41-2026 11AB Process Improvement Addendum 1.pdf

Page 1 Rev. 2025.2

NORTH CAROLINA

DEPARTMENT OF INFORMATION TECHNOLOGY

STATEWIDE IT PROCUREMENT OFFICE

https://it.nc.gov/resources/statewide-it-procurement-office

Solicitation Addendum Solicitation Number: 41-2026 11AB DR Process Improvement RFP Lite

Solicitation Description: The purpose of this RFP Lite is to procure staffing to assist development and implementation of a Disaster Recovery Program for North Carolina Department of Information Technology

Solicitation Opening Date: 09/03/2026

Time: 2:00PM

Addendum Number: 1

Addendum Date: 08/24/2026

Contract Specialist or Purchasing Agent:

Anthony.Benzor@nc.gov

1. This addendum does not need to be returned.

No. Section Vendor Question State's response

1. Section 3.4, pp. 9–12;

Section 4.0, pp. 13–14

Section 3.4 describes Position 1 and Position 2 separately, while the Furnish and Deliver Matrix provides only one 12-month ITDR Systems Analyst line item for each contract year. Please confirm whether the solicitation requires one ITDR Systems Analyst or two separates, concurrently assigned personnel.

There is funding available for two individuals for the first year, the second year is awaiting an award from FEMA.

2. Section 4.0, pp. 13–14

If two personnel are required, please confirm whether vendors should provide separate monthly unit costs and extended costs for each position. If so, will NCDIT issue a revised Furnish and Deliver Matrix?

Please price 2 individuals on a monthly amount based on the table provided.

3 Section 3.4, pp. 8–9, Specifications 1–10

The specifications include NCDIT-wide walkthroughs, annual tabletop exercises, a partial recovery exercise, review of departmental DR playbooks, development of an integrated NCDIT DR Plan and sequencing plan, Steering Committee recommendations, monthly meetings, and periodic reporting. Please confirm whether NCDIT expects these requirements to be fulfilled by one contractor resource or by a contractor-provided team.

This is a vendor driven answer, based upon limited funding for these activities.

As these activities are not all due at one time and are spread throughout the contract period. One individual or two can share this workload within the contract period.

https://it.nc.gov/resources/statewide-it-procurement-office

Solicitation Number: 41-2026 11AB Page 2 Addendum Number: 1

Rev. 2025.02

4 Section 3.4, pp. 8–9, Specifications 1–3

Specification 2 establishes an annual cadence for the tabletop exercise. Please confirm the required cadence for the walkthrough exercise under Specification 1 and the partial recovery exercise under Specification 3, including whether each is required once during the initial contract term or annually during each exercised contract year.

Normally this agency has two exercises each year, presently limited to mainframe services, however there is a need to expand to other departments within

NCDIT.

5 Section 3.4, p. 9, Specification 4

Please provide the approximate number of departmental DR plans, service-level playbooks, applications, systems, or other recovery documents expected to be included in the annual review and integrated NCDIT DR Plan.

At present there are 23 departments where some are cloud based or individual applications.

6 Section 3.4, p. 9, Specification 5

Please identify whether NCDIT currently maintains an application, system, and infrastructure inventory or dependency map that the contractor may use as a starting point for the sequencing plan.

Yes, NCDIT currently maintains an application, system, and infrastructure inventory or dependency map that the contractor may use as a starting point for the sequencing plan.

7 Section 3.4, pp. 9–12, Positions 1 and 2

Please identify the principal DR/BC tools and platforms currently used by NCDIT that the awarded contractor will be expected to use, assess, or integrate with, including applicable backup, replication, cloud recovery, monitoring, ticketing, GRC, or BCM systems. Please also clarify whether implementation of net-new tooling is within the contemplated scope.

There are no principal DR/BC tools and platforms currently used by NCDIT that the awarded contractor will be expected to use, assess, or integrate with, including applicable backup, replication, cloud recovery, monitoring, ticketing, GRC, or BCM systems. This initiative is not expected to implement any net-new tooling within the contemplated scope.

8 Section 3.8, p. 12

Section 3.8 states that individuals may work remotely but must brief on location once per month at 3700 Wake Forest Road. Please confirm whether physical attendance is mandatory for every monthly briefing or whether NCDIT may permit virtual attendance under appropriate circumstances.

