Questions for Vendors Revised Company Profile: Successful completion of the Contract will require a substantial commitment of Contractor's resources and personnel. This section profiles the organization and status of the companies that may perform the Contract. Respondent Information: Respondent shall complete the Vendor Responsibility Questionnaire as noted in Section 7.10 of the RFP. Respondents shall also provide a copy of their Dun and Bradstreet SQR report as required in Section 3.14. In addition, the respondent shall provide responses to all questions below. o Describe company organization and, if applicable, relationships with subsidiaries, parent corporations, and affiliates or other related companies; include organization charts and details concerning facilities that serve the Florida market o Describe your principal type of business o Document your insurability and bonding capacity o If you offer to use any subcontractors, describe your experience as a prime contractor managing subcontractors, and your plan to manage and coordinate any proposed subcontractors Critical Questions: As part of the RFP response, each offeror must reply in writing to the questions listed below, fully, clearly, and concisely. These will be used in assisting the evaluation process. Many questions request responses for standard Hot-site, Warm-site, Cold-site, or Mobile-sites; however, the Respondents may also address other proposed solutions to include new technology as well as: Archiving solutions, Disk-based solutions, Live-streaming solutions, Web-based solutions, Cloud solutions, Multi-platform solutions, Virtualization solutions, Remote-management, and other proposed solutions appropriate for IT Disaster Recovery. A. Hot-Site Recovery Capability The successful offeror will provide and maintain a fully equipped Hot-site, with computer equipment and communications configurations that meet a wide variety of disaster recovery needs and are capable of running the Eligible User s operating systems, systems software, and applications software. All proposed sites must be located in the U.S. A1. Describe your approach to providing a Hot-site Recovery. The contractor shall provide adequate annual test time based on size and complexity of scheduled services and technical assistance as requested in Section 6.2.2 to assist agency staff in assuring that the agency's backup operations can be implemented in the contractor's Hot-site facility at the time of a disaster. A2. Describe how your approach meets the testing objectives in Section 6.2.2 to include access to all covered equipment in a reasonable time following a request to test and the approach provides access to allow testing and full activation of each agency's disaster recovery plan at a recovery facility 24 hours per day, 365 days
per year. A3. Does the contractor supply a telephone number that is staffed twenty-four (24) hours per day, seven (7) days per week through which the agency may make arrangements for immediate access? A4. Describe how your solution for hot-site recovery will satisfy the Office Space requirements in Section 6.2.2.v A5. Describe how your solution for hot-site recovery will satisfy the Recovery Objectives in Section 6.2.1. A6. Describe how your solution for hot-site recovery will satisfy the Growth Objectives in Section 5.16.2. The state is open to innovative solutions in this area. A7. The contractor will also provide assurance that its technical staff will be available to the agency for testing purposes as well as at the time of a disaster to aid recovery operations. A8. Describe the access the agency has to technical staff during recovery of operations at your proposed Hotsite solution. B. Recovery Services Overview B1. Describe any limits on the agencies' access and the number of subscribers who may be accommodated respectively for each Hot-site, Warm-site, Cold-site, Mobile-site solution proposed, and any limits on shared peripherals between computer configurations (e.g., disk, tape, cartridges, etc.). B2. Describe under what circumstance, if any, would another subscriber have higher access rights to the proposed Hot-site, Warm-site, Cold-site, and Mobile-site computer equipment configuration than the agency. Under what circumstances is this not available? Under what circumstances will the Contractor offer a guaranteed spot in line? Explain who gets priority in a wide-spread disaster? B3. What documentation is provided as part of the Hot-site, Warm-site, Cold-site, and Mobile-site/proposed solution (Set up Guides.) and how often is documentation updated? Include a copy of such documentation for the agency's review. Also, provide a listing of all system reference manuals that may be furnished by the Hot-site facilities as convenience to its subscribers. B4. Specify the maximum length of time the agency may occupy the Hotsite, Warm-site, Cold-site, and
