, just to kind of lay out what 14 we anticipate as utilization of the services. 15

And finally there were some questions 16 dealing with the financial proposal, and we tried to 17 capture what we believe to be a generic but applicable 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

format. If this will not work for your solution, 1 please let us know quickly. 2

We recognize that there is a lot of variety 3 out there and this is the best guess we had on some 4 way to make the proposals comparable. Please 5 carefully read and follow all instructions for the 6 financial proposal. 7

And with that, I’m going to let Ira pick up 8 and maybe go into a review of the financial sheet that 9 was distributed. 10

MR. GREENSTEIN: Very good. In writing 11 these instructions for people, because there are so 12 many different options it was a little hard to capture 13 it, and we understand that at least one person sent us 14 a question asking us to please go over the way that 15 the pricing proposals are going to work. 16

The pricing proposal for each offering has 17 basically three components -- one that is based on the 18 volume range; one that is pre-award charges; and the 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

other that is implementation during the implementation 1 charges during that period of time. 2

And if you look at the price proposal 3 itself, there is an offering 1 and an offering 2 under 4 the presumption that perhaps, you know, one company 5 will have two different offerings. If you have three, 6 that’s fine. If you have two, that’s fine. If you 7 have one, that’s fine. We just want to ensure that 8 you have a space to put stuff in. 9

For year one, which if you looked upon -- 10 starting at the beginning of the financial price 11 proposal, what we did in offering number 1 is we had 12 ranges for a volume that went from zero to 50,000; 13

50,001 to 100,000; 100,001 to 150,000; and 150,000 and 14

up. 15

We had pricing -- unit pricing that was 16 different for each, but you’ll notice that there’s a 17

125,000 people in this sample – 125,000 volume, which 18 was split 50,000 for the first tier; 50,000 at the 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

second tier; and 25,000 at the third tier, okay, and 1 then that multiplies its way up. 2

In the case of pre-award charges, we used a 3 sample saying 25 hours estimated for technical 4 assistance at $150 an hour for $,3750. But we also 5 allow not only that kind of a rate times volume but 6 also just a flat charge. So, in this case, for 7 example, training is $10,000 as a flat charge, and 8 there were no other costs, or zero in column D if that 9 was the case. 10

For implementation, again you have 50 hours 11 at $150, so $7,500; training being a flat fee, and 12 charge for the sale of an application interface of 13

$10,000. So, the grand total for option 1 in year one 14 for the pricing components is $198,750. 15

So, for offering 2, the sample that we put 16 there. What we did is we put assumed that certain of 17 the vendors might price this based on the volume as 18 opposed to per tier. 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

So, in this particular case there’s a zero 1 to 75,0000 range with no quantity; 75,001 to 150,000 2 at $1.35 with quantity 125,000, and then nothing here, 3 so that this is assumed that if you had 125,000 you’re 4 giving us one price for the 125,000 at $1.35 each, 5 okay? But again that’s a different pricing model. 6

It’s not tiered. It’s based on a certain anticipated 7 volume. 8

For the charges for pre-award, again, same 9 business. You can either do X number of hours times 10 rate, or a flat fee -- flat rate and when we used that 11 sample and that came to $251,250 in this particular 12 case. 13

What we then did is provided for base year 14 one for two offerings; base year two for two 15 offerings; three, four, five, and for option years one 16 and two also for, you know, the pricing. We’re 17 assuming that the costs pre-award are all pre-award 18 and they don’t exist after the first year. The same 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

with implementation. It wouldn’t exist after the 1 first year. 2

The only asterisk you might put on this is 3 we said you have to enter something in all of the gray 4 areas. What happened is as this thing went through 5 considerations the gray areas on quantity ended up 6 being missing. 7

So, on the quantity, for the ranges section 8

-- the top section of each of the offerings, you do 9 have to enter some kind of a quantity. 10

What quantity do you put in? If you look in 11 the instructions for the financial proposal, in 12

Attachment B of the RFP on page 46 of 81 what we did 13 is gave you the best guess on what year one would be, 14 year two would be, and year three and after would be. 15

So 125,000 year one; year two 75,000; year three and 16 after 50,000 per year. 17

