RFP Title: AI Innovation Institute Technology Solutions

RFP#: CDR010826

RE: Question and Answer Addendum 3 Date: February 4, 2026

The following questions and answers will be considered part of the solicitation documents.

Question 1: Will UConn extend the due date?

Answer 1: The University does not expect to extend the due date at this time.

Question 2: What level of FISMA compliance is UCONN looking for?

Answer 2: FISMA level high.

Question 3: Will UConn share its primary goals for the AI Innovation Institute for the first 12– 18 months and the initial 4-year term? Are there specific success metrics, such as research output, time to set up compute environments, or job wait time expectations, that we should consider when designing our architectural approach?

Answer 3: Refer to RFP Section 2.0 for the University’s vision for the AI Innovation Institute. It is left to the discretion of the proposer to articulate its system architecture, project plan, and timeline in the proposal. Proposals will be evaluated in accordance with the Evaluation Criteria in the RFP.

Question 4: Are there particular focus areas (e.g., health/biomedicine, materials science, climate, public policy, or social sciences) or specific AI/ML workflows that UConn would like the platform to prioritize and optimize for?

Answer 4: Refer to RFP Section 2.0 for the areas across which the AI Innovation Institute will serve as a hub for AI research, development, education, and workforce development.

Question 5: Does UConn have projections for adoption during Years 1 and 3, including usage by principal investigators (PIs), research groups, students, or external collaborators? Are there any forecasts for each enclave (e.g., General Research, HIPAA, Federal)?

Answer 5: Detailed adoption projections have not been developed. Refer to Answer 3 above.

Question 6: Does UConn currently manage any HPC or AI-specific clusters (e.g., GPU/CPU-based), large-scale storage systems, or orchestration tools (such as Slurm or Kubernetes) that the proposed solution should integrate with or replace?

RFP# CDR010826

Question and Answer Addendum 3

Answer 6: The current HPC environment is outside of the scope of the RFP.

Question 7: Is UConn leaning toward an on-premises, cloud-first, or hybrid deployment model?

If so, are there any constraints (e.g., workloads requiring local hosting or regional requirements) we should be aware of?

Answer 7: The University will not pre-evaluate the proposal. Refer to RFP Section 3.0 – System Modality, “… [t]he proposal may include three different modes: On premise, Cloud, and Hybrid solutions.” It is left to the discretion of the proposer to articulate its proposed system architecture.

Question 8: If on-premises hosting is preferred, can UConn provide details about the anticipated data center location(s), available rack space, power and cooling limits, or redundancy/disaster recovery (DR) requirements?

Answer 8: Refer to Answer 7 above. Refer also to Addendum 2, Question and Answer 20.

Question 9: Could UConn share more about its current campus and data center network capacity (e.g., 25/40/100/400 GbE, InfiniBand, Internet2) and any segmentation or connectivity standards the enclaves need to follow?

Answer 9: The opportunity described in the RFP contemplates a standalone service.

Networking in and out of the enclave(s) will be managed separately.

Question 10: How does UConn envision tenant separation, should it be by PI, lab, department, or shared teaching clusters? Are there any user groups that require dedicated versus shared resources?

Answer 10: It is left to the discretion of the proposer to articulate its proposed system architecture and available modalities. Refer to RFP Section 3.0 – Required Features, “…[t]he proposed AI computing environment must be designed to support multiple, logically segregated security enclaves with distinct compliance profiles.”

Question 11: Will external partners need access to the system? If so, what identity management, onboarding, and data-sharing policies should the platform comply with?

Answer 11: Refer to RFP Section 3.0 – Value-Added Considerations – Future Collaboration.

Proposers are invited to include value added services or approaches to assist the University in realizing the objectives and goals articulated in the RFP.

Question 12: Does UConn have a data classification framework and retention policy that the platform must enforce? If so, could UConn provide a summary or reference document?

