UPDATED DECEMBER 11, 2025 V5.3 1

STATE OF SOUTH DAKOTA

INFORMATION TECHNOLOGY (IT) RFP

(South Dakota Bureau of Information & Technology, 700 Governors Dr, Pierre, SD, 57501)

Infrastructure Resiliency: Data Center Relocation

PROPOSALS ARE DUE NO LATER THAN November 2, 2026

RFP #: 26RFP19987 STATE POC: BIT EMAIL: BIT.DCRESPONSE@state.sd.us

READ CAREFULLY

FIRM NAME: AUTHORIZED SIGNATURE:

ADDRESS: TYPE OR PRINT NAME:

CITY/STATE: TELEPHONE NO:

ZIP (9 DIGITS): FAX NO:

E-MAIL:

PRIMARY CONTACT INFORMATION

CONTACT NAME:

TELEPHONE NO:

FAX NO: E-MAIL:

UPDATED DECEMBER 11, 2025 V5.3 2

1 General Information

1.1 Purpose of Request for Proposal (RFP)

1.1.1 Background:

The State of South Dakota (the “State”) is undertaking the Infrastructure Resiliency Project to strengthen the reliability, security, and long-term scalability of the State’s core technology environment. As part of this initiative, the State intends to partner with a qualified data center vendor capable of delivering modern, resilient, and secure hosting services.

This Request for Proposals (RFP) represents an opportunity for vendors to support the State’s broader modernization strategy. The State is seeking a vendor that can offer a hosting environment engineered for high availability, robust physical and environmental protections, and the performance needed to support mission-critical government services. The selected provider will play a key role in enabling improved continuity of operations and enhanced cybersecurity alignment as statewide technology demands evolve.

Vendors will be asked to demonstrate the maturity of their facilities, infrastructure, security capabilities, and operational procedures, as well as their ability to meet clearly defined resiliency, compliance, service delivery, and other State requirements as outlined in the RFP.

The State looks forward to engaging with vendors that can provide innovative, reliable, and scalable facility-based solutions aligned with its long-term infrastructure strategy.

By participating in this RFP, vendors will have the opportunity to contribute directly to strengthening the State’s technology foundation and supporting essential services for residents statewide.

This RFP is for physical data center services only.

1.1.2 Goals and Objectives:

The State of South Dakota is issuing this Request for Proposals (RFP) to identify a qualified data center vendor capable of supporting a modern, secure, and resilient hosting environment for critical government systems. The goals and objectives below reflect the State’s procurement direction and strategic intent.

1. Strengthen Infrastructure Resiliency and Service Continuity A primary objective is to ensure that essential state services remain available and reliable, even during disruptive events. The State seeks a facility-based solution

UPDATED DECEMBER 11, 2025 V5.3 3

engineered to support high availability, minimize downtime, and provide robust recovery capabilities and high-speed redundant networking access.

2. Enhance Recovery and Continuity Capabilities The State is pursuing a facility-based environment that can rapidly restore operations after an interruption. This includes facility‑level safeguards and operational processes that help ensure consistent delivery of government services.

3. Advance Security and Compliance Standards This RFP requests that vendors demonstrate strong security practices, including the ability to align with recognized cybersecurity and risk‑management frameworks such as IRS Pub 1075, NIST 800‑53 Rev. 5, and CJIS as well as clearly defined incident‑response and reporting expectations.

4. Provide a Scalable, Future‑Ready Hosting Environment The State intends to select a vendor capable of supporting long‑term growth. This includes the ability to accommodate capacity changes, evolving technological needs, and changing service expectations over time.

5. Establish and Maintain a Robust Partnership to Support Statewide Modernization The selected provider will play a key role in supporting the State’s broader modernization efforts by delivering dependable infrastructure, strong operational support, and effective collaboration and ongoing service delivery.

1.1.3 Description of Phases:

Once a data center vendor is selected, the Infrastructure Resiliency Project transitions into execution‑focused phases designed to ensure a secure, orderly, and efficient migration of State services. These phases include detailed planning and project management, coordinated implementation, and stabilization of long‑term and continued operations.

1. Transition and Migration Planning Following vendor selection, the State and the selected provider will jointly develop a comprehensive migration plan. This includes mapping existing networks and systems, planning rack requirements, configuration, and implementation, identifying sequencing dependencies, preparing for network infrastructure, and relocating workloads and equipment.

2. Implementation and Workload Migration After planning is completed, the project moves into active execution. This phase involves network layout, rack installation and configuration, transferring workloads and critical systems to the vendor’s facility-based environment, performing configuration

UPDATED DECEMBER 11, 2025 V5.3 4

activities, validating system readiness, and coordinating cutovers in stages to maintain service continuity.

3. Testing, Verification, and Quality Assurance As systems come online within the data center, the State will conduct structured testing to confirm functionality, performance, interoperability, and resiliency. This includes verifying that the environment meets required operational and security controls and that systems perform consistently prior to full production cutover. In addition, the State of South Dakota’s Governance, Risk, and Compliance team will audit and document the physical controls provided by the vendor to ensure they align with the State’s security and compliance requirements, as well as those stated in IRS Pub 1075, NIST 800‑53 Rev. 5, CJIS, and other applicable governance and compliance frameworks.