So what we tried to do here is to give what 18 we thought would be the most flexible format for 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

people to put something in, allowing you to either use 1 a flat rate or a quantity times a rate. 2

We also allowed you to have different tiers, 3 but also if everything was based on a single tier 4 which we’ve also seen -- you know, if we think it’s 5 going to be under 125 the first year, you give us a 6 price based on that, and then, you know, if that is 7 the case and it ends up more or less what we do is we 8 sort of square up in year two. 9

And then at the grand there is -- we have to 10 include because they’re in the proposal, we have to 11 include all five years plus the two option years, and 12 then at the very bottom there is a total evaluated 13 proposed price for offering 1, and a total evaluated 14 proposed price for offering 2. 15

The spreadsheet does have to have your name, 16 signature, and date on it, along with your address and 17 your FEIN. 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

And once we get to the question and answer 1 section of this, I’ll be more than happy to try to 2 explain anything that is now not clear. And I hand 3 this back over to, I guess, to Margie. 4

MS. GORDON: Yep. Okay. What I’m going to 5 do is go over the procurement instructions. In 6

Section 4, we did -- as I said, I know that vendors 7 have realized that we have changed over from eMaryland 8

Marketplace to eMaryland Marketplace Advantage, and 9 just to let you know, you have to be registered on the 10 new eMMA. It’s free to register but you have to be 11 registered in order to receive a contract award from 12 the State Retirement Agency. 13

On the instructions of 4.2 you will see 14 where to go and on -- as far as our URL address which 15 is https://procurement.maryland.gov, and once you’re 16 on that page you go on the left-hand side and there’ll 17 be log-in and register to begin the process and then 18 you’ll follow the prompts. 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

Questions, we’ll go over those. I do have a 1 few questions that I received and we will go over 2 that, but you have until at least five days prior to 3 the due date which is April (phonetic) 26th, but you 4 have five days before that to send in any other 5 questions that you may have and providing that, we 6 will review the questions, answer them, and then I 7 will post those questions and answers on eMaryland 8

Marketplace Advantage, plus email them to the direct 9 vendors that were not listed on eMaryland Marketplace 10 at the time. 11

MR. GREENSTEIN: Margie? 12

MS. GORDON: Yes? 13

MR. GREENSTEIN: Just a clarification. I 14 think you accidently said April 26th. It’s August 15

26th. 16

MS. GORDON: I’m sorry -- August 26th. My 17 bad. I’m going backwards in time. I’ll go over the 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

questions near the end, and questions and answers that 1 we have so far. 2

Section 5 are the submissions and we are 3 asking only for emails of your proposals, and that’s 4 to email them to Procurement@sra.state.md.us. They 5 are to be in two separate emails. One will be a 6 technical proposal. The second one will be financial 7 proposal. 8

They all -- proposal email attachments shall 9 be sent with a password protection. Don’t send the 10 password in your email. I will -- when I get them, I 11 will send you an email and request your password, and 12

I am the only one that will request your password. I 13 don’t want your password for financial proposal until 14

I ask you for it. 15

And make sure that in your technical 16 proposal you do not put your financial proposal in it. 17

I don’t want anything that has financial in your 18 technical at all. 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

Now, offerors that are unable to provide a 1 password that opens the proposal will be deemed not 2 susceptible for award. So, I’m asking you, please, 3 send me your file email submissions with a password 4 protected email. 5

Your maximum size email size -- is there 6 still a maximum of email size, Ira? 20 megabytes? 7

MR. DIEHL 35. 8

MS. GORDON: 35 megabytes? Okay. 9

MR. DIEHL: For the attachment. That was 10 one of the questions. 11

MS. GORDON: Email size is 35 megabytes and 12

SRA can only accept emails that are less than or equal 13 to a certain size. If a submission exceeds this size, 14 split the submission into two or more parts and 15 include the appropriate part number in the subject 16 line. For example, part one of two, part two of two, 17 et cetera. 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

All pages of both proposal volumes shall be 1 consecutively numbered from beginning -- page one to 2 the end, page whatever. 3

Your technical proposal and all supporting 4 material should be in Microsoft Word, and your 5 technical proposal should be able to be searchable in 6

Adobe format, as well, because a second searchable 7

Adobe copy of the technical proposal redacted in 8 accordance with confidentiality and proprietary 9 information should be removed. You’ll see that in 10

