IFB 43-1391-26 DES Data Back Up and Recovery Services

STATE OF NORTH CAROLINA INVITATION FOR BID NO. 43-1391-26
Contract Name: Data Backup & Recovery Services
AGENCY NAME : Department of Commerce
Division Name : Division of Employment Security Bid Opening Date: October 26, 2026 at 3:00 p.m.
E.T.
Issue Date: October 14, 2026
Refer ALL inquiries regarding this IFB to:
Name : Casey C. Jones Commodity Code: 811122 Software Maintenance
and Support
Email : casey.c.jones@commerce.nc.gov
Purchasing Agency: Division of Employment Security
See page 2 for submittal instructions. Requisition No.: PR13037134
OFFER AND ACCEPTANCE
The State seeks offers for the software and software support described in this solicitation. The State's
acceptance of any offer must be demonstrated by execution of the acceptance found below and any subsequent
Request for Best and Final Offer, if issued. Acceptance shall create a contract having an order of precedence
as follows: In cases of conflict between documents comprising the contract, the order of precedence shall be (1)
Best and Final Offers, if any, (2) special terms and conditions specific to this solicitation, (3) specifications, (4)
Department of Information Technology Terms and Conditions of this solicitation, and (5) the agreed portions of
the awarded Vendor's offer. No contract shall be binding on the State until an encumbrance of funds has
been made for payment of the sums due under the contract.
EXECUTION
In compliance with this solicitation and subject to all the conditions herein, the undersigned offers and agrees to
furnish any or all Services or goods upon which prices are offered, at the price(s) offered herein, within the time
specified herein. By executing this offer, I certify that this offer is submitted competitively and without collusion.
Failure to execute/sign offer prior to submittal shall render offer invalid. Late offers are not acceptable.
OFFEROR:
STREET ADDRESS: P.O. BOX: ZIP:
CITY, STATE & ZIP: PHONE:
NAME & TITLE OF PERSON SIGNING: E-MAIL:
AUTHORIZED SIGNATURE: DATE:
Offer valid for sixty (60) days from date of offer opening unless otherwise stated here: ____ days
ACCEPTANCE OF OFFER
If any or all parts of this solicitation are accepted, an authorized representative of Department of Commerce shall
affix their signature hereto. A copy of this acceptance will be forwarded to the successful vendor(s).
FOR STATE USE ONLY
Offer accepted and contract awarded _____________________________________, as indicated on attached certification,
by _____________________________________________ (Authorized representative of Department of Commerce).

TABLE OF CONTENTS
1.0 INTENT, USE, DURATION AND SCOPE ................................................................................................. 3
2.0 GENERAL INFORMATION .......................................................................................................................3
2.1 VENDOR QUESTIONS ..............................................................................................................................3
2.2 ADDENDUM TO SOLICITATION ..............................................................................................................3
2.3 ELECTRONIC OFFER SUBMITTAL ..........................................................................................................3
2.4 BASIS FOR REJECTION ...........................................................................................................................4
2.5 LATE OFFERS ...........................................................................................................................................4
2.6 NON-RESPONSIVE OFFERS ...................................................................................................................4
2.7 NOTICE TO VENDOR(S) ..........................................................................................................................4
2.8 E-PROCUREMENT SYSTEM ....................................................................................................................5
2.9 DISTRIBUTORS AND RESELLERS ..........................................................................................................5
2.10 POSSESSION AND REVIEW ..................................................................................................................5
2.11 BEST AND FINAL OFFERS (BAFO) .......................................................................................................5
2.12 AWARD .....................................................................................................................................................6
2.13 POINTS OF CONTACT ...........................................................................................................................6
