Questions and Answers_August 13.pdf

RFQ Reference Document Question ABMC Response

1 PWS Our licensing for Microsoft 365 and Active Directory / Entra ID is based on the number of users. Could you please confirm the total number of users in scope?

400 users

2 PWS What Azure infrastructure services are expected to be protected?

Virtual Machines, Scale Sets, Blob Storage, Disk Storage, Virtual Networks, Load Balancers, Routing Tables

3 PWS Which Azure platform services are currently in scope? App Services, SQL Databases, Function Apps, Key Vaults, Logic Apps

4 PWS What type of Azure storage is being used (Blob Storage, Azure Files, etc.)?

Blob Storage, Managed Disks

5 PWS What is the total Azure storage volume to be protected ? 167 TB

6 PWS Would you require an immutable, air-gapped copy stored within our FedRAMP-managed Azure storage environment ? If yes, we would need to know the retention period that you want to have on it.

The PWS requires backup data to be separate from production data and protected from unauthorized change or deletion.

Offerors should describe the immutability or isolation controls included in the proposed service and any associated retention assumptions or optional pricing.

7 PWS Approximately how many Azure VMs are in scope?

What is the total protected data volume associated with these VMs?

77 VMs / 17.3 TB

8 PWS What is the total volume of data hosted within Azure SQL that would need to be protected?

71 GB

9 PWS Section 2; Section 3.2 How many Microsoft 365 E5 licensed users are in the ABMC tenant? Please identify the user count offerors should use for base year pricing, and whether ABMC anticipates change in the user count across the option years.

400 users, no changes expected however that could change based on Congressional mandates.

Offerors should offer tiered pricing options.

RFQ ABMCFY26_CloudBackup Questions and Answers Template

10 PWS Section 2; Section 3.2 Section 2 quantifies SharePoint Online data only. Please provide approximate data volumes for the remaining in scope workloads: Exchange Online, OneDrive for Business, and Microsoft Teams; and for Azure, the virtual machine count and provisioned capacity, the Azure SQL database count and aggregate size, and the storage account volume.

The PWS provides approximately 30 TB for SharePoint Online, including duplicate data, with 5%–10% annual growth and a ceiling of 45 TB during the period of performance.Offerors should disclose interim assumptions.

11 PWS Section 2; Section 3.2 How many Active Directory forests and domains, and how many Microsoft Entra ID tenants, are in scope?

Please also provide the approximate object count for each.

1 AD Forest, 1 Entra ID Tenant

12 PWS Section 2; Section 3.3.9 Section 2 states that ABMC maintains approximately 30 TB of SharePoint Online data including duplicate data, and expects the deduplicated data set to be less than half that amount. For licensing and pricing purposes, should offerors quote capacity against the approximately 30 TB source volume, or against the expected deduplicated volume?

Offerors should size and price SharePoint protection against the source data volume:

approximately 30 TB at the outset, with 5%–10% annual growth and not more than 45 TB during the period of performance.

The expected deduplicated volume is informational and should not be used to reduce the protected source-capacity assumption unless the pricing model expressly supports it.

13 PWS Section 2; Section 7 ABMC operates facilities outside the continental United States. Does ABMC have any data residency, privacy, or sovereignty requirement applicable to backup data originating from European or other overseas locations that offerors should account for alongside the FedRAMP Moderate hosting requirement in Section 7?

No additional overseas data-residency or sovereignty requirement is stated in the PWS.

Backup hosting must be limited to FedRAMP Moderate-authorized sites.

Offerors should disclose hosting and replication locations and identify any data-residency assumption.

14 PWS Section 3.2; Section 3.3.10

Section 3.3 requirement 10 states the solution to protect and recover in scope on premises workloads and endpoint data. On premises servers and endpoints are not identified in Section 2 or Section 3.2, and the Performance Work Statement is titled as a cloud to cloud backup requirement. Please confirm whether on premises workloads and endpoint data are in scope. If they are, please provide server counts, endpoint counts, and approximate data volumes. If they are not, please confirm that offerors should demonstrate the capability without pricing it.