Answer 12: Refer to the following University policies:

Data roles and responsibilities policy: https://policy.uconn.edu/2012/06/21/data-roles-and-responsibilities-information-technology/

Records retention policy: https://policy.uconn.edu/2011/05/24/records-management-policy/

Question 13: Will UConn provide a rough estimate of expected HIPAA-regulated and federal https://policy.uconn.edu/2012/06/21/data-roles-and-responsibilities-information-technology/ https://policy.uconn.edu/2012/06/21/data-roles-and-responsibilities-information-technology/ https://policy.uconn.edu/2011/05/24/records-management-policy/ workloads (e.g., NIST 800-171 / FISMA)? Are specific granting agencies driving the need for the Federal Enclave?

Answer 13: Refer to RFP Section 2.0 for background information on the establishment of the AI Innovation Institute. Refer also to RFP Section 3.0 – Pricing Proposal. Each proposal must include a pricing proposal for the baseline AI computing environment and General Research Enclave, with incremental costs associated with implementing and operating the HIPAA and Federal Compliance Enclaves. Proposals will be evaluated in accordance with the Evaluation Criteria in the RFP.

Question 14: Does UConn require compliance with NIST 800-171 for Controlled Unclassified Information (CUI) without formal Authority to Operate (ATO), or does it expect a fully authorized FISMA system? If an ATO is required, which agency and impact level apply?

Answer 14: It is left to the discretion of the proposer to define the impact levels supported by the proposed solution. Proposals will be evaluated in accordance with the Evaluation Criteria in the RFP.

Question 15: How does UConn plan to divide HIPAA obligations between itself and the contractor? Will a Business Associate Agreement (BAA) be required?

Answer 15: Refer to Addendum 2, Question and Answer 72. Refer also to RFP Section 3.0 – Technical & Programmatic Support, “[t]he awarded proposer will run the AI resource as a managed service, ensuring stability, security, and performance on a 24/7 basis.” The awarded proposer is expected to be responsible for implementing technical, administrative, and physical safeguards for the enclave.

Question 16: Will UConn consider hosting non-PHI research in the HIPAA enclave for better operational efficiency, or should this enclave remain strictly for PHI workloads?

Answer 16: Refer to RFP Section 3.0 – Required Features, “[t]he proposer may, at their discretion, propose hosting non-HIPAA research workloads within the HIPAA-compliant Enclave, provided all HIPAA requirements remain fully satisfied.”

Question 17: What level of audit support and documentation does UConn expect from the contractor for HIPAA and NIST 800-171/FISMA compliance?

Answer 17: It is left to the discretion of the proposer to describe how the proposed design and managed service supports UConn’s ability to meet compliance requirements.

Question 18: Are there specific vendors or technologies that UConn prefers (e.g., for GPUs, storage platforms, or networking)? Conversely, are there any that are explicitly prohibited?

Answer 18: The opportunity is an open competition. No preference or prohibitions have been identified.

Question 19: Does UConn have a preference for schedulers (such as Slurm or Kubernetes) or MLOps platforms (e.g., MLflow, Kubeflow, or cloud-native tools)? Should the solution integrate with existing systems?

Answer 19: It is left to the discretion of the proposer to define the proposed software stack.

The opportunity described in the RFP contemplates a standalone service.

Question 20: Does UConn have enterprise agreements with cloud providers like AWS, Azure, or GCP? If so, should cloud usage go through UConn’s accounts, or will it be managed by the contractor?

Answer 20: The University has an existing agreement with Microsoft Azure. The proposal may include other solutions as part of the proposed managed services, in the discretion of the proposer.

Question 21: Are there specific restrictions on using public cloud environments for PHI or CUI (e.g., GovCloud, dedicated regions, data residency requirements)?

Answer 21: Refer to RFP Section 3.0 – Secure Multi-Enclave Architecture, the HIPAA Enclave must support HIPAA Compliance and the Federal Compliance Enclave must be designed to support workloads requiring compliance with federal data security frameworks.

Question 22: How should security responsibilities, such as IAM, patching, vulnerability management, SIEM/SOC, and incident response, be divided between UConn IT/security and the contractor?

Answer 22: The University will not advise the proposer on the content of the proposal. Refer to RFP Section 3.0 – Technical & Programmatic Support, “[t]he awarded proposer will run the AI resource as a managed service, ensuring stability, security, and performance on a 24/7 basis. … The proposal must also articulate proposer’s assumptions related to support by UConn personnel, if any.”