3.0 SPECIFICATIONS ....................................................................................................................................6
3.1 VENDOR STANDARD AGREEMENT(S) ..................................................................................................6
3.2 VENDOR UTILIZATION OF WORKERS OUTSIDE U.S. - DISCLOSURE STATEMENT ........................ 7
3.3 E-VERIFY ...................................................................................................................................................8
3.4 BRAND SPECIFIC PRODUCT ..................................................................................................................8
3.5 SECURITY SPECIFICATIONS ..................................................................................................................8
3.6 ENTERPRISE ARCHITECTURE SPECIFICATIONS .............................................................................. 10
3.7 SPECIFICATIONS - SEE SECTION 4.0 FURNISH AND DELIVERY ..................................................... 12
3.8 DELIVERY ...............................................................................................................................................1 2
3.9 CONTRACT TERM ..................................................................................................................................1 2
3.10 PROFESSIONAL SERVICES AND IMPLEMENTATION SPECIFICATIONS.....................................12
3.10.1 IMPLEMENTATION ROLES AND RESPONSIBILITIES.............................................................12
3.10.2 TIMELINE.........................................................................................................................12
4.0 FURNISH AND DELIVER .......................................................................................................................1 3
5.0 ADDITIONAL INFORMATION ................................................................................................................1 7
5.1. RECYCLED CONTENT ...........................................................................................................................1 7
5.2. ENERGY STAR PRODUCTS ..................................................................................................................1 7
6.0 DEPARTMENT OF INFORMATION TECHNOLOGY INSTRUCTIONS TO VENDORS ........................ 18
7.0 DEPARTMENT OF INFORMATION TECHNOLOGY TERMS AND CONDITIONS ............................... 20
ATTACHMENT A: ADDENDUM TO THE RUBRIK MASTER AGREEMENT/RUBRIK MASTER AGREEMENT
Page 2 of 3 Aug 5, 2026

1.0 INTENT, USE, DURATION AND SCOPE
The purpose of this IFB is to solicit offers to provide Data Backup & Recovery Storage Services via
Rubrik Hardware, Software and Professional Services for the North Carolina Department of
Commerce, Division of Employment Security. Goods and Services will be provided in accordance to
the terms and conditions of this Solicitation.
2.0 GENERAL INFORMATION
2.1 VENDOR QUESTIONS
All inquiries regarding the solicitation specifications or requirements must be addressed to the contact
person listed on Page One of this solicitation via the Ariba Sourcing Tool's message board. Vendor
contact regarding this Solicitation with anyone other than the contact person listed on Page One of
this Solicitation may be grounds for rejection of said Vendor's offer.
Written questions concerning this Solicitation will be received until October 16, 2026 1:00 pm
Eastern Time. They must be submitted to the contact person listed on Page One of this Solicitation
via email at Casey.c.jones@commerce.nc.gov. Please enter "Questions Solicitation IFB 43-1391-
26" as the subject for the message. Questions should be submitted in the following format:
REFERENCE VENDOR QUESTION
Solicitation Section,
Page Number
2.2 ADDENDUM TO SOLICITATION
The Agency will issue an Addendum by 5:00 pm Eastern Time on October 19,2026 to provide a
response to all questions received in accordance with Section 2.1-VENDOR QUESTIONS, above.
The Agency may issue additional Addenda as needed to modify the specifications, requirements,
terms and conditions, etc. Critical information may be included in these Addenda. It is important
for Vendors to periodically check the website for any and all Addenda that may be issued prior to
the bid opening date.
All Addenda will be posted on the electronic Vendor Portal (eVP) website at https://evp.nc.gov and
will become Addenda to this solicitation.
2.3 ELECTRONIC OFFER SUBMITTAL
Due Date: October 26, 2026
Time: 3:00 p.m. Eastern Time
Sealed offers, subject to the conditions made a part hereof, will be received by the time and date
specified above and then opened for furnishing and delivering the commodity as described herein.
It is the Vendor's sole responsibility to submit its offer by the specified time and date of opening.