The priced scope identified in Section 3.2 includes Microsoft 365, SharePoint Online, Azure workloads, Active Directory, and Microsoft Entra ID.

No other on-premises server or endpoint workload is identified for pricing. Offerors should demonstrate the broader capability in Section 3.3.10 and clearly identify any optional pricing; Additional workloads MAY be added.

15 PWS Section 3.2; Section 3.3.13

Section 3.3 requirement 13 states protection and recovery of identity data across Active Directory, Microsoft Entra ID, and Okta. Okta is not identified in Section 2 or Section 3.2. Please confirm whether Okta is present in the ABMC environment and in scope. If Okta is not in use, please confirm whether offerors should price Okta protection or demonstrate the capability only.

Okta is referenced as a required platform capability in Section 3.3.13 but is not identified as an in-scope environment in Sections 2 or 3.2.

Unless ABMC issues an inventory adding Okta, offerors should demonstrate support for Okta but should not include Okta quantities in evaluated pricing.

16 PWS Section 3.3.1; Section 7 Does ABMC require the service to be hosted in a United States government cloud region, such as Microsoft Azure Government, Microsoft GCC High, AWS GovCloud, or is a FedRAMP Moderate authorized commercial region acceptable?

A FedRAMP Moderate-authorized commercial or government region is acceptable if the proposed service and all locations used to store or process ABMC backup data are within the service's authorization boundary. Offerors must disclose the hosting location and authorization details.

17 PWS Section 3.3.4 Should the optional local backup or recovery target be quoted as a separate line item? If so, what capacity and what number of locations should offerors assume?

The local backup or recovery target is optional and is not part of the baseline priced requirement.

Offerors may present it as a separately identified optional item, stating capacity, location, prerequisites, and pricing assumptions. No baseline capacity or number of locations is specified.

18 PWS Section 3.3.5 Section 3.3 require 5 states software, storage, compute, and data transfer to be included in the subscription model. Please confirm that ABMC expects data transfer to be inclusive of restore and egress traffic, with no separate per restore or per terabyte charge. If an offeror's solution includes any limit on restore or egress volume, should that limit be disclosed as an assumption?

Yes. The subscription price must include software, storage, compute, and data transfer required for the service, including normal backup and recovery operations.

Offerors must clearly disclose any restore, egress, throughput, or usage limits and any circumstance that could result in additional charges.

19 PWS Section 3.3.12 Section 3.3 requirement 12 addresses integration with security monitoring or response tools. Which security monitoring, SIEM, or incident response platforms does ABMC use today that offerors should plan to integrate with?

The PWS does not identify a mandatory SIEM, SOAR, or incident-response platform. Offerors should describe integrations included in the proposed solution and any prerequisites or additional costs.

20 PWS Section 3.3.16; Section 7 Section 3.3 requirement 16 states hosting only in FedRAMP Moderate authorized sites. Please confirm that a service holding FedRAMP High authorization satisfies this requirement, and that an Agency authorization is acceptable in addition to a Joint Authorization Board provisional authorization. Please also confirm whether the proposed offering itself must hold a FedRAMP authorization, or whether an offering hosted within an authorized underlying cloud service provider environment satisfies the requirement.

The proposed service must meet or exceed FedRAMP Moderate and the applicable service, data paths, and hosting locations must be within an active authorization boundary.

FedRAMP High is acceptable if the offered service is covered. An Agency authorization is acceptable if active and applicable; authorization of only the underlying cloud infrastructure is not sufficient when the offered service itself is outside that boundary.

21 PWS Section 3.3.17; Section 6 Please define the east coast business hours window and the holiday schedule ABMC expects support to observe.

Is after hours coverage for severity one incidents required, or may offerors propose it as a priced option?

EST operating hours are 8am-5pm. ABMC follows all Federal holidays.