4. Ongoing Operations and Continuous Support During this phase, the engagement shifts to long‑term operations in partnership with the selected vendor. This includes routine service management, ongoing monitoring and reporting, incident handling, and periodic review of service quality and compliance.

These ongoing operations support the State’s broader modernization efforts and ensure continued alignment with resiliency and security objectives.

1.1.4 Scope of Components:

The State’s migration will encompass a diverse suite of enterprise‑class hardware, including networking equipment, production storage arrays, mainframe compute systems, virtual tape appliances, hybrid server‑storage platforms, and other government systems currently housed within State facilities. Because these assets vary significantly in size, power requirements, cooling needs, and connectivity, the selected facility-based vendor must be capable of supporting mixed rack configurations, varied power densities, and resilient network architectures. Several components require specialized vendor handling during removal, transport, installation, and post‑migration validation. The vendor must therefore be prepared to accommodate heterogeneous hardware classes, ensure appropriate physical and logical isolation where required, and support system dependencies inherent to the State’s enterprise backup, storage, and hybrid compute environments.

1.2 Issuing Office and RFP Reference Number

The South Dakota Bureau of Information and Technology (“Agency” or “BIT”) is the issuing office for this document and all subsequent addenda relating to it, on behalf of the State. The reference number for this transaction is RFP#26RFP19987. This reference number must be referred to on all proposals, correspondence, and documentation relating to this RFP. If an offeror’s proposal includes the lease of any real property, the South Dakota Bureau of Human Resources and Administration will be a participant in the proposal review, approval, and contracting processes. In addition, depending upon an offeror’s proposal, approval of the contract may require approval by the South Dakota Legislature, which can only take action on the contract while the Legislature is in session (January – March each year).

1.3 Schedule of Activities (Subject to Change)

UPDATED DECEMBER 11, 2025 V5.3 5

All deadlines in the Schedule of Activities are due by 11:59 p.m. CST. The Schedule of Activities for this RFP is as follows:

RFP Publication September 25, 2026 Deadline for Letter of Intent October 5, 2026 Deadline for Submission of Written Inquiries October 12, 2026 Deadline for Responses to Offeror Questions October 16, 2026 Deadline for Proposal Submission November 2, 2026 Evaluation of Proposals to Determine Short List (If required) EST November 16, 2026 Discussions / Technical Review EST December 7, 2026 Demonstrations and presentations (if required) TBD Proposal Revisions (if required) TBD Anticipated Award Decision/Contract Negotiation TBD

1.4 Submitting a Proposal

Prohibition on Solely AI-Generated Submissions - All questions, responses, and proposals submitted in response to this RFP must be thoroughly vetted, verified, and validated by the offeror's human staff. Submissions that are solely generated by Artificial Intelligence (AI) without substantive human review and oversight are strictly prohibited and may result in the disqualification of the proposal or rejection of the submitted questions.

All proposals must be completed and received by the Agency by the date and time indicated in Section 1.3 Schedule of Activities.

Proposals received after the Deadline for Proposal Submission will be late and ineligible for consideration.

All proposals must be signed, in ink or electronically, by a representative of the offeror who is legally authorized to bind the offeror to the proposal. Proposals that are not properly signed may be rejected. The offeror’s proposal must be prepared pursuant to the requirements of Section 6 Proposal Submission Requirements of this RFP.

The State will only accept electronic proposals via email.

Each offeror must provide an electronic version of the proposal. The electronic version should be provided in MS Word or in PDF format to BIT.DCRESPONSE@state.sd.us The email, including attachments, must be limited to 20MB in size.

No proposal will be accepted from, or no contract or purchase order will be awarded to, any person, firm, or corporation that is in arrears upon any obligations to the State of South Dakota, or that otherwise may be deemed irresponsible or unreliable by the State of South Dakota.

1.5 Certification Regarding Debarment, Suspension, Ineligibility, and Voluntary

Exclusion – Lower Tier Covered Transactions

By signing and submitting this proposal, the offeror certifies that neither it nor its principals is presently debarred, suspended, proposed for debarment, declared

UPDATED DECEMBER 11, 2025 V5.3 6

ineligible, or voluntarily excluded from participation, by any Federal department or agency, from transactions involving the use of Federal funds. Where the offeror is unable to certify to any of the statements in this certification, the offeror shall attach an explanation to its offer.

1.6 Non-Discrimination Statement

The State of South Dakota requires that all contractors, vendors, and suppliers doing business with any State agency, department, or institution, provide a statement of non-discrimination. By signing and submitting their proposal, the offeror certifies they do not discriminate in their employment practices with regard to race, color, creed, religion, age, sex, ancestry, national origin, or disability.