The Vendor shall bear the risk for late electronic submission due to unintended or unanticipated
delay including, but not limited to, internet issues, network issues, local power outages, or application
issues. No offers are able to be uploaded in Ariba after the deadline/bid opening date and time.
a) Submit one (1) signed, original electronic offer via the Ariba Sourcing Module. The Vendor
to include the Execution Page 1 WITH the remaining pages of the solicitation in one PDF.
Page 3 of 4 Aug 5, 2026

The Execution Page 1 must be signed and dated by an official authorized to bind the Vendor's
firm. Failure to return a signed offer shall result in disqualification.
b) File names should identify the Vendor, solicitation, and document in that order (Vendor Name -
Solicitation Number - Offer, etc.).
c) Files must not be password protected. They must be in .PDF, .JPEG, .DOC or .XLS format and
capable of being copied to other sources. The Vendor's offer may be deemed non-responsive if
the Agency is unable to open the file(s).
d) If the offer contains any confidential information (as defined in the NCDIT Terms and Conditions,
"CONFIDENTIALITY" Section), the Vendor must provide one (1) redacted electronic copy in
addition to the original copy.
2.4 BASIS FOR REJECTION
Pursuant to 9 NCAC 06B.0401, the State reserves the right to reject any and all offers, in whole or
in part; by deeming the offer unsatisfactory as to quality or quantity, delivery, price or service offered;
non-compliance with the specifications or intent of this solicitation; lack of competitiveness; error(s)
in specifications or indications that revision would be advantageous to the State; cancellation or
other changes in the intended project, or other determination that the proposed requirement is no
longer needed; limitation or lack of available funds; circumstances that prevent determination of the
best offer; or any other determination that rejection would be in the best interest of the State. Vendor
contact regarding this RFQ with anyone other than Casey C. Jones at
casey.c.jones@commerce.nc.gov may be grounds for rejection of said Vendor's offer.
2.5 LATE OFFERS
Regardless of cause, late offers will not be accepted and will automatically be disqualified from
further consideration. It shall be the Vendor's sole risk to ensure delivery at the designated office by
the designated time. Late offers will not be opened and may be returned to the Vendor at the expense
of the Vendor or destroyed if requested.
2.6 NON-RESPONSIVE OFFERS
Vendor offers will be deemed non-responsive by the State and will be rejected without further
consideration or evaluation if statements such as the following are included:
* "This offer does not constitute a binding offer",
* "This offer will be valid only if this offer is selected as a finalist or in the competitive range",
* "Vendor does not commit or bind itself to any terms and conditions by this submission",
* "This document and all associated documents are non-binding and shall be used for discussion
purposes only",
* "This offer will not be binding on either party until incorporated in a definitive agreement signed
by authorized representatives of both parties", or
* A statement of similar intent.
2.7 NOTICE TO VENDOR(S)
The State objects to and will not be required to evaluate or consider any additional terms and
conditions not previously agreed to by the State and submitted with an Offeror's response.
This applies to any language appearing in or attached to the document as part of the Offeror's
response. By execution and delivery of this RFQ and response(s), the Offeror agrees that any
additional terms and conditions, whether submitted purposely or inadvertently, shall have no
force or effect.
Page 4 of 5 Aug 5, 2026

2.8 E-PROCUREMENT SYSTEM
The State utilizes the NC eProcurement (NCEP) system to process requisitions and issue purchase
orders. See http://eprocurement.nc.gov/ and General Terms and Conditions, Electronic
Procurement for more information.
a) It is the Vendor's responsibility to read these provisions carefully and to consider them in
preparing the response. By signature, the Vendor acknowledges acceptance of all provisions
related to NCEP.
b) The transaction fee addressed in General Terms and Condition, Electronic Payment (currently
at 1.75%) applies to the purchase of goods only. It does not apply to Vendor Hosted Solutions,
IaaS, PaaS, SaaS, software maintenance/support services, or any other type of services.
c) If not already registered in NCEP, the Vendor must register within two (2) days after notification
of contract award.
d) The Vendor must be current on all NCEP fees prior to submitting a response. Otherwise, the
State may disqualify the Vendor from participating in this solicitation.
