SRA20-08 Identity Proofing SaaS RFP - Questions & Responses.pdf

SRA 20-08 – Identity Proofing SaaS Questions & Responses

1. Do you have a preferred method for IDV of all the ones mentioned?

MSRA Response: No preferred methodologies have been established. The items identified in section 2.2.3 are marketplace observations.

2. When will the decision on a vendor be made?

MSRA Response: It is possible a decision could be made by the end of the calendar year, depending upon the number and length of the POCs.

3. Will the State work with a partner of that vendor as the primary contact for the solution?

MSRA Response: We prefer not to have resellers, but if we have to, we want that reseller to be able to FULLY support the proposed solution. We only want 1 responsible party to deal with.

4. Will a POC be required?

- If so, how long will the POC period last?

- What will determine a successful POC?

MSRA Response: Yes, for selected proposals.

Please see RFP Section 4.11.1 - Based on the current timeline, our best guess is that any POC will be in the upcoming fall or perhaps early winter.

A not yet determined set of criteria will be used evaluation the success of the requested POCs.

o Who will be responsible for the integration into the existing software?

MSRA Response: Please see RFP 2.3 (Responsibilities and Tasks)

6. Do you have specific guidelines around required / desired SLAs?

MSRA Response: Please see RFP 2.5. The proposed SLA(s) will be used in the evaluation process.

7. Have you integrated successfully with an IDV provider previously via API?

MSRA Response: No. This will be our first IDV provider integration. SRA used APIs to integrate the primary authentication vendor with mySRPS, as it has used APIs in the process of integrating other commercial products.

8. Do you have any document requirements / restrictions?

MSRA Response: We understand that available documentation may vary by each proposed solution, and the Agency can clarify during any Oral Presentation what documentation would be acceptable. In this manner, prior to submission of any Best and Final financial offer, the bidder will have a chance to adjust pricing to reflect a common understanding of

Agency requirements.

9. In section 2.2.5 State Staff and Roles, you indicate, “Agency development team will develop the mySRPS code that integrates with the selected ID Proofing SaaS Solution(s).”

- What integration services are required of the selected vendor(s)?

- Solution configuration? (e.g. initialization, data seeding, etc.)

- Endpoint enablement? (for ID proofing checks and responses)

- Other?

MSRA Response: It is anticipated that integration coding will be performed by the MSRA development team. We also expect that specific services will require different levels of integration support by the solution provider. Please see RFP section 2.3. The level of vendor support should be identified in each option proposal.

10. For section 2.3 Responsibilities and Tasks, will the solution provider(s) have responsibility/access to the mySRPS application / code to review / troubleshoot integrations to ensure seamless integration?

MSRA Response: MSRA intends this to be a collaborative effort. Relevant code can be shared on as "As Needed" basis, along with sharing application sessions for integration and troubleshooting purposes.

11. RFP Section 5.3.2(F)(1)(b) requests video or an online demo of the end user experience.

This requirement seems to indicate the need to submit video content with the proposal.

That could cause problems with both submission file size and the password protection that is required for this proposal submission. In lieu of submitting video content with the proposal, is MSPD willing to schedule a live demo with Offerors during the proposal evaluation process? If not, please provide guidance as to the type of files or methodologies that are acceptable for a response to this section (e.g., access to a Microsoft Teams session with a recorded video presentation; or a YouTube video).

MSRA Response: No online demo is required until a vendor is invited to make an Oral

Presentation. Thus, it is not part of proposal submission.

12. Before we can prepare a full proposal, it is essential we have sufficient time to consider

MSRA’s responses to inquiries. The contract is critically important to the agency, and

Offerors want to consider your needs carefully. To that end, if MSRA is unable to provide answers at least 10 business days before the current proposal deadline, we respectfully request an extension of 10 business days after the time that all answers are posted in an addendum.

MSRA Response: The question submittal deadline is Friday 8/14. All efforts are being made to respond to the questions as quickly as possible.

13. Can you please confirm the different channels/options to access my SRPS Internet portal?

Desktop/Laptop, Mobile Phone, tablet, …?

MSRA Response: Desktop/Laptop, Mobile Phone and Tablet. mysSRPS uses responsive web design principles.

