New Jersey Is an Equal Opportunity Employer • Printed on Recycled and Recyclable Paper

PHILIP D. MURPHY

Governor

State of New Jersey

DEPARTMENT OF THE TREASURY

DIVISION OF PURCHASE AND PROPERTY

PROCUREMENT BUREAU

33 WEST STATE STREET

P. O. BOX 230

TRENTON, NEW JERSEY 08625-0230

ELIZABETH MAHER MUOIO

State Treasurer

TAHESHA L. WAY

Lt. Governor

AMY F. DAVIS, ESQ.

Acting Director https://www.njstart.gov

4/15/2025

To: All Interested Bidders

Re: Bid Solicitation # 25DPP01136

T2970 – CUSTOMER QUEUING SYSTEM FOR NEW JERSEY MOTOR VEHICLE COMMISSION

Current Quote Submission Due Date: April 17, 2025 (2:00 p.m. Eastern Time) REVISED QUOTE SUBMISSION DUE DATE: April 30, 2025 (2:00 p.m. Eastern Time)

Bid Amendment #2

The following constitutes Bid Amendment #2 to the above referenced Bid Solicitation:

• The Quote Submission Due Date has been extended from Thursday, April 17, 2025 to Wednesday, April 30, 2025; and

• Answers to the Bidder electronic questions.

It is the sole responsibility of the Bidder to be knowledgeable of all of the additions, deletions, clarifications, and modifications to the Bid Solicitation and/or the New Jersey Standard Terms and Conditions relative to this Bid Solicitation as set forth in all Bid Amendments.

All other instructions, terms, and conditions of the Bid Solicitation shall remain the same.

Bid Solicitation #25DPP01136

T2970 – CUSTOMER QUEUING SYSTEM FOR NEW JERSEY MOTOR VEHICLE COMMISSION

Answers to Questions

Where applicable, each question references the appropriate Bid Solicitation section.

# Bid Solicitation Section Reference Question (Bolded) and Answer

1 Quote Submission

Q: Please confirm a Bidder may deliver a hardcopy quote instead of submitting a response electronically.

A: Please be advised that all Quotes shall be submitted electronically through

NJSTART.

2 Quote Submission

Q: Should I check that I have properly completed and attached all of the required documents with my submitted Quote?

A: Yes. Prior to the Quote Opening Deadline, a Bidder should review the documents comprising the submitted Quote to ensure that all of the required documents have been completed and attached. Oftentimes a Quote is deemed non-responsive because a Bidder fails to attach a required form or attaches a blank form. To review a submitted a Quote, a Bidder should log into NJSTART and review each document attached to the Quote submission. Instructions on how to review a submitted Quote can be found in the Quick Reference Guide entitled How to Review a Submitted Quote, which is available on the NJSTART Vendor Support Page under Vendor Reference Guides.

3 PDF Documents

Q: When trying to open a Portable Document Format (PDF), I am receiving an error message and am unable to access the PDF. How should I proceed?

A: It is recommended that users utilize Microsoft Edge to view PDFs. Certain PDF forms cannot be opened in the Chrome or Firefox built in PDF viewers that are enabled by default. If using Chrome or Firefox it is recommended that the file is downloaded instead by clicking the download button in the upper right-hand corner of the browser after an error message is received. An alternative option is to disable the built in PDF viewers in Chrome or Firefox.

4 Exceptions

Q: Will the State allow Bidders to take exception to any of the Standard Terms and Conditions?

A: As stated in Bid Solicitation Section 2.2, Exceptions to the State of NJ Standard Terms and Conditions (SSTC): “Questions regarding the State of New Jersey Standard Terms and Conditions and exceptions to mandatory requirements MUST be posed during the Electronic Question and Answer period and shall contain the Bidder’s suggested changes and the reason(s) for the suggested change(s).” Moreover, as stated in Bid Solicitation Section 3.11, Bidder proposed terms or conditions that conflict with those contained in the State of New Jersey Standard Terms and Conditions may render a Quote non-responsive.

5 Section 1.1 – Purpose and Intent

Q: Can a vendor apply for specific portions of the contract, i.e., the cloud infrastructure, application security, user access, project management, maintenance tec., or does the vendor need to apply for the whole contract including hardware and software

A: Bidders must submit a Quote that meets all of the requirements of this Bid Solicitation. It is the intent of the State of New Jersey (State) to award a single Contract to that responsible Bidder whose Quote, conforming to this Bid Solicitation is most advantageous to the State, price and other factors considered.

