Vendor Questions and Department Responses.pdf

Vendor Questions & Department Responses RFI 25/26-118 SAP S/4HANA Process Intelligence and Business

Process

Good afternoon:

Questions received timely and the Department responses are below:

1. Question: Program Direction & Migration Strategy; Is the Department fully committed to a defined S/4HANA migration timeline, or is there flexibility to sequence or extend phases based on process discovery and readiness?

Department Response: Flexible to a certain degree. High level timeline in place

2. Question: Has the Department evaluated options to extend the operational life of its current ECC environment to allow for a more deliberate, discovery-first transition?

Department Response: Yes

3. Question: If ECC systems could be extended through 2040 initially, might that change the fundamentals around migration journeys and upgrade paths dictated by SAP's roadmap?

Department Response: No

4. Question: What happens with existing perpetual licenses that are paid for and owned outright by State of Florida?

Department Response: We have been told those will no longer be valid.

5. Question: Deployment Model; What is the planned S/4HANA deployment approach (in-place technical conversion vs new implementation)?

Department Response: In place Technical Upgrade

6. Question: Is the Department targeting private cloud, public cloud, or an on-premise/government cloud model for S/4HANA?

Department Response: On-premise/government cloud

7. Question: RISE with SAP; Is the Department currently committed to or evaluating

RISE with SAP as part of its transformation strategy?

8. Question: If not, is maintaining flexibility outside of a bundled RISE construct a consideration?

9. Question: Database & Landscape Strategy; Given the recent HANA implementation, is there an expectation to further transform or relocate database environments as part of the S/4 program?

Department Response: Already Done. Nothing new to relocate.

10. Question: Would the Department consider maintaining its current HANA-based landscape in place where stable, rather than restructuring as part of the migration?

Department Response: In place

11. Question: Current-State Preservation vs. Transformation; To what extent is the

Department seeking to optimize and preserve stable existing processes versus re-engineering them as part of the transition?

Department Response: Brownfield approach keep as much as makes sense.

12. Question: Is there openness to approaches that reduce transformation risk by maintaining proven system components while selectively modernizing?

Department Response: Yes, but focus is on as-is during the upgrade vs. leveraging modernization and new build.

13. Question: Support & Operating Model; How is the Department currently planning to support ECC systems during the transition period leading up to S/4HANA?

Department Response: Dedicated teams focus with keeping systems running

14. Question: Would the Department consider alternative support models that could provide:

• Extended support beyond SAP timelines

• Greater flexibility in migration sequencing

• Cost savings that could be reinvested into modernization efforts

15. Question: The RFI response section “II. General Questions Matrix” provides tables for respondents to answer the Department’s questions. Two “proof of value” questions are provided in the first table (“Vendor Profile Questions”). However, the remainder of the question tables (e.g., System Technical Questions, System Functional Questions, etc.) are all blank. Can the State please provide the relevant questions to be answered by vendors?

Department Response: No, we want to see the products and use first hand. We did not want to limit anything so these were left blank.

16. Question: Which end-to-end business processes are most critical to the transformation initiative?

Department Response: Everything needs to work. No process will be left unturned

17. Question: What business areas and processes does SUNTAX support today?

Department Response:

• Sales & Distribution (SD): Order-to-Cash, Pricing, Billing, Shipping, Customer

Management

• Finance (FI/CO): General Ledger, Accounts Payable/Receivable, Asset Accounting, Cost Center Accounting, Profitability Analysis

• Human Resources (HCM): Personnel Administration, Payroll, Time Management, Talent

Management

• PSCD & FICA: Tax accounting

• Plant Maintenance / Enterprise Asset Management (PM/EAM): Maintenance Planning, Work Order Management, Asset Lifecycle Management, Intelligent Asset Management

• CRM

• BW

18. Question: How many business users, process owners, and transformation team members would require access to the platform?

Department Response: For the POV, 3-5

19. Question: How are processes currently documented, governed, and maintained across the organization?

Department Response: Each has their silo and governance and structure.

20. Question: Are there any specific challenges around process standardization, compliance, change management, or adoption that the organization is seeking to address?

