Amendment 2 2024-10926.pdf

July 11, 2024

SPOKANE TRANSIT AUTHORITY

ADDENDUM TO

RFP 2024-10926 – BUSINESS CONTINUITY PLAN CONSULTING SERVICES

AMENDMENT NO. 2

Amendment 2 consists of this cover page and one (1) attachment – Responses to Questions and Requests for Approved Equals, Clarifications, or Changes.

Change to Section 1.5 Proposal Due Date and Proposal Submission:

Proposals will be accepted until 4:00 PM, Pacific Time, August 7, 2024, in accordance with the specifications and conditions stated in the RFP.

This Addendum is hereby made a part of the RFP document to the same extent as though it were originally included therein. All Proposers shall acknowledge receipt and understanding of this addendum by completing the information required on Attachment A, Proposal Response Form, and returning the signed page with their proposal on or before the proposal due date.

Jennifer Anderson Procurement Coordinator

Attachment - Responses to Questions and Requests for Approved Equals, Clarifications, or Changes

Question # Document Section

Page Number Question STA Response

1 NA NA

Is the intention to include emergency response and recovery into the BCP? Would this include crisis management, crisis communications, response and recovery coordination? I ask this since BCP is typically highly IT focused for continuances but doesn't usually do an in-depth job of managing disasters or emergencies that would impact Spokane Transit and their customers.

STA would like the engagement to facilitate the creation of a command structure and communication structure that cross all phases of an incident/crisis. The engagement does not include building a cyber incident response plan, IT disaster recovery program, or capabilities for IT resiliency.

2 NA NA

Is there a need for Emergency Action Planning for SpokaneTransit and its facilities/locations?

Not at this point. This engagement could call out the needs for specialized situational plans for future development.

3 NA NA

Is an IT Disaster Recovery Plan or Information Systems Contingency Plans needed for systems used by Spokane Transit?

No, STA is currently building this in-house.

4 NA NA

Does Spokane Transit need IT related services in augmentation of the project to include Disaster Recovery as a Service (DRaaS), Infrastructure as a Service (IaaS), Object Storage, Microsoft 365, Managed Cyber Security etc.?

No.

5 SOW 17-18

For each department listed in the RFP, how many business units does each have?

Following are the business units of each department:

• Executive (2) - CEO/Clerk of Authority, Ombudsman

• CFO (5) - Finance, Information Services, Purchasing, Contracts, Public Records

• Planning & Development (4) - Planning/Grants, Community Dev, Capital Dev, Service Dev

• HR (5) - Safety, Security, Learning/Dev, HR, Benefits

• Communications (4) - Web Services, MarCom, Bus Dev, Cust Service

• Operations (11) - Ops Tech, Fixed Route, Paratransit, Transdev, Ridershare, Fleet Transition, Maintenace Analyst, Para/Rideshare Maint, Fixed Rte Maint, Facilities & Grounds, Plaza Ops

6 SOW NA

Does the scope of this project include Spokane Transit Authority executive leadership or elected officials?

The scope of the project involves executive leadership as they should form the governing body overseeing the programs, and in some cases owning specific areas of the plan, i.e., Crisis Communication. The Board of Directors will not be involved other than a communications path and for large impact/dollar decision-making in the event of a disaster.

Section

Page Number Question STA Response

7 NA NA

What is compelling STA to create a business continuity program at this time?

STA had a cybersecurity tabletop event in Dec 2022, and it included all departments. It largely called out the need for BCP agency-wide.

8 NA NA

This RFP will result in the creation of a business continuity program. In what department will this program reside, and who do you envision managing it in that department?

We know the program will require on-going oversight and resources. We anticipate needing to make that decision as governance and policy is setup as part of this engagement. Each department will be responsible for their plan.

We believe the agency level oversight and coordination of testing will be part of the necessary future state.

9 NA NA

We understand you have some existing continuity plans.

How many continuity plans do you currently have, and are they at the asset or end-to-end function level?

We do not have business continuity plans. We have an emergency plan that is generally designed around maintaining service in a snow storm. We also have a cybersecurity Incident Response Plan. It guides technology recovery only without regard to continuity during an event.

10 NA NA

When did you last test any of those plans, and who tested it? STA had a cybersecurity tabletop event in Dec 2022, and it included all departments. It largely called out the need for BCP agency-wide.

11 NA NA

Have you ever conducted business impact analysis of your mission critical business functions? If yes, are you confident it's up to date?

No.

12 NA NA

How much of your data backed up to a hot site or warm site that is geographically remote?

