6-Backup Disaster and Recovery Solution (RFP 2026-0003).pdf

REQUEST FOR PROPOSAL

FOR

Backup Disaster and Recovery (BDR) Solution

(RFP 2026-0003)

PROPOSAL SUBMITTAL DEADLINE

5:00 P.M. (EST)

Thursday, February 12, 2026

LOCATION:

SAVANNAH AIRPORT COMMISSION

400 AIRWAYS AVENUE

SAVANNAH, GA 31408

REQUEST FOR PROPOSAL

Backup and Recovery (BDR) Solution (RFP) 2026-0003

PURPOSE OF PROPOSAL

The Savannah Airport Commission (SAC) is soliciting proposals from qualified firms to provide a comprehensive Backup and Disaster Recovery (BDR) Solution that ensures the protection, availability, and recoverability of critical systems and data. The solution should support both local and cloud-based backups, offer rapid recovery capabilities, and include strong security, compliance, and testing features.

The selected provider will be responsible for furnishing all equipment, labor, management, materials, and infrastructure necessary to deliver a reliable, secure, and high-quality BDR Solution to the Savannah Airport Commission. Participation in this RFP process is at the sole expense of the proposer. Any costs incurred during proposal preparation or submission will not be reimbursed by the Commission.

Proposals for the Backup Disaster and Recovery Solution will be received by the Savannah Airport Commission until 5:00 P.M. (EST), February 12, 2026, at which time they will be opened by the Commission’s Purchasing Manager, whose contact information is below. All responses to this proposal must be submitted through https://savannahairport.bonfirehub.com/, and will not be accepted via email or mail.

Christy Dixon Purchasing Manager cdixon@flySAV.com

TABLE OF CONTENTS

Airport Overview pg. 3 RFP Timeline pg. 4 Contract Terms pg. 5 Scope of Services pp. 5-7 Submittal Instructions pp. 7-10 Required Forms pg. 11 Evaluation Criteria & Award pp. 12-14 https://savannahairport.bonfirehub.com/ mailto:cdixon@flySAV.com

Request for Proposals Backup Disaster and Recovery (BDR) Solution (RFP 2026-0003)

For Savannah Airport Commission

Airport Overview

The Savannah/Hilton Head International Airport (the “Airport”) is operated by Savannah Airport Commission, a public body corporate organized under the laws of the State of Georgia (Georgia Code L-1952, Section 13) (“Commission”), and an operating agency of the City of Savannah. Commission consists of five members, appointed by the Mayor and Aldermen of the City of Savannah, for a term of five years.

The Commission is responsible for the improvements, maintenance, and operation of the Airport, and it is authorized to enter into contracts for the rental of buildings, land, office space and other property; to adopt rules and regulations for the operation of the Airport; and to have control, custody and direction of all lands, properties and improvements affixed thereto by the actions of the General Assembly, and to have general direction of the same. The Commission meets monthly, usually at 9:00 a.m.

on the first Wednesday of each month, in the Commission Conference Room, located on the third floor of the terminal building at 400 Airways Avenue, Savannah, Chatham County, Georgia. The Commission acts by and through its Executive Director and staff on all matters pertaining to the management and operations of the Airport.

The Airport is a 3,681-acre site located approximately eight miles northwest of the business district of Savannah, only 45 minutes from Hilton Head Island, South Carolina, and less than two hours from the Golden Isles at Brunswick or Charleston, South Carolina. The following major airlines serve the airport: Allegiant Air, American Airlines, Avelo Airlines, Breeze Airways, Delta Air Lines, Frontier Airlines, JetBlue Airways, Southwest Airlines, Sun Country Airlines, and United Airlines. Collectively these airlines, along with affiliated regional air carriers, transported approximately 4.1 million passengers in 2024.

RFP Timeline Summary:

The Commission reserves the right to modify this timeline at any time.

Contact Person: Christy Dixon E-mail: CDixon@flySAV.com

Non-Mandatory Preproposal Meeting Information

A non-mandatory Pre-Proposal Meeting will be held on January 14, 2026, at 1:00 PM (EST) at the following location:

Savannah Airport Commission 640 Gulfstream Road Savannah, GA 31408

All interested proposers are encouraged to attend. For those who wish to participate virtually, a Microsoft Teams option will be available. Please RSVP if you plan to attend in person or virtually with Melanie Freeman via email (as shown below) no later than 5:00 PM (EST) on January 13, 2026.

