{"Project Scope & Deliverables":"Vendor must implement a COTS, cloud-based grants management system covering full lifecycle (intake, review, award, contracting, reporting, closeout). Includes implementation, hosting, maintenance, training, and ongoing support. Distinct phases: kickoff, testing, deployment, adoption.","Experience and References":"Bidder must describe three examples in which the proposed software has been deployed for a customer similar to EOED, and for each of these instances provide the name and contact information for an individual employed by the entity that has deployed the software that can be used as a reference.","Client / End-User Profile (User Base)":"Estimated user volumes across all tracks total 9 System Administrators, 130–190 Program Staff, 300–450 Reviewers, and 3,000–6,000 Applicants/Grantees.\nThe system serves Internal Admin Access users—System Administrators (3 users across phases), Program Staff (30–40 in Phase 1; 75–100 in Phase 2; 25–50 in Phase 3), and Reviewers (100–150 across all phases)—and External Grantee Access users (Applicants/Grantees: 1,000–2,000 across all phases)..","Go-Live/Launch Timeline":"Community One Stop for Growth:\n1. Project Kick Off - Engagement begins - 10/08/2026\n2. MVP Public Launch - 01/15/2027\n- Deliverables include, but not limited to:\n- Grant Portal fully configured, with required design components incorporated\n3. Substantial Completion - All remaining scope completed - 03/04/2027\n- Custom Mass.gov domain assigned\n- Accessibility requirements met\n- Organization profiles configured\n- MyMass.gov SSO integration\n- Expression of Interest integration\n\nBusiness Front Door:\n1. Project Kick Off 10/08/2026\n2. Substantial Completion TBD","Geographic / Offshore Resource Restrictions":"All contractor personnel must be physically located and operating in the U.S. Data subject to Massachusetts/Commonwealth residency and security standards.","Hosting & Infrastructure Requirements":"Cloud-based SaaS required. Must comply with Commonwealth enterprise security, accessibility, and architecture standards. No specific provider mandated; extensible, standards-based integration required.","Legacy System":"IGX (One Stop)\nSalesforce (Business Front Door)\nSoftware implementation vendor not stated.","Data Migration":"Vendor responsible for data conversion and migration from legacy systems (IGX, Salesforce). Must support import of historical application data into new system.","System Integrations":"Requires robust, standards-based RESTful APIs and bi-directional integration with Business Front Door (Salesforce) for application initiation and status sync, MyMassGov (OpenID Connect OAuth 2.0 SSO) for applicants, Azure Entra ID for staff SSO, One Stop Expression of Interest tool (AWS AI agent), reporting platforms (Snowflake, Power BI, ArcGIS, Tableau), and Commonwealth platforms (Submittable, Microsoft).","Reporting & analytics":"Built-in dashboards, Ad hoc reporting, KPI reporting, Portfolio reporting, Graphs, Charts, Drill-down reporting, PDF/XLSX/CSV exports, Aggregate reporting, Audit reporting. Compliance tracking","Maintenance & Support":"Vendor must provide ongoing managed services including maintenance, support, help desk operations, troubleshooting, system upgrades, performance monitoring, and sustained operational/development support.","Training":"Vendor must deliver training for internal and external users. At least two EOED staff must be trained to deliver future training. Materials must include guides and help desk support.","Proposal / Submission Requirements":"Responses submitted via COMMBUYS portal. Must include technical and cost proposals, compliance forms, and SBPP eligibility documentation if applicable.","Initial Contract Term":"From the Effective Date through June 30, 2027, estimated to be approximately nine (9) months if the contract begins on or around October 1, 2026.\nFour one-year renewal options. Maximum duration through June 30, 2031.","Ongoing Project Management Obligations":"Weekly status reports and meetings required. Contractor PM must maintain project plan, provide updates, and coordinate with EOED PM. Formal acceptance process for deliverables.","Disclosed Budget or Contract Value":"Not addressed in RFP or addenda. No budget range disclosed.","Subcontracting & Teaming":"Subcontractors permitted but prime contractor retains full responsibility. Personnel changes require EOED approval.","Pricing Structure & Cost Format":"Firm fixed price for tasks/deliverables. Costs must cover licenses, hosting, training, maintenance, and enhancements. Milestone-based payments tied to deliverable acceptance.