Section 2.1 –

Electronic Question and Answer Period

Q: Will the agency publish the consolidated Q & A from all the vendors in one place or will individual vendors get individualized answers to their questions?

A: The State will post the Question and Answers in a Bid Amendment on

NJSTART.

7 Section 2.5 – Mandatory Site Visit

Q: What can be expected from the site visit that can help the vendor understand the requirements better?

A: The site visit was conducted so that potential Bidders were able to visually see the components that were described in this Bid Solicitation.

8 Section 3.1 – Quote Submission

Q: Is the vendor expected to deliver a comprehensive plan, technical architecture etc. for evaluation? Or can the vendor supply preliminary high-level project plans and schedules based on it's understanding of the RFP and requirements?

A: The Bidder, with submission of their Quote, should provide as much information as the Bidder deems necessary to meet all the requirements set forth in the Bid Solicitation and that allows the Evaluation Committee to properly evaluate how the Bidder intends to successfully meet all of the Bid Solicitation requirements.

9 Section 3.1 – Quote Submission

Q: 1. Is there a set template the NJ MVC would like us to respond in, or should we direct our response to the Scope of Work such as 4.2.1, 4.2.2 and so forth in a regular document?

A: There is no set template that the Bidder is to use when submitting their Quote.

Section 3.25 –

Financial Capability of the Bidder

Q: Does the bidder need to submit this along with the RFP or can it submit it after allocation of the contract or on request?

A: If the Bidder does not submit sufficient financial information with its Quote, that enables for the State to assess the financial capability of the Bidder, the

State may still require the Bidder to submit it. If the Bidder fails to comply with the request within seven (7) Business Days, the State may deem the Quote non-responsive.

Section 3.25 –

Financial Capability of the Bidder

Q: Due to the sensitive nature of company financials, does the State have a secure and encrypted way to submit this data, other than marking it confidential?

A: Pursuant to the New Jersey Open Public Records Act (OPRA), N.J.S.A.

47:1A-1 et seq., or the common law right to know, Quotes can be released to the public in accordance with N.J.A.C. 17:12-1.2(b) and (c). A Bidder may designate specific financial information as not subject to disclosure when the Bidder has a good faith legal/factual basis for such assertion. The State reserves the right to make the determination to accept the assertion and will so advise the Bidder.

12 Section 4 – Scope of Work

Q: Is the vendor expected to install and hand off the system to the agency (also known as "Go Live") and support the transition to an existing support team over 1 to 2 quarters (as is customary)? Or is the vendor expected to "Go Live" and support the newly built system (as is customary with all proprietary systems)?

A: The Bidder is expected to fully support the newly built system through installation and continue to provide full system support during and after “Go Live”.

Section 4.2.1 – CQS

Technical Requirements

Q: Is the agency looking to replace all hardware and software, i.e., the whole system? Or is this just enhancement and maintenance of the existing system?

A: The State is looking for replacement of all hardware and software.

Q: Is the agency looking to keep and enhance the existing database or looking for replacing the same completely or partially?

A: The State is looking for replacement of the existing database, however, any existing data from the legacy system currently stored must be retained.

Q: What are the security requirements that the proposed CQS solution must satisfy?

A: The Bidder must satisfy all security requirement that are listed within Section 6 of this Bid Solicitation.

Q: What are the bandwidth requirements for initial installation, daily use, and projected growth? What is the current setup?

A: One Gigabyte (1GB) capacity is required at all MVC Agencies. Projected growth is unavailable at this time, however, any system proposed by a Bidder in response to this Solicitation is expected to meet and/or exceed current system’s capabilities.

Q: 1. What specific data fields should be included in the data dictionary?

A: Data Fields will be discussed with the awarded Vendor following completion of the onboard process and as follow-on JAD sessions occur.

2. How frequently is data routinely communicated to customers via CQS?

A: Data is continuously communicated in Real Time.

Q: What are the current versions of Microsoft Edge and Google Chrome that the web-based client must operate on?

A: All MVC browsers have the latest release schedule.

Q: Could you please confirm whether the contractor is responsible for providing thermal printer paper rolls for the entire five-year contract period? (for ticket printing system)

A: Yes, Section 4.2.1, Subsection 3; specifically sub “a”, i and ii state respectively:

a. Each designated printer location must be stocked with a redundant ticket printer, set up to ensure uninterrupted customer service in the event of a printer service issue.

i. The CQS solution must use off-the-shelf supplies for all activities. No proprietary ticket printer paper or other supplies are permissible.

ii. Printer paper and supplies shall be provided by the Contractor.