Section 4.8. 11

Your financial proposal as I said should 12 also be in and all supporting material in PDF format 13 and also searchable in Adobe, and a redacted copy, 14 also. Read Section 4.4 for that information. 15

Proposals and any modifications to proposals 16 will be shown only to State employees or members of 17 the Evaluation Committee and other persons deemed by 18 the Agency to have a legitimate interest in them. 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

Right now requests for extensions of this 1 date and time of August 26th will not be granted 2 except as provided in COMAR 21.05.03.02F. Proposals 3 received by the Procurement Officer after the due date 4 will not be considered. 5

Read over Section 5 very carefully as to -- 6 it goes into depth about the format of the technical 7 proposal and the financial proposal. Section 6 is 8 your evaluation criteria. Please read over how the 9 vendors are going to be evaluated. The award 10 determination is basically technical factors will 11 receive greater weight than financial factors. 12

And before I ask any further -- go over the 13 questions, do I have any questions from you to ask our 14 panel? 15

MR. HARRISON: I do have a question. This 16 is Trey Harrison with LexisNexis Risk Solutions. 17

Thank you for walking through the Attachment D 18 spreadsheet. That helped a lot. 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

I want to confirm and make sure I heard the 1 right thing. So, even though that there’s two 2 offerings listed in your spreadsheet, if we want to up 3 to three or more, and if I heard you correctly, we 4 basically just add those below? We copy the rows for 5 offerings one and two and make offering three or four, 6 or however many we need; is that correct? 7

MR. GREENSTEIN: We weren’t sure how many 8 people would have -- if you want to do that then why 9 don’t you contact Margie and let her know and she can 10 produce a revised spreadsheet for you specifically. 11

MR. HARRISON: Okay. I just note that there 12 are nine methodologies, I guess, listed on page 4 of 13 the RFP, so I’m having to (indiscernible) confuse 14 this, my options. But I’ll reach out to Margie. 15

My other question that’s directly related to 16 this is as vendors potentially offer more than one 17 solution, if the State takes more than one there’ll be 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

economies of scale in terms of project management, 1 accounts setup, and things like that. 2

Is there any way we could find out to devise 3 a discount method of the three methodologies from us, 4 you know, each individual point solution will be 5 cheaper than just taking one in isolation? And I can 6 roll that all up into a question for Margie, but I 7 wanted to put that on the table. 8

MR. GREENSTEIN: I think that would be a 9 good thing to submit to Margie and let us contemplate 10

it. 11

MR. HARRISON: Sure thing. Sure thing. 12

Thank you. 13

MS. GORDON: Anybody else? 14

(No response.) 15

MS. GORDON: All right. 16

MR. GREENSTEIN: Margie, can I make one 17 statement, too? 18

MS. GORDON: Go ahead. 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

MR. GREENSTEIN: And that is, I’d really, 1 you know -- and this is Ira -- I really do appreciate 2 the flexibility that everyone has shown in terms of 3 dealing with this rather unusual format and all of 4 this stuff. I’m looking forward to this, what’s going 5 to happen in the next several weeks. 6

I think, you know, my compliments to -- and 7 this is a totally unusual thing for us to do in a pre-8 bid conference, but I want to specifically compliment, 9 you know, the procurement group here and any others 10 who are participating for the flexibility that they’re 11 showing in order to figure out a way to make all of 12 this stuff work in this particular time of pandemic. 13

MR. DIEHL: You’re on mute, Margie. Margie? 14

MS. GORDON: I’m sorry. 15

MR. DIEHL: There we go. 16

MS. GORDON: Questions and answers. What 17

SSO do you currently have? And answer, currently we 18 don’t have a Single Sign On except for applications 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

running within the Agency networks for Agency 1 employees. This does not apply to external retirement 2 plan participants using the mySRPS secure internet 3 portal about which this RFP is issued. 4

Two, is mySRPS platform compliant with SAML 5

2.0? MySRPS works with opendldConnect. 6

Three, please share existing user 7 provisioning process for mySRPS. We use the services 8 of current authentication solution provider to 9 validate and authentic a mySRPS user using multi-10 factor identification process. One, a user 11 name/password, and two, OTP sent via email, phone, or 12