14. Are you planning to develop a mobile App to access mySRPS? If yes, will it be possible to register using this application in the future?

MSRA Response: No, a mySRPS APP is not in the current plan.

15. Is the ID Proofing solution required just for the initial registration?

MSRA Response: Yes. We decided to use ID proofing services as part of the registration process, not as a step-up when a participant wants to perform a more sensitive transaction.

However, should this strategy change, we wanted to be up-front that the volume of use of the SaaS service might adjust at some point.

16. Do you require any type of authentication for the future login after the initial registration?

MSRA Response: Yes. We will continue to use a Username & Password One Time

Passcode (OTP) via email, phone or SMS process already in place for access to mySRPS after the participants registration.

17. Is the login, after the initial registration, covered by the commercial service (SecureAuth)?

Or do you need any additional security options?

MSRA Response: Yes.

18. Can you confirm the total volume of required registrations? Do you need to register or re-register the full database or participants (+400K)?

MSRA Response: That’s our maximum number as of today. Not all potential users will ultimately register to use the mySRPS application. Please see page 46 of the RFP for anticipated usage.

19. What’s is the number of new participants per year?

MSRA Response: Please see page 46 of the RFP for anticipated usage. The year three usage of 50.000 is the anticipated on-going registrant count.

20. Do you have any data on how these total number of registrations will spread over time?

(i.e. New Registrations/Existing Re-registrations)?

MSRA Response: Please see page 46 of the RFP for anticipated usage. MSRA is in process of distributing registrants time sensitive packets, so that empirical data is not available.

21. What type of matching information is available for each individual? Can this information be accessed by the ID proofing provider?

MSRA Response: It is anticipated that where the mySRPS system needs to provide participant information, that will be done through an API.

22. Do you wish to apply the blacklist checking only at the time of registration?

MSRA Response: Yes. We decided to use ID proofing services as part of the registration process, not as a step-up when a participant wants to perform a more sensitive transaction.

However, should this strategy change, we wanted to be up-front that the volume of use of the SaaS service might adjust at some point.

23. Do you provide any other secure access to participants like IVR or Call Center?

MSRA Response: Yes, secure access to a limited read only data set is available to participants via IVR.

24. Can the participants register via “mySRPS Registration Hot Line”? Or this is just for support.

MSRA Response: We do not currently register people ourselves for mySRPS over the phone, we just help them get themselves onto the site to register themselves.

25. If possible, can you register by a phone call to the Hot Line?

MSRA Response: No.

26. Are you looking to also secure the registration via the Hot Line ?

MSRA Response: No.

27. Do you need to re-register participants already enrolled via the Hot Line?

MSRA Response: No, since registration does not occur via the "Hot Line"

28. Is the registration at mySRPS an individual registration? Or can a caregiver/family member have any type of access to the participant account?

MSRA Response: Yes, mySRPS is an individual registration. Caregivers/family members, including Powers of Attorney and Guardians, are not eligible for access to a participants accounts.

29. Does fraud prevention and identifying known fraudsters hold any priority in the overall design of the solution?

MSRA Response: Yes, fraud prevention is a priority in the solution design.

30. The RFP is asking for information on our Info Sec information which we consider to be proprietary. Does the state have a MNDA that can be signed by both parties to ensure this information is kept confidential? Our intent is to include our Info Sec package in the response to address the questions in the RFP but we need to ensure our security information is not disclosed to any third parties.

MSRA Response: Please refer to Sections 4/81 and 5.3.2 (B) of the RFP. This addresses the specific attention that the Vendor should give to confidential and/or proprietary commercial information.

31. I think I heard on the call that the agency would be willing to create a custom pricing sheet for companies who had more than 2 pricing options. TransUnion has 3 models/approaches we would like to propose for MDSRPS. Can you adjust the form so we have 3 models please?

MSRA Response: As far as the Financial Proposal – just use another copy of the Financial

Proposal and put the 3rd model on that.

32. Sorry for the multiple emails. Also on Tab I we have been requested for all current and past contracts within the state of MD for 5 years. This list for us is very long over 50 contracts.

Is there a cap on how many you want from us?

MSRA Response: The 10 largest by dollar volume (per year, if an ongoing contract).