In addition, Section “B” of the State-Supplied Price sheet includes a price line for “Hardware, including all supplies”. Bidders are instructed to provide a firm-fixed cost for all hardware and supplies.

Technical Requirements

Q: As per 4.2.1 requirement 2.a, assuming this is for staff to authenticate/login to the platform, can you elaborate on the Garden State Network and which technology this runs on?

A: The System’s administrative tasks and platform operate behind the State’s Garden State Network and are not accessible to the public.

Q: Do the requirements for hardware vary from location to location based on size and volume of customer flow?

A: Yes, the requirements for hardware vary from location to location based on size and volume of customer flow.

Q: What is the maximum number of users logged into the CQS concurrently?

A: Approximately 1,600 users.

Q: Is there an opportunity to utilize the existing on-site hardware for your current CQS to reduce costs for the state, or is new hardware required?

A: Separate and apart from any ticket issuing devices, MVC intends to utilize its existing Hardware for Queuing Intake and customer monitors.

Section 4.2.2 – CQS

General

Q: What is the current daily average volume of transaction across all services? Is there a breakdown available by each service, such as licensing, or registration etc.?

A: Average approximately 20,000 visits per day across various services, Report attached for Service Breakdown. Please see the attached “Transaction Time per Service for Question #24 4.15.2025” for further details.

Q: What is the average processing time across all services per worker? Is there a breakdown available by individual service, such as Registration etc.?

A: Agency operations average per transaction per service is about 7 minutes 46 secs. Please see the attached “Service Summary for Question #25 4.15.2025” for further details.

Q: Is there a customer average wait time available?

A: Average wait time per customer is approximately 18 minutes 26 seconds.

Q: Is there a breakdown by center and by services in those centers?

A: Please see the attached “Service Summary for Question #26 4.15.2025” for further details.

Q: What are the anticipated transactional productivity and efficiency improvements expected from the new CQS?

A: Integration with the existing appointment application is expected to maximize system and procedural efficiencies, provide better workflow management, reduce Customer Queue wait time and improve appointment cycle times.

Q: 1. What are the most common customer transactions that the CQS must handle?

A: Most common transactions and the approximate (~) total for each of the following daily transactions include issuance of: New Registration & title = ~ 3,333 per day, Real ID = ~ 3,046, Initial Driver’s License = ~ 3,034 and Driver License Renewals = ~ 941

Q: 2. What specific types of notes need to be captured during customer transactions?

A: Customer transaction notes typically consist of internal customer support and transactional information for use and review by NJMVC employees such as identifying customer needs. Examples may include, but are not limited to, individual customer requirements such as a wheelchair friendly station.

Q: 3. Can you provide more details on the "user specified conditions" that will automatically adjust the workflow?

A: User specified conditions may include, but are not limited to:

• Any change in customer transaction type/needs;

• supervisor visit required;

• customer must delay or reschedule an appointment to return later on the same day.

Q: 3. What are the requirements for customizing tickets at different levels (NJMVC-wide, regional, agency-specific)?

A:

1. Authorized Agency personnel must have the capability to issue SMS tickets via text message to cell phone.

2. Authorized Agency personnel must have the ability to print queue tickets for customers.

Tickets are issued uniquely at each location and department.

Example:

• Trenton Agency = Issues unique tickets for this location. T001 – T100

• Trenton Regional Center Issues unique tickets for this location.

TR001 – TR100

• Trenton Road Test Center Issues unique tickets for this location.

TC001 – TC100

Q: 1. How does NJMVC plan to use the kiosk environment functionality?

A: NJMVC intends for customers to enter the Que utilizing a standalone kiosk placed at the agency.

Q: 2. What specific reports and dashboards are needed for insights, statistics, analysis?

A: Enterprise dashboard must show each location’s queues and services currently in process in real time, including, but not necessarily limited to pre-existing “Canned” and Custom reports which should be made available for:

• Staff performance

• Queue summary and overview

• Service summary and overview

• Visit overview

• Service overview

• Transaction time

• Wait time

• Customer overview

Q: 3. What parameters and settings need to be managed through system administration?

A: Established Service Level Agreements (SLAs) for each queue and service offered, the types of services offered, locations, business rules, etc.

Q: As per 4.2.2 (7), are Smart Kiosks a part of the plan or a nice-to-have?

If implementing kiosks within the CQS solution, equipped with multi language easy to customize intuitive interfaces that enhance customer experience, can demonstrably drive efficiency by reducing wait times through automated check-ins and queue management while also handling routine tasks like appointment scheduling and screening customer eligibility - ultimately freeing staff for higher-value interactions - would that influence your perspective on incorporating kiosks?