1.7 Restriction of Boycott of Israel

For contractors, vendors, suppliers, or subcontractors with five (5) or more employees who enter into a contract with the State of South Dakota that involves the expenditure of one hundred thousand dollars ($100,000) or more, by submitting a response to this solicitation or agreeing to contract with the State, the bidder or offeror certifies and agrees that the following information is correct:

The bidder or offeror, in preparing its response or offer or in considering proposals submitted from qualified, potential vendors, suppliers, and subcontractors, or in the solicitation, selection, or commercial treatment of any vendor, supplier, or subcontractor, has not refused to transact business activities, has not terminated business activities, and has not taken other similar actions intended to limit its commercial relations, related to the subject matter of the bid or offer, with a person or entity on the basis of Israeli national origin, or residence or incorporation in Israel or its territories, with the specific intent to accomplish a boycott or divestment of Israel in a discriminatory manner. It is understood and agreed that, if this certification is false, such false certification will constitute grounds for the State to reject the bid or response submitted by the bidder or offeror on this project and terminate any contract awarded based on the bid or response. The successful bidder or offeror further agrees to provide immediate written notice to the contracting executive branch agency if during the term of the contract it no longer complies with this certification and agrees such noncompliance may be grounds for contract termination.

1.8 Certification Relating to Prohibited Entity

For contractors, vendors, suppliers, or subcontractors who enter into a contract with the State of South Dakota by submitting a response to this solicitation or agreeing to contract with the State, the bidder or offeror certifies and agrees that the following information is correct:

The bidder or offeror, in preparing its response or offer or in considering proposals submitted from qualified, potential vendors, suppliers, and subcontractors, or in the solicitation, selection, or commercial treatment of any vendor, supplier, or subcontractor, is not a prohibited entity, regardless of its principal place of business, that is ultimately owned or controlled, directly or indirectly, by a foreign national, a foreign parent entity, or foreign government from China, Iran, North Korea, Russia, Cuba, or Venezuela, as defined by South Dakota Codified Law § 5-18A. It is understood and agreed that, if this certification is false, such false certification will constitute grounds for the State to reject

UPDATED DECEMBER 11, 2025 V5.3 7

the bid or response submitted by the bidder or offeror on this project and terminate any contract awarded based on the bid or response. The successful bidder or offeror further agrees to provide immediate written notice to the contracting executive branch agency if during the term of the contract it no longer complies with this certification and agrees such noncompliance may be grounds for contract termination and would be cause to suspend and debar a business under SDCL § 5-18D-12.

1.9 Modification or Withdrawal of Proposals

Proposals may be modified or withdrawn by the offeror prior to the established due date and time.

No oral, telephonic, telegraphic or facsimile responses or modifications to informal, formal bids, or Request for Proposals will be considered.

1.10 Questions Regarding RFP

All written questions should be sent to: BIT.DCRESPONSE@state.sd.us; only emailed questions will be accepted.

Each offeror may submit questions via email concerning this RFP to obtain clarification of requirements. No questions will be accepted after the date and time indicated in the above schedule of activities. Email questions to the email address listed above with the subject line “RFP#26RFP19987”. The questions and their answers will be sent to all offerors that submitted Letters of Intent, submitted questions, or requested the questions and answers via email before the proposal submittal date and will be sent by the date and time indicated in the above calendar of events. Offeror may not rely on any other statements, either of a written or oral nature, that alter any specification or other term or condition of this RFP that have not originated from the SD RFP Project Contact. Offerors will be notified in the same manner as indicated above regarding any modifications to this RFP. Offerors and their agents may not contact any state employee other than the buyer of record regarding any of these matters during the solicitation and evaluation process.

Inappropriate contacts are grounds for suspension and exclusion from specific procurements.

1.11 Proprietary Information

The proposal of the successful offeror(s) becomes public information. Proprietary information can be protected under limited circumstances such as client lists and non-public financial statements. An entire proposal may not be marked as proprietary.

Offerors must clearly identify in the Executive Summary and mark in the body of the proposal any specific proprietary information they are requesting to be protected. The Executive Summary must contain specific justification explaining why the information is to be protected. Proposals may be reviewed and evaluated by any person at the discretion of the State. All materials submitted become the property of the State of South Dakota and may be returned only at the State's option.

1.12 Length of Contract

The length of the contract will be for a term of 10 years. The State will have the opportunity to renew the contract annually for up to two one-year time extensions. The extension(s)

UPDATED DECEMBER 11, 2025 V5.3 8

will not be automatic.

1.13 Governing Law

This RFP will be governed by and construed in accordance with the laws of the State of South Dakota. The venue for any lawsuit pertaining to or affecting this RFP will be in Circuit Court, Sixth Judicial Circuit, Hughes County, South Dakota.

1.14 Site Visit

If site visits are required, they will be scheduled before the submission of the proposal.

Site visits will be made at the offeror’s expense.

1.15 Presentations/Demonstrations

At the State’s discretion, the State may require a presentation or demonstration by an offeror to clarify a proposal. However, the State may award a contract based on the initial proposals received without a presentation or demonstration by the offeror. If presentations or demonstrations are required, they will be scheduled after the submission of proposals. Presentations and demonstrations will be made at the offeror’s expense.