There will be allowances for exceptions allowed on a case by case basis.

9 Section 3.5, p. 12

Section 3.5, Security Specifications, is marked “Reserved.” Please confirm whether contractor personnel will be subject to background investigations, confidentiality agreements, security-badge requirements, or system-access provisioning before beginning work. If so, please provide the anticipated requirements and onboarding timeline.

• State law § 143B-1379 mandates that agency liaisons—and by extension, staff performing technology roles—undergo criminal background checks through the State Bureau of Investigation, including fingerprinting; multi-state checks if they haven’t lived in-state for 5+ years. [it.nc.gov], [ncleg.gov]

• The Statewide Information Security Manual further reinforces personnel security controls aligned to NIST 800-53 (e.g., SCIO-SEC-307:

Identification and Authentication;

https://it.nc.gov/programs/privacy-data-protection/privacy-laws-policies-guidance https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_143B/GS_143B-1379.html

Solicitation Number: 41-2026 11AB Page 3

SCIO-SEC-313: Physical & Environmental Protection).

[it.nc.gov]

Conclusion: Yes, criminal background checks are required for contractor personnel assigned to state IT roles.

Conclusion: Contractors must sign confidentiality agreements as part of contractual compliance.

Conclusion: Badging is very likely required, especially if on-site access is involved; confirm specifics in RFP/modality.

10 Section 4.0, pp. 13–14

Please confirm the anticipated level of effort associated with each monthly unit, including whether each required position is expected to provide full-time services, such as 40 hours per week, or another specified allocation.

This is vendor/contractor driven based upon meeting vendor deliverables to NCDIT. There is an expectation for 40 hours a/week.

11 Section 3.4, p. 10, Position 1, Scope of Services

Position 1 includes providing guidance during actual recovery events. Please clarify whether the contractor is expected to provide after-hours, weekend, or on-call coverage; any required response times; and whether such support is included in the monthly unit cost or will be separately authorized and compensated.

All efforts are planned during normal business hours M-F 0800-1700 hours.

12 Sections 3.4 and 3.8, pp.

8–12

Please confirm the anticipated contract start date and identify any existing DR plans, business impact analyses, RTO/RPO inventories, prior exercise reports, risk assessments, or remediation registers that will be made available to the awarded contractor at the beginning of the engagement.

Contract start date is within 30 days, when during the first five days agency will make arrangements for sharing of available documents.

13 Section 2.15, pp. 6–7 — Financial Stability

Financial stability is identified as an evaluation criterion. Please specify whether vendors must submit particular financial documentation with the offer, such as financial statements, bank references, credit information, or other evidence of financial capacity.

For North Carolina procurement, when Financial Stability is listed as an evaluation criterion, the state generally requires vendors to demonstrate financial health through official documentation, typically including: Certification of Financial Condition and audited or reviewed financial statements (e.g., Balance Sheet, Income Statement, Cash Flow) — usually the most recent fiscal year.

14 Section 3.4, Pages 8–9 (Positions 1 and 2)

Section 3.4 lists two separate position descriptions — "Position 1" and

Thank you for highlighting this. To clarify:

https://it.nc.gov/programs/cybersecurity-risk-management/esrmo-initiatives/statewide-information-security-policies

Solicitation Number: 41-2026 11AB Page 4

"Position 2" — both titled "Information Technology Disaster Recovery (ITDR) Systems Analyst" with substantially overlapping scope. Please confirm: is this solicitation seeking one (1) ITDR Systems Analyst position, or two (2) separate/concurrent positions? If two, please clarify how the scope, deliverables, and pricing differ between Position 1 and Position 2.

• The solicitation is indeed requesting two (2) separate and concurrent ITDR Systems Analyst positions—Position 1 and Position 2.

• These are not duplicates: each role will support distinct yet overlapping ITDR functions. We plan to differentiate them based on specialization, workload and cross-cover requirements.

To support your proposal, we will shortly provide:

1. Role Definition Matrix – This will outline specific responsibilities, skill requirements, and expected deliverables for each position (e.g., Position 1 focused on orchestration & tool administration; Position 2 focused on DR planning, testing, and documentation).