22 PWS Section 3.4, CLIN 0002 The Performance Work Statement does not specify backup retention periods or recovery point and recovery time objectives. What retention period and what RPO and RTO targets should offerors assume for each workload type? If ABMC prefers offerors to propose these values, please confirm, and offerors will state them as assumptions.

While the PWS does not prescribe workload-specific retention, RPO, or RTO values, offerors should propose their standard recommended values for each workload, identify them as assumptions, and explain any price or service impact. Final policies will be confirmed during implementation.

23 PWS Section 3.4, CLIN 0002;

Section 5

The initial backup of approximately 30 TB of SharePoint Online data is constrained by available throughput and by Microsoft service throttling rather than by contractor staffing. Will ABMC provide network capacity and any tenant level throttling accommodations needed to support the initial seed?

Please also confirm whether the six month deployment period in Section 3.4 and the corresponding acceptance criterion in Section 5 are measured to completion of the initial seed, or to completion of configuration, testing, and knowledge transfer.

ABMC will provide reasonable administrative access and coordination for tenant onboarding, subject to its security controls and Microsoft service limitations.

The six-month requirement is measured to completion of the CLIN 0002 deployment, configuration, validation, recovery testing, documentation, and knowledge transfer. Offerors should identify any assumptions, dependencies, and schedule risks in the implementation plan.

24 PWS Section 3.4, CLIN 0002 Section 3.4 requires at least one recovery test for each workload type. Please confirm that the workload types for this purpose are the six categories listed in Section 3.2, and identify any additional workload type ABMC expects to be tested.

For recovery-test planning, use each distinct configured workload category in Section 3.2:

Microsoft 365 E5, SharePoint Online, Azure infrastructure/platform/storage, Azure VMs, Azure SQL, and identity systems. Where a category contains materially different recovery methods, the implementation plan should identify appropriate sub-tests. Final scenarios will be approved at kickoff.

25 PWS Section 8; FAR 52.212-4 Section 8 of the Performance Work Statement establishes an order of precedence of contract, Performance Work Statement, then Contractor proposal.

FAR clause 52.212-4, which the solicitation notice states applies to this acquisition, contains its own order of precedence provision that addresses addenda to the solicitation, including license agreements for computer software. Please clarify which order of precedence governs in the event of a conflict, and confirm whether ABMC will review an offeror's commercial terms, including the end user license agreement, subscription agreement, and service level agreement, and incorporate agreed terms as an addendum to the award.

The contract and applicable FAR clauses govern.

Section 8 applies among the contract, PWS, and contractor proposal to the extent it does not conflict with a controlling clause. Offeror commercial terms are not automatically incorporated; submit all requested exceptions and commercial terms for ABMC review, and only terms expressly incorporated into the award will bind the parties.

26 PWS Section 9 What is the payment schedule for CLIN 0001 recurring services in the base year and each option year: annually in advance, quarterly, or monthly?

The PWS states that the CLIN 0001 payment schedule will be established in the award and does not specify annual, quarterly, or monthly billing. Offerors should clearly state any billing assumption in the price proposal.

27 Proposal and Evaluation Instructions

Are there page limits, font or formatting requirements, or required file formats for the technical proposal and the price proposal? The Proposal Format checklist specifies content but does not address these items.

No additional page limit, font, formatting rule, or required file format is stated in the materials reviewed. Offerors should follow the solicitation's submission and Proposal Format instructions.

28 Section 3.2 – Identity Systems Please provide the total number of Active Directory users, groups, service accounts, Organizational Units, and domain controllers that are in scope for protection.

29 Section 2 – Environment Please provide the total number of Microsoft 365 licensed users in scope for backup and recovery services, including any projected growth during the period of performance.

30 Section 2 – Environment;

Section 3.2 In Scope Workloads

Please provide the current counts and sizes for Exchange Online mailboxes, OneDrive accounts, SharePoint sites, Teams, and Microsoft 365 Groups that will be protected under this requirement.