A: Smart kiosks are, at this time, an option that the State is considering.

Q; Will NJMVC require kiosks to have an appointment check-in feature, or are customers expected to check in via mobile devices or staff-assisted processes?

A: The mobile device check-in is a mandatory requirement within this Solicitation. The Kiosk check-in is optional.

Q: If kiosks are implemented, should they be equipped with barcode or QR code scanners for appointment verification?

A: Yes. Pease refer to Section 4.2.2(6).

Section 4.2.2.1 – Interfacing with

NJMVC’s Existing Scheduling System

Q: What type of API and PII data transfer calls will the CQS need to support for interfacing with Tyler Technologies?

A: The scheduling platform will provide appointment information in a JSON based API. The data elements for each appointment could include (but isn’t limited to) the individual’s name, email, phone, and appointment details such as location, type, and date.

Interfacing with

Q: 1. What specific data needs to be populated from the existing scheduling system (Tyler Technologies) when a customer arrives for an appointment?

A: The customer’s individual name, email, phone, and appointment details such as location, type, and date.

Q: 2. What is the process for coordinating CQS updates with the PIVS team to ensure continued compatibility?

A: Vendors, incumbent NJMVC service partners and any Contractor awarded a Contract as a result of this Solicitation must coordinate all efforts with each other and the State.

Interfacing with

Q: 2. As per 4.2.2.1, will all scheduling be done in Tyler? From the Site visit, it sounded like the winner of this bid will take care of all scheduling and queue management. Can you clarify which services are booked in Tyler and which will be made in the winner of this bid?

A: The awarded Bidder will be responsible for the queue management and NJMVC’s existing service partner Vendor (Tyler Technologies) will be responsible for the scheduling component.

Interfacing with

Q: 3. As per 4.2.2.1 as an example, let’s say NJMVC offer 10 services of which 4 are booked through Tyler appointment systems such as license, registration, written, and road tests, would you be interested in the CQS providing a solution that will allow appointment booking using customizable workflows for the remaining 6 services?

A: No, all scheduling of appointments is conducted by Tyler Technologies and the Bidder is responsible for the management of the Queuing system.

Interfacing with

Q: As per 4.2.2.1, are there any additional cost associated with integrating with Tyler’s platform? Do they e.g. charge for API connections, integration work etc.?

A: No, there are no additional costs associated with integrating into Tyler Technologies’ platform.

Interfacing with

Q: What is the preferred method for integrating the CQS with Tyler Technologies (e.g., API, data exchange, middleware)?

A: The preferred method for integrating the CQS with Tyler Technologies is API.

39 Section 4.2.2.1 – Interfacing with

Q: Are there existing API specifications or data exchange formats that vendors must adhere to?

NJMVC’s Existing

Scheduling System

A: API specs do not currently exist. A standard/best practice JSON based API format shall be used to exchange appointment data. The Contractor and MVC must work in cooperation to develop accurate requirements around the necessary data elements which must be exchanged between these two systems.

Interfacing with

Q: When a customer with a scheduled appointment arrives at an NJMVC agency, should the CQS automatically pull their appointment details from Tyler Technologies and generate a queue ticket? If so, how should this process be triggered (e.g., barcode scan, manual check-in, or automated lookup)?

A: Yes, the CQS should automatically pull the customer’s appointment details from NJMVC’s existing service partner Vendor’s system (Tyler Technologies) and generate a queue ticket when the customer arrives at an NJMVC agency.

Interfacing with

Q: Should the CQS be able to send updates back to Tyler Technologies if an appointment is modified, rescheduled, canceled, or marked as a no-show within the queue system?

A: Yes, the CQS should be able to send updates back to Tyler Technologies if an appointment is modified, rescheduled, canceled, or marked as a no-show in the queue system.

Interfacing with

Q: Will NJMVC or Tyler Technologies provide technical documentation, API access, or support for integration to ensure compatibility with the new

CQS?

A: Yes, technical documentation will be provided after Contract award.

43 Section 4.2.3 – CQS Customer Ticketing

Q: 4. Ticket printing capability for both authorized NJMVC Agency employees and customers (via home and/or personal printer); We assume customers gets ticket printed after check-in at DMV. Printing ticket at home needs more clarification on this req.

A: Tickets must be printed at each respective agency following customer check-in.

44 Section 4.2.4 – CQS Video/Audio

Q: How many TV displays are needed at each NJMVC location? or in total at all 43 locations

A: Bidders are advised an average of four (4) monitors are currently in place at each of the NJMVC Agency locations. However, Bidders are also advised that the actual number of individual TV displays may vary by Agency location.