Department Response: User adoption and culture

21. Question: Please provide us with the Microsoft Excel format of the System

Requirements and General Questions Matrix in Attachment 1 of the subject RFI.

Department Response: Not available at this time.

22. Question: What is the anticipated scale for SUNTAX process modeling and monitoring? Specifically: # of Users, Divisions/Units within DOR, Estimated # of Processes

Department Response: Less than 50

23. Question: Can the Department provide additional details on the current SAP ECC, CRM, and SUNTAX landscape (modules in scope, integrations, data volumes)?

Department Response: No response available at this time.

24. Question: What is the current timeline and phased approach for the S/4HANA migration (key milestones)?

25. Question: What specific success criteria will be used to evaluate the Proof of Value

(PoV)?

26. Question: Will the Department provide sanitized production data for PoV testing?

Department Response: TBD for which environment will be used.

27. Question: What specific non-SAP systems (e.g., tax, audit, reporting platforms) must be integrated into the process intelligence platform?

Department Response: TBD. Nothing to be specified at this time

28. Question: What level of cross-system visibility is expected (SAP-only vs enterprise-wide including external systems)?

Department Response: Focus is on SAP ECC

29. Question: Can the Department clarify whether the future effort is expected to include both platform implementation and ongoing managed services, or primarily technology procurement?

Department Response: TBD

30. Question: What “automations" currently exist in the SUNTAX/ECC environment?

How does the Department define “automation”?

Department Response: Unknown

31. Question: Are there automations outside SUNTAX/ECC (RPA Bots, Middleware, Integrations)?

Department Response: Minimal if any

32. Question: Is there existing inventory of systems documentation describing each automations technology and the capability it has automated?

33. Question: Has the Department assessed which current SUNTAX/ECC automations are compatible with SAP S/4HANA?

34. Question: Has the Department been provided any type of demonstration in the last two years?, If so, what vendor or companies provided those demos?

Department Response: NA

35. Question: Is there an established budget for this project?

36. Question: If we are not ingesting tax information / IRS data, would we still be required to provide a fedramp solution? If we are hosted in AWS GovCloud, are we compliant?

Department Response: No, yes

37. Question: With reference to Section 5 (Objective), could the Department explicitly define the specific State of Florida data residency and security compliance frameworks the platform must adhere to?

Department Response: USA only locations

38. Question: Section 1 and Requirement 2.0 highlight that the environment includes both SAP ECC and SAP CRM components. Does the Department expect out-of-the-box, standard data extractors/connectors for the legacy SAP CRM environment, or will custom data engineering and SQL-based extraction to ingest transaction logs from CRM be acceptable?

Department Response: Readily available connections is preferred. So confirmation on needed development will need to be communicated as part of the POV

39. Question: Requirement 3.0 requests simulation tools to test changes before they go live. Could you clarify what tools are needed? Does the Department expect tools for change impact modeling, or other capabilities?

Department Response: Nothing is specific on our needs. The department would like to know if there are tools you use or capabilities you have to show the change impact

40. Question: Requirement 4.2 requests support for automated process discovery.

Does this include the use of AI or machine learning for that automation?

Department Response: Either Or. Basically, we would like to confirm if there are processes in place to auto discover/build.

41. Question: For Requirement 5.0, what are the Department's expected retention duration baselines for both the ingested SAP process logs and the user audit trails?

Department Response: Please confirm your options if configurable or any limitations.

42. Question: Requirement 5.1 requests support of accessibility standards. What specific accessibility standards are expected? Are there any state-specific requirements to be aware of?

Department Response: Please reference the The Americans with Disabilities Act | ADA.gov for standards that should be met.

https://www.ada.gov/ https://www.ada.gov/

43. Question: Requirement 7.0 requests support of internal controls. What are the specific internal controls they are looking for support with? Segregation of duties, approval process adherence, spend compliance, all the above?

Department Response: All of the above

44. Question: Requirement 7.1 requests tools for monitoring and identifying regulatory gaps. Does this involve adhering to internal policy or making sure business processes are in accordance with state/national law?