\n\nEOED expects that license and subscription costs could be waived or heavily discounted during the implimentation phase because EOED does not have full productive use during this time.\n\nAll Bidder proposed fees, including but not limited to license, hosting and maintenance subscription fees, and time and materials hourly fees, shall remain fixed for the first five (5) years of the agreement. Fees for each successive year may not increase more than 3% of the previous year. Bidders are encouraged to propose a price cap lower than 3%. \n\nThe narrative must detail implementation costs, licensing models, maintenance/support, volume discount schedules, right-sizing user license adjustment processes, optional module pricing, cost model alternatives, and estimated 3-year major upgrade costs.","Diversity / Socioeconomic Preferences":"Massachusetts Small Business Partner Program (SBPP) preference applies. SBPP-certified small businesses prioritized if they meet best value criteria.\n\nAdditionally, bidders must submit a Supplier Diversity Program (SDP) Plan, committing at least 1% of the contract value to certified diverse businesses, with higher commitments receiving additional evaluation points.\n\nWhile all businesses, no matter the size or principal place of business, may submit responses to this solicitation, should an SBPP participant respond and meet the best value criteria as described in this solicitation, the SBPP participant shall be awarded the contract. The Strategic Sourcing Services Team (SSST) will not evaluate submissions from non-SBPP participants unless no SBPP Bidder meets the SSST’s best value evaluation criteria. \n\nAfter contract award (if any), the Total SDP Commitment shall become a contractual requirement to be met annually on a Massachusetts fiscal year basis (July 1 – June 30) for the duration of the contract. The minimum acceptable Total SDP Commitment in response to this solicitation shall be 1%. Bidders shall be awarded additional evaluation points for higher SDP Commitments.\n\nSDP Partners are not required to be subcontractors.\nSDP Partners are not required to be Massachusetts-based businesses.\nSDP Partners may be changed or added during the term of the contract, provided the Contractor continues to meet its SDP Commitment.","E-Signature":"The solution must provide legally binding electronic signature capability for award letters, grant agreements, and other grant-related documents. No preferred e-signature vendor (e.g., DocuSign, Adobe Acrobat Sign) is specified.","Escrow":"Not addressed in RFP or addenda.","Warranty / Stabilization Period":"Minimum six (6) month warranty following Agency acceptance of the system or modifications. During the Warranty Period, the Contractor must correct defects at no additional cost. Subscription-based licenses must be warranted for the entire subscription term.","Payment Terms":"Payment tied to deliverable acceptance. Invoices due within 45 days of acceptance. Commonwealth bill-paying policies apply.","Retainage / Withholding":"Not addressed in RFP or addenda. No retainage specified.","Billing and Invoicing":"Valid invoices must include resource names, dates, hours, and deliverable references. Late invoices (>45 days) may be reduced.\nInvoices must comply with CTR Bill Payment Policy and electronic signature standards (CTR Appendix D). \nBidders must submit a Prompt Payment Discount Form with their bid response.","Disaster Recovery And Business Continuity":"Vendor must provide hosting with performance monitoring. No explicit RPO/RTO targets stated. Must comply with Commonwealth standards.","Security Requirements":"Must comply with Commonwealth enterprise security standards, encryption at rest/in transit, audit logs, role-based access. No specific certifications (e.g., SOC 2) mandated.","Change Request / Scope Change Handling":"Formal change requests via written amendment. Contractor must notify EOED 30 days before termination if tasks incomplete.","Mobile App":"Software should be mobile-ready and user-friendly via web browsers on phones, tablets, and other devices in addition to personal computers and laptops. The Software should be able to be accessed through today's leading web browsers, including, but not limited to Google Chrome, Safari, and Microsoft Edge.","L-1 Support/Help Desk Support/Call Center":"Ongoing help desk services must provide timely technical assistance to applicants during application submission and to EOED and participating agencies in connection with review, reporting, compliance, and data extraction activities.","Intellectual Property Ownership":"Governed by Commonwealth IT Terms and Conditions (Attachment G-1/G-2) and Standard Contract Form. The Commonwealth prefers productized COTS/SaaS solutions where core vendor platform IP remains vendor-supported while system configurations, custom workflows, data, and deliverables belong to or are fully accessible to the Commonwealth. Data migration and export required at contract end.","Commercial and Legal Risks (Liability caps, indemnity, liquidated damages, penalties, performance bonds, no exceptions)":"Vendor liable for misrepresentation of SBPP status. Accessibility violations must be remediated at no cost.