45 Section 4.2.4 – CQS Video/Audio

Q: 1. What specific messages and information should be displayed on the audio and visual system?

A: As with all current messages and information displayed on the existing audio/visual system, the Contractor must secure advance written NJMVC approval prior to utilization. Typically, the messages conveyed are public service announcements (PSAs) along with any NJMVC approved advertisement and relevant queueing/messaging data which may be required by the State.

Q: 2. What additional languages might be needed in the future for system communications?

A: Spanish is the most probable additional language, however this may not be the only additional language required over the term of any Contract resulting from this Solicitation. Additional language requirements are unknown at this time. Bidders are advised that following any contract resulting from this Solicitation, the Contractor must accommodate any future language requirements identified by the State.

Q: 3. How will NJMVC personnel verbally direct customers to the correct counter?

A: The CQS shall automatically call out the customer number and counter location via a speaker system.

Section 4.3.1 –

Senior Management Capabilities

Q: What is the organizational hierarchy that uses the CQS solution?

1) Super Admin login (Head Quarter: Views all 43 MVC live details) 2) Manager login (Views only local MVC live details) 3) Staff login Are there any other logins and authorization levels required?

A: Log in authorizations are as follows: Super Admins, IT Admins, Coordinators, Managers and Staff.

47 Section 4.6 – CQS Installation

Q: 7. As per 4.6, is it expected the winner of this bid will be in charge of doing cabling, data/power drops etc. themselves or will this be handled by the NJ MVC’s facilities?

A: Cabling tasks listed within this question will be handled by MVC IT/Facilities.

48 Section 4.6 – CQS

Q: 8. As per 4.6, which power and data drops are available today at 1) the counter where staff will sit to print tickets and 2) for the monitors already in place?

A: Both are currently available.

49 Section 4.6 – CQS

Q: 9. As per 4.6, can we expect to re-use the existing monitors already in place at the various locations? Can you describe what current hardware you expect to keep using? What will run the content of the monitors?

A: MVC will utilize existing monitors originally supplied by the current PVIS vendor. Regarding content, Bidders are instructed to carefully review NJMVC’s answer to Bidder’s Question #45, Q1.

50 Section 4.6 – CQS

Q: How many devices would be needed at each of the 44 locations?

(Kiosks, Displays, etc.)

A: Devices are location dependent, however a minimum of five (5) per agency location plus an additional 10% of the on-location devices must be maintained by the Contractor in reserve for backup replacements as needed.

51 Section 4.8 – CQS Help Desk/Support

Q: How many support-tickets do you generate per week with your current vendor?

A: Typically, an average of four (4) support tickets are generated per week.

Section 4.9.1.1 –

CQS Service Level Agreements

Q: As per 4.9.1.1, it is stated that hardware is Level 1 and that a resolution must be done within 1 hour. We recommend moving this to a Level 2 or 3, as the system is still fully functional even without working hardware. 1 hour will be difficult in case of traffic, adverse weather or any other force majeure events that will increase resolution time. Can you please elaborate?

A: This SLA must remain at Level 1 Status as the failure of an individual hardware item can result in one (1) or more inoperable agencies.

Q: As per 4.9.1.1, will it be possible to store spare hardware parts in certain MJ MVC locations, so local staff can resolve the hardware issue with a simple replacement?

A: Yes however, available storage space is location dependent.

Q: The RFP states in section 4.9.1.1 that hardware issues are classified as Level 1 and must be repaired or replaced within one hour of NJMVC contact. Given potential factors such as site accessibility, parts availability, and troubleshooting time, would the state consider alternative response time commitments that ensure both rapid resolution and practical feasibility?

A: No, the State will not consider alternative response time commitments for Level 1 classification.

Section 4.9.4.1 – Facilities

Management Plan

Q: Would the agency consider revising the requirement to maintain an active office within the State of New Jersey for the duration of the contract? While we fully understand the importance of providing responsive, high-quality service, we believe this requirement may inadvertently limit competition and exclude highly qualified vendors who can deliver exceptional service without a physical office presence in the state. Advancements in remote collaboration tools, combined with a commitment to on-site support as needed, enable contractors to provide the same level of responsiveness and operational oversight without the added cost of maintaining a local office. Removing or relaxing this requirement would promote a more equitable and competitive solicitation process while still ensuring that MVC receives the highest quality service and support.

A: The State agrees to this requirement change. The Contractor must maintain an active, effective office location within the contiguous United States (US).