We have a hot site that we currently replicate data to. It is not regionally diverse.

13 NA NA

Have you threat modeled physical attack techniques on your fleet and how recovery would occur?

No.

14 NA NA

Do you maintain a trustworthy call list In the event of a ransomware attack or other cyber incident?

Departments have their own methods for maintaining good employee contact information. The HR modules of our ERP have contact information, but it may not be up-to-date.

15 NA NA

What do you envision the relationship of this business continuity program to your current crisis management program?

We have a very light emergency management program that generally involves maintaining service during snow storms. We anticipate the BCP to live at a broader level that could then call on Crisis Management, Cybersecurity response plan, etc. The BCP should be the playbook for how businesses maintain/recover services in the event of various scenarios. We also envision new/necessary teams and programs being called out as a result of this engagement.

16 NA NA

How much of your operations are outsourced? What percentage of your mission critical personnel are outsourced?

A very high percentage of our activities are in-sourced. We have a major contract with Transdev for Paratransit service for nights/weekends. We in-source that during the day.

Section

Page Number Question STA Response

17 NA NA

Can we expect to have a dedicated liaison in each critical department available to us?

Yes, we anticipate assignment of a liason in each department.

18 Cover, 1.5 6 Will STA consider extending the bid response period to August 7, 2024?

Yes, STA will extend the proposal due date to August 7, 2024, 4:00 PM, Pacific Time.

19 NA NA

Is there any onsite presence in Spokane required during the contracted period or is the expectation that the contractor work fully remotely?

We have no expectation of on-site presence during the engagement. A single visit might be valuable to guide you in the BIA and risk determination.

20 NA NA

What is the driving factor for this initiative? Is there anything directly driving the development of the program (i.e., recent incident, audit/regulatory findings, etc.)?

STA had a cybersecurity tabletop event in Dec 2022, and it included all departments. It largely called out the need for BCP agency-wide. Risks were not modeled and recovery strategies were not formulated.

21 NA NA

Are there any audit or regulatory findings related to business continuity that we should be aware of?

No

22 1.7 7

Must our proposal include, at the time of submittal, evidence of the business registration with the Secretary of State, Department of Revenue, and active worker’s compensation account with the Department of Labor & Industries? Or are we to provide this evidence after the awarding of the contract? Is STA requesting that proof of any or all of the following as part of the proposal: Active registration with the Washington State Secretary of State, Active Washington State Business License issued by the Washington State Department of Revenue, Active Worker’s Compensation Account with the Washington State Department of Labor & Industries, and City of Spokane business license

Per Section 1.7 Proposer Registration & Licensing, Parts 1.7.1 and 1.7.2, At the time of proposal submittal, as a minimum requirement for a proposal to be deemed responsive, proposers must meet the following business registration and licensing criteria:

A. Active registration with the Washington State Secretary of State.

B. Active Washington State Business License issued by the Washington State Department of Revenue.

C. Active Worker’s Compensation Account with the Washington State Department of Labor & Industries.

In addition to the requirements of subsection 1.7.1, following award of Contract, but prior to Contract execution, the Proposer shall provide evidence of necessary local business licenses, if applicable, within the local jurisdictions where the performance of work shall occur, as follows:

A. City of Spokane business license.

23 Exhibit NA We are requesting an extension to the end of the week for thorough review and markup of the sample agreement-is this acceptable?

No, the deadline to submit requests for clarifications, questions, and redlines to the Sample Agreement has passed.

24 NA NA

Has a BCP / DR audit ever been completed for STA? If so, what were the findings of that audit?

No.

25 NA NA What ERP is STA utilizing? Tyler Technologies- Munis

Section

Page Number Question STA Response

26 NA NA

Does the “Facilities Master Plan” include recovery locations for vehicle maintenance, staffing, or other BCP needs?

Our next Facilities Master Plan is currently in the draft phase and has identified the needs for recovery/alternate locations for multiple functions. The former version did not address those needs.

27 NA NA

Does STA have existing relationships with any business continuity vendors (mobile units, recovery sites, etc.)

No.

28 NA NA

Does STA have a mature governance structure for other processes within STA?

We are not mature in this area; however, there are other committee type programs that it could be modeled after.

29 NA NA

What % of STA processes are documented? Do any include process workflows?

Some departments have SOPs that would document their processes. It would be a low percentage that could plug those into a recovery plan.

30 NA NA

Is STA dependent on any State or City of Spokane resources as part of the current BCP?

No.

31 NA NA

Have BCP leads been identified within STA? Leads have not been identified; however, the executive team has commited to the expected resource requirements for program development.