1.16 Discussions

At the State’s discretion, the offeror may or may not be invited to have discussions with the State. The discussions can be before or after the RFP has been submitted.

Discussions will be made at the offeror’s expense.

1.17 Technical Review

At the State’s discretion, the State may require a technical review of the offeror based on the offeror’s proposal and response to the Security and Vendor Questionnaire.

1.18 Negotiations

This process is a Request for Proposal/Competitive Negotiation process. Each proposal will be evaluated, and each respondent will be available for negotiation meetings at the State’s request. The State reserves the right to negotiate on any component of every proposal submitted. From the time the proposals are submitted until the formal award of a contract, each proposal is considered a working document and as such, will be kept confidential. The negotiation discussions will also be held as confidential until such time as the award is completed.

2 Contract Terms and Conditions

Any contract or agreement resulting from this RFP will include the State’s standard terms and conditions attached to this RFP as Appendix A, the State’s standard Information Technology (“IT”) contract terms attached to this RFP as Appendix A-1, and any additional terms and conditions as negotiated by the parties. The offeror must indicate in its response any issues it has with specific contract terms listed in Appendix A and Appendix A-1. If the offeror does not indicate that there is an issue with a specific contract term listed in Appendix A and Appendix

UPDATED DECEMBER 11, 2025 V5.3 9

A-1, then the offeror will be deemed to have accepted the contract terms as written.

If the proposal is for the lease of real property, the contract or agreement resulting from this RFP will include the State’s standard Lease Agreement, attached to this RFP as Appendix A-

2. The Lease Agreement must be agreed to as is with no modification.

3 Scope of Work

The scope of this initiative includes the relocation of production workloads, compute and storage systems, and associated platform and network infrastructure currently housed within State‑operated facilities. The transition encompasses the full inventory of systems identified for relocation, including enterprise‑class servers, blade and chassis systems, and centralized storage devices. These components collectively support mission‑critical government operations and require a physical facility-based hosting environment engineered for availability, security, and long‑term scalability.

In addition to primary compute and storage assets, the migration scope includes the supporting infrastructure necessary to maintain operational continuity within the selected data center. This includes network switches and routing equipment, rack‑mounted and power‑distribution hardware, and platform‑specific devices that interface with backup systems or secondary hosting locations. Some equipment may require specialized handling or recertification when relocated, ensuring that all interconnected systems continue to operate effectively following migration.

The hosting environment must meet the State’s physical, environmental, and security requirements. These requirements include adherence to NIST SP 800‑53 Rev. 5 control frameworks, facility‑level access and surveillance controls, redundant power and cooling capabilities, fire detection and suppression systems, and infrastructure capable of supporting diverse carrier pathways and cross‑connect configurations. Vendors must demonstrate the ability to house State systems in a secure, resilient, and compliant environment and to provide the operational maturity required for continuity of services.

The project also incorporates a structured procurement and evaluation process informed by the Vendor Questions and Scoring materials provided. Offeror proposals will be assessed on their capacity to support the full migration lifecycle, including planning, execution, risk mitigation, communication, and ongoing operational support. The State seeks a vendor capable not only of receiving and hosting the identified systems but also of supporting a carefully sequenced migration from existing facilities and maintaining service availability throughout the transition period.

Through this effort, the State aims to establish a long‑term commercial hosting foundation that reduces operational risk, strengthens resiliency, and enables future modernization. The selected vendor will be responsible for housing the migrated systems and enabling the State to achieve its goals and priorities.

4 Project Deliverables/Approach/Methodology

The offeror must describe in detail how its proposed deliverables will meet the needs of the State as described in Section 3. At its sole discretion, the State may consider a solution that includes any of these deliverables or consider deliverables not originally listed.

UPDATED DECEMBER 11, 2025 V5.3 10

An offeror must highlight any requirement in Section 3 or Section 4 that the offeror’s proposed deliverables cannot comply with, and the offeror must provide any suggested “work-around” to the requirement in question or a future date that the offeror will be able to comply with the requirement.

4.1 The offeror’s proposal must include a:

• Migration Services and Governance Plan – A comprehensive description of the vendor’s approach to managing migrations, including governance structure, resource assignments, escalation pathways, and coordination with State project leadership.

• Risk and Dependency Management Plan – Identification of potential logistical, operational, environmental, or resiliency-related risks and vendor strategies for mitigation, with specific attention to specialized services.

• Physical Hosting Requirements Compliance Matrix – A structured response demonstrating how the proposed facility meets or exceeds the State’s physical hosting, power redundancy, environmental, network, and security standards, including NIST SP 800-53 Rev. 5 alignment. Refer to Appendix C: Physical Hosting Requirements at-a-Glance for guidance.

• Communication and Coordination Plan – The vendor’s stakeholder communication structure, including cutover coordination, outage notifications, migration checkpoints, and reporting protocols throughout the engagement.

• Testing and Validation Plan – A detailed plan describing functional testing, performance benchmarks, and resiliency validation. To ensure this plan, an audit will be performed by the State of South Dakota Bureau of Information and Technology Governance, Risk, and Compliance team for all systems once placed in the vendor’s environment.