SMS. 13

MR. GREENSTEIN: It’s a one-time password. 14

MS. GORDON: Thank you. Four, based on the 15 solicitation, number of users are 400,000; please 16 confirm. Answer: that’s our maximum number as of 17 today. Not all potential users will ultimately 18 register to use the mySRPS application. 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

Five, what is the time line for the POC you 1 are looking for? Based on RFP Section 4.11.1, current 2 time line, our best guess is that any POC will be in 3 the upcoming fall or perhaps early winter. 4

Six, question was pertaining to the pricing 5 sheet of which we went through earlier. Seven, does 6

MSRA have metrics on the geographic locations of the 7 participants that could be shared with bidders? That 8 was RFP Section 2.2. The answer is the Agency does 9 not have metrics on location of mySRPS users and -- 10 oh, excuse me -- does have metrics on location of 11 mySRPS users and will share them. For your 12 information, they are entirely within the United 13

States. 14

Question eight, please specify any file size 15 limits for email submissions. If bidders’ responses 16 exceed any email size limits are multiple files and 17 emails allowed? Please confirm. PDF format is 18 acceptable for final RFP responses. 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

I answered that, and we would prefer 1

Microsoft Word file in addition to a PDF file and a 2 third file which would be a redacted PDF file. So, 3 you’ll have three files. 4

Question nine, bidder assumes claim of 5 confidentiality shall follow the Tab A title and Tab 6

Table of Contents; please confirm. You will insert 7 your claims of confidentiality in between Tab A and 8 the Table of Contents. So, you’ll have Tab A, the 9 title, and then you’ll have your claims of 10 confidentiality, and then your Table of Contents. 11

Question ten, bidder assumes response to 12 this requirement is to identify exceptions only; 13 please confirm. That’s under RFP Section 5.3.2.F.4. 14

That is correct. Proposals should identify exceptions 15 only if requirements of the RFP are not acceptable to 16 the bidder. 17

Question eleven, in lieu of a current SOC 2 18 report for the proposed solution, would the State 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

accept bidders providing a date of when a SOC 2 would 1 be available or plans for completing a SOC 2? That’s 2 per RFP Section 5.3.2.0. The Agency will accept a 3 future SOC 2 Type 2 commitment if it is in the next 4 four months. 5

However, since the Agency cannot assume that 6 there will be no adverse findings, an award would have 7 to be contingent on an acceptable report and any 8 significant findings in the sole discretion of the 9

Agency would be grounds for immediate revocation of 10 any award made. 11

The Agency also points out that this clause 12 only applies if the vendor processes or stores 13 sensitive data provided by the Agency, a condition in 14 which the Agency does not assume will be the case for 15 every proposed identity-proofing solution. 16

That is all the questions that I’ve received 17 so far. As I said, these will be in the minutes, and 18 if you have other questions, as I said I request them 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

to be sent to me within five days of the proposal due 1 date of August 26th so that we’ll have time to answer 2 them and post them. 3

That’s all I have. Anybody else have any 4 questions? Any comments? 5

MR. SINGH: This is Surendra from UVS 6

Infotech. I just heard you mention that the Agency 7 already has the SSO platforms. Can you please confirm 8 does it have that capability to connect to the API -- 9 to the identity proofing system? 10

MR. GREENSTEIN: Let me take a first stab at 11 that. The premise that you have is that we have SSO 12 platforms, and the answer to that is for the purpose 13 of this procurement which deals with the external 14 users, not internal users, there is no SSO platform 15 right now. 16

What we would expect is that using either 17

APIs that the vendors provide or something similar 18 that the ID Proofing solution will be included in the 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

overall flow of the registration process for mySRPS. 1

There’s no SSO involved in this. 2

MR. SINGH: Yeah. I understand. Just a 3 follow-up question. Like, you know, so the intent of 4 this question is where do you create the identity, 5 like when the user is supposed -- the user is trying 6 to register. The registration process, what part 7 actually? What component clears the user in the 8 system? 9

MR. GREENSTEIN: Chandra, do you want to 10 take that one or do you want me to wing it? 11

MR. PURANAM: I would say I’ll let you talk 12

Ira or Tom. 13

MR. MONTANYE: So, I’ll chime in. It’s Tom 14

Montanye. The account is -- the identity in the 15 account is created in our -- currently we’re using a 16