������� Email: mfreeman@flysav.com

Questions: All questions must be submitted through https://savannahairport.bonfirehub.com/, and will not be accepted via email or mail. All questions must be submitted no later than January 20, 2026, by COB (5:00pm EST). All responses to questions will be provided through https://savannahairport.bonfirehub.com/ in an addendum by the date noted on this document.

Deadline for Submitting Proposals: February 12, 2026, by COB (5:00pm EST)

Submittal Information: All responses to this proposal must be submitted through https://savannahairport.bonfirehub.com/, and will not be accepted via email or mail.

RFP Timeline:

ISSUE DATE: December 29, 2025

NON-MANDATORY PRE-PROPOSAL MEETING January 14, 2026

WRITTEN QUESTIONS/COMMENTS DUE DATE: January 20, 2026

LAST ADDENDUM RELEASED: January 28, 2026

RFP RESPONSE DUE DATE: February 12, 2026

NOTIFICATION OF AWARD DECISION TO BIDDERS: NLT April 15, 2026 mailto:CDixon@flySAV.com mailto:mfreeman@flysav.com https://savannahairport.bonfirehub.com/

Contract Term and Renewal

The Commission seeks an initial contract term of three (3) years, with two (2) optional three-year renewal periods. Either the initial term or any renewal period may be terminated with thirty (30) days’ prior written notice. The Commission may adjust contract specifics between renewal periods to accommodate changing requirements, including, but not limited to, increased storage needs or expanded DRaaS coverage.

If the Commission exercises its renewal option, all terms, conditions, and provisions of the original contract shall remain in effect, unless amended in writing. Any adjustments to compensation or other contractual provisions resulting from such modifications will be documented through a formal amendment. All renewals and amendments are at the sole discretion of the Commission.

Convenience Termination of Contract

The Commission reserves the right to terminate the Contract, in whole or in part, at any time if it determines that such action is in its best interest. Termination may be initiated with or without cause, including but not limited to unsatisfactory performance by the service provider.

In such an event, the Commission will provide the service provider with thirty (30) days’ written notice, specifying the effective date of termination. No penalties or termination fees shall be due to the service provider as a result of such termination.

Scope of Services

The selected provider shall deliver a comprehensive, secure, and scalable Backup, Disaster Recovery, and Storage solution that meets the operational, security, and compliance needs of the Savannah Airport Commission. The solution must be designed to safeguard critical data assets, ensure business continuity, and provide rapid recovery capabilities in the event of system failure, cyberattack, or disaster.

At a minimum, the provider’s services must address the following key areas:

1. Backup and Storage Architecture

2. Security and Compliance

3. Disaster Recovery and Testing

4. Management and Support

5. Vendor Qualifications

Each of these areas is further defined below to ensure alignment with the Commission’s requirements and industry’s best practices.

1. Backup and Storage Architecture

a. On-premises backup appliance with a minimum of 40 TB usable storage.

b. Immutable storage for all backup data, including on-premises, cloud, and SaaS workloads.

c. Offsite replication of backup data to a secure, vendor-managed cloud environment with appropriate compliance certifications (e.g., SOC 2 Type II).

d. Backup storage must be isolated from common network protocols (e.g., SMB/NFS) to reduce attack surface.

e. Backup infrastructure should not rely on traditional Windows or SQL Server components.

2. Security & Compliance

a. Multi-factor authentication (MFA) with support for time-based one-time passwords (TOTP).

b. A secure approval mechanism that prevents unauthorized or accidental changes to data lifecycle policies.

c. Architecture should follow Zero Trust principles.

d. Encryption of data in transit and at rest.

e. Support for secure credential management, including integration with Group Managed Service Accounts (gMSA) or equivalent.

f. Time synchronization mechanisms should be resilient to tampering (e.g., NTP poisoning).

g. Ability to meet government or industry compliance standards (e.g., FedRAMP) upon request.

3. Disaster Recovery & Testing

a. Disaster Recovery as a Service (DRaaS) coverage for all protected systems.

b. Enhanced DRaaS capabilities (e.g., 1-hour RTO) for at least three critical systems.

c. Automated backup integrity testing to ensure recoverability.

d. Scheduled disaster recovery testing, including non-disruptive failover to cloud environments with detailed reporting.