2.9 DISTRIBUTORS AND RESELLERS
"Resellers" as used herein, refers to businesses that routinely sell or distribute Vendor's Products,
and may include "Distributors", "Value Added Resellers" (VARs), "Original Equipment
Manufacturers" (OEMs), Channel Partners, or such other designations. These businesses must be
approved by the State prior to placement of any orders. Any contract established will be subject to
this solicitation and any resulting Agreement(s), and to the terms and conditions of the State's
competitive bidding process.
The Agency acknowledges that the Reseller has merely purchased the Third-Party Items for resale
or license to the Agency, and that the proprietary and intellectual property rights to the Third-Party
Items are owned by parties other than the Reseller ("Third Parties"). The Agency further
acknowledges that except for the payment to the Reseller for the Third-Party Items, all of its rights
and obligations with respect thereto flow from and to the Third Parties. The Reseller shall provide
the Agency with copies of all documentation and warranties for the Third-Party Items which are
provided to the Reseller. The Reseller shall assign all applicable third-party warranties for
Deliverables to the Agency.
2.10 POSSESSION AND REVIEW
During the evaluation period and prior to award, possession of the bids and accompanying
information is limited to personnel of the issuing agency, and to the committee responsible for
participating in the evaluation. Vendors who attempt to gain this privileged information, or to
influence the evaluation process (i.e. assist in evaluation) will be in violation of purchasing rules and
their offer will not be further evaluated or considered.
After award of contract the complete bid file will be available to any interested persons with the
exception of trade secrets, test information or similar proprietary information as provided by statute
and rule. Any proprietary or confidential information which conforms to exclusions from public
records as provided by N.C.G.S. 132-1.2 must be clearly marked as such in the offer when
submitted.
2.11 BEST AND FINAL OFFERS (BAFO)
The State may establish a competitive range based upon evaluations of offers, and request BAFOs
from the Vendor(s) within this range, e.g. "Finalist Vendor(s)". If negotiations or subsequent offers
are solicited, the Vendor(s) shall provide BAFO(s) in response. Failure to deliver a BAFO when
Page 5 of 6 Aug 5, 2026

requested shall disqualify the non-responsive Vendor from further consideration. The State will
evaluate BAFO(s), oral presentations, and product demonstrations as part of the Vendors'
respective offers to determine the final rankings.
2.12 AWARD
It is the general intent to award this contract to one (1) Vendor. As provided by statute, award will
be based on Best Value Analysis, Lowest Price Technically Acceptable Source Selection Method
in accordance with 09 NCAC 06B. 0302 Information Technology Procurement.
2.13 POINTS OF CONTACT
Contact by the Offeror with the persons shown below for contractual and technical matters related
to this RFQ is only permitted if expressly agreed to by the purchasing lead named on page 4, or
upon award of contract:
For Vendor completion:
Vendor Contractual Point of Contact Vendor Technical Point of Contact
Name of Vendor: Name of Vendor:
Street: Street:
City, State, Zip: City, State, Zip:
Email: Email:
State Contractual Point of Contact State Technical Point of Contact
Name of State Agency: Name of State Agency:
Street: Street:
City, State, Zip: City, State, Zip:
Email: Email:
3.0 SPECIFICATIONS
3.1 VENDOR STANDARD AGREEMENT(S)
The terms and conditions of Vendor's standard license, maintenance or other agreement(s)
applicable to Software and other Products acquired under this Agreement may apply to the
extent such terms and conditions do not materially change the terms and conditions of this
Agreement. In the event of any conflict between the terms and conditions of this Agreement and
the Vendor's standard agreement(s), the terms and conditions of this Agreement relating to audit
and records, jurisdiction, choice of law, the State's electronic procurement application of law or
administrative rules, the remedy for intellectual property infringement and the exclusive remedies
and limitation of liability in the Terms and Conditions herein shall apply in all cases and supersede
any provisions contained in Vendor's relevant standard agreement or any other agreement. The
State shall not be obligated under any standard license and/or maintenance or other Vendor
agreement(s) to indemnify or hold harmless the Vendor, its licensors, successors or assigns; nor
arbitrate any dispute, nor pay late fees, legal fees or other similar costs.
