WSHS Questions 34 - 128.pdf

Q34. Reference 10-223-SOL-00188_RFP_Amendment_1.pdf, section 15.1, page 15. This section refers to a section about information Security: “IMPORTANT NOTE TO OFFERORS: The following information shall be addressed in a separate section of the Technical Proposal entitled, "INFORMATION SECURITY”. The instructions for proposal submission starting on page 37 do not provide instructions for addressing this requirement. Please provide instructions and additional page count to address this requirement.

A34. Please address this requirement in Volume I, Section A.1 “Technical Understanding and Approach” of the proposal.

Q35. RFP Section 7 Place of Performance (Page 6) and Section B Pricing (Page 44).

Question: The location of the specific tasks are inconsistent and overlapping. Can the Government clarify which tasks are to be performed on “Government Site” (e.g. Government site rates) and which tasks are to be performed on “Contractor Site” (e.g. Contractor site rates)?

A35. Please refer to the Place of Performance.

Offeror may decide to use resources in their at their site or government site to perform to assist with work that needs to be performed in other tasks and will need to document pricing correctly in that capacity.

Q36. Reference Attachment 1 – Amendment 1 - SOW, section 4.6, page 11. Please clarify the first sentence: “…to meet the requirements gathered in task 1 Web Governance, performance criteria in task 2 Web Content Management System Development, and programming language server upgrades.” Task 1 Web Governance does not exist. There are no performance criteria identified for the Web Content Management System Development task. Additionally, please clarify the requirement for programming language server upgrades as it is not mentioned elsewhere.

A36. There are two performance criteria that cover all tasks. 4.6 also is included in Timely Submission of deliverables and Report in advance variance in scope or schedule for each project.

An example of a programming language server upgrade would be upgrading from ColdFusion version 8 to ColdFusion version 9

Q37. The above RFP states that the place of performance is in Maryland. It appears from reading the RFP that we can most of the work in our offices in Minnesota with limited travel to the FDA. Am I correct in my assumption?

A37. The majority of the work would be able to be performed remotely.

Q38. SOW Section 3 (Page 2) and Section 4.6 (Page 11). Question: Section 3 states there are over 60 web applications hosted on the FDA internet / intranet website. Section 4.6 does not identify 60 different web applications. In section 4.6, please provide the list of web applications that are to be specifically maintained and enhanced. For each application, please provide the specific technology (e.g. language), complexity (e.g. sizing information), and URL (e.g. if public)?

A38. Please note these are separate task. The environment that must be supported contains 60 different web applications. 4.6 is the applicable to applications the contract will support with through development. Most application are small, and the links are available for Internet application.

Examples of Simple Dynamic Forms is GRAS inventories available here -http://www.accessdata.fda.gov/scripts/fcn/fcnNavigation.cfm?rpt=grasListing All of these applications are written in Cold Fusion.

Q39. SOW Section 4.2 (Page 4). Question: Where is the current FDA public website currently hosted? Where is the current FDA employee website currently hosted?

A39. Both Internet and Intranet are hosted through Contracted Hosted Data Centers. The contract only pertains to the hosting of the Internet and supporting of the Intranet.

http://www.accessdata.fda.gov/scripts/fcn/fcnNavigation.cfm?rpt=grasListing

Q40. SOW Section 4.2 (Page 4). Question: How many data centers are deployed and supported in the current contract? Is Disaster Recovery (DR) site deployed on separate data centers different from production data centers?

A40. Both Internet and Intranet are hosted through Contracted Hosted Data Centers. The contract only pertains to the hosting of the Internet and supporting of the Intranet.

Currently DR is not deployed in separate data Centers.

Q41. SOW Section 4.2 (Page 4). Question: Are there separate deployment architecture and servers for Intranet and Internet websites/applications? If yes, are there any servers common to both of them?

A41. No, These are only servers for Internet. Intranet servers are not hosted through this contract.

Q42. SOW Section 4.2.6 (Page 6). Question: Are the servers listed in the point 1 (Servers supported but not hosted under this contract) deployed for Intranet website (except 4.2.6.1.1.2)?

Where are these servers hosted? Is there any integration between these servers and servers listed in Section 4.2.1?

A42. Yes, those servers are not hosted under this contract. These servers are hosted at FDA and through another contract.