31 Section 3.2 – In Scope Workloads

Please provide the total number of Azure subscriptions, resource groups, and regions included in scope.

32 Section 3.2 – Azure Virtual Machines

Please provide the number of Azure virtual machines, operating system types, average disk sizes, and total protected VM storage capacity.

33 Section 3.2 – Azure SQL Please provide the number of Azure SQL databases, deployment types (Single Database, Managed Instance, SQL VM, etc.), and total database storage capacity.

34 Section 3.2 – Azure Infrastructure Services, Platform Services, and Storage

Please provide a workload inventory identifying which Azure services are required to be protected (e.g., Storage Accounts, Key Vaults, App Services, AKS, Cosmos DB, Azure Files, etc.) along with associated capacities.

35 Section 3.2 – Identity Systems Please confirm whether Okta is currently deployed and in scope for protection given the requirement in Section

3.3.13 to protect and recover Active Directory, Microsoft Entra ID, and Okta from one administrative platform. If so, please provide tenant sizing information.

Okta is not identified as an in-scope environment in Sections 2 or 3.2. Unless an amendment adds Okta to the inventory, offerors should demonstrate the capability required by Section

3.3.13 without including Okta quantities in baseline pricing.

36 Section 2 – Environment Please provide current annual growth rates by workload type (Exchange, OneDrive, SharePoint, Teams, Azure workloads, and identity data) to ensure consistent pricing assumptions among offerors.

For SharePoint Online, assume 5%–10% annual growth and a maximum of 45 TB during the period of performance. Offerors should state reasonable assumptions for any unquantified workload.

37 Section 3.3 – Service Requirements

Please provide the required backup retention period(s) for each workload type and identify any regulatory or records-management retention requirements that vendors should account for in storage sizing.

The PWS does not prescribe retention periods or additional records-management schedules.

Offerors should propose standard recommended retention by workload, state all sizing assumptions, and describe legal-hold or long-term retention capabilities. Final settings will be confirmed during implementation.

38 Section 3.4 – Contractor Tasks Please identify the expected number of administrative users requiring access to the backup platform for role-based access and licensing purposes.

39 Section 2 – Environment Please indicate whether any on-premises workloads remain in scope, given Section 3.3.10 references protection of on-premises workloads, and if so provide workload types and sizing information.

No on-premises workloads other than Active Directory are identified in Section 3.2, and endpoints are not quantified. Do not include unlisted on-premises servers or endpoints in baseline pricing; demonstrate the capability and separately identify optional pricing.

40 Proposal Format Does the government want proposals to reference GSA, SEWP or some other contract vehicle? Would the government prefer to receive submissions using Azure Marketplace? If so, pleaee provide the ABMC account number in Microsoft Azure to reference

No preference for Azure Marketplace is established in the PWS; however offerors should provide their most competitive bids.

41 Proposal Format Does the ABMC RFP include a small Business requirement for the bidders? If so, what is the NAICS code associated with the RFP?

42 Section 2 – Environment;

Section 3.2 In Scope Workloads

Is there any data to be protected from the Azure workloads that is not in either a SQL database or associated with M365? For instance, is there any File & Object data? If so, how much?

43 PWS Section 2 – Environment

"ABMC uses Microsoft 365 E5, SharePoint Online, and Azure."

PWS Section 3.2 – In Scope Workloads, Item 1: "Microsoft 365 E5"

Can ABMC provide the approximate number of Microsoft 365 E5 licensed users in scope for backup services?

44 PWS Section 2 – Environment

"In scope Azure workloads include virtual machines, Azure SQL, infrastructure services, platform services, and storage."

PWS Section 3.2 – In Scope Workloads, Item 4: "Azure virtual machines"

Can ABMC provide the approximate number of Azure virtual machines?

45 PWS Section 2 – Environment

"In scope Azure workloads include virtual machines, Azure SQL, infrastructure services, platform services, and storage."