Regardless of the Contractor’s office location, the Contractor must provide the same level of responsiveness and operational oversight detailed within the specified SLAs and meet all related service requirements as stated throughout this Solicitation. Bidders are advised to provide and demonstrate detailed capabilities information within its proposal to convince and assure the State of its commitment to deliver exceptional on-site support and robust response as needed with remote collaboration tools. Please see REVISED T2970 Bid Solicitation 4.15.2025.

56 Section 4.9.5 – System Security Plan

Q: 1. What methods should be used for detecting, reporting, and responding to incidents, vulnerabilities, and threats?

A: Bidders are instructed to carefully review Section 6.27, Continuous Monitoring, for the methods that should be used for detecting, reporting, and responding to incidents, vulnerabilities, and threats.

Q: 2. What are the requirements for application partitioning and single tenant environments?

A: This information will be discussed with the awarded Contractor after Contract award.

Q: 3. How should the Contractor maintain network security? Are there existing NJ state standards specific to DMV that are applicable?

A: Bidders are instructed to carefully review Section 6.21, Network Security, for details on State specific standards.

57 Section 4.9.5 –

Q: 1. What, if any, are the products and methods that NJMVC DMV currently uses for ensuring data integrity?

A: This information is confidential and will be discussed with the awarded Contract after Contract award.

Q: 2. What is the expectation regarding security controls that are required for wireless, remote, and mobile access?

A: Bidders are instructed to carefully review Section 6.20, Mobile Device Security, for information regarding the expectations the State has regarding security controls for wireless, remote, and mobile access.

Q: 3. What are the expectations regarding how the Contractor will address security measures regarding communication transmission, access, and message validation?

A: Bidders are instructed to carefully review Section 6.12, Access Management.

58 Section 4.9.5 –

Q: 1. What are the requirements for continuous monitoring?

A: Bidders are instructed to carefully review Section 6.27, Continuous Monitoring collectively with Section 4.9.5.

Q: 2. How will change and configuration management be handled? Are there existing written protocols and standards that needs to be followed?

A: Bidders are instructed to carefully review Section 6.27, Continuous Monitoring

Q: 3. What type of confidentiality and non-disclosure agreements are required?

A: Bidders are instructed to carefully review Section 4.9.5 for descriptions on what type of non-disclosure agreements and confidentiality agreements.

59 Section 4.9.5 –

Q: 1. How does NJMVC define a "Breach of Security"?

A: See Bid Solicitation Section 9.2 Definitions.

Q: 2. What are the specific requirements for data transmission and storage, including geographic restrictions?

A: All data must be encrypted in transit and at rest and, redundant cloud instances must be in different geographic locations to meet established Disaster Recovery requirements.

60 Section 4.9.5 –

Q: 1. What specific regulations and security requirements (e.g., PCI, HIPAA, FISMA etc.) must the Contractor address?

A: Bidders are instructed to carefully review Section 6.3, Compliance.

Q: 2. What are the requirements for role-based security access?

A: Bidders are instructed to carefully review Section 6.12, Access Management.

Q: 3. What logging and auditing controls are required?

A: The Contractor must detail its audit control methods and related requirements. Such controls must address, but are not necessarily limited to, all user access and identification linked to any changes to the system and data and, specify its process and procedure to make all audit data accessible to state and federal audit staff. The Contractor’s transaction audit trail should track date, time, user, and the end-user device utilized to initiate and execute each transaction. Audit data must be protected, non-repudiated and restricted to authorized staff. Retention of the audit records must be retained online by the Contractor for at least ninety (90) days and the Contractor must further preserve audit record retention offline for the duration of any contract resulting from this Solicitation or as otherwise required by applicable State and Federal law, guidelines and/or regulations.

61 Section 5.3 – Performance Security

Q: Would the agency consider waiving or adjusting the Performance Security bond requirement based on the scope and risk profile of this project? Given the nature of the services requested, a performance bond may add significant costs to the solution. Could the agency confirm if this requirement is necessary, or if alternative assurances (such as service-level agreements or references) would be acceptable?

A: No. The Performance Bond will remain at $5.5mil due to the inherent risk associated with poor/non-performance and its impact on the motoring public of nearly seven (7) million NJ State licensed drivers. Bidders should note NJMVC operations span across forty-six (46) agency locations and is arguably one of the most public-facing entities within the state. The Contractor should be fully vested in the success of this project and the established Performance Bond value serves to support such mutual interest between the Contractor and

NJMVC.

62 Section 6.7 – Privacy

Q: 1. What are the requirements for data re-use and data handling at the end of the contract?