The Addendum to the Rubrik Master License Agreement by and between the North Carolina
Department of Information Technology and Rubrik, Inc. fully executed on December 19, 2018, is
Page 6 of 7 Aug 5, 2026

applicable to this IFB # 43-1391-26 and is hereby incorporated by reference herein and included
as Attachment A - Addendum to the Rubrik Mater License Agreement. This Addendum may be
updated and if so, the current edition will be incorporated into the IFB/Contract via a Best and
Final Offer (BAFO).
3.2 VENDOR UTILIZATION OF WORKERS OUTSIDE U.S. - DISCLOSURE STATEMENT
In accordance with the Statewide Information Security Manual (SISM), the State restricts the
location of information systems that receive, process, store, or transmit State and Federal data
to the United States which includes the following areas: US States, US Territories, US
Embassies, and US Military installations (stateside or overseas). This restriction applies to the
Vendor and to any subcontractors engaged to provide Services under this Agreement or with
access to State Data. The Vendor must ensure that its subcontractor agreements contain the
same restrictions and will be responsible for monitoring and enforcing subcontractor compliance
at all times.
Pursuant to N.C.G.S. 143B-1361(b), the Vendor must complete and return this Disclosure
Statement herein with its solicitation response. The Vendor may attach additional pages to its
response if needed. The State of North Carolina will evaluate Disclosure Statement Information
for additional risks, costs, and other factors associated with its service prior to making an award
for any such Vendor's offer. The Vendor must provide the following information in its bid
response:
Vendor to complete a.-e. in their offer:
a. The location of work performed under a state contract by the Vendor, any subcontractors,
employees, or other persons performing the contract and whether any of this work will be
performed outside the United States.
Vendor to enter text here to answer this disclosure question:
b. The corporate structure and location of corporate employees and activities of the Vendor,
its affiliates or any other subcontractors.
Vendor to enter text here to answer this disclosure question:
c. Vendor agrees to provide notice of the relocation of the Vendor, employees of the Vendor,
subcontractors of the Vendor, or other persons performing Services under a state contract
outside of the United States in the event such relocation occurs during the contract term.
Does Vendor agree to provide notice as defined above? YES NO
d. Vendor agrees that any Vendor or subcontractor providing call or contact center Services
to the State of North Carolina shall disclose to inbound callers the location from which the
call or contact center Services are being provided.
Does Vendor agree to provide disclosure as defined above? YES NO
e. Will any work under this contract be performed outside the United States? YES
NO
The use of resources or workers located outside the United States is a critical security exception
that must be escalated to the State Chief Information Officer for review pursuant to N.C.G.S.
143B-1376(c) and 143B-1320(c). These critical security exceptions are approved only in rare
and extenuating circumstances. Vendor should account for this when preparing its response.
Page 7 of 8 Aug 5, 2026

____________________________________________________________________________
__
3.3 E-VERIFY
Pursuant to N.C.G.S. 143B-1350(k), the State shall not enter into a contract unless the
awarded Vendor and each of its subcontractors comply with the E-Verify requirements of
N.C.G.S. Chapter 64, Article 2. Vendors are directed to review the foregoing laws. Any awarded
Vendor must submit a certification of compliance with E-Verify to the awarding agency, and on
a periodic basis thereafter as may be required by the State.
3.4 BRAND SPECIFIC PRODUCT
Manufacturer(s) name and product descriptions used in this solicitation are product specific. The
items offered in response to this solicitation must be the manufacturer and type specified. Failure
to comply with this requirement will result in rejection of offer.
