02/14/2017 ADDENDUM # 1. RFP : Managed Service Provider for IT Infrastructure. Provide answers to Managed Service Provider questions.

Transcription

1 02/14/2017 ADDENDUM # 1 RFP : Managed Service Provider for IT Infrastructure Addendum #1 is being issued to: Provide answers to Managed Service Provider questions. Proposers shall sign this Addendum as acknowledgment and return it with the submittal. RFP ADDENDUM Addendum # 1 Dated We, the undersigned, acknowledge the receipt of the above addendum(s) as dated. By: Title: Company: Date:

2 RFP Managed Service Provide for IT Infrastructure Some of the same questions were asked by several different vendors and were able to be combined into a single question/answer item. Q1. What is the approved budget for this contract? A: The budget for this project may exceed $400,000 Q2. Is there any incumbent of this RFP? If yes, please provide their name? A: No Q3. What is the annual spend amount for last contract? A: N/A Q4. Can the deadline for the RFP submission be extended until 03/03/17 A: Not at this time Q5. Is there a need for IaaS from the new vendor, or are you simply asking for the new vendor to help manage an existing Iaas Provider? A: Management and Continuous Improvement of the County s growing Azure presence will be the focus of IaaS related efforts. Q6. There is a section for asset management, and that it is required, but in is says NOT responsible for physical asset management/ownership A: Please see the revised exclusions below for , some asset management is required for Network and Data Center equipment. Customer Relationship Management Geographic Information Systems Help Desk/Service Desk Project Management Office (PMO) Physical Asset Management/Ownership IT Strategy and Consulting (VCIO) Asset Management(Desktop) Asset Ownership Financial Management Hardware/Software Licensing Q7. Are the datacenters in St. Charles, KC, and Wentzville owned facilities, co-lo providers, owned facilities, or a combination? A: Combination St. Charles Owned, Wentzville Owned, KC Co-lo

3 Q8.What are the ages of the on-premises gear? If co-lo, does that include any remote hands assistance at each of the respective sites? A: Ages range from 0-8yrs, limited remote hands assistance available at KC-Colo. Q9. Does the county have a framework or methodology in mind as to how we manage warrant, support, and maintenance contracts? We can certainly do this, but it is an area we would like to discuss. For example, we do this in-house and have our service contracts group handle contracts/warranty/support that we manage for our customers. The county has indicated that hosting is not desired, and that the county maintains ownership. This is all good, we just want to clarify. A: The County will likely retain ownership of physical assets though the management of such related to warranty, support, and maintenance may be considered a value added service of a Managed Service Provider. Please see General Systems Management. Q10. Will there be any parameters around creating/modifying polices, as it relates to time/effort? We can definitely help with that out of our Advanced Services group, but trying to quantify. A: St. Charles County will consider the value of every proposal in regards to improvement of existing process or policy. Any changes will be reviewed and approved by St. Charles County personnel before being implemented. Please see Infrastructure Administration for more information. Q11. Regarding the on-premises datacenter facilities management, and hardware replacement tasks.do you feel that one will be needed in each of the locations, or can this be a shared resources between St. Charles Co, Kansas City, and Wentzville? A: Shared resources Q12. Is it possible to arrange an onsite visit to view the datacenter facilities and other key physical areas within scope to assess and determine readiness, datacenter environmentals, cleanliness, etc? A: Finalists with outstanding written proposals will be invited for an onsite interview which can include a limited facilities tour. Q13. Specific to Network- is there a current network topology diagram available to get a view/size/scope, and inventory? Number of IDF/MDF. Same question for the WAN/Carrier providers? This will be critical to be able to manage SLAs and system availability, etc. Also, we will need a Letter of Agent (LOA) in place to act as representative for any 3 rd party carriers. A: Finalist(s) will be invited for an Audit and Discovery phase of the environment to run concurrent with any contract or SLA negotiation. LOA to be provided shortly after contract signing by both parties. Q14. Under Datacenter Services- Backup and Recovery- Actifio and Microsoft DPM are called out. There is also a other backup or archival statement. Does the County own other solutions? We would need to know specifically what these are. Tape, disc-based, etc. What are accumulated rough capacities of all systems for data protection? A: In addition to Actifio and Microsoft DPM, Windows Storage Server (Disk Based) is also used. Q Network Services- how many network devices by type and location?