SecureAuth for that to house the member account, 17 basically -- the member ID. Does that answer the 18 question? 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

MR. SINGH: Okay. Yes. Yes. Is it 1 possible if you can share your process as a State 2 process for registration of the user and how do they 3 access? 4

MR. MONTANYE: We have it. I’m not sure 5 whether we want to share that publicly or it may have 6 to be someone else’s response. 7

MR. GREENSTEIN: Thank you. Submit that 8 question to us and let us -- you know, because what we 9 don’t -- obviously, you know, there will be certain -- 10 once a person is authorized by us to begin the sign-on 11 for the registration process they go through a level 12 of authentication, and then what we would do after 13 that is send the process to an identity proofing 14 solution in order to bolster that identification. 15

Exactly how we do it and what data fields we 16 use in order to identify the individual on our end, 17

I’m not sure we want to share that. 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

MR. DIEHL: Now, it provides somewhat of an 1 outline of here’s the steps, not necessarily all the 2 details. 3

MR. GREENSTEIN: Yeah. So if you would 4 submit that question in writing we can provide a 5 thoughtful response to it. 6

MR. COLLINS: Okay. Hi. This is Hugh 7

Collins from IBM. Could I ask kind of a follow-up 8 question to that? 9

MR. DIEHL: Sure. 10

MR. COLLINS: Thank you. So, in general, 11 when we’re looking at the contents of the RFP, the 12 process that is described is kind of what we perceive 13 to be a pro-active ID proofing scenario where the 14 participant is asked ahead of time to -- you know, 15 they request access and then there’s a process they go 16 through that you described, you know, several options 17 in terms of how the solution can respond to that to 18 affect the ID proofing. 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

Is there any interest on the part of the 1

State for a more reactive process where there’s more 2 of a continuous authentication type of approach taken 3 where, you know, the individual sessions with the 4 users are evaluated on an ongoing basis to make sure 5 that the user is, in fact, who they say they are? 6

Things like behavioral biometrics or a combination of 7 behavioral biometrics and IT lists and geo-location, 8 and, you know, other attributes of that particular 9 user and past sessions to establish that individual 10 trust on an ongoing basis? 11

Is the organization open to considering that 12 kind of a solution? 13

MR. DIEHL: I think we already leveraged 14 some of that through the existing authentication 15 vendor, and Chandra and Tom, you can chime in, or 16

Harris. But those are all functions of existing 17 current solutions. So, you know, as you go through 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

the authentication process the user is -- you know, 1 there is a risk analysis that is performed. 2

I think what we’re looking for here is to 3 really -- you know, we have somewhat of an ID proofing 4 process, internal process in place but we would like 5 to make that a much more robust solution. Does that 6 kind of capture things, folks? 7

MR. GREENSTEIN: I think there’s one other 8 thing to mention and that is that because this is only 9 available -- the registration is only available to 10 participants in the program, this is not something 11 where you can just go online if you have no specific 12 relationship to us and just try to register. 13

This is something where we control who can 14 do it in the first place, who is authorized to 15 register, and so it makes for a, you know, a little 16 bit more of a closed process and then perhaps what 17 some people may be envisioning here. 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

Currently what happens is we mail an 1 enrollment code to every person who is allowed to 2 register in the first place and they have to answer 3 that enrollment code within a certain period of time, 4 or they’d have to call us up and get specifically sent 5 an enrollment code. That’s what we are currently 6 doing. 7

MR. SANSCHAGRIN: Hi Margie and team. This 8 is Nick with Entrust Datacard. May I ask a quick 9 question? 10

MS. GORDON: Yes. 11

MR. SANSCHAGRIN: Right. So we are looking 12 at the compliance. So we saw a couple of words like 13

FIPS, NIST, FEDRAMP. Could you expand a little bit on 14 what your compliance expectations are for this 15 solution? 16

MR. GREENSTEIN: Right. So let me take that 17 one, I guess. There is State template language that 18 may or may not apply. What we’re looking for is a 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

solution that is itself proven to be secure, and we 1 are, by definition, in the National Institute of 2

