ADDENDUM 1 2001-25 Cloud Services 1.6.26.pdf

ADDENDUM # 1

2001-25 CLOUD SERVICES

Original Notice of RFP Issued on: November 6, 2025

Response Due Date: Thursday, January 15, 2026

1/6/2026

To All Prospective Bidders:

The purpose of this addendum is to provide answers to questions raised by a potential bidder.

1. What was the annual spend for the previous year on this Project? $120,000.

2. If this is a new Contract, What is the annual Budget for this? $150,000

3. Are you open to a hybrid delivery model with a mix of offshore and onshore resources?

Please clarify, I am not sure what this question is about.

4. Work will be onsite or remote. Remote

5. Is this contract intended to be awarded to a single vendor or to multiple vendors? One vendor

6. Who are previous incumbents on this project? Novus

1. I am writing to ask about the subcontractor requirements related to the Hartford Housing

Authority for RFP 1382 - 2001-25. We work with a company out of Florida to assist with staffing when we are short staffed. You must receive permission from the Authority prior to passing work on to a third party.

1.Are you looking for respondents to provide end-user support of the applications running within the

Server Hosting Environment? NO

a. If yes, it is expected that we also support the end-user’s workstation used to connect into the Server Hosting Environment?

b. Is there any end-user support you are looking for? No

2) The SPS mentions the environment must integrate with the client firewall. Does the authority desire to collocate a firewall in the same rack as the cloud hosting environment, or do you desire for respondents to include a firewall within the Server Hosting Environment solution? If the latter, what does the SPS mean by stating that the solution must integrate with the client firewall?

Include firewall within the hosting environment solution and integrate agency physical device i.e.

IPSec tunnels, firewall rules, NAT, routing policies, or SD-WAN integration

1. Can the Authority provide the expected number of employees that the contractor must maintain?

2. Does the Authority have a preferred cloud service provider (e.g., AWS) or preferred landing zone/architecture for hosting these services? No. However, Agency currently has a Microsoft 365 business premium license.

3. Will the Authority require offsite or geo-redundant backups? Yes.

4. Beyond Active Directory, are there any legacy applications requiring special configuration? No

What are the expected Recovery Time Objective (RTO) and Recovery Point Objective (RPO) for disaster recovery? At this time, the Authority has not defined specific numeric RTO (Recovery Time Objective) or RPO (Recovery Point Objective) requirements in the current SPS/RFP.

Respondents are expected to:

Propose their recommended RTO/RPO values based on industry best practices for a Server Hosting

Environment with disaster-recovery capability.

Explain how their proposed RTO/RPO supports operational continuity and data protection

Clearly specify whether the targets apply to:

• Full environment failover

• Critical systems only

• Backups, replication, or hybrid recovery approach

5. Should Infrastructure-as-a-Service (IaaS) costs be included in the pricing proposal, or will these be handled separately? Yes

6. Should proposals include cost models for scaling Remote Desktop Services licenses beyond the initial 50 users? No

- Does the customer have more information/specs on the environment to be migrated beyond what was listed in the RFQ?? At this time, no additional migration specifications or environment documentation beyond what is already listed in the RFQ is available.

Respondents are expected to:

• Base their proposals on the current RFQ scope only

Include discovery and assessment activities in their migration approach, if required for accurate sizing, dependency mapping, or planning

Clearly state any assumptions, constraints, or risks identified due to limited upfront environment detail

If a solution depends on deeper environment insights (e.g., application dependencies, server inventories, data volumes, network flows, or integration touchpoints), those should be treated as part of the respondent’s discovery phase, not as missing Authority-provided specifications.

7. - Is AWS a preferred CSP??No Preferences

8. - Want to clarify that this includes services too and not just IaaS quote?? Refer the RFQ

1. To accurately spec cloud platform instance types, will the housing authority accept proposals which exceed the specifications requested to conform to available cloud platform instance types?

Yes

The RFP does not outline CPU requirements, can the housing authority please specify CPU core count requirements for each server listed? Industry best practices for server hosting environments any sizing outcomes identified through their proposed discovery or assessment phase (if included)

Clearly document and justify the CPU configuration in their solution, including:

processor model/family core count per server or vCPU allocation

2. How many concurrent users does the housing authority expect to utilize the Remote Desktop

Services server? 50 Max

a. Does the housing authority operate more than 1 internet circuit? This will be necessary to determine the site-to-site VPN requirements for redundancy/failover? One per location

b. If yes, what make/model of firewall does the housing authority have in place currently?

SonicWALL NSA 2700 (main) and TZ470

3. Does the housing authority currently utilize Microsoft 365? If so, what license types are in place currently? Yes, 365 business premiums.