2. Pricing Guidance – Including expectations around level of effort and pricing tiers, enabling you to properly itemize for each role.

3. Performance Metrics & Reporting Requirements – Specific goals or SLAs tied to each role.

ADDENDUM X – Clarification of Section 3.4: ITDR Systems Analyst Positions

This addendum is issued to clarify the intent of Section 3.4 of the solicitation regarding “Position 1” and “Position 2,” both titled Information Technology Disaster Recovery (ITDR) Systems Analyst.

Solicitation Number: 41-2026 11AB Page 5

1. Number of Positions Required The State confirms that the solicitation is seeking two (2) separate and concurrent ITDR Systems Analyst positions. Each position is staffed independently and is expected to operate in parallel throughout the engagement.

2. Distinction Between Position 1 and Position 2 While both roles share core disaster recovery responsibilities, they are intentionally defined as separate positions to support different functional areas within the ITDR workstream.

Vendors must propose and price each position independently. The expected differentiation is as follows:

Position 1 – ITDR Systems Analyst (Resiliency Architecture & Platform Operations) Primary focus areas include:

• Analysis, configuration, and management of DR platforms, tools, and automation systems

• Coordination with infrastructure, cloud, and network teams to ensure DR platform readiness

• Engineering support for DR orchestration, runbook automation, and failover tooling

• Development of technical DR procedures, scripts, and system-level resiliency configurations

• Support for DR testing events with emphasis on tooling, systems integration, and platform performance Deliverables and pricing should reflect a heavier emphasis on technical depth and platform operations.

Position 2 – ITDR Systems Analyst (Planning, Testing & Agency

Solicitation Number: 41-2026 11AB Page 6

Coordination) Primary focus areas include:

• Disaster recovery planning, documentation, and maintenance of DR plans and runbooks

• Coordination with agencies and application owners on DR readiness, test planning, compliance reviews

• Execution and facilitation of DR exercises, reporting of results, and tracking remediation activities

• Support for risk assessments, RTO/RPO validation, and business-impact–driven DR requirements

• Process development and continuous improvement of DR governance practices Deliverables and pricing should reflect a heavier emphasis on planning, coordination, documentation, compliance tracking, and cross-agency engagement.

3. Pricing Guidance Vendors must provide separate pricing for Position 1 and Position 2. If a vendor proposes the same rate for both positions, the vendor must clearly indicate this in the pricing section. The State reserves the right to award one or both positions to the same vendor or to different vendors.

4. Proposal Submission Requirements Vendors must submit:

• Two independent resumes (one per position)

• Two separate role descriptions identifying how the proposed personnel align with the scope above

• Separate pricing entries

• Any assumptions related to staffing availability or role overlap

5. Effect of This Addendum Except as specifically modified above, all

Solicitation Number: 41-2026 11AB Page 7 terms, conditions, and requirements of the original solicitation remain unchanged.

15 Section 4.0, F&D Matrix, Pages 13–14 The F&D Matrix lists Qty 12, Unit "month," for both Year 1 and Year 2.

Please confirm this represents one (1) FTE for 12 months per year (i.e., a monthly billing rate for a single analyst), rather than 12 separate units/positions. If it reflects something other than a single FTE billed monthly, please clarify the intended staffing quantity.

The F&D Matrix represents the total monthly cost for effort, 2 personnel. The FTEs aren’t priced separately.

16 Section 4.0, F&D Matrix Please confirm whether Vendors should propose a single blended monthly rate covering all responsibilities in Section 3.4 (Items 1–10), or whether a more granular/itemized cost breakdown is expected as part of the Total Offer Cost.

The F&D Matrix represents the total monthly cost for effort, 2 personnel. The FTEs aren’t priced separately.

17 General — no reference section identified

The RFP Lite does not appear to include a stated requirement for vendor references. Please confirm whether references (e.g., number required, relevant time period, comparable engagement type) are required as part of the offer, and if so, where in the response they should be included.

References aren’t required.

18 General — no past performance section identified

Similarly, the RFP Lite does not specify a past performance submission requirement. Please confirm whether Vendors are expected to submit past performance narratives/documentation (e.g., similar DR/BC engagements) as part of the offer, and if so, the expected format and page limit.

Past Performance isn’t required.

