24-0005 QA2.docx

Question & Answer #2 Facility Technology Modernization – 24-0005

This document is posted to capture the questions received during the question & answer period for 24-0005 Facility Technology Modernization. This document is the official response to the questions received.

No questions or responses included in this document require any change to the solicitation document, this document stands alone.

Any additional questions regarding this solicitation must be directed to the Procurement Coordinator listed below. As a reminder, all questions must be received by Tuesday October 8, 2024. No solicitation questions received after October 8, 2024 will be addressed.

Yes, DES will accept AWS as a cloud environment. As long as it meets the Washington State security requirements and approved by Office of Cybersecurity during a Security Design Review.

Office of Cybersecurity has approved Azure cloud from an enterprise standpoint and therefore that would be the preference, but not required.

No

No, SOC 1 Type II is a mandatory item.

A SOC 1 report evaluates service organization controls that are applicable to a user entity's internal control over financial reporting. It is specially designed to meet the needs of user entities and the accountants who audit their financial statements and is essentially an evaluation of the effectiveness of a service organization's internal controls.

The SOC 1 Type 2 report has the same analysis and opinions found in a Type 1 report but also includes views on the operating effectiveness of preestablished controls designed to achieve all related control objectives established in the description over a specified period.

No

No, a SOC 2 Type II is not sufficient for this requirement. Bidder must complete a Security Design Review at the direction of Enterprise Services.

No

Yes. While Single Sign On (SSO), Multi Factor Authentication (MFA) and Azure Authentication are preferred but Google Authenticator would be acceptable and approval would be confirmed by OCS during the Security Design Review (SDR) process.

No

Yes, that is acceptable. DES will accept the bidder’s VPAT or ACR and review those documents and the product to confirm how the product meets the standards.

No

Yes, this remains mandatory. There is a requirement to physically provide SOC 1 Type II and SOC 2 Type II annually for as long as SaaS application is being used by DES.

No

Should projects currently in progress be included or do all projects need to be completed?

This response references Exhibit B2-Implementation Plan, Section 1 – Qualification and Prior Experience.

To meet minimum acceptable standard [0%]: Bidder must demonstrate that it successfully has completed at least 3 projects in the last 5 years that are similar in scope to the services being procured.

No

No. As part of competitive contracting DES can only enter into contracts with the awarded Contractor (the Bidder). DES would have no authority as part of this procurement to enter into an agreement with the third-party software provider.

No

No

No. DES will not consider removing or changing the requirement status for these items. These are Mandatory requirements for accessibility, security, and system access.

No

Yes, the floor plans are polylined.

No

No, the platform should maintain a rolling database of 20- years of art inventory.

No

DES estimates between one hundred (100) and one hundred-fifty (150) inventory items that will require data migration for movements and transfers.

No

DES currently maintains six (6) to ten (10) inventory locations.

No

This response references Exhibit B-1 Performance Requirements. Requirement ID 83.

At any given time, DES manages over 700 projects, ranging from simple component replacements to large-scale modernizations worth up to $100 million.

No

DES currently performs preventative maintenance and repair on 35 buildings.

No

Yes, “Train the trainer” is an acceptable approach.

No

(a) How much data will need to be migrated and what format is the data in?

(b) Are there any additional integrations that DES requires or would like to have?

This response references Exhibit B-1 Performance Requirements. Requirement ID 252.

(a) DES estimates there are over 5000 rows of data in an Excel workbook format that need to be migrated.

(b) No.

No

DES estimates there are over 5000 rows of data in an Excel workbook format that need to be migrated. These data migrations should be included in bidder’s pricing proposal.

No

Yes, DES will want to be involved in the data migration process.

No

Yes, DES does have some concerns about the quality and/or completeness of the data.

No

DES is requesting two (2) hosted environments.

No

Yes. For a multi-tenant environment, DES supports the request as long as the following are met and adhered to:

1. Data is logically separated, as noted below

1. ACL’s/Policy around access are configured and in place ( Role based access )

1. MFA is enabled and used for Vendor access/admin support to our ORG’s data

1. SSO of course is mandatory for all SaaS

No

The technology does not need to run in FedRAMP or GCC environment, nor does DES require it to be FedRAMP certified. However, if the bidder’s solution does implement either environment or with certification it would provide a higher degree of security than it would without.

No

The total number of editors working in the field, as well as how many are full-time versus part-time users, has not been determined.

No

The total number of editors who require offline mobile access has not been determined.