PWS Section 3.2 – In Scope Workloads, Item 5: "Azure

SQL"

Can ABMC provide the approximate number of Azure SQL instances in scope?

46 PWS Section 2 – Environment

"ABMC maintains approximately 30 TB of SharePoint Online data... In scope Azure workloads include virtual machines, Azure SQL, infrastructure services, platform services, and storage."

PWS Section 3.2 – In Scope Workloads, Items 3, 4, 5

Can ABMC provide the total estimated data volume for Azure workloads (excluding SharePoint Online)?

47 PWS Section 2 – Environment

"In scope identity systems include Active Directory and Microsoft Entra ID."

PWS Section 3.3 – Service Requirements, Item 13: "Protect and recover identity data across Active Directory, Microsoft Entra ID, and Okta from one cloud based administrative platform

Can ABMC provide the approximate number of identity objects in scope, including Active Directory users, Microsoft Entra ID accounts, and Okta accounts?

48 1.Total Data Volume and Locations:

oCan ABMC provide the total estimated data volume

(in TB/PB) for each in-scope workload, including Microsoft 365 (aside from the 30 TB of SharePoint Online data), Azure workloads, and any other identified on-premises workloads?

oCan ABMC specify the primary geographic locations

(e.g., specific Azure regions, physical locations for on-premises data) where this in-scope data currently resides?

The PWS quantifies SharePoint Online at approximately 30 TB, with 5%–10% annual growth and a 45 TB maximum. All backup hosting must remain within FedRAMP Moderate-authorized sites.

49 M365 Details How many active M365 users does ABMC currently have or expect to have over the course of the contract?

50 oCan ABMC provide an estimated number or list of Azure Virtual Machines, Azure SQL databases, and other significant Azure infrastructure/platform services (e.g., App Services, Functions, Storage Accounts, Key Vaults, etc.) that are in scope for backup?

oFor Azure storage, are there specific types of storage accounts (e.g., Blob, File, Disk) or containers that are in scope, and what are their approximate current size and expected growth?

51 maximum number of users expected to be configured in each (Okta, AD, Entra ID) for the duration of the contract?

52 Section 3.3, requirement 10 mentions protecting and recovering "on premises workloads" and "endpoint data," but these were not explicitly detailed in Section 2 (Environment) or 3.2 (In Scope Workloads) beyond Active Directory. Can ABMC clarify if there are other specific on-premises workloads or endpoint data (e.g., user workstations, servers not in Azure) that are in scope for backup and recovery? If so, what are these workloads and their approximate data volumes?

*For Endpoint protection, we will need number of users in addition to estimated amount of data

No additional on-premises servers or endpoint devices are identified in Section 3.2. Do not include them in baseline pricing; demonstrate the capability required by Section 3.3.10 and separately identify optional pricing.

53 What is the available network bandwidth for primary cloud seeding (initial data transfer) from ABMC's on-premises environments (if applicable) to the chosen cloud backup service? Does network bandwidth available vary by time of day?

The baseline scope does not identify an on-premises data-seeding requirement. For cloud-to-cloud onboarding, offerors should describe Microsoft and Azure API or throttling dependencies.

54 Can ABMC specify the desired Recovery Point Objective (RPO) and Recovery Time Objective (RTO) targets for each workload type (e.g., Microsoft 365, SharePoint Online, Azure VMs, Azure SQL, Identity Systems)?

No workload-specific RPO or RTO is prescribed.

Offerors should propose standard recommended targets for Microsoft 365, SharePoint Online, Azure VMs, Azure SQL, and identity systems, including dependencies and pricing impacts.

Final targets will be confirmed during implementation.

55 What are ABMC's specific data retention requirements (e.g., daily backups for X days, weekly for Y weeks, monthly for Z months, yearly for A years) for each in-scope workload type?