33. Proof of Concept:

a. Will this be via a test data environment?

MSRA Response: Yes, the integration development will not occur in the Production environment.

b. Will this be a live production data environment?

o Please note that live data requires contracting agreements - the service provided is an

FCRA regulated service.

MSRA Response: No, the integration development will not occur in the Production environment.

c. What is the scope of the POC for this type of environment?

MSRA Response: Please see section 4.11.2 of the RFP for an outline of the activities expected in the POC.

d. Do you anticipate the POC to run longer than 4 weeks as noted in the RFP?

MSRA Response: MSRA would like to keep the POC to a maximum 4 weeks. Prior POCs for other solutions were often impacted by the complexity of the integration and the responsiveness by the vendor to address support requests.

e. What is the Volume?

MSRA Response: The POC volume has not been determined.

Financial Proposal Evaluation

34. How is the Total Proposed Price calculated?

MSRA Response: Each option proposal will be evaluated separately. Therefore there will not be a Total Price.

35. If more than one service is priced, is the Total Proposed Price specific to each service offering or the combination of all service offerings?

MSRA Response: Total Proposed Price specific to each service offering.

36. How should a multi-offering discount be presented in the Financial Proposal? That is, if the

Offeror proposes a discount based on the usage of multiple products in combination, how should this be reflected in the pricing spreadsheet when calculating the Total Proposed

Price?

MSRA Response: Each offering pricing proposal should be independent of other offerings.

This will all MSRA to conduct a comparative analysis of similar services and provide the most flexibility in option selection.

37. For service offerings that have an annual fee as a pricing component, how should that be reflected in the pricing tables beyond Year 1?

MSRA Response: The annual fee should be included in the pricing ranges for each option.

38. Is the Offeror allowed to update the Financial Proposal spreadsheet to support the incorporation of more than 2 service offerings? If not, please provide a revised spreadsheet that supports up to six (6) service offerings.

MSRA Response: Please use additional copies of the Financial Proposal and put the additional models on them.

Technical Proposal:

39. The instructions in §5.3.1 states that “In addition to the instructions below, responses in the

Offeror’s Technical Proposal shall reference the organization and numbering of Sections in the RFP (e.g., “Section 2.2.1 Response..., “Section 2.2.2 Response . . .,”). However, §5.3.2 specifies tab formatting and section requirements that do not directly relate to the content presented in sections 2, 3, and 4. While some of the Scope of Work, General Requirements, Procurement Instructions sections are specifically referenced in §5.3.2, many are not.

Please clarify the response structure that is required to incorporate responses to all sections of the RFP, including which subsection responses each Tab should include.

MSRA Response: Please number your sections as you respond to each section and put them in Section Tab E and Tab G and H for Section 3.10.1, and so on.

40. S5.3.2 identifies specific Tabs under which the content for each response is intended to be placed.

a. There are no specifications provided for Tabs F and N. Please clarify the content that the

Offeror needs to address in these “missing” Tabs.

MSRA Response: Please skip Tabs F and N, since there are none in this solicitation.

b. As the Technical Volume is being submitted as an electronic document, rather than a printed document, are each of the Tabs supposed to be submitted as a separate file or can a single file structure be used that identifies the Tab as part of the organization structure/numbering scheme?

MSRA Response: Please identify the Tabs by using a single page with the Tab Letter on it.

41. The instructions in §5.3.2.N Technical Proposal – Required Forms and Certifications states that all forms required for the Technical Proposal are identified in Table 1 of Section 7.

a. Section 7 states that Attachment B – Financial Proposal Instructions and Form must be submitted with the proposal. It is our understanding that this is NOT to be included as part of the Technical Volume (even as an attachment) but submitted as a separate Financial

Volume. Please clarify.

MSRA Response: The Technical Proposal is to be submitted in a separate password protected email and the Financial Proposal is to be submitted in a separate password protected email. No Financial information is to be included in the Technical Proposal.

b. Please clarify which Attachments and Appendices must be included with the Technical

Proposal Volume, and which must be included with the Financial Proposal Volume.

MSRA Response: Section 7 Table identifies what is to be sent with your submission: It tells you when to submit (2nd column)