DHSMV RFI 007-19 Cloud Hosting and Disaster Recovery Services … · DHSMV RFI 007-19 Cloud Hosting and Disaster Recovery Services Questions and Answers DHSMV RFI 007-19, Page 1 of

DHSMV RFI 007-19

Cloud Hosting and Disaster Recovery Services

Questions and Answers

DHSMV RFI 007-19, Page 1 of 17


Note: All written questions are reproduced in the same format as submitted by the Vendor.

Question(s) received on 8/14/2018 from Kinetic:

1. Question: Do you have size of the data files you wish to have in the cloud.

Answer: No. If the Department issues a solicitation, this information will be provided at that time.

2. Question: In a failover situation do you want to have the data restored in order of importance?

Answer: Yes, “orchestration” is a primary component of a failover process. The Department would be interested in seeing solutions that offer the ability to have failover “runbooks” that control the order of restoration.

3. Question: You are requesting a 5 year cost proposal, what about data growth? How can we show the cost for data growth?

Answer: The Department is looking for a pricing structure that would include elements for growth.

Question(s) received on 8/14/2018 from CJIS Group:

4. Question: What is the estimated cost of the Cloud Hosting and Disaster Recovery Services?

Answer: The Department does not currently have this information. The purpose of this RFI is to gather information regarding potential services and costs.

5. Question: Has the Department allocated funding for the Cloud Hosting and Disaster Recovery Services yet? If so, through which source (budget, CIP, state/federal grant, etc.)? If no funding is secured, which sources will be sought and when? If utilizing a grant, would you be able to specify which one?

Answer: No. The Department plans to include this project in its Legislative Budget Requests for consideration by the 2019 Legislature.

6. Question: If a subsequent RFP is released, when does the Department anticipate releasing the solicitation?

Answer: If funding is approved, the solicitation would be released during State of Florida Fiscal Year 2019-2020.

DHSMV RFI 007-19




7. Question: When does the Department want this solution to be implemented by?

Answer: During Fiscal Year 2019-2020.

8. Question: What other systems will have to integrate or interface with the Cloud Hosting and Disaster Recovery Solution, and what vendor provides each system?

Answer: All the current interfaces or integration points would be in scope for the cloud hosting project.

9. Question: Does the Department need to replace or upgrade any of the integrated systems in the next 5 years? If so, which system and when?

Answer: The Department is seeking a managed service that incorporates at least PaaS/IaaS services. It is not the Department’s goal to own hardware, but rather procure a service.

10. Question: What vendor provides current Cloud Hosting or Disaster Recovery Solution? When does the contract expire?

Answer: The Department does not currently have this solution.

11. Question: Who is the technical contact and/or project manager for the Cloud Hosting and Disaster Recovery Services?

Answer: A resource will be assigned later, if a competitive solicitation will be issued.

12. Question: Does the Department anticipate any professional or consulting services may be needed through separate procurements to accomplish this effort? (i.e. project planning/oversight, PM, QA, IV&V, staff augmentation, implementation services etc.)? If so, what services does the Department desire and how do they anticipate to procure?

Answer: The Department is seeking information through this RFI on how to best implement a cloud hosted environment to support operations and disaster recovery. The vendor responses to this RFI, as well as independent research will assist the Department in structuring this project and possible solicitation(s).

Question(s) received on 8/14/2018 from Central Florida Cloud, LLC:

13. Question: Vendor requirements 1. Do you have specific business history requirements? Although my certified veteran owned small business has partnerships with some of the largest and oldest partners in the backup and disaster recovery space.

Answer: This is not a competitive solicitation but rather a request for information intended to determine the capabilities of available solutions.

14. Question: Scale of project. 1. Do you have a rough idea on the number of servers to be backed up in total and/or per location, the amount of data in Tb in total and/or per location? 2. Does this scope include workstations in the backup and recovery plan?

Answer: 1. If the Department issues a solicitation, this information will be provided at that time. 2.No.

DHSMV RFI 007-19




Question(s) received on 8/14/2018 from Deltek:

15. Question: What does the Department currently have in place for Disaster Recovery? Does the Department utilize any cloud hosting services presently? Is there a contracted vendor in place that you work with for these services?