• Training and Knowledge Transfer Plan – Documentation of how the vendor will equip State staff with operational knowledge of the facility environment, monitoring tools, access protocols, and support processes.

• Post-Implementation Support and Operations Plan – A description of ongoing support services, including service-level commitments, monitoring, incident response, maintenance windows, physical access protocols, and reporting capabilities following production cutover.

In addition, the offeror’s proposal must include how its proposed deliverables will meet the following IT requirements (General and Vendor Hosted).

4.2 GENERAL IT REQUIREMENTS

4.2.1 Artificial Intelligence Use

The offeror must provide an explanation of its use of Artificial Intelligence, both in its proposed solution and the development lifecycle of the proposed solution. This requirement includes the offeror’s use of Generative AI (GenAI) tools/products.

For GenAI tools/products, the offeror must provide the following:

• GenAI model name,

• product owner,

• product description (including purpose, functionality, and key characteristics), UPDATED DECEMBER 11, 2025 V5.3 11

• use case (or goal e.g. image recognition, natural language processing, text summarization),

• the intended information use (context for how information is used in the model) for the GenAI included in the offeror’s proposal,

• the geographical location of the tool, and

• how the offeror monitors and audits the tool’s compliance on use restrictions, data restrictions, legal compliance (non-discriminatory outputs), and biases in the tool’s outputs.

4.2.2 Hosting and Data Access Requirements

The State will retain ownership of all systems, hardware, configurations, logs, and data stored, transmitted, or processed within the awarded data center facility. The facility must provide the State with full access to its hosted infrastructure, including but not limited to cabinets, cages, power distribution, cross-connects, network interfaces, and management portals necessary for the State to retrieve, analyze, and transport system data.

The offeror’s proposal must describe how the State will access operational data generated within the facility, including environmental measurements, security logs, network utilization metrics, and power consumption data. The proposal must detail available retrieval mechanisms (e.g., customer portal, API access, secure file export, SNMP), data formats, update frequency, retention practices, and limitations.

The offeror must provide a high-level physical and logical architecture diagram, aligned with Section 6.7 requirements, illustrating the facility’s hosting environment, including power layout, network demarcation, cross-connect options, physical security layers, and any customer accessible monitoring systems.

If available, the offeror must provide separate proposals for:

• Hosting within the offeror’s own data center facility,

• Hosting within State-leased colocation space.

If an option is unavailable, the offeror must clearly state this and explain why.

4.2.3 Single Sign-On (SSO) Requirements

If the offeror provides any customer-facing management portal, ticketing system, monitoring dashboard, or other authenticated interface, the solution must integrate with the State’s standard identity management service supporting OAuth 2.0 SSO.

Password recovery and MFA are managed by the State’s identity system. MFA is required for State administrators and may be required for additional users.

If the offeror cannot meet this requirement, the proposal will be rejected.

4.2.4 SSO Logout Initiation Requirements

If an offeror provides a portal or interface that supports SSO authentication:

UPDATED DECEMBER 11, 2025 V5.3 12

• A clear logout mechanism must be provided.

• Logout actions must correctly terminate the user’s authenticated session using the sign-out endpoint provided during implementation.

4.2.5 Session Timeout Requirements

For all authenticated systems provided by the offeror:

• The system must allow a State-defined inactive session timeout period.

• Users must receive a warning at least one minute prior to session expiration, with an option to extend the session.

4.2.6 Session Termination on Browser Close Requirement

If the offeror provides web-based portals, the system must display a clear notice that closing the browser window or tab does not constitute a valid logout and that an explicit logout is required to end the SSO session.

4.2.7 Onboarding/Provisioning of Users Requirement

The offeror must describe the process for onboarding and offboarding portal users who require access to monitoring tools, ticketing systems, or other facility-related systems. Automated or low-friction user provisioning and user updating methods are preferred.

4.2.8 Interfaces and Integration Requirements

If the offeror provides APIs, monitoring feeds, ticketing system integrations, or facility telemetry interfaces, the proposal must describe how these systems use open industry standards. Documentation for all APIs provided or integrations must be published and available to the State.

4.2.9 Facility Security and Vulnerability Scan Requirements

If the deliverables include any web-based management interfaces, they must undergo a Vulnerability Scan identifying misconfigurations and vulnerabilities such as those in the OWASP Top Ten. The scan must include certainty levels for each finding.

For vendor portals, offerors reaching Tech Review must provide a full report of the most recent Vulnerability Scan. NDAs may be used if necessary but must not impede timelines.

The report must include:

• The system evaluated,

• Categories tested (e.g., SQLi, XSS, RCE),

• General findings,

• Technical detail,

• Remediation status.

UPDATED DECEMBER 11, 2025 V5.3 13

Costs for all required scans must be included in the cost proposal.

4.2.10 Internal Processes and Procedures Requirement

The offeror must follow industry standard operational processes and procedures for facility-level services, consistent with recognized frameworks (e.g., NIST 800 53 Rev. 5 controls for physical security, incident response, and resiliency).

