Request for Proposals Backup and Recovery

Size: px

Start display at page:

Download "Request for Proposals Backup and Recovery"

Juliet Walton
5 years ago
Views:

1 Request for Proposals Backup and Recovery Issued September 4, 2018 Table of Contents Page Background I. MARC Organizational Structure and Activities... 1 II. Objectives... 1 III. Current Backup and Recovery System... 2 IV. Desired System... 3 V. Required/Desired Features... 3 VI. Vendor Requirements... 4 Scope of Work... 4 Proposal Requirements... 4 Questions... 6 Response Requirements... 6 Anticipated Schedule for Vendor Selection... 7 Evaluation Criteria... 7 Open Records Act and Proprietary Information... 7 Protest Procedure... 8 Appendix A Proposed Plan by MARC Consultant... 9 Closing Date and Time for Proposals October 4, 2018, by 4 pm CDT Contact Information Sasan Baharaeen, Information Technology Program Director, sasan@marc.org

2 Background I. MARC Organizational Structure and Activities The Mid-America Regional Council (MARC) is the metropolitan planning organization and association of city and county governments serving the bi-state Kansas City region. It is a public, nonprofit agency. MARC serves nine counties with 119 cities, including Cass, Clay, Jackson, Platte and Ray counties in Missouri; and Johnson, Leavenworth, Miami and Wyandotte counties in Kansas. MARC was formed in 1972 and is governed by a 33-member board of directors composed of city and county elected officials. In addition to the board, MARC has dozens of policy, technical and advisory committees and decision-making entities overseeing its work and providing important and diverse stakeholder involvement. This series of committees and working groups enables MARC to engage a diverse array of community interests and representatives from often under-represented constituencies. The Board and committee activities are supported by a professional staff headed by an executive director who is appointed by the Board. MARC currently has 130+ employees working in six departments: aging and adult services, community development, early learning, research services, financial affairs, and transportation and environment. MARC services are funded by a variety of sources including contributions by member governments; formula and discretionary grants from Missouri, Kansas, and the federal government; and contributions for specific programs from private foundations and civic organizations. II. Objectives MARC is planning to replace its current tape-based backup system and IT Disaster Recovery plan by implementing a fully functional cloud storage, backup, and recovery solution based on the Microsoft Azure platform. MARC engaged an IT consultant to perform a study of its backup and recovery process in 2017 and was provided with a recommended solution and action plan that would meet MARC s Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO). 1

3 III. Current Backup and Recovery System MARC currently operates with a mixture of physical and virtual servers. There is a heavy investment in the Microsoft Stack. The majority of workloads depend on a Microsoft product as well as Microsoft virtualization through Hyper-V. MARC uses an HP tape library (HP MSL2024) and the Veritas BackupExec software to perform complete weekly and incremental daily backups of all its data on tapes. We keep 20 sets of weekly backups and two sets of annual backups. One set is always kept off-site. There are off-site recovery capabilities available to MARC through a service provided by Agility Recovery. The service provides trailers, generators, servers, an LTO tape library, and satellite Internet connectivity, but there is a lengthy and complicated process involved with activating the services. The following is a description of MARC s network and data storage. Virtualization: Virtual Hosts: Microsoft Hyper-V Host 1 Windows 2016 Datacenter, 256GB RAM (198 GB allocated to VMs), 22TB storage (13TB free). Hosts 18 Virtual Machines. Host 2 Windows 2012R2 Datacenter, 128GB RAM (97 GB allocated to VMs), 10TB storage (3.6TB free). Hosts 11 Virtual Machines. Virtual Replicator: Domain Controllers: Physical Servers: Replicator 1 Windows 2016 Datacenter, 56GB RAM, 9TB storage (5TB free). One physical and one virtual. Backup/Print server, VPN server (will be changed to virtual), GIS server (will be retired), Accounting Report server, Computer Lab server, Phone server. Firewall: SonicWall NSA 4600 Switches: Ruckus ICX 7150 managed POE Internet Connectivity: 1G Google fiber (primary), 50M AT&T Business fiber (secondary) Backup: Weekly full backup size 6TB Weekly physical server image backup size 2TB Weekly virtual server backup size 4.5TB Daily implemental backup size 150GB to 500 GB 2

4 Phone System: Avaya IP Office w/ Application Server. This is the only server running Linux and VMware. Workstations: HP desktop and notebooks (most running Windows 10). Software: Website: Office 365 Enterprise (backup provided by Barracuda Essentials), Microsoft Dynamic GP Accounting, Ungerboeck EBMS contact management and event registration software. Hosted on a private cloud using Amazon Web Services by a third party. IV. Desired Systems The desired solution should combine on-site and cloud storage through Microsoft Azure to provide storage, backup, and recovery functionality. V. Required/Desired Features The following is a list of required functionality for the new system. Easy/intuitive interface and management. Ability to quickly restore a deleted file/folder or restore an older version of a file. Ability to quickly restore a virtual server. Ability to restore a physical server to a replacement physical server. Ability to recover from Ransomware. Ability to backup machines with different operating systems (Windows and Linux). Provide continued functionality in the event of a power loss from outside the network. Provide continued functionality in the event of a disaster that limits access to the building for a short or extended time period. Flexible, Hardware-Agnostic replication. Service Level Agreement specifying Recovery Time Objectives and Recovery Point Objective. Geodiversity of replication hardware. Strong security. Ability to perform semiannual or annual failover testing. Detailed documentation of required steps for proper backup and recovery. Ability to meet HIPPA, FERPA (Family Educational Rights and Privacy Act) requirements. Ability to meet CIS (Center for Internet Security) standards. Ability to perform searches on archived files in the event of a legal requirement. 3