19 Section 2.15, Page 6 (Evaluation Criteria)

The evaluation criteria are listed in order of importance (conformance, comparative offer quality, Total Cost of Ownership, schedule/timeline, financial stability) but no point values or weighting percentages are provided. Please confirm whether a scoring rubric or point allocation exists, or whether evaluation is qualitative/ranking-based only.

There is no point evaluation system.

Solicitation Number: 41-2026 11AB Page 8

20 Section 3.9, Page 12 (Contract Term)

Please confirm the anticipated effective/start date of the contract, given the offer opening date of 09/03/2026, to help Vendors plan staffing availability.

We are unable to confirm the start date at this time.

21 Section 3.2, Pages 7–8 (Offshore Disclosure)

Please confirm whether Attachment F (Disclosure Statement) must be submitted even if the Vendor certifies that 100% of work will be performed within the United States (i.e., "No" to offshore work), or if the attachment is only required when offshore work is contemplated.

Disclosure statement must be completed.

22 Section 3.8, Page 12 (Delivery/On-site

Requirement)

Please confirm the expected format of the required monthly on-site briefing at 3700 Wake Forest Road, Raleigh, NC — e.g., is this a specific standing meeting, or may it be scheduled flexibly within a given month?

The intent is to have scheduled monthly meetings on site and may at times be rescheduled as agency necessarily.

23 Section 3.4, Pages 8–9 (Positions 1 and 2)

Section 3.4 lists two separate position descriptions — "Position 1" and "Position 2" — both titled "Information Technology Disaster Recovery (ITDR) Systems Analyst" with substantially overlapping scope. Please confirm: is this solicitation seeking one (1) ITDR Systems Analyst position, or two (2) separate/concurrent positions? If two, please clarify how the scope, deliverables, and pricing differ between Position 1 and Position 2.

Answered above

24 Section 3.4, Positions 1 and 2; pages 9 and 11

Are you seeking two full-time consultants for the term of this engagement?

See section 14.

25 Section 3.4, 2 Scope of Services; pages 10 and

Do you have documented a DR Plan or Plans? If so, how many? If so, when was it/they published? If so, how often is it/they updated?

There are various DR plans in various stages that are updated yearly.

Section 3.4, 2 Scope of Services; pages 10 and

Has a Business Impact Analysis been completed to find out what the DR Plan’s dependencies are? If not, do you want one undertaken?

There is a need for a BIA as there are DR sequencing documents as well as playbooks available to begin launching NCDIT DR maturity.

Section 3.4, 2 Scope of Services; pages 10 and

How many IT systems and applications need to be assessed?

There are over 20 various systems.

Programs, applications, and cloud systems to be addressed. There may be additional IT systems as this process matures, Section 3.4, 2 Scope of Services; pages 10 and

How many people should participate in the tabletop exercises?

These numbers may vary, however no more than 20 are expected. These numbers could increase or decrease based upon DR maturity.

Section 3.4, 2 Scope of Services; pages 10 and

How often would you like tabletop exercises to be undertaken? The goal is one/two each calendar year.

Solicitation Number: 41-2026 11AB Page 9

Section 3.4, 2 Scope of Services; pages 10 and

Would the tabletop exercises take place in multiple locations? No.

Section 3.4, 3

Deliverables; pages 10 and 11-12

Regarding deliverables, how many system runbooks are subject to updating?

There could be 20-30 runbooks.

Section 3.4, 3

Deliverables; pages 10 and 11-12

Regarding deliverables, how many applications need to be mapped with their dependencies?

There are 20-30 IT systems, applications and cloud services that will require their mapping to be updated/validated.

Section 3.4, 3

Deliverables; pages 10 and 11-12

Regarding deliverables, how many system runbooks need to be updated? There could be 20-30 runbooks.

Section 3.4, 3 Deliverables; pages 10 and 11-12

Regarding deliverables, how much technical documentation needs to be reviewed?

There are various Dr Plans in various stages, 20-30 runbooks, and 10-20 Agency policies and procedural documents, however these numbers can increase based upon DR maturity.

Section 3.4, 2 Scope of Services; pages 10 and

Do you know approximately how many critical applications need to be inventoried?

There are 20-30 IT systems, applications and cloud services that will require their mapping to be updated/validated.