Department Response: Both, internal and state law mandated

45. Question: Attachment 2, Section 1 states "Do not provide actual cost or pricing information." However, Section 1.c requests that vendors "please provide the cost for those products and/or services" for similar past projects. Could the Department clarify if actual dollar amounts from past public contracts are permitted in Section 1.c, or if we should strictly describe the historical pricing methodologies?

Department Response: Actual dollar amounts if available. If based on subscriptions, please include what that looks like so we know what our estimated costs might be with your product.

46. Question: Is the State open to procuring off of the NASPO or GSA contract vehicle?

Department Response: Yes.

47. Question: Will the department provide best practice BPMN models to perform fit/gap analysis?

Department Response: No. We would look to this process to build that out for the departments.

48. Question: Regarding General Questions 1.0 and 2.0 regarding a 30-day Proof of

Value (POV) using Department information: Will the Department provide pre-extracted, anonymized/masked sample data logs for this evaluation, or will the vendor be required to establish live system connectivity to extract data during the RFI evaluation phase?

Department Response: FDOR will provide the data from source TLOG data.

49. Question: How is the state defining the success criteria for this Proof of Value test?

Is it baseline process mapping for a singular business process, bottleneck identification, customization analysis of SAP ECC, or something else?

Department Response: Based on 1-2 business processes with their end to end process being mapped, analyzed, adjusted, and value added benefits from the proposed tool.

50. Question: Will the Department require the vendor to execute a specific Non-

Disclosure Agreement (NDA or a specific data-sharing agreement prior to initiating the Proof of Value?

51. Question: To maximize the value of the 30-day test, has the Department pre-selected specific an end-to-end process scope (e.g., Order-to-Cash, Procure-to-Pay, or tax-specific workflows within CRM/ECC) to target during the PoV or can we help suggest a good process for the PoV?

52. Question: Will the Department assign dedicated Business Analysts and SAP

Basis/Technical resources to collaborate with the vendor during the 30-day+ evaluation period?

53. Question: Could the Department clarify the anticipated timeframe for these demonstrations following the July 3, 2026 response deadline? Additionally, will these demonstrations be conducted virtually (e.g., via Microsoft Teams) or will they require vendor personnel to be onsite at the Department's facilities in Tallahassee, Florida?

Department Response: Onsite if available without cost. Virtual is fine as long as we can complete the needed tasks

54. Question: Has the Department selected, or does it anticipate selecting, an SAP

S/4HANA implementation partner prior to procuring the process intelligence platform?

55. Question: Can the Department provide additional information regarding the planned

S/4HANA migration approach (Brownfield, Greenfield, or Selective Data Transition)?

56. Question: Beyond SAP ECC and SAP CRM, are there additional non-SAP systems that the Department expects to include within process discovery and governance activities?

57. Question: Could the Department provide additional guidance regarding its referenced Government Cloud posture and identify whether vendor-hosted SaaS solutions operating in secure government environments would be considered acceptable?

Department Response: Yes, they will be considered

58. Question: For the anticipated Proof of Value, does the Department envision providing anonymized production data, and are there specific business processes or evaluation criteria that will be used to determine success?

Department Response: TBD, but the plan would be to leverage the TLOG data from some of our core processes

59. Question: Approximately how many users (business users, analysts, and administrators) are expected to utilize the platform as part of the Department's long-term process governance strategy?

Department Response: >50

60. Question: Is there any constraint regarding the use of remote/offshore resources?

61. Question: The RFI notes a requirement for deployment consistent with the

Department’s on-premise Government Cloud posture. Would the Department consider a hybrid model where the process intelligence platform itself is hosted in a secure, Coderio-managed private cloud environment to leverage specialized AI-driven development tools, provided all data residency and security requirements are strictly met?

62. Question: Requirement 2.0 mentions the consolidation of ECC and CRM. Beyond these SAP environments, are there specific non-SAP legacy databases or third-party APIs that must be integrated into the automated process discovery to achieve the "holistic view" requested?

Department Response: TBD. Not included in the requested information as part of the

POV.

63. Question: Does the Department’s security posture permit the use of AI-driven

"Copilots" or automated modeling tools during the "as-is" discovery phase?