No

No, because the Contractor will be handling DES data, DES expects the Contractor to take responsibility for any data breaches as part of their obligations when working with a state agency. By placing limitations on damages, the Contractor shifts the financial burden of potential breaches onto taxpayers, which DES is highly reluctant to accept.

No

This section states, “Enterprise Services is entitled to increase or decrease the number of Authorized Users on an as-requested basis at the license prices in accordance with Exhibit E - Prices for Goods/Services.” As the RFP contemplates a subscription, reductions in the number of licenses are generally not allowed during a fixed term. Will DES consent to the removal of “or decrease” from this section?

This response references Exhibit D – Contract, Section 7.1 AUTHORIZED USERS.

No. Any increase and/or decrease will be communicated on an as-requested basis and the bidder's pricing proposal should reflect any potential increase or decrease.

No

This section states, “Contractor shall, within one (1) business day of Enterprise Services’ request, provide Enterprise Services, without charge and without any conditions or contingencies whatsoever (including but not limited to the payment of any fees due to Contractor), an extract of the Data in the format specified by Enterprise Services.” This would effectively entitle DES to an unlimited number of extracts during the term, which would place an unreasonable burden on the software provider. Will DES agree that extracts will require payment of fees?

This response references Exhibit D – Contract, Section 7.6 EXTRACTION OF DATA.

No. DES must retain full access to its data. Ideally, the bidder’s solution would include a method for DES to easily extract its data as part of the proposed solution.

No

Will DES accept the following language in place of Section 7.7. “Upon termination or expiration of this Agreement, Contractor will retain Data for 90 days (the “Retention Period”)? During the Retention Period and upon Enterprise Service’s written request, Contractor will provide Enterprise Service with one (1) extract of all documents and files stored within its instance free of charge via an S3 Bucket or other mutually agreeable format. After the Retention Period, all Data will be permanently deleted from Contractor’s Document Stores and sanitized in accordance with NIST 800-88 standards.

This response references Exhibit D – Contract, Section 7.7 RETURN OF DATA.

No. Section 7.7 Return of Data in the contract, as outlined, will remain in full force and effect.

No

Section 7.8 indicates that the Contractor must comply with all security policies and standards at https://watech.wa.gov/policies. Will DES provide a list and URL for specific policies applicable to this RFP?

This response references Exhibit D – Contract, Section 7.8 SECURITY COMPLIANCE.

Yes. DES will provide a list during the Security Design Review phase of the solicitation process.

No

This section would require the successful bidder to have an “information security audit” performed in the event of any “significant Data Loss” Will DES clarify what is meant by “significant” as well as whether an “information security audit” would be different than a SOC 2 Type II audit (if so, please clarify what the information security audit would consist of)? Finally, will DES agree to remove security logs from the list of items in the 1st sentence? Security logs are generally not provided due to the inherent security risks if they are shared outside the software provider’s organization.

This response references Exhibit D – Contract, Section 7.11 TECHNICAL AUDIT.

The intent of this section is for any data breach or loss of data of a significant nature. Significant would be any data loss that is worthy of attention. This would include any loss of category 3 or 4 data or any large amount of data loss that impacts the operations.

Information security audit here is a specific audit for the cause of the data loss; it is different than a SOC 2 Type II audit. There will be no removal of security logs. The logs are bounded by reasonable access.

No

This section states that annual subscription fees would begin upon the successful launch of the system. If an implementation will take place within the production environment, in which case the Contractor will begin incurring storage and hosting costs shortly after execution, will DES agree that the annual subscription fees will begin at contract execution?

This response references Exhibit D – Contract, Section 9.4 ANNUAL SUBSCRIPTION FEES.

NO. Any solution milestones associated with the Initial Installation and Implementation fees of the proposed solution should be identified separately as described in Exhibit C - Bid Price of the competitive solicitation 24-0005.

No

This section includes no limitation on consequential or incidental damages, no limitation on direct damages, and excludes basic warranty claims. Will DES agree to negotiate reasonable adjustments to this provision that are in line with industry standards for a COTS SaaS subscription?

This response references Exhibit D – Contract, Section 15.9 LIMITATION ON DAMAGES.

No. Since the Contractor will be handling DES data as part of their responsibilities as a bidder working with a state agency, DES expects the Contractor to be accountable for any damages resulting from the performance of the contract.

No

(Rev5/8/2023)

(Rev5/8/2023) image1.png