Answer: For disaster recovery, the Department currently has a primary site located in Tallahassee and a secondary site. Currently, the oracle databases are synchronized between data centers utilizing Active Data Guard.

16. Question: Has funding been secured for this project? Will it be available in the current 2019 Fiscal Year?

Answer: See the answer to question number 5.

17. Question: How urgent of a need is this for the Department? If there were to be a solicitation that would follow this RFI, is there an estimated solicitation release or project start date?


Question(s) received on 8/14/2018 from Carahsoft:

18. Question: How much source side data in the environment?

Answer: If the Department issues a solicitation, this information will be provided at that time.

19. Question: What types of data?


20. Question: What is the available bandwidth to the cloud at each site?


21. Question: How much data is there at each site?


DHSMV RFI 007-19




22. Question: What is your required RTO?

Answer: The Department would like to see different disaster recovery options, i.e., tiers, etc. for various RTO scenarios. Further clarification may be provided during a potential procurement process.

23. Question: What is your required RPO?

Answer: We would like to see different disaster recovery options, i.e., tiers, etc. for various RPO scenarios. Further clarification may be provided during a procurement.

24. Question: What is your required frequency of restores, and data size of average restore?


25. Question: What virtual infrastructure/Guest O/S is in the environment?

Answer: Windows and LINUX.

26. Question: What types of Applications, and Virtual/Physical servers?


27. Question: What Physical Server O/S are you running?


28. Question: What current infrastructure/process is currently in place for protecting data?

Answer: This information is not available for this RFI.

29. Question: Is GovCloud required?

Answer: No.

DHSMV RFI 007-19




30. Question: Do you currently have an IdP you are leveraging?

Answer: Yes, Active Directory.

31. Question: Do you currently have a VPC in AWS? If so, what is located in that VPC? Do you have DirectConnect? If so, do you have a public or private interface?

Answer: No.

32. Question: Is there NAS data in play? If so, what is the nature of files, shares, and is it SMB or NFS? What is your current method of protecting this data?

Answer: See the answer to question #18.

33. Question: What is your SLA on data retention?

Answer: Data retention varies and is based on the requirements in Florida Statutes.

Question(s) received on 8/15/2018 from VIRTIS:

34. Question: Is there a bidding agency we must register with in order to access solicitation documents?

Answer: All solicitations issued by Florida state agencies are posted in the Vendor Bid System (VBS). Any person may access the information posted in VBS, without creating an account. See below the link to the VBS: http://www.myflorida.com/apps/vbs/vbs_www.main_menu

35. Question: Is there a master vendor list we need to register with in order to qualify to bid?

Answer: No.

36. Question: What are the requirements for an out of state business to transact business in Florida?

Answer: All vendors who want to do business in Florida must be registered with the Florida Division of Corporations and MyFloridaMarketPlace (MFMP). For more information regarding the MFMP registration, go to the following link: https://www.dms.myflorida.com/business_operations/state_purchasing/myfloridamarketplace/mfmp_vendors/requirements_for_vendor_registration/doing_business_with_the_state_of_florida

http://www.myflorida.com/apps/vbs/vbs_www.main_menu

http://dos.myflorida.com/sunbiz/

http://dos.myflorida.com/sunbiz/

https://vendor.myfloridamarketplace.com/vms-web/spring/login;jsessionid=34F92EE4CADB5BE0CEA923499F038846.jvm2?execution=e1s1

https://www.dms.myflorida.com/business_operations/state_purchasing/myfloridamarketplace/mfmp_vendors/requirements_for_vendor_registration/doing_business_with_the_state_of_florida



DHSMV RFI 007-19




37. Question: What exactly are the required documents?

Answer: See the RFI #007-19, Cloud Hosting and Disaster Recovery Services posted in the Vendor Bid System.