Question 23: Which identity provider(s) does UConn currently use (e.g., Azure AD, Shibboleth, Okta)? Should all enclaves, including those accessed by collaborators, fully integrate with this IdP?

Answer 23: Refer to Addendum 2, Question and Answer 85.

Question 24: Are there specific requirements for encryption or key management (e.g., FIPS-validated modules, UConn-managed keys, or HSM/KMS?

Answer 24: It is left to the discretion of the proposer to articulate its proposed system architecture.

Question 25: Does UConn require any specific restrictions or workflows for data leaving regulated enclaves?

Answer 25: Refer to RFP Section 3.0 - Secure Multi-Enclave Architecture, “[t]he proposal must explicitly describe: … How users and data move between Enclaves, if at all.” It is left to the discretion of the proposer to articulate its proposed system architecture.

Question 26: Does UConn prefer a fully managed service or a co-managed model? If it’s the latter, which roles will UConn staff, and which will the contractor handle?

Answer 26: Refer to RFP Section 3.0 – Technical & Programmatic Support, “[t]he awarded proposer will run the AI resource as a managed service, ensuring stability, security, and performance on a 24/7 basis. … The proposal must also articulate proposer’s assumptions related to support by UConn personnel, if any.”

Question 27: Are there minimum on-site staffing requirements? Are U.S.-only personnel required for HIPAA or federal workloads?

Answer 27: Refer to RFP Section 3.0 – Secure Multi-Enclave Architecture, the HIPAA Enclave must support HIPAA Compliance and the Federal Compliance Enclave must be designed to support workloads requiring compliance with federal data security frameworks.

Question 28: Does UConn require 24×7 support for all enclaves? Are tiered SLAs acceptable (e.g., higher for HIPAA/Federal workloads and lower for General Research)?

Answer 28: Refer also to RFP Section 3.0 – Technical & Programmatic Support, “[t]he awarded proposer will run the AI resource as a managed service, ensuring stability, security, and performance on a 24/7 basis.” It is left to the discretion of the proposer to articulate the manner by which it proposes to ensure stability, security, and performance on a 24/7 basis.

Question 29: What level of training does UConn expect for faculty, students, and IT staff?

Should this include initial onboarding, periodic sessions, or self-service materials?

Answer 29: The University will not advise the proposer on the content of the proposal. It is left to the discretion of the proposer to articulate its proposed services and value-added considerations, etc., in the proposal. Proposals will be evaluated in accordance with the Evaluation Criteria in the RFP.

Question 30: Will UConn need to migrate existing datasets, models, or workloads? If so, can UConn share estimated data volumes and details about any critical legacy environments?

Answer 30: Refer to RFP Section 3.0 - Secure Multi-Enclave Architecture, “[t]he proposal must explicitly describe: … How users and data move between Enclaves, if at all.” It is left to the discretion of the proposer to articulate the proposed system architecture and capabilities.

Question 31: Which institutional systems should the AI platform integrate with (e.g., LMS, EMR/EHR, LIMS, ERP, SIS, archives)? Are there preferred integration methods (e.g., APIs, feeds, batch, or event-driven)?

Answer 31: The opportunity described in the RFP contemplates a standalone service. The proposal may include details on integration capabilities of the proposed solution.

Question 32: What is UConn’s preferred process for onboarding new PIs or research projects (e.g., request → approval → automated provisioning)? Are there target provisioning SLAs?

Answer 32: UConn has not predetermined an onboarding process or SLAs. It is left to the discretion of the proposer to articulate its capabilities.

Question 33: Are there any specific targets for queue times, interactive notebook performance, or inference latency/throughput?

Answer 33: Refer to Answer 32 above.

Question 34: Does UConn have growth projections for user counts, compute demand (GPU/CPU), and storage capacity over the next 3–5 years?

Answer 34: Refer to Addendum 2, Question and Answer 35 and 99.

Question 35: What availability, backup retention, and disaster recovery (DR) objectives should each enclave meet (e.g., RPO, RTO, secondary site expectations)?

Answer 35: It is left to the discretion of the proposer to articulate its system architecture and technical capabilities in the proposal. Proposals will be evaluated in accordance with the Evaluation Criteria in the RFP

Question 36: Will UConn provide budget expectations for the initial system as well as ongoing operations and maintenance (O&M)?