Mobile-site/proposed solution. Are there options available to extend the length of time, if necessary? Describe existing provisions in place to relocate a subscriber to one or more of these potential alternate sites. B5. Describe the support resources contractually guaranteed at the time of disaster. B6. Do you provide 24x7 Recovery Specialist and Network Engineering support at the Hot Site, Warm-site, Cold Site, and/or Mobile Recovery Centers/proposed solution? C. Multiple Disaster Provisions Cl. The Eligible Users are concerned foremost with having a viable, testable backup facility; the secondary concern is the vendor's provisions for handling multiple subscriber disasters. In the event that two subscribers to the same backup facility/proposed solution experience a disaster at approximately the same time, describe what determines which subscriber uses the backup center and which goes to an alternate facility owned/operated by your company. C2. List the number and locations and describe the capabilities of all Hot-sites, Warm-sites, Cold-sites, and Mobile-sites proposed to support the agency's requirements. C3. What special provisions are made to handle situations involving multiple disasters between Hot-site, Warmsite, Cold-site, Mobile-site subscribers, and other proposed solutions? What circumstances or restrictions dictate the maximum number of subscribers using the facilities?
C4. How do you contractually minimize multiple disaster risks? C5.Describe existing provisions in place to relocate subscriber networks to one or more of these potential alternate sites. D. Warm-site Recovery Capabilities D1. Describe your approach to providing a Warm-site Recovery. The contractor shall provide adequate annual test time based on size and complexity of scheduled services and technical assistance as requested in Section 6.2.2 to assist the Eligible User staff in assuring that the agency's backup operations can be implemented in the contractor's Warm-site facility at the time of a disaster. D2. Does the vendor provide equipment at the Warm-site or is the Eligible User expected to provide their own equipment for the site? D3. Describe how your solution for warm-site recovery will satisfy the Recovery Objectives in Section 6.2.2. D5. Describe how your solution for warm-site recovery will satisfy the Growth Objectives in Section 5.16.2. The state is open to innovative solutions in this area. D6. The contractor will also provide assurance that its technical staff will be available to the agency for testing purposes as well as at the time of a disaster to aid recovery operations. D7. Describe the access the agency has to technical staff during recovery of operations at your proposed Warm-site solution. D8. Describe the security measures at the Warm-site to protect the Eligible User s equipment and data. E. Cold-site Recovery Capabilities: Eligible Users may require a Cold-site support. E1.The proposal shall describe the proposed Cold-site facility, including square footage of raw floor space, environmental controls, network connectivity, conditioned power, appropriate redundancies, physical security, scalable space availability as long as needed, room for big data center needs, appropriate facilities and infrastructure to handle large shipments, water and electricity availability, AC., non-shared space with the ability to lock up tapes, ability to install our own tapes, ability to limit access, restroom facilities, local accommodations and restaurants near a transportation hub, driving distance from accommodations to cold site, etc. The vendor shall provide adequate annual test time and technical assistance as requested in 6.2.5 to include access to all covered equipment in a reasonable time following a request to test of the RFP to assist agency staff in assuring that the agency's backup operations can be implemented in the vendor's proposed environment. E2. Describe how your approach meets the testing objectives in 6.2.5 and how the approach provides access to allow testing and full activation of each agency's disaster recovery plan at any or appropriate recovery
facilities 24 hours per day, 365 days per year. E3. Does the contractor supply a telephone number that is staffed twenty-four (24) hours per day, seven (7) days per week through which the agency may make arrangements for immediate access. The vendor will also provide assurance that its technical staff will be available to the agency for testing purposes as well as at the time of a disaster to aid recovery operations. E4. Describe the access the agency has to vendor technical staff during recovery of operations at your proposed Coldsite alternative. E5. Describe how your solution for cold-site will satisfy the Office Space requirements in section 6.2.3. E6. Describe how your solution for cold-site recovery will satisfy the Recovery Objectives in section 6.2.2. E7. Describe how your solution for cold-site recovery will