4. Will the housing authority require DUO MFA to be implemented on end-user devices, or only the servers noted in the project scope? End users

5. Will the housing authority utilize mobile app push notifications for DUO MFA or will the housing authority require hardware tokens? Both methods currently in used

a. If hardware tokens are expected to be used, can you please specify a quantity or if a unit price for tokens is acceptable? Not applicable now

I am writing to request clarification regarding the reference requirement in the solicitation. Specifically, we would like to confirm whether it is acceptable to submit key personnel experience and references instead of company-level references as part of our proposal submission.

Transition, Evaluation & Administration

1. Is there an incumbent provider, and will transition documentation be made available? transition documentation has not been published and is not currently available for distribution. Respondents should include discovery and knowledge transfer in their transition plan.

2. What is the expected transition timeline from award to steady-state operations? The Authority expects vendors to propose a realistic transition timeline from award to steady-state operations, including phased onboarding if required. No mandated timeline has been issued.

3. Are there defined cutover or blackout windows to avoid operational disruption? No predefined cutover or blackout windows have been formally issued. Vendors should propose cutover strategies that minimize operational disruption and identify recommended windows if needed.

4. Are references required to be public-sector only, or are comparable commercial references acceptable?

Comparable commercial references are acceptable, provided they demonstrate similar scope, scale, and compliance maturity. References are not required to be exclusively public-sector.

5. Will post-submission clarifications or discussions be allowed? Yes, the Authority may request clarifications after submission. Respondents should be prepared to support Q&A or provide additional detail if asked.

Data Residency & Funding Restrictions

1. Are all production data, backups, and logs required to remain hosted within the United States? Vendors should assume that all production data, backups, and logs will be hosted within the United States,

2. Are there HUD, state, or federal funding restrictions that prohibit use of offshore or foreign entities?

There are no broadly published HUD notices in this RFQ that authorize offshore or foreign entities for data hosting or administration. Vendors should avoid proposing offshore entities unless justified and flagged for approval.

3. Should vendors assume all services must be delivered domestically unless explicitly approved in writing? Yes, vendors should assume all services must be delivered domestically unless explicitly approved in writing.

4. Are there audit or reporting requirements tied specifically to data location or personnel location? No separate audit or reporting requirements tied specifically to personnel or data location have been issued beyond domestic delivery and U.S. data residency assumptions.

5. Are exceptions to location requirements ever permitted under this contract? Exceptions may be considered, but only if formally requested and approved in writing by the Authority.

Remote Work, Offshore & Location of Performance

1. Does the Authority permit fully remote administration and support, or is any on-site presence required?

Yes, the Authority permits fully remote administration and support. No on-site presence is required under current scope.

2. Are there requirements that support personnel be located within Connecticut or the United States?

Respondents should propose qualified support models. There is no mandate that staff reside in

Connecticut, but vendors should assume U.S.-based personnel for system administration.

3. Are offshore or non-U.S.-based personnel permitted to perform monitoring or administrative functions?

Offshore or non-U.S.-based personnel should not be assumed for system administration, monitoring, or status entry unless the vendor proposes it as part of a clearly restricted, compliance-safe role and flags it for approval.

4. If offshore resources are allowed, are there restrictions on data access, roles, or hours of operation? No formal offshore staffing model has been authorized, so vendors proposing offshore resources must define restricted roles, limited data access, time boundaries, and compliance controls for Authority review.

5. Are there citizenship, residency, or background check requirements for personnel with system access?

The RFP does not currently define required citizenship, but personnel with system access should be prepared to support:

✔ background checks

✔ role-based access controls

✔ least-privilege system access, all documented in the proposal.

Subcontracting & Staffing Model

1. Can the Authority clarify the approval process and timeline for proposed subcontractors? Vendors should propose their subcontractor approval workflow and timeline for Authority review. No mandated process has been issued.

2. Is there a minimum self-performance requirement for the prime contractor? No minimum self-performance percentage has been defined. The prime must retain full accountability for all services delivered.

3. Are subcontractors required to meet the same experience, insurance, and compliance standards as the prime? Yes, subcontractors must meet the same insurance, experience, and compliance expectations as the prime if they perform system-impacting functions.

4. Would a model where the prime retains full accountability while approved subcontractors perform portions of the work be acceptable? Yes, this model is acceptable, provided subcontractors are approved in writing and the prime retains full responsibility.

5. Are substitutions of subcontractors permitted after award with written approval? Permitted with written approval only.

Pricing & Contract Structure

1. Should pricing assume flat monthly fees, or is tiered or usage-based pricing acceptable within the firm fixed price model? Pricing should align to the firm fixed price model. Vendors may propose tiered or usage-based pricing if it fits within a predictable fixed price structure and is clearly defined.

2. How should vendors price future scaling for additional users, storage, or compute? Vendors should include:

unit pricing or bundled scaling bands for users, storage, and compute clearly stated assumptions for growth.