3.5 SECURITY SPECIFICATIONS
3.5.2 SOLUTIONS NOT HOSTED ON STATE INFRASTRUCTURE
The Agency (named on page one (1)) has designated this solicitation to receive and securely
manage data that is classified as:
Agency has selected:
Restricted - Restricted data represents the highest risk to the State, State Agencies, and
constituents if it is disclosed or compromised. This information is likely to be regulated by
State or Federal law, and access to it is restricted to a limited audience (e.g., State and Federal
Tax Information [FTI], Payment Card data, Protected Health Information [PHI], Criminal
Justice Information [CJI], Social Security Administration provided information, etc.)
Confidential - Includes information that is limited to a small audience with a need-to-know or
legitimate business case (e.g., State employee personnel records, trade secrets, student
records, sensitive public security information, etc.). If exposed to unauthorized parties, data
from this category will cause high impact consequences such as regulatory fines, inability to
recruit talent, loss of confidence, and/or damage to vendor relationships. This is not a
complete list and is subject to legislative changes.
Internal - This is information typically used within the agency and not for public sharing. Most
documents are classified as Internal within the organization, and most State employees would
have access. This type of data, if exposed to unauthorized parties, would have a very limited
impact on an agency's reputation, compliance requirements or ability to achieve strategic
goals. Internally classified data does not contain direct identifiers. Often, the effects of the loss
of data can be recognized in very subtle ways and may not lead to clear negative
consequences causing confusion due to lack of context or minor reputational harm.
Public - Data that is open to public inspection according to state and federal law, or readily
available through public sources.
Refer to the North Carolina Statewide Data Classification and Handling policy for more information
regarding data classification. The policy is located at the following website:
https://it.nc.gov/document/statewide-data-classification-and-handling-policy.
To comply with the State's Security Standards and Policies, State agencies are required to
perform annual security/risk assessments on their information systems using NIST 800-53
controls.
Page 8 of 9 Aug 5, 2026

This requirement additionally applies to all Vendor-provided, agency-managed Infrastructure as
a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) solutions which
will handle data classified as Internal, Confidential, or Restricted.
(a) To comply with the State's Security Standards and Policies, cloud products
are required to comply with applicable FedRAMP or GovRAMP security requirements,
including but not limited to, continuous monitoring, incident response, and data
classification as outlined in GovRAMP documentation.
(b) To streamline and standardize this requirement the State has adopted GovRAMP which
is a Risk and Authorization Management Program that provides a standardized
approach to security assessment, authorization, and continuous monitoring for cloud
products and services. GovRAMP's security verification model is based on NIST 800-53
Rev. 5 (or current).
(c) The required GovRAMP verified status will depend on the sensitivity of the data and
processes supported by the solution as defined in the Statewide Data Classification
and Handling Policy.
(d) For purposes of this solicitation, in accordance with the North Carolina Department of
Information Technology Statewide Information Security Manual, a GovRAMP verified
status of GovRAMP Authorized, or agree to achieve GovRAMP Authorized status no
later than twenty-one (21) months from the effective date of the contract is required. At
offer submission, if the protected system does not currently hold a validated GovRAMP
status, the Vendor will be required to provide their GovRAMP Security Snapshot Score
and upon request, the complete Snapshot Matrix. If awarded the contract, Vendor shall
have an interim period from the effective date of the contract to
achieve the verified GovRAMP status outlined above. The interim time periods for each
data classification that requires a verified status are further described below. The Vendor
shall provision access to the State to their continuous monitoring packages at a
[standard] or [elevated] access level within fourteen (14) days of contract award, and
seven (7) days of any subsequent GovRAMP status changes. If a non-disclosure
agreement (NDA) is required by the Vendor, a copy of the NDA must be uploaded with
the response and executed by the Vendor and the State at the time of contract award.