Section 4.0, pages 13-14 Is travel able to be reimbursed? There is no travel expected within this project.

RFP Sections 1.0 and 3.4; pp. 3, 8-10

Does NCDIT currently have an established enterprise-wide Disaster Recovery Program? If so, what is its current maturity level?

NCDIT requires enterprise-wide Disaster Recovery Program. Existing program is unmature at this stage.

RFP Sec. 3.4, Item 4; p.

It does seem that a Disaster Recovery Plan and BC Plan currently exist? If yes, when was it last updated, audited, reviewed and tested? Is there one DR plan or multiple for each department/division?

All plan documents and playbooks are reviewed yearly, NCDIT requires a single DR plan supporting all departments and divisions.

RFP Sec. 3.4, Item 4; p.

How many departmental Disaster Recovery plans/playbooks currently exist across NCDIT?

There are various Dr Plans in various stages, 20-30 runbooks, and 10-20 Agency policies and procedural documents, however these numbers can increase based upon DR maturity.

RFP Sec. 3.4, Items 1 and 4; pp. 8-9

Are departmental DR plans standardized under a common framework or independently developed by individual departments?

• NCDIT’s Enterprise Approach for IT Business Continuity Management provides a standardized, centrally managed platform and methodology for agencies to develop and maintain DR plans. [it.nc.gov]

• Executive branch agencies are required to submit IT business continuity and DR plans yearly through this centralized system, implementing consistent policy and structure across all department DR plans are not independently developed by individual departments;

https://it.nc.gov/programs/cybersecurity-risk-management/esrmo-initiatives/enterprise-approach-it-business-continuity-management

Solicitation Number: 41-2026 11AB Page 10 they are structured under a centralized enterprise framework.

• Agencies use a shared BCM platform, adhere to agency-wide standards, and receive ESRMO oversight—resulting in consistent, statewide resilience planning.

RFP Sec. 3.4, Item 9; p.

Has NCDIT conducted a prior Disaster Recovery maturity assessment? If so, will the results be made available to the selected vendor?

Disaster Recovery maturity assessment needs to be accomplished.

RFP Sec. 3.4 and

Position 1 Scope; pp. 8-

Are there known deficiencies, audit findings, or gaps that prompted this solicitation?

No, this is a NCDIT driven requirement to meet all State and federal guidelines and regulations.

RFP Sec. 3.4, Item 6; p.

Does a Disaster Recovery Steering Committee currently exist? No.

RFP Sec. 3.4, Item 6; p.

If a steering committee exists, who currently participates? N/A

RFP Sec. 3.4, Items 2 and 6; pp. 8-9

Is there an executive sponsor currently assigned to the Disaster Recovery Program?

Executive-Level Sponsorship

• State Chief Information Officer (CIO) serves as the executive sponsor for DR and business continuity under state statute:

o North Carolina General Statute 143B-1331 requires that the State CIO oversee creation, review, and approval of agency disaster recovery plans.

[ncleg.net] o The Business Continuity Management Services team operates in support of the State CIO, ensuring enterprise-wide resiliency and continuity planning

RFP Sec. 3.4, Items 1, 2 and 6; pp. 8-9

Are DR governance policies, standards, and escalation procedures already documented, approved and in place?

Yes, DR governance under NCDIT is fully documented, standardized, and implemented statewide. It includes formal policies, centrally managed https://www.ncleg.net/EnactedLegislation/Statutes/PDF/BySection/Chapter_143B/GS_143B-1331.pdf

Solicitation Number: 41-2026 11AB Page 11 documentation, annual compliance reviews, and established escalation processes—ensuring consistency and oversight across all departments.

RFP Sec. 3.4, Items 8-9;

p. 9

Does NCDIT currently maintain DR readiness metrics and reporting dashboards?

Yes, DR governance under NCDIT is fully documented, standardized, and implemented statewide. It includes formal policies, centrally managed documentation, annual compliance reviews, and established escalation processes—ensuring consistency and oversight across all departments.

RFP Position 1 Scope and Deliverables; pp. 9-

Are current playbooks/ runbooks, architecture diagrams, recovery procedures, and dependency maps already available for contractor review?

Yes.

