Amendment 1.pdf

SAP

State of South Carolina

Amendment 1

Solicitation:

Date Issued:

Procurement

Officer:

Phone:

E-Mail Address:

Mailing Address:

5400030123 10/23/2026

KAREN BROOKS

803-832-8373 Karen.Brooks@scmd.sc.gov Adjutant General's Office 1 National Guard Road Columbia SC 29201-4752

DESCRIPTION: Website Hosting USING GOVERNMENTAL UNIT: Adjutant Generals Office

SUBMIT YOUR OFFER ON-LINE AT THE FOLLOWING URL: http://www.procurement.sc.gov SUBMIT OFFER BY (Opening Date/Time): 10/29/2026 10:00:00 (See "Deadline For Submission Of Offer" provision) QUESTIONS MUST BE RECEIVED BY: 10/23/2026 12:00:00 EXPIRED (See "Questions From Offerors" provision) NUMBER OF COPIES TO BE SUBMITTED: one online only CONFERENCE TYPE: Not Applicable

DATE & TIME:

(As appropriate, see "Conferences - Pre-Bid/Proposal" & "Site Visit" provisions)

LOCATION: Not Applicable

AWARD &

AMENDMENTS

Award will be posted on 11/16/2026. The award, this solicitation, any amendments, and any related notices will be posted at the following web address: http://www.procurement.sc.gov

You must submit a signed copy of this form with Your Offer. By signing, You agree to be bound by the terms of the Solicitation. You agree to hold Your Offer open for a minimum of thirty (30) calendar days after the Opening Date. (See "Signing Your Offer" provision.)

NAME OF OFFEROR

(full legal name of business submitting the offer)

Any award issued will be issued to, and the contract will be formed with, the entity identified as the Offeror. The entity named as the offeror must be a single and distinct legal entity. Do not use the name of a branch office or a division of a larger entity if the branch or division is not a separate legal entity, i.e., a separate corporation, partnership, sole proprietorship, etc.

AUTHORIZED SIGNATURE

(Person must be authorized to submit binding offer to contract on behalf of Offeror.)

DATE SIGNED

TITLE

(business title of person signing above)

STATE VENDOR NO.

(Register to Obtain S.C. Vendor No. at www.procurement.sc.gov)

PRINTED NAME

(printed name of person signing above)

STATE OF INCORPORATION

(If you are a corporation, identify the state of incorporation.)

OFFEROR'S TYPE OF ENTITY: (Check one) (See "Signing Your Offer" provision.)

___ Sole Proprietorship ___ Partnership ___ Other_____________________________

___ Corporate entity (not tax-exempt) ___ Corporation (tax-exempt) ___ Government entity (federal, state, or local)

COVER PAGE - ON-LINE ONLY (MAR. 2015)

mailto:Karen.Brooks@scmd.sc.gov http://www.procurement.sc.gov/ http://www.procurement.sc.gov/

SAP

SAP

QUESTIONS FROM OFFERORS - AMENDMENT (JUN 2017)

THE SOLICITATION IS AMENDED AS PROVIDED HEREIN. INFORMATION OR CHANGES

RESULTING FROM QUESTIONS WILL BE SHOWN IN A QUESTION-AND-ANSWER FORMAT. ALL

QUESTIONS RECEIVED HAVE BEEN REPRINTED BELOW. THE “STATE’S RESPONSE” SHOULD

BE READ WITHOUT REFERENCE TO THE QUESTIONS. THE QUESTIONS ARE INCLUDED

SOLELY TO PROVIDE A CROSS-REFERENCE TO THE POTENTIAL OFFEROR THAT SUBMITTED

THE QUESTION. QUESTIONS DO NOT FORM A PART OF THE CONTRACT; THE “STATE’S

RESPONSE” DOES. ANY RESTATEMENT OF PART OR ALL OF AN EXISTING PROVISION OF THE

SOLICITATION IN AN ANSWER DOES NOT MODIFY THE ORIGINAL PROVISION EXCEPT AS

FOLLOWS: UNDERLINED TEXT IS ADDED TO THE ORIGINAL PROVISON. STRICKEN TEXT IS

DELETED. [02-2A097-1]

1. Is the vendor expected to migrate the existing website to the new infrastructure?

Yes, although it is simply migrating existing Windows Server machines.

2. Is the vendor expected to develop a new website?

No.