a. Public - For third-party cloud services where the highest category of information to
be processed is Public data, the Vendor must submit an updated score for the
product annually throughout the contract duration that meets or exceeds the
original score at time of contract award. Products with GovRAMP Core, Ready,
Authorized or Provisionally Authorized statuses or FedRAMP Rev. 5 authorization
also satisfy the security requirement.
b. Internal - For third-party cloud services where the highest category of information
to be processed is Internal data, the Vendor must either achieve the status of
GovRAMP Core prior to award, or agree to achieve GovRAMP Core status within
an interim time period, no later than twelve (12) months from the effective date of
the contract.
c. Confidential - For third-party cloud services where the highest category of
information to be processed is Confidential data, the Vendor must either achieve
a status of GovRAMP Ready, or agree to achieve GovRAMP Ready status no later
than fifteen (15) months from the effective date of the contract.
d. Restricted - For third-party cloud services where the highest category of
information to be processed is Restricted Data, the Vendor must either achieve a
status of GovRAMP Authorized, or agree to achieve GovRAMP Authorized status
no later than twenty-one (21) months from the effective date of the contract.
Page 9 of 10 Aug 5, 2026

Upon contract award, Vendor's who submitted a GovRAMP Security Snapshot Score
will be required to enroll in the GovRAMP Progressing Snapshot program prior to any
data being transferred, stored or processed. The Vendor must complete their first
Progressing Snapshot within ninety (90) days of award, with the expectation that
progress will be made on a quarterly basis and access to progress reports must be
provisioned to the State. Products must maintain their participation in the Progressing
Snapshot program and continued access to progress reports must be provisioned to the
State until such time that they have achieved the minimum verified status outlined above.
The State will review the Vendor's progress on a quarterly basis and, in its sole
discretion, may determine that the Vendor is not making satisfactory progress in the
Progressing Snapshot program. Satisfactory progress shall be a material requirement
of the contract.
(e) If the Vendor holds a FedRAMP Rev. 5 authorization at time of award, this authorization
can be accepted in lieu of a GovRAMP authorization. Authorizations obtained via the
FedRAMP 20x Pilot Program will not be permitted.
If the Vendor's cloud product currently holds a FedRAMP Authorized designation, at the
time of award, the State may require the Vendor to initiate and actively pursue, within
thirty (30) days of award, the GovRAMP Fast Track Process, to achieve a GovRAMP
Provisionally Authorized or Authorized status in order to satisfy Statewide continuous
monitoring requirements.
(c) Additional Security Documentation. Prior to contract award, the State may in its discretion
require the Vendor to provide additional security documentation, including but not limited to,
vulnerability assessment reports and penetration test reports. The awarded Vendor shall
provide additional security documentation upon request by the State during the term of the
contract.
Refer to: https://it.nc.gov/documents/statewide-glossary-information-technology-terms for
descriptions of the Application Criticality categories.
Refer to: http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf for descriptions of NIST
system confidentiality, integrity, and availability categories.
3.6 ENTERPRISE ARCHITECTURE SPECIFICATIONS
3.6.1 ARCHITECTURE DIAGRAMS
The State utilizes architectural diagrams to better understand the design and technologies of a
proposed solution. The two diagrams are Network Architecture and Technology Stack. Details
on these diagrams can be found at the following link: https://it.nc.gov/resources/statewide-it-
procurement/vendor-engagement-resources#Tab-Architecture-1192
The provision of these two diagrams is preferred at offer submission. If they are not supplied at
that time, the State will formally request this information from the Vendor and if it is not supplied
within one (1) calendar week, the offer will be considered non-responsive and will not be
evaluated.
There may be additional architectural diagrams requested of the vendor after contract award. This
will be communicated to the vendor by the agency as needed during the project.
3.6.2 SOLUTION ROADMAP
A Solution Roadmap defines the vision and strategic elements of the solution. The Solution
Roadmap is a plan of action for how a Solution will evolve over time. The minimum content should
include:
* Vision for the solution
Page 10 of 11 Aug 5, 2026