5 VI. Vendor Requirements The vendor should: Assign Microsoft and Azure-certified engineers to the project. Be able to provide service after hours if necessary. Scope of Work Work with MARC staff to review current network infrastructure and stored data to provide detailed requirements for a successful Azure implementation. This includes any changes that should be made to the internal network. Review the proposed backup and recovery plan developed by our consultant and recommend any possible changes. Recommend, install, and configure all required hardware for the plan. MARC intends to purchase any required equipment and software. The selected vendor may provide its own pricing for the equipment/software, but MARC may consider other vendors for purchasing the equipment. Set up all required infrastructure on Microsoft Azure for successful backup and full recovery processes. Provide administrator training for MARC IT staff during regular business hours. The IT staff should be able to manage daily processes and file restore functionality on their own. Configure, schedule, and provide encrypted backup management of all the data including, but not limited to: files, folders, images, system state, databases, and enterprise applications. Optimize the backup process in terms of time, space, and minimal disruption to the production environment. Help MARC staff develop a Backup and Disaster Recovery documentation/guideline, including fully annotated diagrams to use for daily operations and during an emergency. The guidelines should include processes for different types of emergencies. Perform failover testing. Proposal Requirements Company Information o List your company s legal name, address, and telephone number. o How long has your company been in business? o How long has your company or division been providing on-premises and cloud backup and recovery solutions? o Indicate if you have a partnership with Microsoft, HP, and SonicWall and describe the level of your partnership. o Do you install the equipment or use subcontractors? o How many employees do you have? o How many Microsoft, SonicWall, and VMware certified engineers do you have on staff? How many have certifications in Azure Backup and Recovery? o If you have to modify the existing plan proposed by our previous consultant, explain why your proposed solution is a better fit for our agency. 4

6 Vendor References o Provide a minimum of three (3) references for customers with operations similar to ours that use the equipment and technology being proposed. Include contact names, telephone numbers, and addresses. The solution must be in full production use. Product Requirements o Provide product descriptions and manufacturer part numbers for the proposed equipment. o Provide a spreadsheet of the Required features included in this RFP and describe how your proposal meets those requirements. o Provide IT network requirements. o Include a diagram and describe the proposed system design and required rack space. Installation Service and Maintenance o Explain details of the installation plan. o Provide a complete service and warranty agreement detailing your response time for routine maintenance work, occasional technical issues, and emergencies. Disaster Recovery o Provide a separate section to discuss how your proposal handles the recovery process for disasters caused by: Malfunctioning equipment Ransomware Loss of power Loss of access to the building Destruction of building Project Plan o Provide a detailed Project Plan/Schedule which documents all activities and timelines associated with the project including, but not limited to: Services ordered, including any required on-site equipment Solution design and configuration Timelines for system administration training On-site installation of any required equipment Testing and acceptance On-site and remote post implementation support o It is anticipated that the consultant should be able to complete the project within a 30- to 45-day timeframe. Pricing o Include separate pricing for: Any required equipment Hourly rates for out of contract work Any other fees 5

7 o Include part and model numbers for all proposed equipment. o Any travel expenses during or after the implementation if physical presence is required by MARC. o All costs associated with responding to this RFP are the sole responsibility of the responding vendor. o MARC has a 501C3 designation and also qualifies for GSA pricing. The 501C3 designation qualifies MARC for a $5,000 credit per year from Microsoft. Questions All questions regarding this Request for Proposals (RFP) should be directed to Sasan Baharaeen by at sasan@marc.org by September 20, Responses to questions will be provided to all interested parties by September 27, Response Requirements Responses to this Request for Proposals should be directed to Sasan Baharaeen NO LATER THAN 4 p.m. CDT on October 4, Responses can be submitted in print or electronic formats. Printed responses should be delivered to: Sasan Baharaeen Mid-America Regional Council 600 Broadway, Suite 200 Kansas City, MO Electronic submittals should be ed in PDF format to Sasan Baharaeen at sasan@marc.org. Note: It is the responsibility of the vendor to verify the receipt of proposals or any related electronic communication by MARC staff as there is always the possibility of s getting blocked by MARC s firewall/spam filter. Engagement This Request for Proposals does not commit MARC to award a contract or to pay costs incurred in the preparation of a proposal in response to this request. MARC reserves the right to accept or reject any or all responses received as a result of this request if it is considered in the best interest of MARC. MARC may require the proposer selected to participate in negotiations, and to submit such price, technical or other information as may be needed to finalize a particular engagement for services. 6