Question(s) received on 8/15/2018 from Sounetu:

38. Question: The RFI requests that prospective vendors provide the following 1) A detailed list of products and/or software that would likely be necessary, as well as the system requirements, to support the solution as intended by this RFI. 2) An overview of the implementation process and its complexity, along with a realistic estimate of the timeframe required for the implementation phase. 1. a description of the level of effort to implement the solution described 2. a detailed Project Plan of the suggested solution 3. an explanation of why the suggested solution was chosen 3) Sample cost information including, but not limited to: 1. Product or Line Item (if applicable); 2. Quantity Required – Number of each product/line item required (if applicable); 3. Initial cost; 4. Total cost over five (5) years; and 5. Cost Benefit Analysis. Our experience in generating plans and successfully migrating thousands of organizations to a cloud environment has shown that migrating systems and applications requires that we have a full understanding of the existing IT environment and because replicating the existing environment is rarely the optimal approach, we need to understand current and future business requirements as well. Does the Department have a network diagram, a detailed description of the current systems and applications and a documented IT plan showing anticipated business requirements and how those will be met utilizing technology, that will be made available to prospective vendors? If so, when?


39. Question: If such documentation is not available, is the Department open to recommendations for a fee-based discovery and assessment engagement to document the current environment and identify current and future business requirements in order to prepare for a cloud migration?

Answer: No, the Department is not currently interested in an engagement as described. Please review section 5.0, Project Goals and section 6.0, Requested Information within DHSMV RFI 007-19, Cloud Hosting and Disaster Recovery Services.

DHSMV RFI 007-19




40. Question: Alternatively, what information can the Department provide that will enable prospective vendors to make general assumptions about the environment and business requirements, in order to respond to the RFI?


41. Question: We are aware of the State of FL’s fiscal year end on 9/30/2018. Is this date driving the requirement for responses to be submitted by 9/10/2018?

Answer: No. The State of Florida fiscal year ended on 6/30/2018.

42. Question: Is it the Department’s intention to begin this project in Fiscal year 2019 (beginning 10/1/2018)?

Answer: No. If funding is approved, this project would begin on 7/1/2019.

Question(s) received on 8/17/2018 from Mythics, Inc.

43. Question: What are the departments applications that need to be migrated to the cloud environment?

Answer: The entire application tier would need to be migrated.

44. Question: Will those applications need to fully function in the cloud environment or are we just backing up and storing the data?

Answer: Yes, the applications need to be fully functional. The Department is looking for a cloud hosted solution.

45. Question: What type of Cloud deployment model would you find acceptable due to your security requirements? (Private, Public, Hybrid)

Answer: The Department would be interested in seeing multiple cloud deployment models. The Department’s preference would be a private model.

Question(s) received on 8/20/2018 from DXC Technology:

46. Question: Please share total number of Physical and Virtual servers considered in scope for this RFI.


47. Question: Please provide information for following Areas -

2.1 · Infrastructure servers and Application servers.

2.3 · Production vs Non-Production Servers

DHSMV RFI 007-19




2.4 · Application to server mapping

2.5 · Application to Application dependencies

2.6 · Application aligned to specific functions for e.g.: ERP, Collaboration

2.7 · Current sizing including CPU, memory, and used data space.

2.8 · OS and their versions

2.9 · Average monthly utilization of CPU and Memory


48. Question: Please share total number of instances of databases and types of databases ( i.e. Oracle, SQL etc.)


49. Question: What is the expected Average Data growth rate for next five (5) years.


50. Question: Please share the technology landscape for applications in scope (example Mainframe, Oracle, SAP, Microsoft etc.).

Answer: Any application environment excluding Mainframe and Oracle would be within the scope of this project.

51. Question: Please specify any security requirements including any industry specific certifications and restrictions.

Answer: Potentially CJIS, DPPA, PCI, and HIPPA.

52. Question: Please specify any specific encryption requirement.

Answer: The Department would be interested in any encryption solutions.

53. Question: Do you have any Load balancer currently in use? Including, Application load balancing?

Answer: The Department currently utilizes the F5 load balancer.

54. Question: Please share current Network Architecture including VLANs, zones, accessibility requirements from different location etc.

DHSMV RFI 007-19





55. Question: Please share current Storage infrastructure details including types of storage (such as File, Share, FTP etc.).