A: Please review Section 6.7.(F), Privacy, in its entirety to understand the general requirements the State is looking for in each respective control policy.

Specific requirements are to be discussed between the chosen Bidder and using Agency after Contract award. In general, the State adheres to NIST and other industry standard policies.

Q: 2. What controls are required for asset management, media protection, and cryptographic protections?

A: Please review Sections 6.10, Media Protection, and 6.11, Cryptographic Protections, in its entirety to understand the general requirements the State is looking for in each respective control policy. Specific requirements are to be discussed between the chosen Bidder and using Agency after Contract award.

In general, the State adheres to NIST and other industry standard policies.

Q: 3. What are the requirements for access management and identity and authentication?

A: Please review Section 6.12, Access Management, in its entirety to understand the general requirements the State is looking for in each respective control policy. Specific requirements are to be discussed between the chosen Bidder and using Agency after Contract award. In general, the State adheres to NIST and other industry standard policies.

63 Section 6.14 – Remote Access

Q: 1. What are the requirements for how remote access should be controlled? Are there existing NJ State protocols and standards that needs to be followed?

A: Please review Section 6.14, Remote Access, in its entirety to understand the general requirements the State is looking for in each respective control policy.

Specific requirements are to be discussed between the chosen Bidder and using Agency after Contract award. In general, the State adheres to NIST and other industry standard policies.

Q: 2. What security engineering and architecture principles should be employed? Are there existing NJ State standards that needs to be followed?

A: Please review Section 6.15, Security Engineering and Architecture, in its entirety to understand the general requirements the State is looking for in each respective control policy. Specific requirements are to be discussed between the chosen Bidder and using Agency after Contract award. In general, the State adheres to NIST and other industry standard policies.

Q: 3. What are the requirements for configuration management and endpoint security?

A: Please review Sections 6.14, Remote Access, and 6.15, Security Engineering and Architecture, in its entirety to understand the general requirements the State is looking for in each respective control policy. Specific requirements are to be discussed between the chosen Bidder and using Agency after Contract award.

In general, the State adheres to NIST and other industry standard policies.

Section 6.18 -

ICS/SCADA/OT

SECURITY

Q: 1. Are there NJ State defined controls and processes required for ICS/SCADA/OT security and Internet of Things security that needs to be followed or adhered to?

A: Please review Sections 6.17, Endpoint Security, 6.18, ICS/SCADA/OT Security, and 6.19, Internet of Things Security, in its entirety to understand the general requirements the State is looking for in each respective control policy.

Specific requirements are to be discussed between the chosen Bidder and using Agency after Contract award. In general, the State adheres to NIST and other industry standard policies.

Q: 2. What are the requirements for mobile device security?

A: Please review Section 6.20, Mobile Device Security, in its entirety to understand the general requirements the State is looking for in each respective control policy. Specific requirements are to be discussed between the chosen Bidder and using Agency after Contract award. In general, the State adheres to NIST and other industry standard policies.

Q: 3.What are the requirements for network security and cloud security implementation, monitoring, and audit?

A: Please review Sections 6.15, Security Engineering and Architecture, 6.21, Network Security, and 6.22, Cloud Security, in its entirety to understand the general requirements the State is looking for in each respective control policy.

Specific requirements are to be discussed between the chosen Bidder and using Agency after Contract award. In general, the State adheres to NIST and other industry standard policies.

65 Section 7.2.2 – Cyber Breach Insurance

Q: We have noticed that the $10M cyber insurance requirement is significantly higher than what we typically see in the marketplace. Would you consider lowering this threshold to not only make the overall solution more cost-effective but also create a more equitable opportunity for a broader range of vendors?

A: The State declines to change or modify the terms and conditions. Terms and conditions on publicly bid procurements must be consistent for all Bidders, and cannot be based on a single vendor’s terms.

Section 9.3 –

Contract Specific Definitions

Q: How does NJMVC define "customer service efficiency and effectiveness" in the context of the CQS?

A: The CQS provided by the Contractor is to be a highly effective and easy to use system that provides customers with a streamlined MVC experience. The Queueing system must add value to the customer’s experience, not burden the customer with any unnecessary or redundant data population requirements, whether such redundancy is perceived or real.

67 Attachment 3 – State- Supplied Price Sheet

Q: There is no line item for installation pricing in Attachment 3, where would you like this pricing included?

A: Bidders are instructed to add installation for all software and hardware on Price Line #1. For installation for hardware replacements should be priced on Price Line #5.

68 Other

Q: DMV allows any walk-in appointments? or whoever walks into DMV has to be on prior appointment only?