3. Will the vendor be responsible to make ongoing updates to the website?

No, but the vendor will provide VPN access for us to make the changes.

4. What CMS is used for the current site?

Umbraco

5. Is there a preferred/required CMS for the new site?

6. Will the vendor be responsible for CMS licensing (if applicable) as part of this procurement?

No, SCEMD will handle all licensing.

7. Is hosting a preview/staging environment required?

No.

8. Please clarify whether pricing line 0001, quantity five EACH, is evaluated as five annual service units, and how one-time migration charges should be entered.

This is for each year of the contract. This is 5 annual service units, your assumption was correct.

SCEMD will not pay one-time migration charges. We are simply moving existing Windows machines into your environment. No CMS change will occur.

9. What is the current CMS/application stack and are software licenses supplied by the agency?

SCEMD is using Umbraco as the CMS. The software licenses are provided by SCEMD, if applicable.

10. May the five-year hosting history and FedRAMP environment evidence be clearly attributed to our named performing provider, with (company name) responsible for prime administration and contract compliance? We will identify actual authorization scope and Marketplace ID rather than claim (company name) holds the provider's authorization.

The company needs to be FedRAMP authorized.

11. Does solicitation 5400030123 include CMS/application work or permit a specialist subcontractor to the hosting provider?

We have a contractor that works on the site from time to time. They built it for us and we still have a contract with them.

12. Could you please clarify whether a managed hosting provider can satisfy the FedRAMP Moderate requirement by deploying the entire solution within AWS GovCloud's FedRAMP-authorized infrastructure, provided all applicable security controls are implemented? Or must the bidding company independently hold FedRAMP authorization for its managed hosting service?

The company needs to be FedRAMP authorized.

13. Is there an incumbent contractor currently performing website hosting and managed infrastructure services for the South Carolina Emergency Management Division (SCEMD)?

Yes, there is a current incumbent contractor performing website hosting and managed infrastructure services for SCEMD.

14. If an incumbent contractor exists, what is the current contract number, annual contract value, and incumbent company name?

I can not provide that information to you. You can look on Procurement.sc.gov and search for the previous contract.

15. Is this solicitation a simple contract renewal (recompete) to host the existing website as it is currently built, or does SCEMD require a complete redesign and migration to a new hosting setup?

Yes, the solicitation is a simple contract renewal to host the existing website.

16. What specific Content Management System (CMS) software and version (e.g., Umbraco, Drupal, WordPress, DotNetNuke, Sitecore) currently power SCEMD's public-facing website?

17. What is the underlying application framework and runtime environment (e.g., .NET Core, PHP, Java, Node.js) used by the CMS?

Unsure

18. What specific database management system (DBMS) engine and version (e.g., Microsoft SQL Server, PostgreSQL, MySQL, Oracle) are required to support the CMS environment?

19. What is the total current size of the primary application database, including transactional data and audit logs?

20. What is the total size of the static asset repository (e.g., media files, image libraries, PDF documents) currently hosted for SCEMD?

SCEMD.org is 1.16GB 2150 files Earhquake.sc is 100MB 230 files Hurricane.sc is 55MB 150 files.

21. Does the current website rely on any third-party plugins, custom compiled modules, or external API dependencies that require specific operating system versions or database drivers?

No

22. Is the CMS configured to support multi-site or multi-tenant deployments, or does it serve a single root domain and database instance?

Single root to the best of my knowledge.

23. How does the existing CMS handle cache invalidation when content editors publish updates (e.g., via programmatic API purge calls, webhooks, or scheduled cache clear tasks)?

24. Does the SCEMD website integrate with external state or federal data feeds (e.g., GIS mapping layers, weather feeds, active shelter status databases, social media channels, or emergency alert systems)?

Yes

25. If external integrations exist, what protocol is used to ingest or present this data (e.g., REST APIs, SOAP web services, RSS feeds, direct database connections)?

REST APIs

26. Are any of the external data feeds un-cacheable at the Content Delivery Network (CDN) edge due to real-time dynamic query requirements?

27. Does the website require outgoing network connections to external services that require static IP address allowlisting by third-party vendors?

28. What Identity Provider (IdP) is currently used for user authentication into the CMS authoring/staging environment (e.g., Active Directory, Azure AD/Microsoft Entra ID, Okta, local CMS database)?