There are data connections and data transfers between environments.

Q43. SOW, Section 4.5 (Page 9). Question: How many instances of Oracle UCM are deployed in FDA? Does FDA manage Internet and Intranet site content from separate instances of Oracle UCM server? How many intranet sites?

A43. UCM is the underlying service for 4.2.6.1.2 Web Content Management Servers. The WCMS contribution servers host both Internet and Intranet. The consumption instance is a separate deployment that receives content from the contributions servers.

Q44. SOW Section 4.6 (Page 11). Question: This paragraph has references to “task 1 web governance” and “task 2 web content management system development”. It is unclear how these references fit within the SOW. Please clarify? Also, the last sentence of the paragraph is incomplete. Is there more to this section of the SOW than has been included?

A44. Assisting with Web Governance is part of Task 4.7. and Web Content Management Development is under 4.5

Q45. Will equipment and software listed in Section 4.2 be owned by FDA or should contractor provide as managed service and retain title?

A45. Contractor provided as managed service and retains title.

Q46. Each of the ten listed hardware components in Section 4.2 calls for Private Backup Network Connection. Can you please provide further information related to this connection?

A46. This is a private connection used for data backup procedures.

Q47. Each of the ten listed hardware components in Section 4.2 calls for Weekly full and Daily Differential.

a. Does FDA have historical information on the size of the weekly and daily backups?

A: Recently daily 70GB Recently monthly 8,200 GB

b. Is centralized backup to off site disk acceptable as alternative to tape?

A: Yes, as long as data can be restored in acceptable time tables, and there is a secure and encrypted.

Q48. The government states that they are open to substitution of equal or better hardware. Is the government also open to alternatives for software i.e. operating systems, ColdFusion, Google Urchin, etc.?

A48. No, alternatives will not be acceptable.

Q49. Would FDA be open to virtualized environment for hardware platform?

A49. No

Q50. Is the equipment listed in Section 4.2 to be contained within one contractor provided IDC?

A50. Yes

Q51. Is there a geographical preference to the data center location?

A51. No

Q52. Section 4.2.4 bullet 4 calls for 100% uptime of network and infrastructure. Is Government willing to accept an uptime that is in line with industry averages – i.e.99.995%?

A52. Yes

Q53. Bottom of page 6 – Section 4.2.6 Server Administration. The paragraph ends with “and.”

Was additional verbiage to be included?

A53. Yes, the language reads, “Covers both servers hosted under this contract and other servers hosted by FDA or under other contracts supporting FDA web infrastructure within the FDA network. Perform system administration, troubleshooting, and maintenance including application of software patches for security and operational stability and upgrades.”

Q54. On page 7 Section 4.2.6.1.1 - .4 lists Servers supported but not hosted under this contract.

Can FDA provide full details on these servers including O/S level? Would FDA be looking for support up to and including the O/S level? Based on the configuration and version levels, would FDA be open to upgrading the software/hardware of these devices?

A54. The servers are to be supported at the application server level. This information is provided in the SOW. Software may be upgraded as directed by COTR, but not till after transition.

Q55. Will the existing FDA infrastructure as described in SOW be moved from the incumbent site to the new hosting site?

A55. No

Q56. Is the new contractor expected to provide replacement HW and SW licenses for all FDA systems to be hosted at contractor facility or will existing HW and SW licenses transfer?

A56.

The Following licenses will be made available by the FDA; however offeror will need to supply support and maintenance of the software licenses:

ColdFusion Enterprise 9

MS SQL 2005

MS SQL Device CAL 2008 MS SQL Server Standard 2008 Urchin 6 3 SSL Certificates

Google Search Appliances schedule is as follows:

Internet production – June 2012 Internet Hot backup – June 2012

Intranet development (POC) – June 2011 Intranet production – Dec 2011

Oracle UCM licenses – 8 licenses are required to be provided by the offeror. All other UCM licenses will be provided by FDA. Offeror must include maintenance and support for all software licenses.

All other hardware and software listed should be included as part of the proposal.

Q57. Will the new contractor maintain/manage SW and HW maintenance licenses for all hosted systems or will FDA?

A57. Refer to A56

Q58. Does hosted data center require BOT biometric and card scanner?

A58. No

Q59. Who is the current FDA DR vendor?