Answer 36: Refer to Addendum 2, Question and Answer 29.

Question 37: Does UConn prefer fixed annual pricing, a hybrid approach with usage-based components, or another model?

Answer 37: Refer to RFP Section 6.8 – Pricing, “[i]n the competitive process, the University will not advise a Proposer on the content of the financial proposal.”

Question 38: Is UConn open to a phased rollout (e.g., General Research first, followed by HIPAA and Federal) if it helps reduce cost or risk? If so, is there a preferred timeline?

Answer 38: In the competitive process, the University will not advise the proposer on the content of the proposal. It is left to the discretion of the proposer to articulate its system architecture, project plan, and timeline in the proposal. Proposals will be evaluated in accordance with the Evaluation Criteria in the RFP.

Question 39: Should hardware refreshes be handled as discrete events, or should they be part of an ongoing “as-a-service” pricing model?

Answer 39: Refer to Answer 37 above.

Question 40: Are there any preferences or boundaries regarding contract durations or extension options?

Answer 40: Refer to RFP Section 3.0 – Contract Term.

Question 41: Within the “Technical Capability & Demonstrated Success” section, which qualifications are most important (e.g., higher education references, experience with large HPC/AI environments, compliance expertise)?

Answer 41: In the competitive process, the University will not advise the proposer on the content of the proposal. Proposals will be evaluated in accordance with the Evaluation Criteria in the RFP.

Question 42: If UConn conducts presentations or demos, are there specific workflows or scenarios they’d like proposers to highlight (e.g., end-to-end research lifecycle, MLOps pipeline, compliance walkthroughs)?

Answer 42: If UConn elects to conduct optional presentations, it will identify expectations for presenters at the time of issuing an invitation to present.

Question 43: Any issue with asking with submitting a spreadsheet with all of our questions or do you want us to use the tool for each question?

Answer 43: All questions relating to the opportunity must be submitted through the HuskyBuy portal.

Question 44: What are the diversity requirements? Are the requirements for implementation or run or both?

Answer 44: Refer to the description found in the HuskyBuy portal related to Supplier Diversity and the required submittals. No other requirements have been identified.

Question 45: Does the university expect to have 400 GPU's and 25 PFLOPS of computing available during the enablement of the compliant secure enclaves or will the computing requirements be deployed over time?

Answer 45: Refer to Addendum 2, Question and Answer 27 and 28.

Question 46: FISMA Compliance - does the university expect to have CUI data stored in the secure enclave and if so, are you looking to establish a CMMC environment that is C3PAO assessed network boundary?

Answer 46: Refer to RFP Section 3.0 – Secure Multi-Enclave Architecture, the Federal Compliance Enclave must be designed to support workloads requiring compliance with federal data security frameworks. CUI data may be expected to be stored in the Federal Compliance Enclave.

Question 47: HIPAA, NIST and FISMA compliance standards - while not specifically called out in the RFP, is there an expectation for compliance such as SSP (system security plans) and POAM artifacts documenting the technical controls applied to the environment?

Answer 47: Yes.

Question 48: Cost Breakdown - what does the university consider as a "baseline" AI computing environment. Is baseline aligned to the compute power identified in the hardware and software needs?

Answer 48: It is left to the discretion of the proposer to articulate its proposed baseline AI computing environment, project plan, and a timeline designed to meet the University’s present and future needs in the proposal.

Question 49: In the required features - how does the university define "administrative" safeguards. What is the deliverable expected aligned to administrative safeguards?

Answer 49: Reference the standard HIPAA definition: administrative actions/policies to manage the selection, development, and maintenance of security measures.

Question 50: Will the hosting environments you are looking to engage provide for the security requirements for a federally compliant system/infrastructure?

Answer 50: Refer to RFP Section 3.0 – Secure Multi-Enclave Architecture, the Federal Compliance Enclave must be designed to support workloads requiring compliance with federal data security frameworks.

Question 51: Will UConn be providing facilities buildout and working space for the support team (work spaces, conference rooms, offices, etc). Will there be a physical presence for the institute on campus and what will that entail?

Answer 51: Refer to Addendum 2, Question and Answer 92.

End of Question and Answer Addendum 3