Attach-B RFI Q A Oracle Retail Upgrade SIM.pdf

VA VCS RFI for Oracle Retail Upgrade and SIM Questions and Answers

Question 1. Project Scope and Objectives

a. What are the primary business outcomes you want to achieve from the Oracle

Retail and SIM migration effort?

Answer: The desired outcome is for the VCS to have a Secure and Sustainable Oracle solution that meets VA security requirements and provides VCS with at a minimum current functionality that is available to VCS as a part of Oracle 13.9

b. Are there any current pain points with the existing Oracle Retail 13 and SIM systems that should be prioritized in this upgrade?

Answer: TLS 1.0 and 1.1 remediation (need to be remediation with VA OIT security requirements), Two factor authentication, migrating from multiple concepts to a singular Canteen location. Java 1.645 remediation, Apache 1.2/3, 508 Compliancy, current data base is not encrypted.

c. Do you envision maintaining any components on-prem, or is full cloud migration a long-term goal?

Answer: All existing applications as a part of the Oracle 19C suite would remain on-prem with the exception of SIM which would be migrated to the cloud. Full migration would be a long-term goal.

Question 2. Technical Environment & Constraints

a. Presently VCS appears to use a non-oracle application for the POS environment.

What is the purpose of this RFI?

Answer: Outside of required interfaces/integrations to the POS from Oracle. The POS is out of scope for this procurement.

Is it to add / enhance the present Oracle back end? The current Oracle solution is beyond end of life and no longer secure. The objective is to replace with a supportable and secure Oracle solution.

Or is this a new POS system that will replace the present vendor? POS is out of scope for this solicitation.

b. Can you confirm the current state of integrations with external systems (e.g., ERP, supply chain, point-of-sale)?

Answer: Yes, see attached VCSAIS Retail System Summary PDF.

c. Are there any system-specific constraints (e.g., legacy middleware, custom code) that must be preserved during the migration?

Answer: Yes, see attached VCSAIS Retail System Summary PDF.

d. Is there a preference for a lift-and-shift migration or a re-platforming effort for the SIM module?

Answer: The Vendor needs to recommend the most efficient effort to meet the governments requirements.

Question 3. Data Migration

a. How much historical data (in years or volume) needs to be migrated to the Oracle Retail 19c and SIM Cloud environments?

Answer: 2015 RMS & SIM transaction data 18 months, RESA 180 days, RDW 2015, Purchase order data (PDS to provide historical data date)

b. Are there any known issues with data quality, duplication, or inconsistencies in the current system?

Answer: None known

c. Should we assume a "zero data loss" policy, or will archiving be acceptable for legacy data?

Answer: Zero Data Loss as outlined in question 3a

Question 4. Customizations and Extensions

a. Can you provide an inventory of custom-built components (e.g., reports, workflows, UI customizations) within the current Oracle Retail and SIM environments?

Answer: A high-level description is provided in attached VCSAIS Retail System Summary PDF.

b. Are there any known third-party add-ons or extensions currently in use?

Answer: No

c. Are you open to reengineering customizations to fit native cloud capabilities?

Answer: Yes, open to cost effective process improvements.

Question 5. Interfaces, Devices, and Hardware

a. What brands/models of handheld scanners, printers, and vending adapters are currently in use?

Answer: Zebra MC67, Zebra QLN320, Zebra EVM/EMC Dex Cable, PIV reader (internal & external)

b. Do you require backward compatibility with existing hardware, or are you planning a refresh?

Answer: Existing hardware would include Zebra EVM/EMC Dex Cable all other equipment would be required to be a refresh.

c. Are there any minimum hardware certifications required (e.g., FIPS compliance, VA approval lists)?

Answer: FIPS-140-2/3, TRM compliant

Question 6. Timeline and Milestones

a. Are there any hard deadlines tied to fiscal year planning, audits, or compliance milestones?

Answer: No

b. Is the project expected to follow an agile rollout or a traditional waterfall schedule?

Answer: Agile

c. Should we assume parallel operations of old and new systems for a transition period?

Answer: Yes

Question 7. Organizational Readiness

a. What is the technical maturity of the internal VCS team in terms of cloud operations and Oracle SaaS products?

Answer: The VCS team has zero level of technical maturity with cloud operations and SaaS products. Would need the AIS team to provide any maturity levels with this request.

b. Will there be a dedicated VA project team or business SME group available during assessment and implementation phases?

Answer: Yes

c. Are there any specific training or change management requirements to be included?

Answer: Yes, as outlined in the PWS. There would be an expectation that VCS and technical support team is trained on how to utilize all changes in functionality and systems navigation from the current Oracle version to Oracle 19C and Oracle Fusion.

Question 8. Budget and ROM Planning

a. Do you expect ROMs to include licensing and subscription costs, or should we focus solely on services?

Answer: Should only include services for the upgrade/migration as the licensing and subscription costs should be covered by VA. If there is a SaaS fee that would need to be included VCS would need to pay and that cost needs to be included in your ROM.

b. Is there a not-to-exceed budget range or ceiling we should be aware of when submitting our ROM estimates?

Answer: The Government will not be providing any estimate/cost for the requirement. It will be incumbent on interested vendors to make a good faith effort of an estimate.

Question 9. Compliance and Security

a. Are there specific cybersecurity frameworks (e.g., NIST 800-53, FedRAMP, VA Handbook 6500) that must be addressed in our approach?

Answer: Please refer to the PWS Sections 2.0 Applicable Documents, 5.13 Assessment, Authorization and Continuous Monitoring and 6.1 Enterprise and IT Framework for specific cybersecurity information.

b. Will any system data be classified as sensitive or PII, triggering encryption or special handling requirements?

Answer: There is no system data that would be classified as sensitive or PII.

Question 10. Post-Deployment Support

a. What is your expectation for post-deployment support – ongoing O&M, training, help desk integration, etc.?

Answer: Vendor is responsible for implementation, integration and vulnerability remediation while working in collaboration with Oracle licensing support. Training and hand-off to the sustainment team. Vendor should recommend appropriate timing to complete the transition to the sustainment team.

b. Will knowledge transfer be expected for internal staff to manage the cloud environment post-implementation?

Answer: We believe the cloud environment should be handled by Oracle.

Question 11.

a. Does the agency have a current contract for the subject effort? If so, could you please provide the contractor's name and contract number?

Answer: Customer currently only has the perpetual licensing for the Oracle Products and limited support. Currently there is no contract.