A59. DR is handled through the current contract

Q60. What is meant by "FDA is allowed one FREE restoration per month "?

A60. The Data Restoration section of the SLA has been updated in Amendment 2.

Q61. Please explain Attachment 6 (Hosting SLA)- Data Restoration section.

A61. Data restoration allows data to be pulled from back up’s and placed back to production or provided to FDA in another capacity as requested.

Q62. Will FDA provide the network monitoring suite?

A62. No

Q63. Does FDA have and utilize a current hot site? If so, please provide location or the distance from FDA.

A63. No

Q64. Are there defined audience segments & how are they prioritized?

A64. There is not enough information to answer this question.

Q65. Must the new site design adhere to current Health & Human Services (or other) templates?

A65. New site design shall adhere to HHS and OMB policies and procedures.

Q66. Does the FDA have access to a list of consumer or business/government users to draw upon for user testing on the new site?

A66. No

Q67. Do the current web analytics point to any major usability issues with the site? Please describe them.

A67. No

Q68. Are their tasks or requests that your offices are fielding by phone that you think should be addressed on the website?

A68. No

Q69. What are the top 3-5 tasks that are being performed on the site today? Said another way, what are the most popular content areas on the site today?

A69. Recalls, Warning Letters, and Guidance Documents

Q70. In Section 4.2.5 of the Statement of Work there is no mention of Oracle RAC database licenses required. Will FDA provide the Oracle RAC database licenses?

A70. This is stated in 4.2 “Hosting includes any operating system software and licensing.”

Q71. In section 4.2.4 there is only one Oracle RAC database cluster mentioned. Does FDA require a pre-production cluster or disaster recovery DB?

A71. Pre-Production is required.

Q72. Does FDA require any end user website performance monitoring support (webmetrics, keynote, etc.)?

A72. No

Q73. Does FDA require the use or integration with an enterprise help desk system such as peregrine of remedy?

A73. No

Q74. What is the current technology used for web cache services?

A74. Akamai

Q75. What software is currently used to publish web content?

A75. Oracle UCM

Q76. How is web site load balancing currently accomplished?

A76. Web application servers are load balanced, load balancers are behind web caching servers.

Q77. Attachment 1 - Section 4.2.1: Page 4: Microsoft announced the end of support for Microsoft Windows Server 2003 Enterprise Edition R2. Would the government accept either Windows Server 2005 or Windows Server 2008 Enterprise Edition as a replacement?

A77. This may be acceptable in the future; base year must include 2003 R2.

Q78. Attachment 1 - Section 4.2.6.1: Page 7: Would the government provide the specific server hardware configuration and the operating systems currently in use for all servers listed in this section?

A78. This information will be provided upon award.

Q79. Attachment 1 - Section 4.2.1: Is the contractor required to provide Internet Connectivity to the data center? If so, what is the bandwidth requirement?

A79. No

Q80. Attachment 1 - Section 4.2.3: Page 6: Would the government accept the use of a different vulnerability scanning tool than the Ambiron TrustWave?

A80. No

Q81. Which Prime contractor is currently delivering requirements for hosting FDA’s web site?

A81. GlobalNet Services Inc.

Q82. Which Prime contractor(s) is currently delivering requirements for developing FDA’s web site?

A82. This is activity is currently unsupported.

Q83. Does the current Prime contractor that delivers requirements for hosting, host the FDA’s web site at their own facility or have they outsourced or subcontracted the Hosting to another vendor?

A83. Hosting is currently structured as a subcontract.

Q84. If the Hosting is outsourced or subcontracted by the current Prime contractor, who is it subcontracted or outsourced to?

A84. Rackspace

Q85. Where is the current FDA web site hosting facility geographically located?

A85. Not applicable.

Q86. What service is being used currently for centralized management backups?

A86. We are open to any service that is able to meet our requirements.

Q87. Where is Google 7007 co-located currently?

A87. Both Google 7007’s are located at the current production data center.

Q88. Who holds current FDA software licenses for SQL, ColdFusion, SSL certs and Oracle

UCM?

A88. Refer to answer A56.

Q89. Can you provide licenses renewal dates for this software as well as Akamaii, Google services and current disaster recovery services?