56. Question: Please share current Backup Infrastructure details including current capacity, software and Hardware used.


57. Question: Please share Backup and Retention Requirements.


58. Question: Please share the number of applications and servers those need to be considered for Disaster Recovery.


59. Question: Please share RTO and RPO requirement for the new Disaster Recovery solution.


60. Question: DHSMV is asking for a Cost Benefit analysis - please elaborate the expectations as there is no data available for current hosting and IT spend by the department.

Answer: Please provide a CBA for a private cloud hosted solution as compared to a traditional on-premise solution.

61. Question: Do you require Hard Copies of Proposal as given in Section 7.0? Or Will you consider modifying the requirement to accept electronic submission only?

Answer: The Department requested hard and electronic copies. The Department will not consider modifying the requirement to accept electronic submission only.

Question(s) received on 8/20/2018 from CenturyLink:

DHSMV RFI 007-19




62. Question: Can you describe, at a high level, your production environment?

• Quantity of servers, Virtual and Physical, size – what is the largest?

• Number of applications?

• Top 5 critical apps?

• Number and types of all databases e.g. Oracle, SQL, Cache, MySQL, SAP, etc.?

• For each DB type, number of servers, clustered or not & size?

• Authentication?

• Shared storage? Or dedicated?

• Any Non wintel architecture?

• Any legacy systems, if so, what?


63. Question: Will the Agency require the selected vendor to design and build the target Production and or DR environment?

Answer: Yes.

Question(s) received on 8/20/2018 from Planet Technologies:

64. Question: SECTION 4 • What responsibilities will the successful vendor have with respect to the creation of a formalized back-up plan narrative or business continuity plan? • Are there specific requirements for a vendor’s relationship or competency level with the proposed Cloud Services provider?


65. Question: SECTION 5 1. Analyze and understand the Department’s current Information Technology (IT) applications, systems, and networks.

• Will the network team be available during initial planning phases? • Can you speak to the overall environment size? Servers, applications, data size?

Answer: Yes, the network team will be available during the initial planning phases. More information will be provided during a potential solicitation process.

66. Question: 2. Provide a plan for Department’s systems migration to a cloud hosted solution that supports cost-effective and secure IT management. • Is there a current cloud presence? If so, is there interest in building on that presence?

DHSMV RFI 007-19




• Is there a partner/owner company currently providing connectivity and infrastructure with which we will need to work? Will they continue to own/manage post integration?


67. Question: 3. Seamlessly transition the specified Department’s mission critical systems in the cloud environment. • What is the current technology behind applications? (SQL, Sybase, etc.)?


68. Question: 5. Store the Department’s data in the cloud. • Can you provide any additional information on the breakdown of data structure (e.g. Flat file vs. database vs. user files; cold storage vs. live data)?


69. Question: 6. Provide data and infrastructure backup strategy. • What is the current backup solution? • What is the RTO and RPO? • Is a local copy of backup data required or is a cloud only solution a viable option?


70. Question: 7. Provide a secure cloud data retrieval mechanism from the Department’s on-premise location to the cloud solution. • Are there External connectivity requirements for remote users?

Answer: All current interfaces or integration points that are currently in place would be in scope for the cloud hosting project.

71. Question: 8. Provide user training and support. • Can you provide any specificity on the Post-engagement support requirements?


Question(s) received on 8/20/2018 from Digital Intelligence Systems, LLC:

72. Question: Is there a page limitation, and or a preference on binders or paper clips for the original and copies?

Answer: No.

DHSMV RFI 007-19




Question(s) received on 8/20/2018 from Deloitte:

73. Question: Please provide details on the current application portfolio along with the list of active environments (e.g. Prod, DR, Dev, Test etc.) associated with this portfolio


74. Question: Can you provide Information on the Technology stack being leveraged by the application i.e. platform, operating system, COTs products?

Answer: Most applications are utilizing Microsoft.NET and are hosted on a Windows Environment.

75. Question: Please provide the number of systems/instances, sizes (e.g. number VM/EC2s, memory, CPU ) across each environment for storage and computing requirements?