Department Response: Only if used against the data provided and not shared outside the vendor’s domain.

64. Question: Regarding the 30-day hands-on evaluation, is the Department looking for a demonstration of out-of-the-box software features, or would you be open to a "Pilot Migration" approach where Coderio demonstrates process intelligence by modernizing a specific sub-process using our proven methodology?

Department Response: We would like to see it working with our data as a zero cost POV before making a decision to purchase or not.

65. Question: The RFI highlights process intelligence as a "permanent capability". Is the

Department interested in exploring a Managed Services model, such as a dedicated Coderio "Delivery Squad", to maintain this capability, or is the focus exclusively on a software-only subscription?

66. Question: For Attachment 1, if a requirement is met through a combination of proprietary AI tooling and expert engineering services rather than a single software package, should this be marked as "Can meet with current configuration" or "Can meet with custom programming"?

Department Response: Yes, Can meet with custom programming.

67. Question: Requirement 5.0 specifies BPMN 2.0 as the modeling standard. Would the Department be open to alternative, AI-native process visualization standards if they offer superior predictive impact analysis for the S/4HANA transition?

68. Question: Is the Supplier permitted to subcontract the Services, in whole or in part, to a third party?

Department Response: Not for the POV.

69. Question: In the event of subcontracting, will the state registration requirements

(MyFloridaMarketPlace and Division of Corporations) apply only to the prime contractor, or also to subcontractors?

Department Response: Only to the prime contractor.

70. Question: Are there any specific insurance requirements or minimum insurance coverage levels that must be maintained in order to provide this service?

Department Response: Standard Requirements for State Services and Contracting.

71. Question: Will prime contractors be permitted to partner with subcontractors in the future formal procurement process?

72. Question: How many active clients, SAP ECC instances, and SAP CRM environments are currently within the scope of this modernization effort?

Department Response: 5 environments, Single Instance of ECC and CRM.

73. Question: What is the annual volume of transactions or event log records generated within SUNTAX for the core business processes?

Department Response: Multiple TB’s of transactions via BAPI’s RFC’s, API’s

74. Question: What is the current total database size of the SAP HANA platform supporting SUNTAX?

Department Response: < 2TB

75. Question: How many active and concurrent users are estimated to utilize the Process Intelligence platform simultaneously?

76. Question: Which specific SAP ECC modules (e.g., FI, CO, SD, MM) and CRM components concentrate the critical processes for the General Tax Administration

(GTA)?

77. Question: What is the initial estimated number of End-to-End business processes targeted for automated discovery?

Department Response: Three

78. Question: Given the "on-premise Government Cloud" posture, must the Process

Intelligence platform be hosted locally on the Department’s infrastructure, or are SaaS models deployed within dedicated government clouds (e.g., AWS GovCloud / Azure Government) acceptable?

Department Response: Preferred on-prem, but open to view additional options if not available

79. Question: What are the specific State of Florida data residency and compliance requirements that the underlying infrastructure must satisfy?

Department Response: US based only

80. Question: Is the Department or the vendor expected to provision the computing infrastructure for the platform's Development, QA, and Production environments?

Department Response: Not for the POV being requested

81. Question: What are the pre-approved hardware specifications, virtualization standards, or reference architectures defined by the Department for SAP-adjacent systems?

82. Question: What specific high-availability (HA) and disaster recovery (DR) architectures or load-balancing tools does the Department require the platform to support?

83. Question: Will data extraction from SAP ECC and CRM into the Process Intelligence platform be handled via native connectors (RFC/BAPIs), external ETL tools, or real-time API integrations?

Department Response: All of the above are available.

84. Question: Are there specific network restrictions, firewalls, or Demilitarized Zones (DMZ) configured between SUNTAX and the proposed infrastructure for the tool?

85. Question: Does the Department require the platform to connect to non-SAP legacy systems that interact with SUNTAX to achieve true end-to-end process visibility?

Department Response: For the POV, no. We will want to see that capability for future need, but not at this time.

86. Question: What specific encryption protocols (beyond standard TLS in-transit and

AES at-rest) does the Department mandate for protecting extracted transaction logs?