A89. Refer to answer A56

Q90. Please provide details for server administration as explained in Section 4.2.6. It seems that this paragraph is incomplete. What servers are covered under server administration?

a) Only those hosted by new contractor and/or

b) Other contracts supporting FDA web infrastructure within FDA. If so, how many and what are the server specifications? Are they located onsite FDA or at other contactors facilities?

A90. Refer to A53;

Servers are listed throughout the sections. The server administration listed is needed for both hosted and FDA maintained infrastructure.

Q91. Is it correct to assume that all servers described in Section 4.2.6.2 through 4.2.6.5 will be hosted at contractor site?

A91. Yes

Q92. What is the average monthly and total yearly data transfer to and from each of the websites covered under this proposal broken out by individual website?

A92. The websites experience more than 350 million hits, 25 TB data transferred, and 6 million visitors per month. FDA.gov and Accessdata are the majority of these metrics in a ratio of 3:1.

Other servers are not significant.

Q93. What are the average monthly and total yearly hits to the websites covered under this proposal broken out by individual website?

A93. The websites experience more than 350 million hits, 25 TB data transferred, and 6 million visitors per month. FDA.gov and Accessdata are the majority of these metrics in a ratio of 3:1.

Other servers are not significant.

Q94. What are the average monthly and total yearly visitors to the websites covered under this proposal broken out by individual website?

A94. The websites experience more than 350 million hits, 25 TB data transferred, and 6 million visitors per month. FDA.gov and Accessdata are the majority of these metrics in a ratio of 3:1.

Other servers are not significant.

Q95. What is the breakdown of user licenses and server application licenses for each of the applications listed in the RFP (e.g. MS SQL, Oracle 10g, Oracle UCM, Windows Server, Cold Fusion/JRun, Google Urchin, etc.?)

A95. Refer to A56

Q96. What is the current backup system software platform?

A96. FDA is open to whatever backup system that meets the requirements.

Q97. How many SSL Certificates are currently in use and required for all of the systems covered under this RFP?

A97. Currently 3 SSL certificates are required for all systems.

Q98. Who owns the existing hardware and software currently supporting the system?

A98. Systems in the contract are currently hosted, unless otherwise state.

Q99. What provisions exist for turnover or disposition of existing hardware and software?

A99. Hardware and Software upgrades or changes will need to cutover without interruptions in service.

Q100. Will all changes including emergency hardware replacement require going through a Change Control Process for government approval?

A100. Yes, Government/Change Control Process approval is required for emergency hardware replacements.

Q101. The data retention rate for backup tapes is only 12 weeks?

A101. Yes

Q102. Data restoration is to only provide FDA internally access to backed up data not applications or websites?

A102. Yes

Q103. Will government provide a list of documentation expected to be turned over at award to contractor?

A103. Documentation will be cut over during 4.1 Contract Transition Activity

Q104. Will government provide working firewall, IDS, and IPS configurations before transition activities begin?

A104. Firewall, IDS, and IPS are required to be provided by the contractor. Special configuration needed for firewall connection will be part of transition activities.

Q105. Is hosting facility support staff responsible for following agency incident response plan?

A105. Yes

Q106. Is hosting facility required to conduct disaster recovery and failover testing?

A106. Yes

Q107. Are all FDA public and internal websites under this solicitation using Oracle Universal Content Management?

A107. Yes

Q108. Will contractors own new Hardware and Software?

A108. Yes

Q109. Does the transition activities include transfer of equipment from other contract hosting facility?

A109. No

Q110. Will contractor receive configuration documentation of existing operational servers operating system and applications running on servers?

A110. Yes

Q111. Will hosting facility network be subject to OMB mandates for government internet initiatives?

A111. Yes

Q112. Are the current development and test servers on the production network?

A112. Yes

Q113. How many indexed documents are of FDA internal and public web sites?

A113. 5 Million

Q114. What is the annual growth of indexed documents on FDA internal and public web sites?

A114. 5%

Q115. Is the Center for Tobacco Products using Oracle Universal Content Management?

A115. Yes

Q116. In creating the database schemas the requirement is to only create the schema in one business day not link objects and tables?

A116. The schema must be created and usable

Q117. Is the “Power Availability” requirement actually 4 or 5 nines availability 99.99999?