The proposal must outline these processes, including:

• Change management,

• Planned outage notifications,

• Incident response communication,

• Environmental and power incident alerting,

• Stakeholder communication procedures for events affecting State-hosted systems.

Notification must be provided to all relevant State stakeholders.

4.2.11 Email Domain Name Requirement

If the offeror’s proposal includes a website or a web application that generates email and is hosted by the offeror or in the State’s cloud, the proposed website or web application cannot use state email domains as the originating domain name.

4.2.12 Banned Entity Requirement

The offeror’s proposed deliverables cannot include any hardware or hardware components manufactured by Huawei Technologies Company, Nuctech, or ZTE Corporation or any subsidiary or affiliate of such entities. This includes hardware going on the State’s network as well as the offeror’s network if the offeror’s network is accessing the State’s network or accessing State data. This includes Infrastructure as a Service, Platform as a Service, or Software as a Service situations. Any company that is considered to be a security risk by the government of the United States of America under the International Emergency Economic Powers Act, in a United States appropriation bill, an Executive Order, or listed on the US Department of Commerce’s Entity List will be included in this ban.

4.2.13 Access Management Requirement

If the offeror’s proposed deliverables require accounts allowing access to State systems, then the offeror must indicate the number of the offeror’s staff or subcontractors that will require access, the level of access needed, and if these accounts will be used for remote access. These individuals will be required to use Multi-Factor Authentication (MFA). The State’s costs in providing these accounts will be a consideration when assessing the cost of the offeror’s proposal. All costs associated with providing an account to the offeror will be borne by the agency.

UPDATED DECEMBER 11, 2025 V5.3 14

4.2.14 Testing Requirements

The following testing may be required by the offeror to validate that the proposed data center facility, supporting infrastructure, and associated operational services meet State requirements for resiliency, availability, physical security, and operational readiness.

4.2.14.1 Infrastructure Regression Testing – Infrastructure regression testing is the process of validating that updates, changes, or maintenance activities performed within the data center facility do not negatively impact previously validated functionality or service levels.

Examples include:

• Verifying infrastructure after electrical, HVAC, fire suppression, construction, or mechanical maintenance.

• Confirming that previously validated power configurations, network routing, and environmental controls continue to function as expected.

• Ensuring no degradation in SLA required uptime or resiliency following vendor-initiated changes.

This testing ensures the facility continues meeting operational expectations following modifications or upgrades.

4.2.14.2 System Integration Testing – System integration testing validates the interoperability between State-owned equipment and the vendor’s facility infrastructure.

This testing ensures:

• Compatibility between State equipment and the facility’s power distribution, cooling systems, cabling, cross-connects, network handoffs, and rack configurations.

• Proper functioning of redundant network paths, meet-me room connections, and any provider-managed transport services.

• Successful integration of monitoring feeds, alerting systems, and portal-based management tools.

Integration testing confirms that the State’s systems and the facility environment operate seamlessly before migration and full production use.

4.2.14.3 Functional Facility Testing – Functional testing validates that the facility’s critical infrastructure and operational capabilities perform according to the State’s requirements, industry standards, and the offeror’s proposed SLAs.

Functional testing may include:

• Verification of access controls, logging, physical, environmental, fire suppression, and security systems.

UPDATED DECEMBER 11, 2025 V5.3 15

• Confirmation of power availability across A/B power feeds, generator start sequence reliability, and UPS failover behavior.

• Testing environmental controls (cooling, humidity, airflow) corresponds to equipment requirements.

• Validating facility readiness for operations, including hands and eyes support, ticketing workflows, and escalation procedures.

This testing ensures the facility’s functions align with State expectations for resiliency and day-to-day operations.

4.2.14.4 Performance Testing – Performance testing evaluates the facility’s ability to meet expected operational performance and resiliency levels under normal and peak load conditions.

Examples of performance attributes tested include:

• Power delivery stability across redundant feeds.

• Cooling and humidity capacity under increased thermal load.

• Facility monitoring responsiveness (environmental telemetry, fault notifications, alert propagation).

Quantitative and qualitative measures may be required to verify consistency with the offeror’s proposed SLAs, including uptime commitments, recovery sequence timelines, and environmental tolerances

4.2.14.5 Load Testing – Load testing determines the facility’s ability to maintain required operational effectiveness under elevated or adverse conditions.

Examples may include:

• Simulating increased electrical or cooling demand to verify continuous support for State equipment.

• Testing redundancy by artificially removing or stressing components (e.g., one UPS train, one chiller, one generator) to confirm N+1, N+2, or 2N design claims.

• Evaluating the facility’s ability to sustain services during partial outages, routine maintenance, or provider disruptions.

Load testing helps confirm the offeror’s ability to support the State’s mission-critical workloads without service degradation.

4.2.14.6 Facility Acceptance Testing – Facility acceptance testing for a data center hosting environment focuses on ensuring the facility, operational procedures, and vendor-provided tools support the State’s real-world operational needs.