No fixed daily, weekly, monthly, or yearly retention schedule is prescribed. Offerors should propose standard recommended retention by workload and clearly state storage and pricing assumptions. Final settings will be confirmed during implementation.

56 Does ABMC have a current or anticipated requirement for an optional local backup or recovery target as mentioned in Section 3.3, requirement 4? If so, what are the specific use cases or requirements for this local target (e.g., specific data types/classification, RTO/RPO targets for local recovery)?

The optional local target is not a baseline requirement and no current use case, capacity, or location is specified. Offerors may provide a separately identified optional solution, including prerequisites, supported workloads, RPO/RTO impacts, and pricing.

57 What are ABMC's expectations regarding alerting and reporting for suspicious activity detected by the service (Section 3.3, requirement 8)?

The service must monitor for suspicious activity and provide actionable alerting. Offerors should describe detection coverage, alert severity, notification methods, reporting, escalation, response times, audit retention, and any integration included in the subscription. Final contacts and procedures will be confirmed during implementation.

58 Does ABMC currently utilize any specific security monitoring (e.g., SIEM) or response tools (e.g., SOAR) with which they would prefer or require integration (Section 3.3, requirement 12)? If so, please specify the tools.

No mandatory SIEM or SOAR product is identified. Offerors should describe available integrations, prerequisites, authorization impacts, and costs.

59 (Section 3.4, CLIN 0002, task 9)?

1.Recovery Test Scope: What are ABMC's expectations for the scope and depth of the recovery tests required for each workload type (Section 3.4, CLIN 0002, task 9)? Will ABMC provide test environments or data for these recovery tests?

Each test should demonstrate a documented restore of representative data or objects for the configured workload, validate integrity and accessibility, record elapsed time and issues, and obtain ABMC acceptance.

ABMC and the contractor will approve scenarios and test locations during implementation;

production testing must avoid operational impact.

60 (Section 3.4, Contract End and Transition Out

1.Data Export Format and Timing: Does ABMC have specific requirements or preferences for the format of exported data during transition out (e.g., native format, specific open standard)? Are there any specific timing constraints for data export or deletion after contract termination (Section 3.4, Contract End and Transition Out)?

No mandatory export format or fixed transition timeline is specified. Offerors must describe supported native or open formats, export methods, fees, throughput and timing limits, continued-access period, and retention/deletion process after expiration or termination. Final transition requirements will be established in the award or transition plan.

61 1.Egress Filtering Policy: What is the egress filtering policy for ABMC's internal workloads to the internet (i.e., are outbound connections restricted by default)?

This is important for understanding connectivity requirements for the backup service.

Offerors should list required endpoints, ports, protocols, service tags, and data flows and should minimize persistent inbound connectivity.

62 (Section 6)? 2.Service Level Agreements (SLAs): What are ABMC's expected Service Level Agreements (SLAs) for incident response and resolution, particularly for critical incidents (Section 6)?

The PWS requires offerors to provide incident-response and escalation procedures but does not prescribe numeric response or resolution SLAs.

Offerors should propose standard severity definitions, acknowledgment and restoration targets, escalation paths, and 24x7 provisions for critical incidents, clearly identifying any exceptions or added cost.

63 (Section 6)? 3.Planned Maintenance Notices: What is the preferred method for planned maintenance notices (Section 6)?

Offerors should propose standard planned-maintenance notice procedures, including email or portal notification to designated ABMC contacts, the normal notice period, expected impact, emergency-maintenance process, and status updates. Final contacts and notice method will be confirmed during implementation.

64 4.Data Residency: Does ABMC have a preference for the geographic region within AWS or Azure for data residency, assuming it meets FedRAMP Moderate requirements (e.g., US East, US West)?

ABMC has not stated a preference between U.S.

East and U.S. West. Any region is acceptable only if the proposed service and backup-data locations are covered by an active FedRAMP Moderate or higher authorization. Offerors must disclose primary and replication locations.