\nLimitation of Liability \nThis Section 13 shall not limit Contractor’s liability and indemnification obligations for personal injury, property damage, and/or intellectual property claims, nor the State’s ability to join the Contractor as a third-party defendant in connection with any claims. The Contractor’s liability for any security incident, data breach, or unauthorized disclosure of data (each a “Data Breach”) shall not exceed the greater of: (i) $500,000; (ii) the amount mandated by applicable State or Federal law; (iii) three (3) times the total value of the Contract (or in the case of subscription-based Contracts, three (3) times the total value of the Contract during the committed subscription term); or (iv) the total coverage available from Contractor’s insurance provider(s) for such Data Breach. The Contractor’s liability for any other claim shall not exceed the greater of: (i) $100,000; or (ii) two times the total value of the Contract (or in the case of subscription-based Contracts, two times the total value of the Contract during the committed subscription term). The Contractor shall be liable for incidental or consequential damages, including without limitation, loss of use of equipment, lost revenue, lost savings or lost profits of the State only with respect to personal injury, property damage, intellectual property rights and Data Breaches.","Staffing(Onsite, Resource availability, feasibility of onsite-offshore model)":"Not addressed in RFP or addenda.","Competition (Favoring a particular vendor, platform)":"Solutions requiring substantial custom development, including implementations built on general-purpose platforms, will be considered less responsive and may receive lower evaluation scores","Partnership Gaps (Lack of required local partner or sub-contractor)":"Partner with a Massachusetts Supplier Diversity Program (SDP)-certified firm (minimum 1% commitment)","Code Review":"The contractor must develop software following industry best practices and security standards (e.g., NIST and SANS). The solution must use separate Development/QA and Production environments, implement change management, source control, role segregation, and security controls to ensure only authorized, tested, and approved code is deployed. Additionally, the software must undergo an independent code review to verify compliance with security, IT standards, and project requirements before production deployment.","Regulatory & Statutory Compliance":"Must comply with Massachusetts procurement laws (MGL c.7, c.30, 801 CMR 21.00). Data handling laws: MGL c.93H, c.66A, c.93I. Accessibility compliance with WCAG 2.1/2.2 AA.","Value Added / Optional":"Bidders are encouraged to demonstrate capabilities such as configurable workflows, AI-enabled automation, enterprise reporting, extensible architecture, and standardized implementation that provide additional value beyond the minimum requirements.","RFP Document Folder Link":"https://drive.google.com/drive/folders/16vEh1552lXkTb_TbyROSZEEOdXxE52Tf?usp=drive_link"}
Assumptions
- Cardinality Solution will be hosted on AWS Gov Cloud for the production instance.
- AWS Hosting includes one production and six non-production instances - Development, Integration Testing, UAT and Staging
- Cardinality SaaS license includes - Yearly 2 upgrades, monthly hot fixes and level 3 support
- All resources would be based out of the United States
- The Cardinality SaaS license cost is provided for up to 640 internal users, 450 External users and up to 6,000 Citizen users
- Cardinality will leverage the Adobe or DocuSign licenses of the Agency for e-signature and Power BI licenses of the Agency for Reporting/Analytics
- The Operations & Maintenance phase is assumed to start after the DDI phase of 6 months followed by 6 months of warranty
- Cardinality will provide a mobile responsive application. Development of a mobile app is not part of scope of work
- Cardinality will provide Tier-1, Tier-2 and Tier-3 support during the M&O Phase
- Training is based on two weeks of in‑person sessions for the staff. Additional sessions, if required, will be delivered virtually through instructor‑led classes or self‑paced modules.
- COLA %
- DDI