A: Yes, under specific circumstances, usually at the direction of an Agency supervisor. However, Bidders are instructed to note some NJMVC services such as a vehicle license plate return do not require an appointment.

69 Other

Q: We are leaders in providing relevant advertising and monetization on to any digital signage screen. Our screens are LIVE in all travel plazas in New Jersey, Pennsylvania, Connecticut, New York, Delaware, Maryland and Florida with over 50M+ monthly views. Would the Agency be interested in generating additional revenues from the screens during idle times and/or in unutilized screen segments, as we can "plug-in" and partner with any queuing system (simple link interface) to have this accomplished?

A: NJMVC currently utilizes its established PVIS vendor services to provide relevant pre-approved advertising within its agency locations. NJMVC does not generate additional revenue by monetizing its digital signage at its agency locations. Such additional services are out of scope under this Solicitation.

70 Other

Q: 11. Does the State have any subcontractors they already work with, trust and can recommend for implementation/installation services?

A: NJMVC is not at liberty to disclose, identify, or otherwise recommend any Vendor or Vendor-provided services as doing so is in direct violation of established NJ State procurement guidelines, policy, and regulations. Bidders are advised to submit a Subcontractor Utilization form with its individual proposal in response to this Solicitation to formally identify any Subcontractors and intended Subcontract services.

71 Other

Q: 12. Does the NJ MVC have any KPI they wish to meet with their new vendor, such as reduced wait times, increased staff and customer satisfaction, improved efficiencies etc.? Can you share any of these?

A: NJMVC typically measures and will continue to base the success of this project on key performance indications (KPIs) such as reduced wait times and the ability to capture no-show appointments as well as any related concerns over providing a positive, seamless start to finish transactional experience for NJMVC customers. Bidders are encouraged to provide such KPIs it may currently measure or have the capability of measuring, along with its typical field results as a standard measure of successful operations and performance of its proposed system.

72 Other

Q: Beyond the listed benefits, what specific key performance indicators (KPIs) will be used to measure the success of the new CQS?

A: Additional KPIs (as defined in the above Q&A # 71) may include, but are not necessarily limited to such field measures. For example, such measures may also include:

• How well is the Contractor able adhere to specified SLAs;

• Is the Contractor provided system generally viewed by NJMVC and its customers as a more user friendly, effective system; and

• Does the Contractor provided system offer customizable features which may be of interest to the State during or following successful installation and implementation of the awarded Contractor’s system?

73 Other

Q: Is it a requirement for NJ MVC to use custom URL (e.g.

bookings.njmvc.gov) and custom emails (e.g. noreply@mvc.nj.gov) (for notifications) as well as a short code for SMS/texts?

A: Yes, this is part of the security requirements that are described in Section 6.

Further details will be discussed with the awarded Contractor after Contract award.

74 Other Q: Can you explain how you are presently handling walk-in customers?

Section Reference Question (Bolded) and Answer

A: Any service that doesn’t require an appointment can be handled via a walk-

in. These include name, address, and gender changes. Customers can also walk-in with a courtesy return ticket – which may, for appropriate reasons, be provided to the customer by an authorized NJMVC agency supervisor or other duly designated agency staff.

75 Other

Q: Do you have an overview of the percentage of your customers who visit your locations are unable to complete their intended tasks because they are not service-ready (e.g., missing the required documentation, ID, or application forms)?

A: NJMVC does not currently track this data.

Q: 18. Do all service centres offer the same services?

A: No. NJMVC agency services vary by location.

76 Other

Q: Do all service centers offer the same services?

A: Bidders are instructed to reference the above Q&A response to item #75.

77 Other

Q: How many in-person visits have you required over the past year from your current vendor?

A: Approximately seventy-five or more (75+).

78 Other

Q: What does NJMVC anticipate for scalability requirements for future user growth? (Services, additional units, etc.)

A: Future user growth and scalability requirements are currently undetermined.

However, any Contractor provided system must be capable of a scalability increase and ready for new services, new locations, and feature improvements at any time during the term of any contract resulting from this Solicitation.

79 Other

Q: Should the CQS maintain separate queues for walk-in customers and scheduled appointments?

A: Yes, the CQS should maintain separate queues for walk-in customers and scheduled appointments.

80 Other

Q: Can you elaborate on future agency growth plans and how the CQS should accommodate them?

A: Currently undetermined, however the system must be ready for new services, new locations, and feature improvements at any time during the term of any contract resulting from this Solicitation. Bidders are instructed to reference the above Q&A response to item #78.

Section 6.18 - ICS/SCADA/OT SECURITY