Questions for Vermont Hosting RFI 1. Will the physical Oracle RAC servers be able to be picked up and moved to the new data center location or will new servers need to be purchased? SOV Response: New servers will need to be purchased or virtualization technologies can be used to replace physical Oracle RAC capacity. 2. Is the state looking to continue using ATT for the MPLS circuits or could another vendor be used? SOV Response: There is no preference to utilize existing circuit providers if solutions can meet performance and SLA expectations. 3. What are the complete addresses of the primary and secondary data center in order to provide a MPLS quote? SOV Response: The RFI is for IaaS services which include data center capacity. The locations are not identified other than the State of Vermont data center locations and the Benaissance locations. 4. Is the bandwidth that is listed the same as what you would like quoted for the MPLS solution? SOV Response: The current bandwidth and latency are adequate. 5. Does the new solution need to include managed firewalls or are all the firewalls maintained by the state? SOV Response: The new solution needs to include managed firewall services. 6. Is Benaissance the payment processor? SOV Response: Yes 7. Is encryption at rest a requirement for storage? SOV Response: Yes 8. What is the size of the daily backup sets below: SOV Response: already specified in RFI. a. Production (live)? b. Lower environments? 9. Would the EMC Data Domain\Commvault Simpana solution be moved as they exist today or would new hardware need to be purchased? SOV Response: The State anticipates utilizing these devices and software to begin replicating backup images and data between our current Hosting vendor and a new provider. The new provider should solution backup recovery equipment, software, etc.as part of their solution to meet performance and retention requirements specified.
10. Regarding the DR plan described within the RFI, could you please describe the responsibilities if the State of VT, Iaas provider and Application Vendor in a steady state, non-disaster situation and then the responsibilities of each in the event of a disaster? SOV Response: The IaaS vendor with respect to steady state is responsible for IaaS at both a primary and secondary facilities. It would be the responsibility of the IaaS provider to ensure connectivity, replication, backup recovery or other technologies used to manage IaaS services are available during steady state and DR activities. The Application Vendor is responsible for DR activities that are related to database replication through mechanisms such as Oracle Data Guard or other file sync technologies not delivered through by the IaaS vendor. 11. Will the state provide the WAN circuits between all datacenters or is this the responsibility of the Iaas provider? SOV Response: WAN circuits between all datacenters are the responsibility of the IaaS provider. 12. Does the State of VT plan to continue using AT&T for WAN connectivity? SOV Response: There is no preference to utilize existing circuit providers if solutions can meet performance and SLA expectations. 13. Please provide more information on the existing Data Domain environment: Does the Iaas provider have to use existing Data Domain environment? SOV Response: No. Does Data Domain have to be included as part of the proposed solution? SOV Response: No Are they located in the existing IaaS provider s datacenter? State of VT datacenters? Both? SOV Response: They are anticipated to be installed and primed with data at the primary data center which is in Phoenix. Once primed and replication established between devices, one device will be moved to a SOV or new IaaS vendor data center for use in IaaS transitioning. What are the specific quantities, model and capacity of the existing Data Domain? SOV Response: Quantity 2 - DD2500 has 81 TB of raw capacity, the head unit is 2U, 12 x 3 TB drives. Each device has 1 ES30 Expansion shelf, 3U, 15 x 3 TB drives. Total of 5U. Standard with 2 ports x 10Gb 10GbaseT and 4 ports x 1 Gb 1GbaseT interfaces.
Does the State of VT own the CommVault licenses or would the Iaas provider be asked to supply them? SOV Response: SOV does not own CommVault licenses so IaaS vendor will be expected to supply backup solution and licensing as part of IaaS services. 14. Are you asking the Iaas vendor to manage the VmWare VM s, including provisioning and maintenance or just the VmWare as the hypervisor level, not including the Virtual instances? SOV Response: Currently the IaaS owns and manages up to and including the operating system so this is more than just hypervisor management. 15. Will State of VT be providing the VmWare licensing? SOV Response: Vendors can utilize whatever licensing or enterprise agreements the SOV currently has with our virtualization partners. 16. VCloud vdc does this need to be provided or will the state be providing these licenses? SOV Response: The SOV is not currently licensed or using vcloud so these would need to be provided by IaaS vendor. 17. How is the State of VT replicating VmWare currently? Are you using SRM? SOV Response: The current hosting provider replicates using SAN replication technologies but does not utilize SRM. 18. What level of monitoring is being requested? Automated alerting, active eyes on screens with proactive response or something in between? SOV Response: Monitoring is required to meet SLA s and compliance/security escalations. 19. Regarding the load balancers, are they state owned or provided by the Iaas Vendor as a paid monthly service? Does the state have any capital investment in them? SOV Response: Load balancing technology will need to be the responsibility of the IaaS vendor. The SOV has adopted a software define data center approach and as such are comfortable with the new IaaS vendor proposing either physical or software based LB. The SOV has no capital invested. 20. Oracle RAC Could you please provide a current production and DR diagram SOV Response: See diagrams and they clearly identify the prod, stage and dr Oracle RAC components. 21. How is the data being replicated in this environment?