4. Management & Support

a. Centralized management console for monitoring and managing backups and disaster recovery operations.

b. Unified visibility across all protected environments (on-premises, cloud, SaaS).

c. 24x7x365 vendor support.

d. Scalable architecture to accommodate future data growth and infrastructure expansion.

e. Access to cybersecurity expertise or incident response services, either included or available as an add-on.

5. Vendor Qualifications

a. Demonstrated experience delivering BDR and DRaaS solutions to organizations of similar size and complexity.

b. Must own or directly manage the DRaaS cloud infrastructure.

c. Provide relevant client references.

Submittal Instructions

All responses to this proposal must be submitted through https://savannahairport.bonfirehub.com/, and will not be accepted via email or mail.

In order to provide a response to this proposal, all respondents must first register their company by using the above link. Registration is easy and free. Please be sure to select the NAICS codes associated with your business and/or organization. For questions regarding vendor registration or instructions on proposal submittal, please contact Melanie Freeman at mfreeman@flysav.com.

All addenda associated with this RFP will be provided through https://savannahairport.bonfirehub.com/ by the date noted on page 5 of this document. All questions must also be submitted through https://savannahairport.bonfirehub.com/, and will not be accepted via email or mail.

As required, it is the respondent’s responsibility to ensure that all addenda are acknowledged through submission of the Acknowledgement of Addendum Form.

Except as otherwise provided herein, proposals which are incomplete or which are not in conformance with the law, may be rejected as non‐responsive. Timely Proposals received will be subject to applicable laws and regulations governing public disclosure.

Submission of a Proposal indicates acceptance by the respondent of the conditions contained in this RFP, and the intent to enter into an Agreement with Commission.

Savannah Airport Commission reserves and may exercise the following rights and options: (i) to reject any and all proposals, negotiate with any respondent, alter the scope of work, to extend the date for submittal responses to request additional information from any Proposer, to supplement, amend or otherwise modify the RFP prior to the closing date and time, and reissue the RFP at any time prior to execution of a final agreement if, in Commission sole opinion, and best interest to do so; (ii) to https://savannahairport.bonfirehub.com/ mailto:mfreeman@flysav.com supplement, amend, substitute, or otherwise modify this RFP at any time prior to selection of one or more proposer for negotiation and (iii) to cancel this RFP with or without issuing another RFP; (iv) to reject the proposal of any proposer who, in the Commission’s sole judgment, has been delinquent or unfaithful in the performance of any contract with Commission is financially or technically incapable or is otherwise not a responsible responder; (v) To reject as informal or non-responsive, any proposal which, in Commission’s sole judgment, is incomplete, is not in conformity with applicable law, is conditional in any way, or deviates from the mandated requirements of the RFP and; (vi) to waive any informalities in the submission process, defect, non-responsiveness and/or deviation from this RFP that is not considered in the best interest and/or best value to Commission, at its sole judgment.

Any exceptions to the specifications included in this RFP must be clearly stated in the proposal.

Submittal Instructions: Organization of Submission

To ensure an efficient and consistent evaluation process, all proposals must be organized according to the format outlined below. Proposals that do not adhere to this structure or that lack the required documentation may be scored lower or deemed non-responsive, which may result in disqualification. In the event of any discrepancies or conflicts within the proposal documents, the Savannah Airport Commission reserves the sole right to determine the appropriate resolution.

Submit data as requested in the following sections: This section will be submitted in Bonfire under Table of Contents, per section (Tab A, Tab B, etc.) as noted below.

A. (Tab A) Cover/Letter of Interest:

Each proposal must have a Cover/Letter of Interest expressing the company’s interest in being considered for this opportunity while also summarizing the company’s qualifications and experience relevant to the scope of services. In addition, the letter will include the company’s information including mane of company (include any DBA names);

headquarters and parent company locations; and brief history of the company; Company’s mailing address, contact person, telephone number for primary contact person, and email address; and a principal or officer of the company authorized to execute contracts or other similar documents on the firm’s behalf must sign the letter.

B. (Tab B) Technical Compliance: Must meet all architectural, security, and DR requirements

a. Describe the proposed backup and storage architecture, including data immutability, isolation from common network protocols, offsite replication capabilities, scalability, and independence from traditional Windows/SQL components.

b. Provide details on Disaster Recovery as a Service (DRaaS) capabilities, recovery time objectives (RTOs), automated testing procedures, and approaches for non-disruptive failover and recovery validation.