Local CMS database

29. Does SCEMD require single sign-on (SSO) integration via SAML 2.0 or OpenID Connect (OIDC) for administrative access?

SSO

30. Section 4 of the SOW specifies Multi-Factor Authentication (MFA) supporting phishing-resistant methods (e.g., FIDO2/WebAuthn or PIV/CAC). Is the contractor required to provide the MFA authentication broker, or will administrative users authenticate through SCEMD's existing agency IdP enforced with MFA?

Yes, the contractor is required to provide the MFA authentication broker.

31. How many total administrative and content editor accounts require access to the CMS authoring/staging environment?

No more than 10.

32. Are Role-Based Access Control (RBAC) permissions managed entirely within the CMS software application, or must network-level access controls be applied based on user roles?

They are handled within the CMS software.

33. Section 4 requires the environment and backup storage locations to operate under a current FedRAMP Moderate authorization or higher. Does satisfying this requirement via an Infrastructure-as-a-Service (IaaS) provider holding a valid FedRAMP Moderate JAB or Agency Authorization (e.g., AWS GovCloud, Azure Government) fulfill this requirement for the contractor's solution?

The web hosting provider must be FedRAMP authorized.

34. Section 4 mandates continuous log collection and monitoring. What specific Security Information and Event Management (SIEM) log forwarding format or ingestion protocol (e.g., Syslog, CEF, HTTPS API, S3 bucket sync) is required to forward logs to SCEMD or state security tools?

Syslog

35. Section 6 specifies that failover between primary and secondary data centers must be accomplished using Border Gateway Protocol (BGP) route withdrawal and re-announcement using Provider-Independent (PI) IP address space under the contractor's control. Does SCEMD own the PI IP address block, or must the contractor supply a PI IP prefix registered under the contractor's Autonomous System Number (ASN)?

The contractor must supply a PI IP prefix.

36. Does SCEMD permit the use of Anycast BGP routing provided by enterprise Content Delivery Networks (CDNs) to satisfy the seamless failover and IP preservation requirements?

37. SOW Section 4 requires FIPS-compliant encryption in transit (TLS 1.2 or higher) and at rest (AES-256).

Does SCEMD require FIPS 140-2 or FIPS 140-3 validated cryptographic modules at both the cloud host and CDN termination layers?

38. Section 4 requires a maximum 4-hour notification timeline for security incidents. Does SCEMD define a "security incident" as any detected threat block (e.g., a blocked DDoS attack or WAF rule trigger), or only confirmed breaches/unauthorized access affecting SCEMD systems?

We want to be notified of detected threat.

39. Does the non-public CMS staging instance require domain name binding under the scemd.org public domain (e.g., staging.scemd.org), or will SCEMD provide a dedicated private domain/subdomain for staging?

40. Who is responsible for purchasing, issuing, and renewing SSL/TLS certificates for the public-facing domain(s) and staging environment: SCEMD or the contractor?

SCEMD is responsible for purchasing and renewing the SSL/TLS Certs and Domains. The web hosting provider will install the Certs as needed.

41. What is the average monthly bandwidth usage (in Gigabytes or Terabytes) for normal, non-emergency operations over the past 12 months?

I don’t have that information, but in 2025 we averaged 39,853 users a month and a total of 478,232 users for the year. It peaked at 137,304 users in January. In 2024 we averaged 57,539 users a month with a total of 690,468 users for the year. It peaked in September with 182,007 users due to Hurricane Helene.

42. What is the peak bandwidth consumption (in Gbps or Mbps) recorded during the most recent declared emergency activation?

See above question

43. Section 3 specifies an auto-scaling capacity requirement of approximately 1 million requests per minute during significant emergency activations. What is the typical static-to-dynamic content ratio (e.g., percentage of requests served via static cached files versus dynamic database calls) during emergency activations?

https://urldefense.com/v3/__http:/scemd.org__;!!GpFojh-4Mw!NP6O9w60jjDASGyaohgQxvq2_-RlKJMY9oqbo63f24BxV9sMVS9L2COZr-k7wsHm_6ADjIs-tsrShlx3mfj4JUvojDM7$ https://urldefense.com/v3/__http:/staging.scemd.org__;!!GpFojh-4Mw!NP6O9w60jjDASGyaohgQxvq2_-RlKJMY9oqbo63f24BxV9sMVS9L2COZr-k7wsHm_6ADjIs-tsrShlx3mfj4JThbBeyg$

44. What is the maximum duration (in consecutive days or weeks) that SCEMD has historically maintained emergency high-traffic auto-scaling operations?