76. Question: Could you provide details on custom development technologies being leveraged currently? (Java, .NET etc.)


77. Question: Please provide the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) requirements for each application/system.


78. Question: Infrastructure & Security Operations: Please indicate the Departments intent for managing security operations in the cloud? Will this be performed by the Department or a managed services provider? If combination what responsibilities will fall to each?

Answer: The Department requires the ability to coordinate, approve, and administer all security operations provided by a managed services provider. The Department currently utilizes a managed security service which would be extended to a cloud environment. If the department issues a competitive solicitation, more information about specific responsibilities may be included at that time.

79. Question: Can you describe any compliance or regulatory requirements for the applications?

Answer: Possibly CJIS, DPPA, PCI, and HIPPA.

DHSMV RFI 007-19




80. Question: Human Capital: Please indicate if the Department has assessed its staff skills readiness or talent attainment program for Cloud?

Answer: No.

81. Question: Please indicate the Department’s preferred training scope needs?


Question(s) received on 8/20/2018 from SHI:

82. Question: Is the agency looking for a single platform to manage a hybrid environment, for both on premise and cloud/multi- cloud operations?

Answer: Yes.

83. Question: Would the agency prefer a solution that does not require use of a gateway device to move data/workloads to and from the cloud?

Answer: Yes.

84. Question: Can a list of applications to be protected and/or migrated to the cloud be provided?


85. Question: Is there a requirement for simultaneous federated search/e-Discovery of all data holdings for the environment?

Answer: No.

86. Question: Is the ability to directly migrate from one public cloud provider to another without restaging data on premise a requirement?

Answer: No.

87. Question: Is the ability to write to and restore from data directly in cloud provider archive tier a requirement to reduce costs?

DHSMV RFI 007-19




Answer: No, but the Department is interested in seeing any solutions related to this aspect.

88. Question: Is data encryption for data in motion and at rest a requirement of the solution? To what encryption standard?


89. Question: Is role-based data and workload access a security requirement for the solution?


90. Question: Is the agency intending to replicate data to multiple cloud provider regions for added risk reduction?


91. Question: Will the cloud be used as a replacement for tape storage?

Answer: Possibly, depending on what solutions are available.

92. Question: How many applications does HSMV currently have?


93. Question: How many servers does HSMV currently operate?


94. Question: How many server and or applications will be required to remain on premises?

Answer: None.

95. Question: Could we be provided a list of all server operating systems currently in use?

DHSMV RFI 007-19





96. Question: Could we be provided an inventory of all relational database management systems currently in use (MSSQL,Oracle, MySQL, etc)?


97. Question: Are all applications that will be protected hosted in the same datacenter?

Answer: Yes.

98. Question: Are any of the applications to be protected on physical machines? (Not VMs)


99. Question: What Hypervisor are the VMs hosted on / version of the Hypervisor? (if there is a virtual environment present)

Answer: VMWare.

100. Question: What are acceptable RPO and RTO for protected applications?


101. Question: What is the current WAN Bandwidth at locations that will have applications protected?


Question(s) received on 8/20/2018 from Cloud Advisor:

102. Question: How many applications does HSMV currently have?


DHSMV RFI 007-19




103. Question: How many servers does HSMV currently operate?


104. Question: How many server and or applications will be required to remain on premises?

Answer: None.

105. Question: Please list all server operating systems currently in use.


106. Question: Please list all relational database management systems currently in use (MSSQL,Oracle, MySQL, etc).


107. Question: Are all applications that will be protected hosted in the same datacenter?

Answer: Yes.

108. Question: Are any of the applications to be protected on physical machines? (Not VMs)


109. Question: What Hypervisor are the VMs hosted on / version of the Hypervisor? (if there is a virtual environment present)

Answer: VMWare

110. Question: What are acceptable RPO and RTO for protected applications?


DHSMV RFI 007-19




111. Question: What is the current WAN Bandwidth at locations that will have applications protected?


Documents

DHSMV RFI 007-19 Cloud Hosting and Disaster Recovery Services … · DHSMV RFI 007-19 Cloud Hosting and Disaster Recovery Services Questions and Answers DHSMV RFI 007-19, Page 1 of