RFP Position 1 Deliverables; p. 10

Has a DR-specific risk assessment been completed within the last 24 months?

The State confirms that a Disaster Recovery–specific risk assessment has been completed within the past 24 months. As part of NCDIT’s enterprise Business Continuity Management (BCM) program, executive-branch agencies undergo annual updates of their business continuity and disaster recovery plans, which include required risk analysis, contingency planning, and mitigation reviews aligned with the Statewide Information Security Manual and statutory mandates. This annual cycle ensures that DR risk assessments remain current, consistently evaluated, and fully integrated into statewide resiliency governance.

RFP Position 1 Scope and Deliverables; p. 10

Will existing audit reports, risk assessments, and continuity documentation be made available to the awarded vendor?

Yes.

RFP Position 1 Scope; p.

10; Position 2

Deliverables; p. 12

Approximately how many discrete applications, databases, platforms, infrastructure systems, and related components are within the scope of this engagement?

There are 20-30 IT systems, applications and cloud services that will require their mapping to be updated/validated.

RFP Position 1

Qualifications and Scope; p. 10; Position 2

What hosting models and cloud environments currently support the in-scope systems, including internally

There are 20-30 IT systems, applications and cloud services that will require their mapping to be updated/validated.

Solicitation Number: 41-2026 11AB Page 12

Scope and Qualifications; pp. 11-12 hosted, externally hosted, private cloud, public cloud, and hybrid environments (for example, Azure or

AWS)?

RFP Position 1 Scope and Qualifications; p. 10;

Position 2 Scope and Qualifications; pp. 11-12

How many data center and hosting locations are included within the project scope, and how many are NCDIT-operated on-site facilities versus colocation, cloud, or other externally hosted locations? Have you run testing or have plans with your third party hosting providers as well?

There are 2 state data centers as well as two vendors supporting data centers.

There are 20-30 IT systems, applications and cloud services that will require their mapping to be updated/validated. External MFaaS vendors complete their validation each year without any NCDIT engagement.

RFP Position 1 Scope; p.

What backup platforms and technologies are currently deployed?

This will be discussed when the selected vendor is on-boarded.

RFP Position 1 Scope; p.

What replication technologies and DR tools are currently utilized?

This will be discussed when the selected vendor is on-boarded.

RFP Position 1 Scope; p.

10; Position 2 Purpose and Scope; p. 11

Does NCDIT maintain a secondary recovery site or alternate processing location? If so, where and how is the current disaster recovery environment hosted (for example, a secondary data center, colocation facility, cloud platform, or hybrid environment)?

There are 2 state data centers as well as two vendors supporting data centers.

There are 20-30 IT systems, applications and cloud services that will require their mapping to be updated/validated. External MFaaS vendors complete their validation each year without any NCDIT engagement.

RFP Position 1 Scope; p.

Is the awarded vendor expected to recommend new technologies, implement technologies, or both?

Who will be responsible for making any updates to the configuration, technology is that vendor selected or NCDIT team members that will work alongside the vendor?

There are no expectations for vendors to recommend new technologies or implement any new technologies. Agency responsible for any new configurations or changes within this agency.

RFP Sec. 3.4, Item 3; p.

Have Recovery Time Objectives (RTOs) already been established for critical systems?

Yes, will be discussed with selected vendor once on-boarded.

RFP Sec. 3.4, Item 3; p.

Have Recovery Point Objectives (RPOs) already been established for critical systems?

Yes.

RFP Sec. 3.4, Item 3; p.

Is the contractor expected to validate existing RTOs and RPOs or create them where they do not currently exist?

The intent is to validate existing documented RTO/RPO’s.

RFP Sec. 3.4, Item 2; pp.

8-9 When was the most recent tabletop exercise conducted? Over 12 months ago.

RFP Sec. 3.4, Item 3; p.

When was the most recent technical recovery exercise or failover test conducted?

Over 12 months ago.

RFP Position 1

Deliverables; p. 10 Will prior testing reports, corrective actions, and lessons learned be made available?

Yes.

Solicitation Number: 41-2026 11AB Page 13

RFP Position 1

Deliverables; p. 10 Has a DR-specific risk assessment been completed within the last 24 months?

To be discussed with selected vendor.