C. (Tab C) Security and Compliance Features: Must include MFA, immutability, Zero Trust, encryption, gMSA, etc.

a. Explain how the solution adheres to Zero Trust principles, multi-factor authentication, encryption standards, credential management, and time synchronization safeguards. Proposers should also specify the compliance certifications supported (e.g., SOC 2 Type II, FedRAMP) and how they are maintained.

D. (Tab D) Disaster and Recovery Capabilities: Must include DRaaS coverage, testing, failover, Recovery Time Objective/Recovery Point Objective (RTO/RPO) guarantees.

a. Provide details on Disaster Recovery as a Service (DRaaS) capabilities, RTOs, RPOs, automated testing procedures, and approaches for non-disruptive failover and recovery validation.

E. (Tab E) Scalability & Future Readiness: Must have capability to grow with infrastructure and data needs.

Proposers must clearly demonstrate that their proposed solution is capable of scaling to meet the Commission’s anticipated growth in both infrastructure and data storage requirements. The response should address not only current capacity needs but also the ability to expand seamlessly without service disruption, costly re-architecture, or performance degradation.

At a minimum, proposers shall:

a. Describe how the solution supports incremental scalability in storage, compute, and disaster recovery capabilities.

b. Provide details on how the architecture accommodates growth in cloud, on-premises, and SaaS workloads.

c. Explain how the solution remains adaptable to evolving cybersecurity, compliance, and technology standards.

d. Highlight any built-in tools or features that proactively monitor capacity trends and support planning for future expansion.

E. (Tab F) Management & Usability: Must demonstrate that solution provides centralized, intuitive, and efficient management capabilities.

a. The proposed platform should enable administrators to manage backup, storage, and disaster recovery operations through a single, unified console with clear visibility across all protected environments, including on-premises cloud, and SaaS workloads.

G. (Tab G) Cost: Proposers must provide a comprehensive pricing proposal that clearly identifies all costs associated with the proposed solution.

a. Pricing shall be all-inclusive, covering all products, licensing, hardware, software, services, deliveries, installations, training, and any other expenses necessary to implement and maintain the solution as proposed. No additional or hidden fees will be accepted beyond the amounts specified in the proposal.

b. Proposers shall also outline any optional services or features separately, with clear pricing, to allow the Commission to assess total cost of ownership and scalability over time.

c. Provide multi-year pricing (e.g., 3–5 years) that includes both initial implementation and ongoing support/maintenance. Clearly state renewal rates and escalation caps, if any, to ensure cost predictability for the Commission.

Required Forms (Must Be Included in Response)

The following forms must be completed in full and submitted with the proposal:

1. Proposal Certification Form. This certifies that the Respondent has certain specific capabilities, and that the proposal accurately represents those capabilities.

2. Non-Collusion Affidavit Form. This certifies that the Respondent has not colluded, conspired, or engaged in any anti-competitive behavior in connection with the preparation or submission of this proposal.

3. Acknowledgement of Addendum Form. Please sign and acknowledge all addenda (if any) associated with this RFP.

4. Reference Forms. Please provide 3 business references. The references must include work associated with past, relevant contracts during the last five (5) years that relate to the proposer’s ability to perform the work outlined in this RFP.

Examples should include the relative size and complexity of other similar work. By including this list, the respondent grants permission to the Commission to contact this client list.

5. Local, Small Business/Minority Business Form. Please complete the Local, Small Business/Minority Business Form of this RFP. If your company does not have either designation, please check the box noted as non-applicable. If applicable, please complete the form in its entirety.

6. Exceptions Form. Please note in your response if there are any exceptions or additions to the requirements in this proposal. If there are exceptions noted on the requirements of this RFP, please notate the exceptions on the designated Exceptions Form next to the Scope of Services Requirement.

7. Pricing Form. Pricing shall be all-inclusive, covering all products, licensing, hardware, software, services, deliveries, installations, training, and any other expenses necessary to implement and maintain the solution as proposed. No additional or hidden fees will be accepted beyond the amounts specified in the proposal. Proposers shall also outline any optional services or features separately, with clear pricing, to allow the Commission to assess total cost of ownership and scalability over time. Provide multi-year pricing (e.g., 3–5 years) that includes both initial implementation and ongoing support/maintenance. Clearly state renewal rates and escalation caps, if any, to ensure cost predictability for the Commission.