A117. 99.995 is acceptable

Q118. Is the “Network Availability” requirement actually 4 or 5 nines 99.99999?

A118. 99.995 is acceptable

Q119. Is the tape library listed under “Data Backups” under “Backups” a requirement or can backup to disk with the same Recovery Time (RTO) and Recovery Point Objectives (RPO) be substituted? The RPO/RTO are listed in “Disaster Recovery/Continuity of Operations” also under “Backups/Data Restoration”.

A119. If substituted, must be stated and address how all requirements will be met.

Q120. Disk backup questions:

Is it acceptable to keep 14 daily’s and 10 weeklies on a rolling basis?

A: No What is the actual disk space utilization for each server?

A: Utilization of servers is as follows Application 1 – 25% Web Analytics – 50% Web Server Staging – 70% Database SQL – 25% File Server – 60% Web Server – 72% Test Web – 25% Test Application – 80% Test DB – 40%

Q121. Regarding the SOW, Section 4.2- Hosting:

What server access does FDA currently have with their existing hosting provider to make changes to things like the Web servers or IP addressing, etc?

A: Some users will require as high as Admin. FDA Security will need admin access to all servers and network devices for audits and to assure compliance and accreditation.

Does current host allow server side applications?

A: Yes Does current host provide a single POC for support that is always available?

A: Yes Does current host provide update to FDA when the site goes down? How quickly?

A: Issues must be reported immediately Are the timely with explanations when things go wrong?

A: Not enough information How far in advance is FDA told about maintenance windows and how often is FDA updated before and after the window?

A: Maintenance needs to be coordinated with COTR, and must be updated during milestones that are provided during maintenance planning.

Is the 500GB of SAN storage the effective amount or raw?

A: Raw What servers are the 500GB allocated to and how much to each?

A: Oracle UCM and staging server for static content Q122. Regarding the SOW, Section 4.2.3:

Is a two factor authentication method required for access to the environment?

A: Yes What speed (Mbps) is desired for the site to site vpn connections?

A: Use Firewall details for this information.

Q123. Section 4.3: What CDN volumes in terms of Gigabytes delivered or Mbps?

A123. Not enough information to answer this question.

Q124. Regarding Section 4.5 -- Content Management/UCM

Would it be possible to view the existing architecture diagram/setup?

A: Upon Award this information will be provided.

Is FDA creating content entirely as contributed content in XML format or are they using WORD documents that get translated by the CMS with a UCM dynamic convertor?

A: FDA’s is creating 98% of their content through contributed content in XML format, however, there are cases that Word, Excel, and Powerpoint documents are being converted using UCM dynamic converter.

How many different workflows are currently in place for content management?

How many total users are currently given access to create, edit, or review content using

UCM?

A: FDA’s instance of Oracle UCM is using two dynamic workflow. There are over 600 users of the WCMS through Oracle UCM system.

What is the shortest amount of time that it can take for content to be approved in UCMS and appear live on the site?

A: New Content appears within seconds of approval Is there content that gets published that does not involved workflow? (ex: Immediate Post by an admin for urgent and time sensitive items) A: No How is content published currently with UCM? Real-Time using consumption server or is the site published and then replicated?

A: Contribution publishes to consumption in real time.

What kind of reporting is available from the existing search appliance?

A: Current reporting is what is standard with GB-7007 Do administrators have the ability to log in and control the UCMS at the application level?

A: Yes

Q125. RFP Section 16.4 states that OPM background investigations will take 120 days. Will contractor staff be given conditional permission to work while the background investigation takes place? If so, by what means, and with what restrictions, if any?

A125. Yes, interim clearance will be used before full investigation is completed. Materials needed for the work and limited access to internal servers will be provided during this time.

Q126. Section 16 addresses Personnel Security. Given our experience with obtaining an FDA security badge and access to systems within each Center, will the government provide any assistance in how much time we should allow for our staff to be cleared and will that time be factored into any transition?

A126. Assistance will be provided to access systems during interim clearance process.

Q127. Will the contractor need to work with TO3 contractor to coordinate the webservices?

A127. There is not enough information to answer this question.

Q128. If the FDA wishes to push the webservices to the contractor, will the hosting company be required to meet all FISMA standards?

A128. Yes. FDA Security will need admin access to all servers and network devices for audits and to assure compliance and accreditation.