SOV Response: Oracle Data Guard, some file synchronization and SAN based replication. 22. Is the Oracle RAC environment all in the same VLAN or multiple? SOV Response: Single VLAN per environment. PRODUCTION ENV VLAN X, STAGE ENV VLAN Y, DR ENV VLAN Z 23. Is the backup environment required to be dedicated to the State of VT? SOV Response: The SOV has no preference. 24. Are you expecting the Iaas provider to supply the active directory functionality? Do you want the Iaas provider to manage this environment? SOV Response: See RFI. The IaaS provider is managing all aspects of the environments related to infrastructure inclusive of the Operating System. 25. To confirm, the 174 production VM s are residing on the 11 ESXi hosts, correct? SOV Response: Correct. 26. What are your IP requirements? What IP networks are you using today? SOV Response: The SOV anticipates the IaaS will need to utilize existing IP networks to avoid a large re-ip project. It is assumed IaaS vendor can propose physical or virtual firewalling devices that can mitigate and leverage existing IP ranges. 27. Can you provide the RFI document in word format so we can use it in our response? SOV Response: Yes. 28. Are the security requirements on page 10 under section 5.1.6 Security a must have or are you looking for capability? SOV Response: The applications running in these environments need to meet the security and compliance requirements outlined. The SOV expects that the IaaS provider will meet any and all compliance/security standards mentioned including HIPAA, NIST, PCI, IRS 1075, MARS-E, etc. and their related controls. 29. Is the State of Vermont looking for rough order of magnitude pricing? SOV Response: The state is looking for as accurate as possible pricing that reflects IaaS services for the environments/capacity outlined in the RFI. 30. The way that we read the RFI the State of Vermont is looking for capability and approach versus an actual design. Is our assumption correct? SOV Response: The state is looking to transition to a new IaaS provider and expect to get viable solutions proposed from the vendor community.
31. What is expected to meet the FIPS 140 requirement? That certificates exist for the products within the infrastructure utilizing encryption modules/algorithms? Is there an expectation that FIPS capable services can be selected for operation or that only FIPS mode is permitted within the infrastructure? SOV Response: The state is required to maintain compliance and security standards as outlined within the RFI. Solutions and pricing should reflect compliance requirements. 32. We would like to partner with C2 (www.competitive.com), offering a bid where Logicworks will provide all hosting and managed services, and C2 would provide on-site support and migration services. Are you open to such an arrangement? We are open to the idea of acting as prime contractor, subcontractor, or offering separate agreements. SOV Response: The state has no preference to IaaS solution provider and their subs however; the state wants to enter into a single agreement. 33. Is any of the current hardware owned by the State of Vermont or is it owned by the current Cloud Hosting Provider? If so, what equipment can be reallocated for the reassignment of this project to another Cloud Hosting Provider? SOV Response: The State owns no equipment so there is nothing to be relocated. It is anticipated that the backup recovery devices (EMC Data Domain 2500 s) can be utilized by the IaaS vendor as part of the transition and possibly IaaS vendor s backup recovery solution. 34. Because Oracle RAC systems are available as VMware virtual machines; will the State be open to using this method instead of physical Oracle systems? SOV Response: The Oracle RAC instances are all physical machines and the state has no preference on whether they are physical or virtual. 35. Who is the responsible party for the Oracle licenses (Cloud Hosting Provider or State of Vermont)? SOV Response: The state is responsible for Oracle licensing. 36. Which environments (Production, Staging, Development, Testing, and or Training) belong in the primary data center and the secondary data center? SOV Response: Production, Stage, Dev, Test and Training all belong in the primary data center. The Disaster Recovery environment that mirrors production as well as ancillary management systems need to exist during failover at secondary data center. 37. Are the Development, Testing and Training environments considered the Disaster Recovery environments? SOV Response: No.