Department Response: PGP, SSH, HTTPS and SSL are all in use. FDOR needs to have any data through it’s lifecycle protected along the way.

87. Question: Will SAP log data extraction be restricted to specific maintenance or off-peak windows to avoid performance degradation on the live SUNTAX production system?

Department Response: It will be offline. No direct connection will be needed for the

POV.

88. Question: What specific accessibility standards (e.g., Section 508, WCAG 2.1 AA) must the platform’s user interface comply with?

Department Response: Latest ADA standards

89. Question: Must the platform integrate with the Department’s Identity Provider (e.g., Active Directory, Azure AD, SAML 2.0) to support Single Sign-On (SSO)?

Department Response: Not for the POV, but preferred to handle SSO and IDP

90. Question: Does the Department require data masking, anonymization, or tokenization of sensitive data (PII or tax administration data) before logs are extracted from SAP?

Department Response: Preferred

91. Question: What is the mandatory data retention period for historical audit data and process models stored within the platform (e.g., 3 years, 5 years)?

Department Response: NA for the POV.

92. Question: Does the Department currently possess a baseline catalog of SAP reference processes, or will all target-state processes be modeled from scratch using

BPMN 2.0?

Department Response: TBD

93. Question: For the fit-gap analysis against SAP Best Practices, must the platform natively include standard libraries (such as SAP Signavio or SAP Activate frameworks), or can custom repositories be imported?

Department Response: Preferred but not required

94. Question: What level of complexity is anticipated for the process approval workflows and governance controls to be configured within the platform?

Department Response: Standard, non-complex

95. Question: Should the process simulation tools (Requirement 3.0) ingest real-time financial/operational cost metrics, or will simulations rely strictly on time and volume parameters?

Department Response: Real time is not needed for this requirement confirmation

96. Question: For the 30-day Proof of Value (POV) test, will the Department provide a pre-cleansed, static historical dataset ready for ingestion?

97. Question: How many Department users will require full platform access and technical support during the 30-day hands-on evaluation period?

Department Response: Five

98. Question: Should the required training and materials (Requirements 1.1 and 1.2) be split into distinct tracks for system administrators and business analysts?

Department Response: Yes, but not part of POV.

99. Question: Is the vendor expected to deliver a strategic framework or recommendation for establishing the long-term Departmental capability for process governance?

Department Response: Yes, but not part of POV.

100. Question: Does the Department currently maintain any enterprise integration, data extraction, or event logging capabilities that may be leveraged to support process mining and process discovery activities?

101. Question: Does the Department anticipate procuring software licensing and implementation services under a single solicitation, or through separate procurement vehicles?

Department Response: Single

102. Question: Can the Department provide its anticipated timeline for the SAP ECC to SAP S/4HANA transformation program?

Department Response: Next 3 years

103. Question: Approximately how many business processes does the Department anticipate being in scope for process discovery, modeling, monitoring, and governance?

Department Response: 200+

104. Question: Can the Department provide additional information regarding the anticipated scope, objectives, and evaluation criteria for any Proof of Value (PoV) activities?

105. Question: For planning purposes, would the Department permit a hybrid onshore/offshore delivery model for future implementation and support services, provided all applicable security, data residency, and compliance requirements are met?

106. Question: Does the Department anticipate that the selected platform will be utilized solely in support of the SAP S/4HANA transformation initiative, or does it envision broader enterprise-wide process governance and continuous improvement use cases beyond the initial implementation?

Department Response: Starting out, SAP, but will be leveraged for outside SAP in the future and should be able to accommodate.

107. Question: Confirm acceptable deployment models – strictly on-prem, Government Cloud, or SaaS?

Department Response: Open for review

108. Question: What external systems beyond SAP ECC/CRM must be integrated into the process intelligence platform?

Department Response: We want to understand limitations. Please outline any limitations.

109. Question: What are the specific data classification, encryption, and regulatory requirements applicable (e.g., PII, tax data handling)?

Department Response: PII

110. Question: System Technical Questions & System Functional Questions, System

Non-Functional Questions, System Administrative Questions, System Security and

Compliance Questions; Other Questions. This section is blank and no questions pre-populated, what is the response expectation?