That is hard to say, because each emergency is different. However, the longest we have operated at max capacity in the past was about 50 days.

45. Section V requires proof of a minimum of five (5) years of experience in hosting public-facing government or emergency-management websites. Is this requirement evaluated as a mandatory pass/fail prerequisite for proposal responsiveness?

46. If a bidder meets all experience, security, and technical requirements but fails to supply one of the listed submittals (such as 3 years of South Carolina public body experience, if none exists), will the submission be deemed non-responsive?

47. Section V (Qualifications - Required Information) requests financial statements reflecting the current financial position and statements for the last two fiscal years, noting that audited versions should be provided if available. If an offeror is a privately held entity that does not produce formally audited or CPA-reviewed financial statements, will standard financial statements (e.g., Balance Sheets and Income/Profit & Loss Statements) generated directly from the company's accounting software satisfy this requirement?

Maybe, as long as they show financial stability

48. Is an offeror automatically disqualified if they do not hold a current active South Carolina State Vendor Number at the exact time of bid submission, or can vendor registration be finalized prior to contract award?

If you do not have a vendor number, you can not log into the system to place a bid. Bids are online only.

49. On Section VIII (Bidding Schedule), Line Item 0001 lists a Quantity of "5.000 Each". Does this unit quantity correspond to five (5) separate 1-year contract periods (1-year base plus 4 option years)?

50. Must the Unit Price submitted for Line Item 0001 represent an all-inclusive annual price covering baseline hosting, auto-scaling emergency capacity, CDN services, SIEM logging, unmetered bandwidth, and 24x7x365 support?

51. Are there separate, billable line items for emergency traffic activation events, or must all emergency auto-scaling costs be included within the fixed unit price for Line Item 0001?

We would require that all pricing is up front.

52. Is there a fixed budget ceiling or estimated price range allocated for this procurement?

I can not answer that question.

53. Does SCEMD hold any license entitlements for the CMS platform?

Our contractor that built the website does.

54. Must the contractor include licensing costs within the bid price?

55. Section VI states that award will be made to the lowest responsible and responsive bidder. Does the technical evaluation consist purely of a pass/fail determination based on compliance with the mandatory prerequisites in Section III and Section V?

56. Will technical proposals be scored using a weighted numerical scale, or is award determined solely by the lowest evaluated total price among offerors meeting all mandatory minimum qualifications?

Lowest responsible and responsive award

57. If a bid contains minor technical omissions that do not alter price or performance terms, will the Procurement Officer issue a request for clarification, or will the bid be rejected immediately as non-responsive?

It depends on the content of what is omitted

58. What is SCEMD's anticipated timeframe for domain cutover, and will the current hosting vendor be required to operate in parallel with the new contractor during a staging and testing period prior to January 1, 2027?

We want to start migrating and test 12.1.2026 which would give a month to complete all migration and testing.

59. Will the incumbent contractor provide raw web server access logs and database exports during migration, or is the new contractor responsible for exporting data via CMS management tools?

Unsure, but I am leaning towards that latter.

60. Who within SCEMD is authorized to declare a site activation and request manual auto-scaling, and what is the primary communication channel (e.g., telephone hotline, ticketing portal, email) used to trigger manual scaling?

There are 4 people at SCEMD authorized to declare a site activation and request auto-scaling. In the past it has been a phone call to our hosting provider.

61. Does SCEMD permit pre-scheduled maintenance windows for routine OS patching or CMS updates, and if so, what are the approved hours and advance notification requirements?

With our current hosting provider, we have patched the OS on the servers ourselves. If we did authorize pre-scheduled windows for maintenance, we would have to have the ability to cancel maintenance during emergencies.

62. Is the contractor expected to absorb Layer 3/4 and Layer 7 DDoS attacks entirely within the fixed contract price without incurring additional usage or traffic charges?

We would require that all pricing is up front in one price.

63. FedRAMP (Section III, items 4 and 5): We would host the site on Amazon Web Services, which is already FedRAMP certified. Does that meet the requirement, or does our own company need a separate FedRAMP certification?

No, you must be FedRAMP certified.