satisfy the Growth Objectives in section 5.16.2. The state is open to innovative solutions in this area. F. Mobile Recovery Alternative The mobile recovery alternative must at a minimum be continuously operable for the duration of the disaster; include the infrastructure required to make/keep the equipment functional, including but not limited to communication capabilities and data access suitable to the agency needs specified by the agency. Each unit must be equipped with office/data processing furniture adequate to support the equipment installed; to provide reasonable work surfaces for activities taking place (office/data processing furniture provided by vendor); and comply with all local City, County, and Federal mobile facility and employee safety and accommodation requirements. F.l. F.2. F.3. F.4. F.5. Describe how each mobile unit is equipped to meet the requirements in this section for mobile units. The vendor shall provide adequate annual test time and technical assistance as requested in 6.2.2 to assist agency staff in assuring that the agency's backup operations can be implemented in the vendor's Cold-site facility at the time of a disaster. Describe how quickly the mobile units will be delivered to the disaster site after notification is received and how quickly the units can be ready for recovery operations after delivery of the unit(s). Describe how long a mobile unit may be left at a disaster site. Describe how a mobile recovery unit is prioritized, if it is moved to another site and provide the maximum distance an Eligible User can expect should a mobile unit have to be moved. Describe how your approach meets the testing objectives in 6.2.5 and the approach provides access to allow testing and full activation of each agency's disaster recovery plan at any of its recovery facilities 24 hours per day, 365 days per year. F.6. Does the Contractor supply a telephone number that is staffed twenty-four (24) hours per day, seven (7) days per week through which the agency may make arrangements for immediate access. The Contractor will also provide assurance that its technical staff will be available to the agency for testing purposes as
well as at the time of a disaster to aid recovery operations. F.7. F.8. Describe the access the agency has to technical staff during recovery of operations at your proposed Mobile Recovery Alternative. Describe how your solution for mobile-site recovery will satisfy the Office Space requirements in section 6.2.2. F.9. Describe how your solution for mobile-site recovery will satisfy the Recovery Objectives in section 6.2.2. F.10. Describe how your solution for mobile-site recovery will satisfy the Growth Objectives in section 5.16.2. The state is open to innovative solutions in this area. G. Tape/Disk/Other Back-up Storage Services: The agencies may be interested in obtaining back-up tape/disk storage services in conjunction with Hot-site, Warm-site, Cold-site, and Mobile-site services. G.l. Describe your tape or disk storage capabilities, to include storage of tapes/disks during a test, during a disaster recovery situation, and as an ongoing service broken out for Hot-site, Warm-site, Cold-site and Mobile-site/other proposed solution., if appropriate G.2. Describe your process and policies with regard to protecting sensitive information. G.3. Describe any provisions that allow Eligible Users to install their own tapes at your facilities. G.4. Describe your facility access policies with regard to personnel, user access, limited access, and the ability to lock up tapes at a facility. G.5. Describe your ability to provide back-up for live streaming data. G.6. The state provides programs via the web such as People First and MyFloridaMarketPlace, portions of which are available to the public and portions that are only available to state employees. Both contain some confidential information as well as information available to the public. Describe your abilities, if any, to provide back-up solutions in this type of environment. H. Network Access The primary communication network for the State of Florida is MyFloridaNet (MFN). Most live testing will require sufficient communications lines connecting the recovery site back to the State of Florida MFN backbone. It is anticipated that in a disaster the State users of the agencies computing services will be connected to the MFN network. Where the end user will be located has not been determined for many of the agencies, however, it is a good assumption that their primary way to communicate to the agencies alternate computing site will be through the MFN network. It is anticipated that the Contractor will have some unique questions how their particular solution may need to connect to the State of Florida MFN network. The vendor must submit all questions to the MFN Services group through the Q&A Board in the Sourcing Tool by the dates specified in the RFP timeline.