38. What are the expected RPOs and RTOs for each of the environments? SOV Response: Production RPO 30 minutes, RTO 8-16 hours All other environments RPO 24 hour, RTO 5-10 days 39. Is the vendor expected to supply, manage, and maintain a Windows Server 2008R2 OS for all of the VMs and physical servers? SOV Response: The majority of the operating systems are Redhat with several Microsoft windows installs. The IaaS provider is responsible for operating system management including patching. The state would be interested in understanding pricing for both the IaaS provider supplying operating system management and/or IaaS provider simply providing operating system for the states Application support vendor to manage. 40. What other operating systems need to be supplied, managed, and maintained? SOV Response: Primarily Redhat 90%, Windows 10% 41. Is the vendor to manage and maintain up to the OS on each of the VMs? Or just on the physical servers and any installed Hyper V? SOV Response: The IaaS provider is responsible for operating system management including patching. The state would be interested in understanding pricing for both the IaaS provider supplying operating system management and/or IaaS provider simply providing operating system for the states Application support vendor to manage. 42. Confirmation the State of Vermont will manage, maintain, and monitor all of the applications above the OS? SOV Response: The States Application management vendor will maintain all software aspects above basic operating system maintenance and operations. 43. Does the vendor need to provide Active Directory, DNS, NTP, and SMTP for the State of Vermont? Or just the servers for the State of Vermont to provide these services? SOV Response: The IaaS provider should plan on providing these services. 44. Can the State of Vermont provide information about how the environment should look - interoperability, relationships between them, how they should be separated physically, etc? SOV Response: This is supplied in the RFI documentation currently. 45. Can the State of Vermont provide the SAN requirements, i.e. total amounts; and respective Tiers. SOV Response: This is supplied in the RFI documentation currently.
46. How much Internet Bandwidth is required for the front end connectivity? SOV Response: This is somewhat unknown but the state only has 4-5 internet exposed web servers. It is not anticipated that internet traffic is large. 47. Is the vendor expected to use the State of Vermont s CommVault and EMC data domains for Backup and recovery? Or may the vendor use their own solution? SOV Response: The state of open to any solution options that are most cost effective and can meet backup recovery needs. 48. How many URLs will AT&T provide DNS management for? SOV Response: There is a maximum of 300-350 virtual/physical devices across the environments. Provider should propose including DNS for worse case. 49. How many firewall-to-firewall Virtual Private Network (VPN) connections are required? SOV Response: Approximately 8-15 50. Do you require SSL acceleration? SOV Response: The current solution does not include this. 51. How many VLANS do you require? SOV Response: The environments and the specific roles each virtual/physical machine have dictate what VLAN the images belong to. This segregation is complex and the number of VLAN s is approx. (12-20 per environment) Example: Production has approx.. 20 VLANS. 52. On p. 11, you state, At least one copy of the Cost Table and Business and Technical Requirements must be made in Microsoft Excel Version 2007 or higher. Please provide further direction on what is meant by this statement. SOV Response: This is not a requirement. IaaS providers can respond to state with proposed solution and anticipated costs through pdf, word, excel or other. The state anticipates numerous solutions and approaches that do not lend themselves to a predetermined response format. 53. Is there a cost table that the State will provide? What section are you referring to when you say Business and Technical Requirements? Should we have received an Excel template as part of the RFI package, or can the State please provide further guidance on how to respond? SOV Response: No. The state expects the provider to outline IaaS solution services they will provide based on the details provided in the RFI. Providers should be as clear as possible with respect to IaaS they provide as part of their solution.
54. The State asks to provide the SLAs that we offer. Can the State share specific SLAs that you would require as part of the Vermont Hosting/Managed Services solution? SOV Response: The states IaaS service availability should be at a minimum of 99.9% with industry standard response times and escalations. Providers should target this availability number and propose your current response and escalation models. Availability Response time 55. Does the State of Vermont have any critical dates regarding when the hosting environment needs to be operational? SOV Response: The Hosting environments need to be completely operational and cutover to on and/or before May 31 st, 2015. 56. What is the tolerance of each environment being offline during the migration? SOV Response: The state would like to minimize the amount of environmental downtime due to the continued development efforts and additional projects coming on line that utilize these IaaS services. Provider should plan on no more than 1 day downtime preferably per environment scheduled based on business needs. 57. What level does the State envision security/audit/compliance solution as part of the Vermont Hosting/Managed Services solution? SOV Response: The state expects IaaS provider to be able to meet compliance and security requirements outlined in the RFI. 58. What are the expectations for managing licensing and the approach for license transfer from one hosting address to another? (From CGI to the new vendor)? SOV Response: The majority of software licensing is owned by State. IaaS providers should include pricing to cover licensing for all IaaS service such as operating systems, backup recovery, antivirus, monitoring agents, etc. 59. Would this include OS licenses? SOV Response: Yes. Providers should plan on licensing OS s. 60. Can the State please provide an inventory of existing licensing that would be part of the Vermont Hosting/Services solution? SOV Response: Details are in the RFI currently. The IaaS provider is not responsible for application licensing outside of the mentioned operating systems and IaaS ancillary systems such as backup recovery, etc.
61. Would application level instrumentation for the purpose of SLA/performance monitoring and application tuning be considered essential? Would performance testing infrastructure be considered essential? SOV Response: Application performance is not seen as an IaaS provider s responsibility. Any solutions that are proposed for IaaS services should include as part of the solution the tools and/or process required to meet the IaaS providers SLA. We anticipate IaaS providers to propose solutions that will maintain a minimum of 99.9% availability.