Evaluation Criteria and Award

At Proposers’ own expense, Proposers may be selected to attend and interview with the evaluation committee to further present their qualifications. These presentations will provide the Proposer with the opportunity to clarify their Proposal and ensure a mutual understanding of the services to be provided and the approach to be used.

By submitting its Proposal in response to this proposal, respondents accept the evaluation process.

The Savannah Airport Commission reserves the right to reject any or all responses, delete any portion of the response, accept any response deemed most advantageous, or to waive and irregularities or informalities in the response received that best serves the interests and at the sole discretion of the Commission.

The respondent selected for an award will not necessarily be the lowest bidder.

Rather, the selection will be based upon the weighted criteria, responsiveness, and the most responsible and advantageous respondent for the Commission, as determined by the Commission in its sole discretion. SAC intends to award a contract, subject to the terms of this RFP, to the best overall valued firm. Firms will be prioritized based on experience and performance, current performance capability, fees, and other criteria as outlined in this document. The Commission anticipates that all firms will have a fair and reasonable opportunity to provide service. The Commission reserves the right to add/delete/modify criteria or times, via an addendum, if it is in the Commission’s best interest, as determined by the city in its sole discretion.

Evaluation Criteria Chart

Evaluation Upon selection of the most qualified Respondents, the Commission may require the finalists to make an oral presentation to the Evaluation Panel to further explain their proposals. If such interviews are conducted, the Commission’s evaluation of the presentations will also be factored into the evaluation of the proposals. However, Respondents are advised that award may be made without interviews or further discussion. The following process will be used to evaluate the proposals:

1. Initial Evaluation

Each Proposal received will first be evaluated for responsiveness. Each Proposal received will first be evaluated for responsiveness. Each proposal will also be evaluated to ensure that all required documents are submitted to meet SAC’s compliance as noted in this RFP (meets minimum requirements).

2. Evaluation Panel

The Commission will use a minimum of a three-person panel to evaluate each of the responsive proposals. The evaluation panel will evaluate the responsive proposals submitted and award points according to the Evaluation Points chart above.

Criteria Maximum Points

Factor Description

1 Technical Compliance 25 Meets all architectural, security, and DR requirements

2 Security & Compliance Features 20 Includes MFA, immutability, Zero Trust, encryption, gMSA, etc.

3 Disaster Recovery Capabilities 10 DRaaS coverage, testing, failover, RTO/RPO guarantees 4 Scalability & Future Readiness 10 Ability to grow with infrastructure and data needs 5 Management & Usability 10 Centralized console, visibility, ease of use

6 Experience & Past Performance 10

Experience in performing the scope of services will be reviewed and evaluated. Experience will be evaluated as it reflects the Respondent’s demonstrated ability to successfully conduct the required services with current and past references.

7 Cost 10 Competitive pricing, value for features offered.

8 Local, Small Business/Minority Business 5

Local, small businesses or minority companies will receive points in this area. A non-local, non-minority designation does not serve as disqualification for the award of this project.

All 100

PLEASE NOTE: No Respondent will be informed at any time during or after the RFP process as to the identity of any evaluation panel member. If a Respondent becomes aware of the identity of such a person(s), he/she will not make any attempt to contact or discuss with such person anything related to this RFP. The designated Contact person is the only person at Commission the Respondent’s will contact pertaining to this RFP. Failure to abide by this requirement may cause such Respondent(s) to be eliminated from consideration for award.

3. Best and Final Negotiations

Contract Award Procedure:

By completing, executing, and submitting the Respondent Certification, attached hereto, and incorporated by this reference, the “Respondent is thereby agreeing to abide by all terms and conditions pertaining to this RFP as issued by Commission.

If a Respondent is selected, Respondents will receive by e-mail a Notice of Results of Evaluation after a notice of award is issued. Such notice will inform the Respondents which Respondent has been selected to proceed with exclusive negotiations.

The Commission will evaluate the Respondents based on the above criteria and will select the most advantageous and best value to Commission. The chosen Respondent is recommended to enter into an agreement for the completion of services.

The Commission reserves the right to conduct a “Best and Final” negotiation at its sole discretion.

////////////////////////////////NOTHING FOLLOWS///////////////////////////////////