Each copy of the proposal shall describe the network access to the Hot-site, Warm-site, and Cold-site facility. H.1. Define the proximity and type of local Central Office support serving the Hot-site, Warm-site, Cold-site, Mobile-site facility, or other proposed solution. H.2. List total current communications capacity in terms of voice circuits, normal data circuits, T1 trunks, etc. serving the Hot-site, Warm-site, Cold-site, Mobile-site facility, or other proposed solution. H.3. Described your business continuity plan for communications in particular to having your telecommunications provider going out of business. I. Disaster Alert and Declaration The successful offeror shall only respond to calls from authorized agency personnel. The agency will provide the names of such authorized personnel. I.1. Describe your recommended disaster declaration procedures and any provisional disaster alert procedures. I.2. Do you have a disaster alert process? If so, how does it work? I.3.Can an agency notify you (via an alert or other means) of a potential disaster without incurring a declaration fee? a) at Warm-site b) at Cold-site c) at Mobile-site d) at Other proposed solution The following set of questions concern the Contractor's equipment maintenance practices. I.4. Describe how the proposed solution will provide 24 hours per day, seven days per week facility maintenance services on all Hot-site, Warm-site, Cold-site, Mobile-site, or other proposed solution facility equipment. This includes HVAC maintenance staff.
I.5. Describe how the proposed solution will satisfy that all equipment be on a preventive maintenance program that has a periodic basis not to exceed one (1) month between service calls provided by an equipment vendor or third party equivalent. I.6. Define current contractual maintenance arrangements for the equipment that is proposed. The following questions involve how modifications and moves are made to equipment at the vendor's site. I.7. Define the proposed policies on equipment upgrades, modifications, physical relocation, and substitution. I.8. Are "Quickship" products offered? (i.e. Can an agency request recovery equipment to be shipped to a specific location? Can this equipment be purchased if required?) Future Equipment Migration I.9. Describe how the proposed solution allows for future equipment and technology enhancements. I.10. What assurances (contractual or historical) can be provided to assure the Eligible Users that their evolving requirements will be met? I.11. Describe how the proposed solution addresses the wide variety of needs for the State s Eligible Users. J. Planning Tools (this may be offered as an option for agencies and other Eligible Users) J1. Describe the proposed solution for planning tools offered as an optional support service in Section 6.18. J2. Describe how the proposed product handles Business Impact Analysis. J3. Describe how the proposed product would handle an agency(s)' COOP plan(s) along with an agency(s)' IT disaster recovery plan(s). J4. Describe how the proposed product handles interfaces to other systems (i.e. Employee Information located in a Human Resources systems or Telephone Directory, when a record changes such as location or telephone number how would that change get into the planning record. J5. Describe how call trees are handled along with any automated notification systems. J6. Describe how plans can be viewed (i.e. Stored and viewable by location, by agency, by location and by agency, and/or by phases of the Business Continuity Lifecycle. J7. Describe the security aspects of the proposed planning tools.
J8. Describe the proposed training services. J9. Describe what testing tools are available in the proposed solution. J10. Describe the proposed approach to Incident Management. J11. Can the offeror provide at least five (5) three (3) references that currently use their tool with contact names and phone numbers? J12. Are there any user groups for the proposed product? J13. What are the future directions of the proposed product? J14. Does the offeror staff include Certified Business Recovery Planning consultants? J15. Is Business Recovery Planning software the offeror's principal line of business? J16. Is the first year of maintenance services included with software? What is the maintenance cost? J17. Is there a trial (evaluation) period before you have to purchase the product? J18. Does the offeror provide toll-free technical support within the USA? J19. Is toll-free technical support available 24 hours a day, 7 days a week to all users? J20. Is free training included with software? J21. Is free "hands-on" training available during evaluation stages? J22. Does the vendor provide training for unlimited personnel at no charge? J23. Are product updates and enhancements free under active maintenance? J24. Is the product PC based and menu driven? J25. Provides a systematic method for developing an effective plan? J26. Uses a popular word processing package for customization of text files? (e.g. Word, WordPerfect) J27. Provides database management capabilities for information best presented in a list format, (i.e. equipment inventories, personnel lists, vendor lists, etc.) J28. Can the product be used for developing an organization wide disaster recovery plan or a plan for only the data processing function? J29. Is the product designed to facilitate maintenance of ITDRP? J30. Does the product provide a comprehensive operations manual?