3. Are price adjustments allowed for Microsoft licensing or CSP cost changes during option years? No automatic price adjustments have been authorized. Any licensing or CSP price change impacts must be submitted for approval during option years.

4. Will the Authority evaluate price realism or only total evaluated cost? The Authority will evaluate total evaluated cost, and may consider price realism if clarification is needed.

5. Are there penalties or service credits associated with SLA failures? Not currently defined. Vendors may propose service credit or penalty models tied to SLA failures.

Service Levels & Support

1. Can the Authority define severity levels and response times beyond the stated 99.9% uptime SLA? Not currently defined beyond 99.9% uptime. Vendors should propose severity levels and response targets.

2. Is 24/7 live support required for all incidents or only for critical outages? 3. Are vendors expected to provide a dedicated service manager or named technical resources? Vendors should not assume 24/7 support for all issues. 24/7 live support may be proposed for critical outages only, as part of vendor-defined SLAs. vendors may propose dedicated or named roles.

4. Are monthly or quarterly service review meetings required, and should they be virtual or in person?

Vendors may propose monthly or quarterly virtual meetings

5. Are proactive performance tuning and optimization included in scope? Vendors should define whether optimization is included or optional.

Backup, Disaster Recovery & Continuity

1. Please confirm the required Recovery Point Objective (RPO) and Recovery Time Objective (RTO).

Respondents must propose and justify RPO/RTO

2. Is cross-region replication required, or is single-region backup sufficient? 3. Are disaster recovery tests required annually, and should these be included in fixed pricing? Vendors should define and justify replication strategy and include DR test pricing.

4. Does the Authority expect infrastructure-level restoration only, or full application-level recovery?

Vendor should specify recovery scope

5. Are backup retention periods beyond 30 days anticipated during the contract term? Not anticipated unless proposed by the vendor

Security, Compliance & Controls

1. Does FedRAMP alignment require use of FedRAMP Authorized CSP, or are FedRAMP-equivalent controls and documentation acceptable? The Authority has not mandated use of a FedRAMP Authorized

CSP. Vendors may propose FedRAMP-equivalent controls and documentation if clearly mapped and justified.

2. Are there specific cybersecurity frameworks or policies beyond those listed that vendors must comply with? Vendors should document compliance alignment.

3. Are annual penetration testing, vulnerability scans, or third-party security assessments required, and who is responsible for the cost? Vendors may propose testing schedules and identify cost ownership.

4. Are cybersecurity incident response and breach notification timelines defined elsewhere, or should vendors propose them? Vendors should propose incident response and breach notification timelines in their submission.

5. Is integration with an existing SOC, SIEM, or security tooling required or preferred? Integration with an existing SOC or SIEM is not mandated, but solutions that support compatibility with standard security tooling (e.g., EDR, API integration, or SIEM agent support) may be proposed and documented as part of the architecture.

Vendors should clarify whether their solution can integrate with common SOC/SIEM platforms if requested in the future.

Scope & Technical Environment

1.Can the Authority confirm the current number of production workloads, total VM count, and average

CPU, RAM, and storage utilization? The Authority cannot confirm numeric details at this time, including:

total VM count,average or current CPU, RAM, or storage utilization

Vendors should include environment discovery, dependency mapping, and workload assessment as part of their proposed migration methodology if accurate sizing is required

2. Are the listed servers (Domain Controller, Application Server, SQL Server, File/Print, RDS) deployed as separate virtual machines or combined roles? Are there any legacy applications or dependencies requiring specific Windows Server or SQL Server versions? Is any application modernization, replacement, or decommissioning planned during the base contract term? The listed servers (Domain

Controller, Application Server, SQL Server, File/Print, RDS) are currently deployed as separate virtual machines, each performing a distinct role.

No published inventory of legacy applications, version dependencies, or decommissioning plans has been issued within the RFQ.

Vendors should:

document any assumptions regarding required Windows Server or SQL Server versions based on workload role.

flag any risks tied to legacy application dependencies that may be uncovered during discovery.

define whether their solution supports in-place migration, phased modernization, or version-specific compatibility.

No formal modernization, decommissioning, or replacement plan has been authorized during the base contract term. If proposed, it must be design-driven and justified by the vendor.

3. Should vendors assume a single-tenant or multi-tenant cloud architecture, provided security requirements are met?

Vendors should assume a single-tenant cloud architecture, unless they propose a multi-tenant model that still meets all security, isolation, and compliance expectations, and clearly document:

• segmentation controls

• identity isolation

• network boundaries

• logging separation

• access restrictions

A multi-tenant approach is not prohibited, but must be fully explained and justified in the solution.

All other terms and conditions remain the same.

Kim Cotharin- Contract Officer

180 John D. Wardlaw Way

Hartford, CT 06106

Kcotharin@hartfordhousing.org

Response Due Date: Thursday, January 15, 2026