Standards and Technology we are a moderate risk 3 environment, and what we would be expecting is 4 something certified at either the moderate or high 5 level risk. 6

MR. SANSCHAGRIN: Okay. Thank you. Do you 7 have any documentation or I guess most of that is 8 listed in the RFP? There are about five or six links 9 for different State compliance laws and regulations. 10

I believe it’s a lot to piece through. 11

Is there, you know, one set of standards you 12 need to, you know, adhere to or is the vendor 13 responsible for kind of going through all those 14 documents and trying to make sure there’s compliance? 15

MR. GREENSTEIN: Well, I have a great deal 16 of empathy for people. They’re just standard language 17 from the State which we are not allowed to change. So 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

you have to read it and look at it however you think 1 it would make sense. 2

I would say that given -- the State 3 standards, for example, are written and based on 4 starting with the NIST framework. So while there may 5 be a lot of – it may look like a lot, I think it’s 6 going to be highly repetitive. 7

But again, that’s something which we’re 8 obligated to include and I can’t tell you that we 9 could change that. 10

MR. SANSCHAGRIN: Okay. And something like 11

FEDRAMP, is that a make or break? I didn’t go through 12 all the different links yet to figure out if that’s a 13

State requirement, but any, you know, sort of cloud 14 solution as a service FEDRAMP comes up. Is that 15 something that’s nice to have or is that a 100 percent 16 need? 17

MR. GREENSTEIN: I would judge that as a 18 nice to have, not a 100 percent need, but if your 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

solution -- you know, whether you have a FEDRAMP 1 certification or not is one means of showing that your 2 solution is secure. It is not the only means of doing 3

it. 4

MR. SANSCHAGRIN: Thank you. 5

MR. SINGH: Hi. This is Surendra from UVS 6

Infotech. I have one more question in terms of scope. 7

So, are you expecting the vendor to do the 8 data conversion for the existing or just started? 9

Suppose we get into identify proofing like knowledge 10 base, or whatever like, you know, based on, you know, 11 anything, like new system. It would start -- like it 12 will be Agency responsibility to take care of like, 13 you know, migrating any old data to the new system, 14 like, you know, or it would be only starting for the 15 new register you can say -- the new people who are 16 registering? Like, you know, who would be 17 responsible? 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

Because, you know, I’m looking one of the 1 price proposal technical assistance column. Are you 2 expecting vendor will do or will be taken care of by 3 the Agency, that one? Just let me know if you want me 4 to repeat that question. 5

MR. GREENSTEIN: No, that’s okay. We are 6 going to have to retrofit, if you will, the people who 7 have already registered to use the site. We’re going 8 to have to come up with a way of getting additional 9 identification through the ID proofing solution before 10 they’re allowed to move ahead. 11

So at some point or another when the 12 solution is there we will have to go out and ensure 13 that people who are already registered have to go 14 through some kind of supplemental process, that while 15 we will be working with the ID proofing vendor to do 16 that, the process of doing that, I believe will fall 17 on the State to do, not on the vendor. 18

MR. SINGH: Thank you. 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

MR. GREENSTEIN: And if any of the others -- 1

Tom or Chandra or Will, if you feel differently, chime 2 in now. But that’s certainly my assumption. 3

MR. MONTANYE: Well, I think -- this is Tom 4

-- I think we’ll have -- you know, we’ll have to have 5 the assistance of -- when we devise a strategy of how 6 to make that happen, we’ll need assistance to be able 7 to do that to know what options we have and what would 8 be the easiest way. 9

So, I think it would be largely 10 collaborative, you know, at least to the point where 11 we’re sure that a conversion is possible and we’re 12 going about it the right way and, you know, the heavy 13 lifting could be done by the Agency and the checks -- 14 the quality control to make sure that it went through 15 properly. 16

But certainly we’ll need cooperation from 17 the vendor to make sure that we’re taking a supported 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

approach and an intelligent approach that will 1 suffice. 2

MR. GREENSTEIN: I think the bulk of the 3 work will be on the Agency to do, but certainly we 4 will need the cooperation of the vendor in the whole 5 process in making it through. 6

MR. SINGH: Again, thanks for clarifying 7 that. 8

MR. SANSCHAGRIN: So, this is Nick here with 9

Entrust Datacard. Just another quick question. I 10 heard in the beginning that the aim was to go with the 11 direct vendor solution. There was also the 12 opportunity to work with a reseller so long as the 13 reseller supports the solution. 14