65 Page 3 The PWS states approximately 30 TB of SharePoint Online data with expected growth up to 45 TB during the contract period. Should pricing be based on:

•Current protected capacity only, or •A fixed maximum protected capacity of 45 TB?

Pricing should use approximately 30 TB of SharePoint source data at the outset and accommodate the stated 5%–10% annual growth, with protected capacity not expected to exceed 45 TB during the period of performance. Offerors should show assumptions and any tier changes by contract year rather than assume 45 TB is consumed on day one.

66 Will ABMC require protection of all Microsoft 365 workloads (Exchange Online, OneDrive, Teams, SharePoint, Groups), or only those explicitly identified in the PWS?

Protect all Microsoft 365 workloads identified in the final ABMC inventory. The PWS expressly identifies Microsoft 365 E5 and SharePoint Online but does not quantify Exchange Online, OneDrive, Teams, or Groups.Offerors should identify included Microsoft 365 applications and exclusions.

67 Page 3 Can ABMC provide estimated quantities for:

•Azure Virtual Machines •Azure SQL Databases •Azure Storage Accounts •Other Azure workloads requiring protection?

All are stimated quantities and capacities for Azure VMs, Azure SQL, Azure storage accounts, and other in-scope Azure infrastructure/platform services. Offerors should state pricing assumptions pending final inventory validation.

68 What is the current total protected Azure data volume that should be included in pricing?

69 Are there any workload-specific recovery point objectives (RPOs) or recovery time objectives (RTOs) for Azure systems?

No workload-specific Azure RPO or RTO is prescribed. Offerors should propose standard recommended targets for Azure VMs, Azure SQL, and other supported Azure services and state dependencies, exclusions, and pricing impacts.

70 Page 4 Requirement 3.3.13 references protection of Active Directory, Microsoft Entra ID, and Okta from a single platform. Is Okta currently deployed in the ABMC environment, and if so, approximately how many users and objects must be protected?

Okta is not identified in the Section 3.2 environment inventory. Unless ABMC confirms deployment and provides quantities in an amendment, offerors should demonstrate Okta protection capability without including Okta users or objects in baseline pricing.

71 Are there any additional identity platforms that ABMC intends to include during the contract period?

No additional identity platform is identified beyond Active Directory and Microsoft Entra ID;

Okta is referenced as a platform capability.

Offerors should describe support for additional identity platforms as optional capability and identify any related licensing.

72 What are the required retention periods for:

•Microsoft 365 backups •SharePoint Online backups •Azure backups •Identity backups?

No fixed retention period is prescribed for Microsoft 365, SharePoint Online, Azure, or identity backups. Offerors should propose standard recommended retention by workload, state capacity and pricing assumptions, and explain available legal-hold or extended-retention options.

73 What backup frequency is required for each workload type?

No workload-specific backup frequency is prescribed. Offerors should propose standard achievable frequencies for each workload, explain resulting RPOs and platform throttling constraints, and identify any tier or cost differences.

74 Page 4 Requirement 3.3.16 requires hosting in FedRAMP Moderate authorized sites. Will ABMC accept solutions that are FedRAMP Moderate Authorized through a cloud provider sponsorship and listed in the FedRAMP Marketplace?

Yes, provided the offered service is actively FedRAMP Moderate authorized or higher, is listed in the FedRAMP Marketplace, and all proposed hosting and data locations are within the applicable authorization boundary.

Authorization of the underlying cloud provider alone is not sufficient if the offered service is outside that boundary.

75 The PWS describes a "fully managed cloud backup and recovery service." Does ABMC expect the contractor to perform backup monitoring and operational management only, or also execute recovery activities upon request?

The contractor is expected to operate and monitor the managed backup service and support recovery activities. Offerors should describe the division of responsibilities, request and approval workflow, included recovery assistance, service limits, and any activities reserved for ABMC administrators.

76 Is 24x7 monitoring required, or only support availability during East Coast business hours?

Continuous service monitoring should be included as part of operating the managed service. Human support must be available during East Coast business hours as stated in the PWS.