RFP Position 1 Scope and Deliverables; p. 10

Will existing audit reports, risk assessments, and continuity documentation be made available to the awarded vendor?

Yes.

RFP Position 1 Scope; p.

10; Position 2

Deliverables; p. 12

Approximately how many discrete applications, databases, platforms, infrastructure systems, and related components are within the scope of this engagement?

There are 20-30 IT systems, applications and cloud services that will require their mapping to be updated/validated.

RFP Position 1 Qualifications and

Scope; p. 10; Position 2 Scope and

Qualifications; pp. 11-12

What hosting models and cloud environments currently support the in-scope systems, including internally hosted, externally hosted, private cloud, public cloud, and hybrid environments (for example, Azure or

AWS)?

There are 20-30 IT systems, applications and cloud services that will require their mapping to be updated/validated.

RFP Sec. 3.4, Item 3; p.

Have prior DR exercises successfully achieved established RTO and RPO targets?

Yes.

RFP Position 2 Scope; p.

Are there currently outstanding remediation items related to previous DR /BC testing activities?

This will be discussed with the selected vendor.

RFP Sec. 3.4, Item 3; p.

For the required partial recovery exercise, can NCDIT specify the number of systems involved, test objectives, test environment, and whether production or non-production systems are in scope?

There are 20-30 IT systems, applications and cloud services that will require their mapping to be updated/validated.

RFP Sec. 3.4, Item 2; pp.

8-9 How many tabletop exercises does NCDIT expect the vendor to conduct annually?

The expectation is to complete 2 tabletops annually.

RFP Position 1 Scope and Deliverables; p. 10

Is the selected vendor responsible only for exercise facilitation, or also for test execution, documentation, reporting, and remediation planning?

Yes, exercise facilitation, documentation, reporting, and suggested remediation planning.

RFP F&D Matrix; pp. 13-

The pricing schedule identifies an IT Disaster Recovery Systems Analyst.

Is NCDIT seeking one dedicated resource or a team-based delivery model?

See section 14.

RFP Positions 1-2 and F&D Matrix; pp. 9-14

Is the expected level of effort full-time, part-time, or based upon project milestones?

See section 14.

RFP F&D Matrix; pp. 13-

What estimated number of hours per month should vendors assume for pricing purposes?

See section 14.

RFP Position 1 Scope; p.

Will NCDIT provide internal resources to support interviews, documentation reviews, plan development, and testing activities?

Yes, NCDIT will assist with internal resources.

Solicitation Number: 41-2026 11AB Page 14

RFP Sec. 3.4, Items 1-2;

pp. 8-9 Are departmental DR coordinators already identified within each business unit?

Yes.

RFP Position 1 Scope; p.

10; Position 2 Scope; p.

How many NCDIT personnel currently support the in-scope systems and Disaster Recovery Program, and how is the awarded vendor expected to integrate with those personnel?

There are internal resources identified to assist the selected vendor with this initiative.

RFP Terms, Transition Assistance; p. 26

Is there an incumbent contractor, consultant or NCDIt team members currently providing DR-related support services? If so, will transition knowledge be available?

There are internal resources identified to assist the selected vendor with this initiative.

RFP Sec. 3.4, Items 4 and 8-9; p. 9

Are templates available for DR plans, departmental playbooks, runbooks, risk assessments, quarterly reports, and annual reports?

There are documents that will be shared with the selected vendor.

RFP Positions 1-2

Deliverables; pp. 10-12 Are deliverables expected to follow a specific NCDIT format or methodology?

This will be discussed with the selected vendor.

RFP Positions 1-2 Deliverables; pp. 10-12

What repository or platform should be used for final documentation (e.g., SharePoint, ServiceNow, Archer, or another platform)?

NCDIT used ServiceNow and SharePoint resources.

RFP Position 1

Deliverables; p. 10 What level of detail is expected for application and infrastructure dependency mapping?

This will be discussed with the selected vendor.

RFP Positions 1-2 Scope; pp. 10-11

Does NCDIT expect the vendor to create documentation from scratch, update existing documentation, or perform both activities?

This is dependent on what documentation gaps exist and what documentation is needed for this initiation of building a DR maturity program.

RFP Position 2 Purpose/Scope; p. 11

Following delivery, will the contractor be responsible for maintaining documentation throughout the contract period?