J31. Does the product include backup and restoration procedures? J32. Can the product be used on a LAN system? J33. Does the product facilitate recovery from multiple levels of disaster? J34. Does the product contain an emergency management module? J35. Is there a single-user version of the product that can operate on either a stand alone PC or on a file server? J36. In the multi-user LAN version, can multiple people access the same data table/file simultaneously? J37. Does the LAN version operate in a number of LAN environments?(i.e. Novell, NT, UNIX) K. Notification Services K.1. Describe any optional notification services available to agencies and eligible users provided under Section 6.18. L. Scalability L.1. Agency and Eligible Users may on occasion be asked to reduce their budget. As a result of these requirements, Disaster Recovery services may need to be reduced. Vendors may offer as a Value Add services to assist customers by helping them determine the best places to reduce services appropriately. M. Testing M.1. How many tests have you supported? M.2. What services are included during customer tests and what additional services are available? M.3. Do you contractually guarantee comprehensive support for testing? M.4. Describe the replacement plan (upgrade path) for equipment and software for regular equipment and the upgrade path for testing equipment. M 5. Describe the types of testing that your proposed solution supports. Examples of test types include the following: Simulation Testing
Parallel Testing Full Interruption Testing Combination Testing Remote Testing Other Testing types N. Location and Access N.1. Provide a list of all Hot Site recovery facility locations. Indicate the proposed primary and alternate(s) facilities capable of supporting Eligible Users throughout the State of Florida. N.2. Can an agency test remotely from any of its customer-designated locations? N.3. Do you allow facility audits of your recovery and test centers? N.4. Have you ever allowed a non-customer to declare a disaster and, subsequently, perform the non-customer's recovery? If yes, provide the details of the recovery. If no, do you contractually agree to deny access to noncustomers for the purpose of business continuity? N.5. Do you engage in any customer contracts, which give a customer greater access rights than other customers? N.6. Will you allow any customer to have pre-emptive access rights over other customers? If yes, describe the circumstances. O. General Questions O.l. List platforms for which you provide direct disaster recovery services. O.2. How will you ensure you are familiar with an Eligible User s possible recovery scenarios and requirements? O.3. What steps do you take to offer disaster avoidance support, prior to officially declaring a disaster?
O.4. What method will be used to ensure that you are fully prepared to respond to a declaration disaster with the "currently in use by Eligible User" versions of operating systems(s) and other specified software? O.5. What is your track record for full system recovery of declared disasters within 24 hours, including full network restoration and application processing? O.6. What additional professional/consulting fee-based services do you provide? O.7. Does your proposal contain any items provided by third parties for which you don't assume third party liability? If yes, then list all items. P. Security P.1 Describe the security provided for your proposed solution. Security must address the following: Staff Security Eligible User Security Security of data provided by the Eligible User Building Security Other security provided Q. Growth Capacity Q.1 Describe your solution to accommodate growth within an Eligible User s agency, address data consolidation, which may require additional capacity as described in Sections 5.16.2 and 6.2.9 of the RFP. Other Information Respondents may provide any other information deemed relevant or necessary for the response, but inapplicable to any of the other required parts or sections of the proposal. If an offeror attaches a publication or other document to provide required information, a specific reference to the document and the relevant page or pages must be given in the appropriate section of the reply. If the document is not specifically referenced in a section of the reply, it will not be considered as a response to the corresponding paragraph of this solicitation.