4 A: This information can be obtained by finalists during the Audit and Discovery phase of the project. Q16. Appendix D- Data Footprints per application. Is it safe for us to assume that the 74TB is representative of total data under management or is that a different number? A: No, all SAN storage is under management. Q17. Appendix states storage capacities in SCC is 374TB, and KC is 209TB. This is different from the applications capacities, which shows 75TB. Can you provide a little detail on this discrepancy? A: The total number includes Archival Storage, Volume Snapshots, and Replication. Q18. Please provide a copy of the RFP in word format for the purpose of our use in the response. A: This will be included as an additional attachment to the online bid posting. Q19. Sections 4.6, & & 6.1.6: Contract duration and Work-in Progress: St. Charles County has requested three-year pricing with three additional option years, however has indicated current inprogress work for migration to Azure. Please provide and describe the County s IMS roadmap during the three to six-year contract term regarding the migration to the cloud, ramp up, and the changes in scope the provider should anticipate. A: Phase 1 - Azure Pilot project (ongoing) Phase 2 - Azure Migration (Target: 90-95% workload to Azure within 6 years) Q20. Section Warranty, Support, and Maintenance: Please describe the County s current asset management process today. Are asset details in a consolidated asset management database or configuration management database today? A: For Network and Datacenter equipment this is currently tracked in Excel. Entries/updates are required for any Installation, Move, Add or Change. Q21. Section Warranty, Support, and Maintenance: Are all asset information, licenses and applications automatically imported to the asset management database or configuration management database or are all inputs managed manually? What automated discovery is used? A: No automatic import of information, tracked and reviewed manually as needed. Q22. Section All Hardware Support: Is the expectation that provider is responsible for procuring hardware equipment when hardware has reached end of life, or will the County retain responsibility for hardware cost? A: St. Charles County will retain procurement and ownership in most cases. Q23. Section Periodic Audits of Equipment: Please indicate the frequency of required equipment audits. (example: required annually, quarterly, etc..) A: Minimum Annually, ad hoc as needed for special cases related to design or compliance.

5 Q24. Section Inventory: Please describe how inventory is managed today for spare and retired equipment and where the spare equipment is physically stored. A: Inventory: see answer for Question 20, equipment is stored in storage room on location at St. Charles County IS Department. Q25. Section Inventory: Please describe the current disposal processes for retired equipment. A: Once the retirement is tracked, a ticket is opened with St. Charles County IS Technical Services team for equipment disposal. Q26. Section Termination and Transfer - Sample Exit transition plan please describe the target environment to which the provider will be expected to transition services to upon contract exit. Example: transfer of services back to in-house, to another provider, or through migration to cloud services. A: Since no target exit exists at this time, please provide a mock transition plan for as many of the three scenarios as you have experience with. Q Managed Security Services Within the managed security section, it indicates the MSS may be quoted separately, given this can providers bid without addressing managed security services? A: Yes Q28. Section Please provide a breakdown of the applications which require monitoring and the number of databases. A: Will provide when a finalist is selected. St. Charles County currently has over 200 applications and over 100 databases. Q29. Section Are the application and database management services limited to the list provided in Appendix D? If not, please provide a complete list. If a complete list is unavailable, please provide a total count with breakdown by priority / criticality. A: This information can be defined with Finalist(s) during the Audit and Discovery phase Q30. Section 6.4 Reporting of billable staff hours Please specify for which services in scope the County requires reports to include billable staff hours against. A: Any and all if the billing type is per unit/use rate per hour.

6 Q In Flight Projects Please provide an estimation of effort needed to assist with execution.(number of hours, % of FTE etc..) A: Unknown at this time Q Standard Maintenance tasks - is there an expected frequency for 1) log rotation and pruning and 2) backup testing? A: Yes, frequency for 1.) weekly/monthly 2.) frequency will be determined in SOW Q All Hardware Support - Is it possible to get a breakdown on number of events that required remote hands in 2016? A: Most Incident and Problem records stated in the RFP as worked by Engineering can be resolved remotely. St. Charles County IS would estimate as many as 75% of total events are resolved remotely. Q Hardware Support What is the expected frequency for providing audit logs? A: This frequency will be defined in the SOW Q IaaS Billing Utilization - Please define the expectations for billing utilization for monitoring. A: Gather Azure data on performance usage against in place performance targets; propose adjustments and continuous improvements available from modified configuration or migration to reduce costs where applicable. Watch for unexpected or unusual changes in billing such as a high hourly use out of normal parameters. Q IaaS - Please clarify if the expectation is to include hours for project efforts to stand up new environments? A: While it may not specifically include hours to standup new environments, some reference to billable hours will be needed since supplemental project work may be desired for varying resource types (Network or Systems engineers). Specifically in regards to IaaS this would include the provisioning and modifications of VMs in an existing Azure environment. Q Monitoring Please provide a breakout of total number of alerts in 2016 and their priority (critical, high, medium, low)? A: This information may be extrapolated by the finalist(s) during the Audit and Discovery phase and defined in the SOW.