Facility acceptance testing may include:

• Verifying that access procedures, security protocols, and check-in/check-out workflows function as expected for authorized State staff.

UPDATED DECEMBER 11, 2025 V5.3 16

• Evaluating offeror ticketing, communication, and escalation processes during simulated operational events.

• Confirming that monitoring dashboards, alerting systems, and reporting tools meet the State’s operational and compliance requirements.

• Conducting pilot equipment installation or migration activities to ensure the facility supports the State’s hardware, expected workflows, and environmental conditions.

Facility acceptance testing confirms that the facility and its operations are ready for full migration and long-term production use by the State.

4.2.15 Facility Portal and Web-Based Interface Requirements

If the offeror provides any web-based portal, dashboard, monitoring interface, ticketing system, reporting tool, or customer-facing website as part of the data center service, the system must comply with the State’s Web Standards listed in this RFP and as found in:

https://www.sd.gov/bit?id=bit_standards_web https://www.sd.gov/bit?id=bit_standards_vendor_client_sec_req

These requirements apply to any vendor-supplied interface used for:

• Submitting or managing support tickets,

• Monitoring facility environmental data (power, cooling, alarms),

• Viewing network utilization or cross-connect status,

• Downloading reports, logs, or infrastructure telemetry,

• Managing user access,

• Receiving facility notifications or alerts.

4.2.16 Accessibility Requirements for Facility-Provided Web Interfaces

Any vendor-supplied web-based portals or interfaces must conform to Web Content Accessibility Guidelines (WCAG) 2.1 Level AA.

This requirement applies even when the primary service is facility hosting, since the State’s operations and oversight teams rely on these tools for visibility into facility performance, incident reporting, SLA tracking, and equipment management.

4.2.17 Browser Compatibility

Any vendor-provided customer portal, dashboard, or web interface must be compatible with supported versions of:

• Microsoft Edge,

• Google Chrome,

• Apple Safari,

• Mozilla Firefox.

4.2.18 Network Vulnerability Scan Requirement

Any networking components, cross connects, management portals, or vendor provided systems deployed within State infrastructure will be subject to a State

UPDATED DECEMBER 11, 2025 V5.3 17

performed network vulnerability scan.

This includes:

• Network-attached appliances,

• Vendor configured handoff devices (e.g., firewalls, routers, demarc equipment),

• Any facility provided monitoring or control systems that interface with State networks.

4.2.19 Use of Abstraction Technologies Requirement

The offeror must describe how its proposed deliverables use abstraction technologies, which is defined as the removal of the network control and forwarding functions that allows the network control to become directly programmable and the underlying infrastructure to be separated for applications and network services.

4.2.20 Non-Standard Hardware and Software Requirement

State-standard hardware and software should be used unless an exception is justified. See https://bit.sd.gov/bit?id=bit_standards_overview for lists of the State’s standard hardware and software.

If the offeror recommends deploying non-standard equipment within State space, such as:

• Specialized Power Distribution Units, on-standard racks or enclosures,

• Video/audio camera equipment

The proposal must clearly identify:

• What non-standard hardware or software is required,

• Why it is necessary for the project,

• Associated costs (included in the cost proposal),

• A link to the vendor’s technical specifications (or an explanation if one is unavailable).

BIT must approve all non-standard hardware or software before a contract can be awarded.

4.2.21 Vendor to State Hosted Transition

If, as part of the proposed project plan, the offeror intends to set up or configure a deliverable outside of the State’s IT infrastructure, even in part, and then move said deliverable to the State’s infrastructure, then the offeror must provide a complete and detailed project plan on how that transition will occur. The offeror’s proposal should include any additional time and money considerations for the transition.

4.3 PHYSICAL HOSTING REQUIREMENTS

UPDATED DECEMBER 11, 2025 V5.3 18

The offeror’s proposal must provide a comprehensive, detailed description of the offeror’s data center facility, operational practices, physical security posture, and governance frameworks. The offeror must demonstrate that its hosting environment satisfies all physical, environmental, security, resiliency, and auditing requirements established by the State of South Dakota and articulated in Appendix C: Physical Hosting Requirements at a Glance.

The requirements outlined in this section apply to any vendor-owned, vendor-operated, or vendor-controlled facility in which State equipment, systems, or data are housed. Compliance with the requirements of this section is mandatory for award.

4.3.1 Governance and Contractual Obligations

The offeror must acknowledge and adhere to all State governance requirements applicable to physical hosting. This includes, but is not limited to, compliance with the BIT Information Technology Security Policy, all referenced BIT standards, and all State procurement and contractual requirements governing data center services. The proposal must describe, in legally sufficient detail, the contractual framework under which the offeror will operate, including the offeror’s obligation to execute the appropriate Master Service Agreement for IT services and to comply with any Statements of Work issued under that agreement. The offeror must further articulate its commitment to meeting all terms and conditions required for physical facility hosting, including requirements governing service levels, physical access, equipment removal, and facility termination procedures.

