The file's text, extracted by GovTribe without its formatting.
Appendix F:
RFP Evaluation Criteria
All respondents must include a complete copy of this appendix (Appendix F: RFP Evaluation Criteria form with their proposal. While respondents are encouraged to provide supplemental documentation, a fully completed Appendix F is required for a proposal to be considered for the awarded contract.
The South Dakota Bureau of Information and Technology (BIT) is requesting detailed proposals from qualified providers capable of delivering the services outlined in this RFP. Your proposal must demonstrate a thorough understanding of the required services and the outcomes expected. Clearly identify the outcomes your solution will achieve and the deliverables you will provide as a result of performing the required services.
Your response must address each requirement in the order presented, using the compliance ratings defined in Table 1 – Acceptable Compliance Responses. Responses must be provided in a tabular format. For each requirement, list the compliance rating in one column and any explanatory text or supporting details in a separate column.
If the space provided for responses is insufficient, or if you wish to include additional supporting materials (such as support agreements, solution overviews, user manuals, or other documentation), you may include them in an appendix. Any appended material must be clearly referenced within your response.
Please ensure all information provided is accurate and not misleading. Incorrect or deceptive responses may result in disqualification from further consideration or may invalidate any resulting contractual agreements.
| Native |
| Feature/requirement is a standard feature in the current offering. |
| Additional |
| Feature/requirement can be achieved through procuring additional offerings or services through the respondent. |
| Third-Party |
| Feature/requirement can be achieved through procuring additional offerings or services via a third-party. |
| Not Supported |
| Feature/requirement cannot be met. |
Table 1 - Acceptable Compliance Responses Requirement priorities are coded as follows:
| R |
| Required: This functionality is required, and a vendor may be excluded if this functionality or its equivalent is not met. |
| D |
| Desired: This functionality is desired and expected to be provided by the vendor, although not vital for the acceptance of this RFP. |
| O |
| Optional: This functionality is considered “nice to have” but is not vital for acceptance of this RFP. |
Table 2 - Definition of Requirement Priority Coding
1.1 Engagement Methodology
| ID |
| Requirement |
| Priority |
| Compliance |
| Comments |
| EM01 |
| Will the vendor engage in quarterly service meetings with the organization? |
| R |
| EM02 |
| Can the vendor provide resumes or equivalent information about key staff? |
| R |
| EM03 |
| Will the vendor outline the functional responsibilities of each key staff role? |
| R |
| EM04 |
| Will all of the support staff and/or sub-contractors be based in the United States? |
| R |
| EM05 |
| Do pricing discount terms and/or service credits apply for transition services? |
| O |
| EM06 |
| Will the vendor provide client and partner references? |
| R |
| EM07 |
| Is the vendor willing to align with BIT’s project management practices and processes? |
| D |
| EM08 |
| In the event of an operational dispute, will the account liaisons of the vendor conduct a meeting within three (3) calendar days to either resolve the matter and set forth a resolution in writing or define the dispute in writing, including a description of each party and which projects and tasks it would affect? |
| R |
| EM09 |
| If an agreement cannot be reached in the event of a dispute, will the vice president and/or president of the client meet at a mutually agreed-upon location to reach a resolution within thirty (30) calendar days? |
| R |
1.2 Co-location / Hosting
| ID |
| Requirement |
| Priority |
| Compliance |
| Comments |
| H01 |
| Can the provider confirm whether the data center is used exclusively by their company or shared? |
* If a shared facility, who operates or manages the data center?
* If your company acquired the facility, how long has it been within your portfolio?
R
| H02 |
| Was the facility purpose-built as a data center, or was it retrofitted? |
If retrofitted, please explain D
| H03 |
| Is the data center location a possible contributing factor to unintentional manmade threats? |
For example: Are there chemical plants or fertilizer factories nearby? Is there a railroad track nearby? Is it located at the end of an airport runway? In a flood or seismic zone?
D
| H04 |
| Compared to data center design, build, and operational standards such as the UI, TIA, or BICSI, is the facility: |
1. Concurrent maintainable (increased level of redundancy which enables the data center subsystems to continue operating while parts of the power and cooling equipment are being replaced or maintained)?
2. Fault-tolerant (data center with fully redundant subsystems)?
D
| H05 |
| Does the facility (specific) service-level agreement provide for at least 99.999% availability? |
| R |
| H06 |
| Can the provider/vendor assure that they have completed an examination in conformity with either the International Standard for Assurance Engagements (ISAE) No 3402 Type II Service Organization Control (SOC1 and SOC2) or CSAE 3416 Type 2 for the period between January 1, 2025 to April 30, 2026? |
| R |
| H07 |
| Does the facility employ power usage monitoring (at rack, cage, or PDU) for each customer to ensure power usage is not at or over full capacity? |
| R |
| H08 |
| Does the facility have spare capacity (power, cooling, etc.) sufficient to be able to provide additional capacity for unpredictable demand on the facility? |
| D |
| H09 |
| Will the facility support the cooling requirements for high-density/converged infrastructure deployment? |
| R |
| H10 |
| Is the facility able to provide low-latency/high-availability interconnection to public clouds (like AWS DirectConnect, Google Cloud Platform, Microsoft Azure ExpressRoute, IBM Softlayer, CloudFlare, or Oracle)? |
| D |
1.3 Technical and Managed Services
| ID |
| Requirement |
| Priority |
| Compliance |
| Comments |
| MS01 |
| Are change management services/processes available, including process steps related to: |
• Logging changes.
• Assessing the impact, cost, benefit, and risk of requested changes.
• Providing change approval or rejection.
• Overseeing the change implementation.
• Monitoring and reporting the status of change.
• Closing change requests and conducting post-implementation reviews.
• Standard and custom reporting.
• Pricing and exceptions.
• Standard service-level agreements.
R
1.4 Security and Privacy Capabilities
| ID |
| Requirement |
| Priority |
| Compliance |
| Comments |
| SP01 |
| Does the vendor contract for, or protect against its own infrastructure, denial-of-service attacks for its infrastructure offering? |
| R |
| SP02 |
| Will the vendor provide the latest evidence of SOC2 Type 2 report and update the status accordingly? |
Note: SOC1 (SSAE16), ISAE3402, and SOC3 reports are not valid for security purposes.
R
| SP03 |
| Is the vendor able to provide the latest evidence of ISO 27001 certification report and update the certification status annually? |
| R |
| SP04 |
| Can the vendor provide the latest evidence of PCIDSS assessment report and update the certification status annually? |
| R |
| SP05 |
| Can the vendor provide the latest evidence of GovRamp authorization report and update the status accordingly? |
| R |
| SP06 |
| Does the vendor have a process of reporting to customers security incidents and events with prioritization, notification, and severity-level assessment? |
| R |
| SP07 |
| Regarding the facility’s customer data deletion: Will the customer receive written verification from the cloud service provider that all data has been removed from any and all information systems and that the provider will not use any of the consumer's data for any purpose in the future? |
| O |