7 Q Administration - For 'providing access' - Please clarify if this is for access that requires elevated privileges or all access requests? Are you able to estimate the number of access requests handled by IMS? A: Yes this includes elevated privileges; we estimate all access requests to be approximately per month. Q Administration - Will selected vendor work primarily with application/db vendors or will there be an 'in-house' resource(s) available? A: Depending on the application, both in house Application Support staff and Vendor Support staff will be engaged directly. Q 40. Will you accept RFP's in pdf version, by ? A: No. Your response must be submitted in a sealed envelope. See page 2 of the RFP. Q41. Data Center: Is it required to have a Missouri-based data center? (As a California company, we utilize a San-Diego and Arizona-based data center.) Also, are Google services a possible consideration for an economical Disaster Recovery scenario? A: We don t anticipate the need for additional physical data center foot print, given our current Hybrid scenario of on premise/azure. Google Services are not compatible with current environment and therefore are not considered. Q42. Please clarify the section on the notarized affidavit - Is this required only if participating in the federal work authorization program? Or do all submissions require this? A: All submissions are required to have this form completed. Q43. What is the timeline for moving onsite workloads into Azure? A: see Q19 Q44. When the Azure migration is complete, how many onsite servers will remain at SCC data centers? A: Approximately 5-10% of environment workload will remain on premise.

8 Q45. How many FTEs are currently performing the onsite tasks outlined in the RFP? A: 2 FTEs and 2 supplemental contractors Q46. How many users are on the network? How many of those are privileged users? A: Approximately 1200 users, 10 privileged users. Q47. What versions of operating systems are included in the managed environment? A: 64-bit edition of Windows 7 64-bit edition of Windows bit edition of Windows Server 2008 Enterprise 64-bit edition of Windows Server 2008 R2 Enterprise 64-bit edition of Windows Server 2012 Standard CentOS Linux 6 (64 bit) Microsoft Windows 10 Enterprise 64-bit Microsoft Windows 7 Enterprise 32-bit Microsoft Windows 7 Enterprise 64-bit Microsoft Windows 8.1 Enterprise 64-bit Microsoft Windows Server 2008 R2 Enterprise 64-bit Microsoft Windows Server 2008 R2 Standard 64-bit Microsoft Windows Server 2012 R2 Standard 64-bit Microsoft Windows Server 2012 Standard 64-bit Ubuntu Linux (64 bit) Windows Server 2003 Enterprise Edition (32-bit x86) Windows Server 2003 Standard Edition (32-bit x86) Q48. What software is in use for anti-virus? A: Microsoft System Center Endpoint Protection Q49. What software is in use for file integrity monitoring? A: None Q50. Which configuration baselines are currently in use in the environment? A: 1 for new VM/Server

9 Q51. What is the total number of live IP addresses in use on the network? a. Of those, how many are externally available? b. Of those, how many are internally available? A: Can be provided to Finalist(s) during Audit and Discovery phase Q52. Which regulatory frameworks are you required to follow? A: Sarbanes-Oxley Act (SOX), the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economical and Clinical Health Act, the Gramm-Leach-Bliley Act (GLB), the Family Educational Rights and Privacy Act, Cardholder Data as defined by Payment Card Industry (PCI) Data Security Standards, criminal justice information (CJI) including without limitation criminal history record information (CHRI) as defined in Title 28, Part 20, Code of Federal Regulations Q53. Outside of the infrastructure listed in the RFP documentation, what other technologies will be in scope for security monitoring? A: A specific SOW will be developed for any services in scope of the eventual agreement. Q54. Is an onsite presence required for the managed security services, or are they able to be provided remotely? A: Most services could be provided remotely, though an occasional onsite presence may be required. Q55. We notice the Proposal Response block on the bottom right of each page of the RFP. Would you prefer our proposal be submitted within the RFP PDF document provided, or would it be acceptable to present our proposal as a separate document? A: We will accept both. The County s original RFP document must be included with all submittals and all forms must be completely filled out.