64. Current site: Which content management system does the SCEMD website run on today? Should the contractor support that system as well, or only host it? If SCEMD would consider moving to WordPress, would WordPress VIP (FedRAMP Moderate, package FR1923743650A) meet the FedRAMP requirement?

We use Umbraco. You would only host it.

65. IP addresses (Section III, item 6): Would fixed IP addresses assigned to us by our network provider, Amazon CloudFront, count as address space "under the Contractor's control"?

I am not sure.

66. Support (Section III, item 9): Can the 24x7x365 support be met by round-the-clock automated monitoring and failover, with our staff responding during business hours?

No, we need to be able to pick up the 24x7x4x365 and speak with a live human. We operate 24 hours a day our website must also.

67. Experience (Section III, item 5, and Section V): Does the five years of hosting experience include the experience of key personnel and named subcontractors?

The company must have five years’ experience.

68. Section VIII, Bidding Schedule, Line 0001. Line 0001 shows quantity 5.000, unit of measure "each."

Please confirm that each unit is one contract year, so the unit price is the annual price and the extended price is the five-year total.

Correct

69. Where hosting is provided by an identified subcontractor: (a) will the subcontractor's FedRAMP package identifier and most recent continuous-monitoring date satisfy Section 5; (b) may the five-year hosting requirement be met by the offeror's prime hosting experience delivered with that subcontractor, together with the subcontractor's own experience; and (c) must the subcontractor's financial statements be included in the offer, or may they be provided upon request?

We do not want a subcontractor. We are not going to deal with two different companies

70. Section 5 items 4 and 5 (System Security Plan summary, DR/COOP plan, and recent incident response and contingency test results) are to be made available "upon request or contract award." Please confirm they need not be included in the offer, and that a commitment to provide them satisfies Section 5.

They do not need to be included in the offer.

71. Will provider-independent IP space and an ASN registered to the offeror's identified hosting subcontractor satisfy "under the Contractor's control"? (b) Will a FedRAMP-authorized anycast or global load-balancing service that keeps SCEMD's public IP addresses unchanged on failover, with no DNS change, satisfy Section 6? (c) Are new public IP addresses expected at transition, with DNS updated at cutover?

I am unable to answer this question currently.

72. Will requests served by the CDN count toward the approximately one million requests per minute, so that origin capacity may be sized for the traffic that reaches it?

I am not sure how to answer this question currently.

73. To size capacity, please share, if available: average monthly requests and outbound bandwidth; total CMS and media storage; peak requests per minute and duration during the largest recent activations; and the typical number of activations per year.

I don’t have that information, but in 2025 we averaged 39,853 users a month and a total of 478,232 users for the year. It peaked at 137,304 users in January. In 2024 we averaged 57,539 users a month with a total of 690,468 users for the year. It peaked in September with 182,007 users due to Hurricane Helene.

74. Please confirm the domains in scope (for example, scemd.org, hurricane.sc, earthquake.sc) and the current CMS and version. Is the Contractor to host the existing site as-is or migrate it, and is the Contractor responsible for CMS and site-code maintenance and upgrades, or only for hosting and securing the environment? Will the current provider supply exports for transition?

The domains in scope are scemd.org, hurricane.sc, and earthquake.sc. the CMS is Umbraco. I do not know the version. I don’t understand will the contract host the existing site or migrate it. It will need to be migrated from the current contractor to the new contractor. The contractor is not responsible for CMS maintenance. They should provider supply exports for transition.

75. Section 8 refers to a higher-priority SLA tier during activated emergencies "as described in Section 9," but Section 9 does not define one. Do different targets apply during an activation, and if so, what are they?

I am unsure how to answer your question.

76. With award posting on 11/16/2026 and an estimated 01/01/2027 start, by what date must the new environment be in production? (b) The Delivery Date clause states "All recovery shall be delivered within 4 hours after receipt of purchase order." What must be delivered within four hours?

The site needs to be migrated, tested and running on 1/1/2027. I am unsure how to answer the second question part of this question.

77. For an environment hosted on a FedRAMP-authorized cloud (IaaS) provider, will the following satisfy the SOW: (a) for the POA&M "inclusive of the IaaS platform," the hosting provider's monthly summary referencing the IaaS provider's FedRAMP continuous-monitoring status; (b) for the 10 Gbps requirement, the IaaS provider's documented redundant network capacity; and (c) for the separate backup location, a third region of the same provider within the FedRAMP boundary?

I am unsure how to answer your question.