4.3.2 Security Requirements

The offeror must establish, document, and maintain a security posture aligned with the minimum control expectations set forth in NIST SP 800 53 Rev. 5 and tailored in accordance with SP 800 53B impact baselines, as well as all requirements identified in the BIT Information Technology Security Policy.

The offeror must provide explicit assurance that its facility meets or exceeds these controls and that its personnel, processes, and technologies operate within those standards.

4.3.2.1 Regulatory Overlays

Where State workloads are subject to additional legal or regulatory frameworks, including but not limited to HIPAA, IRS Publication 1075, PCI DSS, CJIS, or other federal or state standards, the offeror must demonstrate its capability and willingness to meet such requirements.

4.3.2.2 Physical Access Controls

The offeror must describe the facility’s physical access controls, which must include, at a minimum, twenty-four-hour-controlled access, escorted visitor procedures, comprehensive access logging, periodic recertification of authorized access, and multi-factor authentication for entry into secured areas. The facility must employ mantrap entry controls, restricted loading dock procedures, and rack-level locking capabilities when required by the State.

UPDATED DECEMBER 11, 2025 V5.3 19

4.3.2.3 Surveillance and Monitoring

The proposal must describe the offeror’s physical surveillance systems, which must include continuous closed-circuit monitoring of all ingress and egress points and all customer-assigned rack locations, with a minimum video retention period of 180 days.

The State requests the right to escorted access to review video recordings of State equipment areas.

4.3.2.4 Personnel Security

The offeror must limit both physical and logical access to authorized personnel and must conduct background checks consistent with BIT requirements. The offeror must maintain documented personnel access records and must adhere to state-mandated training, privacy, and attestation obligations.

4.3.2.5 Supply Chain and Subservice Providers

The offeror must have a system to track and manage all third-party service providers and suppliers providing all components in support of the service. The State reserves the right to review the vendor list and components for compliance with applicable state laws. The offeror must ensure that each such entity meets the same control obligations imposed on the primary vendor and must make SOC reports or equivalent assurance reports available upon request.

4.3.3 Environmental Protections

The offeror must describe the environmental safeguards in place to ensure continuous, resilient, and safe operation of State-hosted equipment.

4.3.3.1 Power Resiliency

The facility must utilize redundant power feeds, uninterruptible power supply systems, generator-backed power continuity, and real-time power monitoring. The proposal must document the availability and configuration of redundant power systems and their monitoring systems. The offeror must demonstrate its power-related uptime for the previous calendar year and provide assurances consistent with State resiliency expectations.

The offeror must clearly identify the specific substations supplying electrical power to the proposed facility and certify that all power originates solely from within the United States. The proposal must detail the geographical location, ownership, and provider relationships associated with each substation and affirm that no portion of the electrical supply, transmission, or supporting infrastructure relies on foreign entities or cross‑border power sources. This documentation must be sufficiently detailed to allow the State to validate domestic power origination and to assess risks associated with grid access, transmission paths, and geopolitical dependencies.

4.3.3.2 Cooling and Environmental Controls

The facility must utilize redundant HVAC systems and maintain real-time environmental monitoring capable of alerting the State to temperature and humidity

UPDATED DECEMBER 11, 2025 V5.3 20

deviations. The proposal must document the availability and configuration of redundant HVAC systems and their monitoring systems. The offeror must demonstrate that its cooling capacity is sufficient for the total amperage and thermal load of the State’s planned installation.

4.3.3.3 Fire Detection and Suppression

The facility must utilize and document fire detection and suppression systems appropriate for data center environments, including pre-action or dry pipe systems, smoke and heat detection, and automatic notification systems capable of alerting the State of any fire-related activity. The offeror must demonstrate that its fire suppression system is sufficient for the State’s planned installation.

4.3.4 Network and Connectivity Requirements

The offeror must provide a complete description and documentation of the physical wiring pathways for network connectivity.

The proposal must include a current catalog of available cross-connect types, colocation rooms, pricing, and installation service levels; an updated inventory of on-site telecommunications carriers; and a description of the facility’s ability to support diverse and physically separated cable pathways for both fiber and copper media. The offeror must disclose any facility-managed patch points and provide diagrams of infrastructure elements through which State connections must traverse.

4.3.5 Operational Support and Monitoring

The offeror must describe how the offeror’s operational framework supports ongoing physical hosting needs.

4.3.5.1 Remote Hands Support

The offeror must provide remote hands services with authorized personnel for State use, including power cycling, visual inspections, cable work, keyboard virtual monitor support as directed by the State, and other basic tasks necessary to support operational continuity up to the point of login. The proposal must define service levels and the offeror’s response obligations.

4.3.5.2 Change Management

The offeror must notify the State of any change that could impact hosted equipment, including, but not limited to, changes to power distribution, cooling, cabling, or physical security systems.

4.3.5.3 Incident Response Obligations

The offeror must notify the State promptly of any environmental, physical security, infrastructure, or weather-related conditions affecting the State’s equipment. The notification must occur within the timeframes identified in Appendix C: Physical Hosting Requirements at-a-glance, section 10, Summary Table.

UPDATED…