Am I correct in assuming the preference is 15 to work directly with the end user, or is there a 16 preference to go via a reseller? 17

MR. GREENSTEIN: I wrote that section of the 18

RFP so let me answer that. We have no problem with 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

the reseller. I think we stated that the problem 1 we’ve got is where there’s a split responsibility. 2

For example, the reseller is there in order 3 to sell it and to -- all of that, but when we start 4 getting into technical questions, because our contract 5 would be with the reseller, that means that we don’t 6 have a direct relationship with the product owner, per 7 se, and that the technical support would then be 8 coming from a different party that is not directly 9 managed by the reseller, and that’s what we’re trying 10 to avoid, is a situation where there is a reseller but 11 the reseller can’t handle any of the really detailed 12 kind of questions or technical stuff. 13

And to the extent that there is consulting 14 support required in order to make a solution work, 15 what we don’t want to have is the reseller basically 16 brokering through the technical support from the 17 product owner. So we’re trying to avoid that to the 18 extent it’s possible. 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

If the solution is only sold through 1 resellers, we would need some way of -- you know, we 2 would need some kind of a reassurance that we’re not 3 going to get into a finger pointing kind of a thing 4 where we’re trying to get support and we have no 5 contract with the entity that’s providing the support. 6

Does that make it at all clear? 7

MR. SANSCHAGRIN: Very helpful. Understood, 8 and that makes sense. You want to be able to have a 9 direct line of support where you’re not reaching out 10 to the reseller to then, you know, bypass over to the 11 end -- you know, vendor group. That’s clear. If I 12 could expand on the -- 13

MR. GREENSTEIN: We’ve had that happen twice 14 to us so we are trying to avoid it again. 15

MR. SANSCHAGRIN: That’s fair. And to 16 expand, and I’ll close after this, you know, Entrust 17

Datacard, we received the RFP via kind of an inbound 18 email a few weeks ago. There’s mention here that this 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

RFP’s been going on for quite some time, or at least 1 the project. 2

So, would it be safe to assume that your 3 team has spoken with other vendors in the past, had 4 some POCs, or, you know, even working with a systems 5 integrator, or is everybody sort of on the call in the 6 same type of situation here? 7

MR. GREENSTEIN: Everyone’s in the same 8 situation. What we’ve been -- the RFP development 9 itself took a very, very long time. We have no POCs 10 that have ever happened dealing with identity 11 proofing, just with the original authentication 12 process. 13

Everyone’s in the same boat on this, and 14 we’ve tried as scrupulously as we possibly can to 15 avoid getting into conversations with identity 16 proofing vendors up until now so that we don’t 17 compromise the ability of a given solution provider to 18 provide that solution. 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

There is a State rule that says that if 1 someone is involved in developing requirements for an 2

RFP they cannot bid it, and consequently we try to 3 keep the vendors out of that process entirely to be 4 able to maximize the amount of responses that we get. 5

But this is -- while the process has been 6 around and while we’ve been developing the system for 7 a while and the RFP for a while, this is the first 8 time we’re getting to speak with anything specific 9 dealing with ID proofing. 10

MR. SANSCHAGRIN: Very helpful. Thank you. 11

MR. GREENSTEIN: I mean, we’ve obviously, 12 you know, looked at what’s in the marketplace, but we 13 have not had any kind of proofs of concept or anything 14 like that up until now. 15

MR. GURUNG: This is Amrit Gurung of Alpha 16

Technologies. I’ve got a quick question. Are you 17 able to tell us -- do you currently have an 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

identification process in use and if there’s any 1 incumbent vendors holding it? 2

MR. DIEHL: Hi. Can you repeat that? 3

MR. GURUNG: Do you currently have an 4 identification process that’s in use, and also if 5 there is an incumbent vendor supporting -- providing 6 the support? 7

MR. DIEHL: I don’t -- I’ll take a whack at 8

it. I would say that, no, there is no incumbent 9 vendor providing that solution. 10

As Chandra had kind of pointed out, we go 11 through a process to identify -- you know, we know who 12 our membership is, so there is a time-sensitive 13 notification that goes out and that’s used to kind of 14 initiate the whole registration process. 15