Offerors should describe any 24x7 incident coverage, especially for Severity 1 events, and identify exceptions or optional charges.

77 Are recovery requests expected to be performed by contractor personnel, ABMC administrators, or either party?

Either party may initiate recovery through the authorized administrative workflow, subject to role-based access and ABMC approval controls.

Offerors should describe self-service recovery and contractor-assisted recovery, including authentication, authorization, audit logging, service limits, and any added cost.

78 Page 4 Approximately how many ABMC administrators require access to the backup management console?

Up to five (5).

79 Are there any requirements for role-based access controls, privileged access management, or integration with existing identity providers?

Yes. The solution must use strong access controls and should support role-based least privilege, multifactor authentication, audit logging, separation of duties, and integration with ABMC's approved identity provider where supported. Offerors should describe privileged-access controls and dependencies.

80 Page 4 The PWS requires implementation completion within six months. Does ABMC have a preferred implementation schedule or target go-live date?

No fixed go-live date beyond completion within six months after kickoff is stated, however this is a priority project for ABMC and will be completed as soon as possible.

The contractor must submit an implementation schedule at kickoff that covers provisioning, configuration, validation, recovery testing, documentation, user acceptance support, and knowledge transfer.

81 Will ABMC provide necessary administrative credentials, connectivity, and access to all Microsoft 365 and Azure environments during implementation?

ABMC will coordinate appropriate administrative access, connectivity, and authorized personnel needed for implementation, subject to security and least-privilege requirements. Offerors must identify required roles, permissions, endpoints, dependencies, and lead times in the implementation plan.

82 Are there any blackout periods or operational restrictions during deployment and testing?

No blackout periods or special deployment restrictions are stated. Applicable change windows and operational constraints at kickoff.

Offerors should identify activities that could affect production services and propose low-impact scheduling.

83 Page 4 Requirement 3.4 requires at least one recovery test per workload type. Does ABMC have specific recovery test scenarios or success criteria that must be demonstrated?

At minimum, each configured workload requires one documented recovery test that demonstrates successful restoration and validates integrity and accessibility. The contractor should propose representative scenarios, success criteria, expected duration, rollback, and evidence;

ABMC will approve the final test plan during implementation.

84 Will ABMC provide test environments for recovery validation, or should testing occur in production environments?

Testing should use non-production or isolated recovery locations whenever feasible. ABMC and the contractor will approve environments and data during implementation. Any production recovery test requires prior authorization, change control, and safeguards against operational impact.

85 Is there a preferred pricing template for CLIN 0001 and CLIN 0002 submissions?

No separate preferred pricing template is identified in the PWS. Offerors should present CLIN 0001 recurring services by base and option year and CLIN 0002 as a one-time implementation price, with assumptions, optional items, and potential usage charges clearly separated.

86 Are there any incumbent contracts or existing backup platforms currently protecting Microsoft 365, Azure, or identity workloads that will be replaced by this requirement?

There is no incumbent.

87 Is the ABMC Microsoft 365 tenant Commercial, GCC, or GCC High? Approximate total licensed user count would also be helpful if available.

Commercial.

88 Are there any specific retention periods, legal-hold, or records-management requirements for the protected workloads that are not stated in the PWS?

No additional retention, legal-hold, or records-management requirement is stated in the PWS.

Offerors should describe available capabilities and propose retention assumptions by workload.

Final requirements will be confirmed during implementation or in the award.

89 Does the Government have any target RTO/RPO expectations, or should Offerors propose their standard commercial recovery capabilities?

ABMC has not prescribed target RPO or RTO values. Offerors should propose their standard commercial capabilities and recommended targets by workload, explain dependencies and exclusions, and identify any pricing impact. Final targets will be confirmed during implementation.

90 For identity protection (Active Directory / Entra ID / Okta), can ABMC share approximate object counts or confirm whether Okta is currently in production?