111. Question: Are there preferred cost models (subscription, usage based enterprise license)?

112. Question: Regarding Section 5 (Objective) and the Department's on-premise

Government Cloud posture: Can the Department clarify if a secure, single-tenant SaaS deployment hosted by the vendor is acceptable if it complies with specific federal/state security standards (e.g., FedRAMP or SOC 2 Type II), or is it a mandatory requirement for the process intelligence platform to be deployed entirely within the Department’s self-managed cloud infrastructure?

Department Response: Self-managed fed ramp infrastructure preferred

113. Question: In the case of an on-premise or self-managed deployment within the

Department's environment, will the Department provide the underlying hardware, operating systems, and database licenses, or should the vendor include the full infrastructure software stack requirements in the proposed architecture?

Department Response: This is a POV, not hardware, licenses, OS or any other tech stack should be needed from the FDOR.

114. Question: Requirement 2.0 states that the migration involves consolidating both

ECC and CRM into a single platform. For automated process discovery (process mining), does the Department require the platform to natively correlate transaction logs across both systems simultaneously (e.g., tracking a taxpayer process that starts in SAP CRM and completes in SAP ECC) to form a unified end-to-end process view?

Department Response: Nice to have if possible.

115. Question: To help vendors accurately size the data ingestion requirements for

Attachment 2 (Cost Methodology): Could the Department provide an estimate of the annual transaction log volume (e.g., number of cases, financial line items, or event log rows) expected to be extracted from the legacy SUNTAX ECC and CRM systems?

Department Response: Multiple TB’s worth of Data Transfers between the systems.

116. Question: What are the current SAP NetWeaver, ECC, and CRM release/support package (SP) versions currently running in the SUNTAX production environment?

Department Response:

• SAP ECC (PRD, QAS, DEV,SBX): EHP8 For SAP ERP 6.0 SPS 22 (Based on

SAP NETWEAVER 7.5 SPS 29)

• SAP CRM (CPD, CQA, CDV,CBX): EHP8 For SAP ERP 6.0 SPS 22 (Based on

SAP NETWEAVER 7.5 SPS 29)

• SAP BW (BPD, BQA, BDV,BSX) ABAP: SAP NETWEAVER 7.5 SPS 29

• SAP Portal (SPP, SPQ, SPD) JAVA: SAP NETWEAVER 7.5 SPS 29

117. Question: In the General Questions Matrix (Attachment 1, Section II), the

Department inquires about running a true 30- day Proof of Value (POV) test with departmental information. Given the high sensitivity of General Tax Administration (GTA) data, will the Department provide a pre-scrambled/anonymized data extract for this evaluation, or will the vendor be expected to apply data-masking protocols during the extraction phase?

Department Response: We would like to see data masking if you have them as part of the product.

118. Question: For the execution of the 30-day POV, will the Department grant remote secure access (e.g., via VPN) to a nonproduction SAP sandbox/QA environment, or should vendors plan for an offline evaluation utilizing flat-file data exports provided by the Department?

Department Response: Offline Evaluation

119. Question: For the execution of the 30-day POV, will the Department grant remote secure access (e.g., via VPN) to a nonproduction SAP sandbox/QA environment, or should vendors plan for an offline evaluation utilizing flat-file data exports provided by the Department?

Department Response: Offline Evaluation

120. Question: Requirement 4.1 mentions comparing current "as-is" processes against SAP Best Practices. Does the Department expect the vendor’s platform to come pre-populated with the standard SAP S/4HANA Best Practices reference models, or will the Department provide its own reference models to be imported into the tool?

Department Response: Would like to have the system suggest or show the differences between what we have outlined and what best practices would suggest.

Thank you for your interest in doing business with the Florida Department of Revenue.

Sincerely:

Ed Valla, FCCN, FCCM, FCPM, CPPB

Purchasing Analyst EXE Program/Office of Financial Management/Purchasing Florida Department of Revenue

(850) 717-7567 edwin.valla@floridarevenue.com mailto:edwin.valla@floridarevenue.com