No, all documentation will be maintained at the agency’s location.

RFP Position 1 Qualifications; p. 10

Has NCDIT formally adopted NIST SP 800-34, ISO 22301, or another DR/BC framework as its standard?

CIO policy is compatible with NIST SP 800-34 concepts because both rely on NIST SP 800-53 CP controls.

However, SCIO policy:

• does not formally adopt NIST SP 800-34;

• does not include its detailed lifecycle methodology;

• focuses on state-specific compliance requirements rather than federal-level procedural completeness.

Solicitation Number: 41-2026 11AB Page 15

RFP Position 1 Scope; p.

Are there specific regulatory, audit, or statutory mandates driving this project?

No, not at this time.

RFP Position 2 Scope; p.

Are there existing compliance findings that must be remediated under this engagement?

No, not at this time.

RFP Position 2 Scope; p.

Will compliance artifacts and prior audit reports be provided to the contractor?

Yes

RFP F&D Matrix; pp. 13-

Should pricing be based on a fixed monthly fee, fixed annual fee, labor rate, milestone-based deliverables, or another structure?

Please provide pricing as the pricing table indicated.

RFP Position 1 Scope; p.

Are after-hours, weekend testing, or emergency support activities expected under the proposed pricing structure?

No expectations.

RFP Sec. 1.0, Intent, Use, Duration and

Scope; p. 3; Sec. 3.9, Contract Term; p. 12;

Terms, Transition Assistance; p. 26

Please clarify the anticipated support model following the initial 12-month term, including the approval process for exercising the optional second year and whether NCDIT envisions a longer-term, three- to five-year support horizon after the potential 24-month engagement.

Presently funded for year one, waiting on approval for year two.

RFP Position 1 Scope; p.

Are vendors expected to include implementation assistance for DR technology platforms within the proposed pricing?

No.

RFP Position 1 Scope and Deliverables; pp. 9-

10; Position 2 Scope and Deliverables; pp. 11-12;

Terms, Transition Assistance; p. 26

Is the selected vendor expected to train NCDIT personnel to assume responsibility for this work following the initial 12-month term or optional extension through 24 months? If so, what knowledge-transfer deliverables are expected?

No training requirements.

RFP Position 1 Scope and Deliverables; pp. 9-

10; Position 2 Scope and Required Qualifications;

pp. 11-12

Does NCDIT expect the vendor to provide a dedicated technical writer as part of the project team, or will NCDIT assign technical-writing support to collaborate with the technical team?

NCDIT will assist with technical writing outside this scope, expecting vendor to provide needed documentation.

RFP Sec. 3.4, Items 1-9;

pp. 8-9; Position 1

Scope; p. 10

Approximately how many personnel are within NCDIT and potentially covered by the Disaster Recovery Program?

Information will be provided to selected vendor.

RFP Sec. 3.4, Items 1-5;

pp. 8-9; Position 1 Scope; p. 10

Approximately how many constituents use the in-scope systems or depend on their continued availability?

Information will be provided to selected vendor.

RFP Position 1 Scope; p.

10; Position 2 Scope; p.

When did NCDIT most recently activate or execute its disaster recovery procedures for an actual disruptive event, and which systems or services were involved?

Information will be provided to selected vendor.

Solicitation Number: 41-2026 11AB Page 16

Failure to acknowledge receipt of this addendum may result in rejection of the response Check ONE of the following options:

☐ A response was submitted prior to this Addendum. An updated response has been submitted to address the changes resulting from this Addendum.

☐ A response was submitted prior to this Addendum. NO CHANGES have resulted from this Addendum.

☐ A response was not submitted prior to this Addendum. ANY CHANGES resulting from this Addendum are included in our response.

ALL OTHER TERMS AND CONDITIONS REMAIN THE SAME

Execute Addendum:

Offeror:

Authorized Signature:

Name and Titled (Typed):

Date:

RFP Position 1 Scope and Deliverables; pp. 9-

10; Terms, Force Majeure; p. 23

During Hurricane Helene, did NCDIT activate any disaster recovery or business continuity procedures? If so, please describe the affected systems, recovery actions, outcomes, and lessons learned that should inform this engagement.

Information will be provided to selected vendor.