They’re given instructions and criteria and 16 once they begin the registration process, based upon 17 information that’s available to us, we’ll satisfy -- 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

along with that one-time registration code, we’ll 1 begin the registration process. 2

So, we’re really looking to again make this 3 a much more robust environment utilizing additional 4 information that’s available in the marketplace, and 5 also I think trying to avoid at some point -- you 6 know, one of our industry, one of the risks is 7 potential fraud, especially at the -- I’ll say the 8 member relationship level. 9

And so we want to know who -- you know, we 10 want to know that you are who you are during that 11 registration process, okay? 12

MR. GURUNG: Got it. Thank you. 13

MR. DIEHL: All right. Thank you. 14

MR. SANSCHAGRIN: I hate to be another one 15 to hear, but Nick with Entrust Datacard. So, would it 16 be safe to assume that these external users, the 400K, 17 are they comfortable using this solution on a mobile 18 phone or are we supposed to be providing a solution 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

that’s available on pretty much any consumable means 1 they have access to the internet with? 2

I don’t know if that question makes sense, 3 but just trying to understand, these end users of 4 yours, are they comfortable putting, you know, a 5 corporate app on their phones, those kinds of things? 6

Have you thought about -- 7

MR. DIEHL: 20 to 90, okay? Age group -- 20 8 to 90 and potentially beyond. So, you can take a 9 whack at that yourself and try to draw some 10 comparisons to maybe some individuals in your own 11 household and what would they be comfortable with. 12

MR. PURANAM: But to answer the question, 13 currently, the current group of users are using all 14 devices. They’re using desktop. They’re using a 15 mobile phone. They’re using iPads. So whatever 16 device is comfortable for them, they’re using. So I 17 would expect that to continue, not thinking about 18

(indiscernible). 19

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

But one question is about the app. We don’t 1 have an app. They use the -- just go to the browser, 2 click on the link and it opens up and you do your work 3 in that browser. But as of today currently we do not 4 have an app. 5

MR. SANSCHAGRIN: Thank you. 6

MS. GORDON: Anybody else? 7

MR. TOWNSEND: This is Paul Townsend from 8

Acuant. Just a logistics question about the password 9 protected files. Do you expect each one of the 10 different versions of the technical and the 11 spreadsheets to be protected separately, or would a 12 single zip file that’s password protected for each 13 volume be acceptable? So you have two passwords 14 instead of six. 15

MS. GORDON: I’d like a password to open the 16 whole file. 17

MR. TOWNSEND: All versions? 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

MS. GORDON: Yeah. Well, for the technical 1 email I’d like one password. For the financial I’d 2 like a different password. 3

MR. TOWNSEND: Right. But you want that on 4 the individual file, on either the Word document or 5 the PDF or the redacted PDF; or could the three of 6 those be in a single zip file that is password 7 protected? 8

MS. GORDON: You can do a zip file. 9

MR. TOWNSEND: Thank you. 10

MS. GORDON: Anyone else? 11

(No response.) 12

MS. GORDON: Okay. If you find that you 13 have more questions, please forward them to me using 14 the procurement email address that’s on your Key 15

Information Sheet, and I will forward them to the 16 evaluation group, or myself as far as being able to 17 answer them, and we’ll get those to you. 18

Serving Maryland, Washington, and Virginia

410-766-HUNT (4868)

1-800-950-DEPO (3376)

So, if no one else has anything extra to 1 add, the evaluation group, let me know. Okay? 2

MR. GREENSTEIN: I’m fine. 3

MS. GORDON: Bob? 4

MR. DIEHL: Thank you very much, Margie. 5

MS. GORDON: Thank you. So, everyone, we 6 thank you for coming to the Pre-Proposal conference 7 virtual, and, as I said, with our recording we will 8 get you the minutes and we will get you a list of all 9 the vendors that have attended, and questions and 10 answers, all right? 11

And if you have any other questions other 12 than that, just send me an email and I will try to 13 answer them as best as I can. 14

MR. DIEHL: Can I just say one thing, 15

Margie, and it’s part of the RFP? We just wanted to 16 kind of encourage the straightforward approach to the 17

RFP responses,…