8 Anticipated Schedule for Vendor Selection REQUEST FOR PROPOSALS The following schedule will be used for the selection of a vendor. Issue Request for Proposals September 4, 2018 Deadline for Questions and Requests for Further Information September 20, 2018 Responses to Questions September 27, 2018 Deadline for Proposals October 4, 2018, by 4 pm CDT Select Preferred Vendor October 22, 2018 Finalize Agreement and Issue Notice to Proceed Week of October 25 We encourage vendors to make site survey appointments with the MARC IT staff. Evaluation Criteria The proposals submitted by each vendor will be evaluated by an internal committee of MARC staff according to the following factors: A. Technical a. Experience and expertise b. Effective demonstration of similar projects B. Quality, reliability, completeness, and efficiency of the technical approach and the degree it uses existing MARC equipment and infrastructure. C. Physical presence in the Kansas City metropolitan area D. Ability to complete the project in a timely manner E. Price During the evaluation process, MARC staff reserves the right, where it may serve MARC's best interest, to request additional information or clarification from proposers or to allow corrections of errors or omissions. Open Records Act and Proprietary Information The Mid-America Regional Council (MARC) is a public organization and is subject to the Missouri Open Records Act (Chapter 610, RSMo). All records obtained or retained by MARC are considered public records and are open to the public or media upon request unless those records are specifically protected from disclosure by law or exempted under the Missouri Sunshine Law. All contents of a response to a Request for Bids, Qualifications, Proposals or information issued by MARC are considered public records and subject to public release following decisions by MARC regarding the bid request. If a proposer has information that it considers proprietary, a bidder shall identify documents or portions of documents it considers to contain descriptions of scientific and technological innovations in which it has a proprietary interest, or other information that is protected from public disclosure by law, which is contained in a Proposal. 7

9 After either a contract is executed pursuant to the Request for Bids, RFQ or RFP, or all submittals are rejected, if a request is made to inspect information submitted and if documents are identified as Proprietary Information as provided above under Missouri Sunshine Law, MARC will notify the proposer of the request for access, and it shall be the burden of the proposer to establish that those documents are exempt from disclosure under the law. Protest Procedures In the course of this solicitation for proposals and the selection process, a proposer (bidder of offer or whose direct economic interest would be affected by the award of the contract) may file a protest when in the proposer s opinion, actions were taken by MARC staff and /or the selection committee which could unfairly affect the outcome of the selection procedure. All protests should be in writing and directed to Mr. David Warm, Executive Director, Mid-America Regional Council, 600 Broadway, Suite 200, Kansas City, MO Protest should be made immediately upon occurrence of the incident in question but no later than three (3) days after the proposer receives notification of the outcome of the selection procedure. The protest should clearly state the grounds for such a protest. Upon receipt of the protest, MARC s Executive Director will review the actual procedures followed during the selection process and the documentation available. If it is determined the action(s) unfairly changed the outcome of the process, notifications with the selected proposer will cease until the matter is resolved. 8

10 Appendix A Proposed plan by MARC consultant 9

11 BACKUP AND DISASTER RECOVERY RECOMMENDATION 1. Microsoft Backup and Azure Site Recovery A. Overview: 1) Includes the ability to both backup and restore locally as well as within the MS Azure cloud services. 2) Creates a great way for MARC to test the grounds with cloud services. 3) Creates a simple approach to full migration to the cloud, if MARC chooses to go that direction in the future. 4) Substantially improved RTO and RPO capabilities over existing solution while at the same time maintaining the current DR/BCP budget. 5) Service Provider (Microsoft) managed DR site. Includes facilities, cooling, security, networking, storage, compute, etc. 6) Capable of easily expanding the solution to other locations and services. B. Estimated Expense Breakdown: $20k - Local Hyper-V host for both backups as well as restoration of files and full servers to either original production location or backup hypervisor. $13k/year estimated Azure cloud storage costs $3k + $200/m Network failover capabilities provides by Cisco virtual appliance and onsite router $10k estimated implementation costs for solution Total first year = $46k Each remaining year = $15.6k Estimated average annual costs = $21.6k NOTE: estimates were generated with an estimated RTO of 30 min, RPO of 1day and a retention of 45 days. 10

C. General Design Docs Solution includes both local

for offsite backups to a MS Azure cloud service.

solution to assist with access to services in an

12 C. General Design Docs Solution includes both local backups to a MS Hyper-V Host as well as replication jobs for offsite backups to a MS Azure cloud service. Also included in this solution is an IP WAN mobility solution to assist with access to services in an automated fashion when services are provided from the Azure virtual DR site. 11

13 D. Network Failover to Azure In order to address the manual requirements of updating IP addressing, DNS, and the like. We recommend the implementation of an IP WAN mobility solution such as Cisco s OTV. This can be accomplished within Azure by Implementing the following: i) Small Cisco Azure supported virtual appliance - ~$200/m ii) Small Cisco OTV supported router on site - ~$3k 12

City of North Kansas City Request for Proposals Microsoft Office 365

City of North Kansas City Request for Proposals Microsoft Office 365 Project Overview The City of North Kansas City, Missouri is soliciting proposals to contract with a vendor to assist the City in the