Amendment 2.pdf

SAP

State of South Carolina

Amendment 2

Solicitation:

Date Issued:

Procurement

Officer:

Phone:

E-Mail Address:

Mailing Address:

5400030123 10/26/2026

KAREN BROOKS

803-832-8373 Karen.Brooks@scmd.sc.gov Adjutant General's Office 1 National Guard Road Columbia SC 29201-4752

DESCRIPTION: Website Hosting USING GOVERNMENTAL UNIT: Adjutant Generals Office

SUBMIT YOUR OFFER ON-LINE AT THE FOLLOWING URL: http://www.procurement.sc.gov SUBMIT OFFER BY (Opening Date/Time): 10/29/2026 10:00:00 (See "Deadline For Submission Of Offer" provision) QUESTIONS MUST BE RECEIVED BY: 10/23/2026 12:00:00 EXPIRED (See "Questions From Offerors" provision) NUMBER OF COPIES TO BE SUBMITTED: one online only CONFERENCE TYPE: Not Applicable

DATE & TIME:

(As appropriate, see "Conferences - Pre-Bid/Proposal" & "Site Visit" provisions)

LOCATION: Not Applicable

AWARD &

AMENDMENTS

Award will be posted on 11/16/2026. The award, this solicitation, any amendments, and any related notices will be posted at the following web address: http://www.procurement.sc.gov

You must submit a signed copy of this form with Your Offer. By signing, You agree to be bound by the terms of the Solicitation. You agree to hold Your Offer open for a minimum of thirty (30) calendar days after the Opening Date. (See "Signing Your Offer" provision.)

NAME OF OFFEROR

(full legal name of business submitting the offer)

Any award issued will be issued to, and the contract will be formed with, the entity identified as the Offeror. The entity named as the offeror must be a single and distinct legal entity. Do not use the name of a branch office or a division of a larger entity if the branch or division is not a separate legal entity, i.e., a separate corporation, partnership, sole proprietorship, etc.

AUTHORIZED SIGNATURE

(Person must be authorized to submit binding offer to contract on behalf of Offeror.)

DATE SIGNED

TITLE

(business title of person signing above)

STATE VENDOR NO.

(Register to Obtain S.C. Vendor No. at www.procurement.sc.gov)

PRINTED NAME

(printed name of person signing above)

STATE OF INCORPORATION

(If you are a corporation, identify the state of incorporation.)

OFFEROR'S TYPE OF ENTITY: (Check one) (See "Signing Your Offer" provision.)

___ Sole Proprietorship ___ Partnership ___ Other_____________________________

___ Corporate entity (not tax-exempt) ___ Corporation (tax-exempt) ___ Government entity (federal, state, or local)

COVER PAGE - ON-LINE ONLY (MAR. 2015)

mailto:Karen.Brooks@scmd.sc.gov http://www.procurement.sc.gov/ http://www.procurement.sc.gov/

SAP

SAP

QUESTIONS FROM OFFERORS - AMENDMENT (JUN 2017)

THE SOLICITATION IS AMENDED AS PROVIDED HEREIN. INFORMATION OR CHANGES

RESULTING FROM QUESTIONS WILL BE SHOWN IN A QUESTION-AND-ANSWER FORMAT. ALL

QUESTIONS RECEIVED HAVE BEEN REPRINTED BELOW. THE “STATE’S RESPONSE” SHOULD

BE READ WITHOUT REFERENCE TO THE QUESTIONS. THE QUESTIONS ARE INCLUDED

SOLELY TO PROVIDE A CROSS-REFERENCE TO THE POTENTIAL OFFEROR THAT SUBMITTED

THE QUESTION. QUESTIONS DO NOT FORM A PART OF THE CONTRACT; THE “STATE’S

RESPONSE” DOES. ANY RESTATEMENT OF PART OR ALL OF AN EXISTING PROVISION OF THE

SOLICITATION IN AN ANSWER DOES NOT MODIFY THE ORIGINAL PROVISION EXCEPT AS

FOLLOWS: UNDERLINED TEXT IS ADDED TO THE ORIGINAL PROVISON. STRICKEN TEXT IS

DELETED. [02-2A097-1]

1. Section III.5 requires past performance showing a minimum of five years hosting public-facing government or emergency-management websites. Section V (Qualifications of Offeror) states that the State may consider a documented commitment from a satisfactory source, and any identified subcontractor. Will the State accept this five-year experience requirement being met by an identified subcontractor that will operate the hosting environment, where the Offeror acts as prime contractor with full responsibility for performance?

The contractor should have the five years of hosting experience.

2. Section III.4 requires that "the environment, and all backup and storage locations, shall operate under a current FedRAMP authorization at the Moderate impact level or higher," and Section III.5 asks for the FedRAMP Marketplace package identifier. Will the State accept a managed environment built on a FedRAMP Moderate or High authorized Infrastructure-as-a-Service platform, where the Marketplace package identifier and continuous monitoring date provided are those of the cloud platform provider? Or must the Offeror or its managed-service subcontractor hold its own FedRAMP authorization listed on the Marketplace?

The contractor should have a FedRAMP authorization.

3. Does the FedRAMP requirement also apply to the CDN, WAF, and DDoS mitigation services, which run on globally distributed edge locations? If so, is it enough that these services are within the cloud provider's FedRAMP-authorized service list?

Everything.

4. Section III.4 calls for a monthly POA&M "inclusive of the underlying Infrastructure-as-a-Service (IaaS) platform." Cloud providers do not usually release their POA&Ms directly to customers or resellers; they share them with agencies through the FedRAMP secure repository. For the IaaS layer, will the State accept the cloud provider's FedRAMP continuous monitoring materials through that channel, with the Contractor providing a POA&M for the layers it manages?

I am unable to answer the question at this time.

5. Beyond FedRAMP Moderate, will the State also require GovRAMP (formerly StateRAMP) status for the proposed solution under SCDIS-200 or the related appropriations provisos referenced in Section III.4?

No

6. Section III.6 requires BGP using provider-independent IP address space, with failover by BGP route withdrawal and re-announcement and no DNS change. Will the State accept a cloud-native design that keeps the same public IP addresses through failover with no DNS change or dependency on DNS TTL?

For example, Contractor-owned IP space brought to the cloud provider and announced over BGP, or static anycast addresses that route traffic to the primary or failover region. Or is a traditional two-facility design with directly operated BGP routers required?

I am unable to answer the question at this time.

7. Are SCEMD's current public-facing IP addresses registered to SCEMD (portable) and expected to be kept and announced by the new Contractor? Or will the Contractor assign new addresses at cutover, with SCEMD updating any systems that hard-code or allow-list them?

No

8. Section III.6 requires the provider-independent IP space to be "under the Contractor's control." Is this met if the address space is registered to the Offeror's identified subcontractor that operates the network, rather than to the Offeror itself?

We do not want to deal with two sperate companies when it comes to hosting our website.

9. Section III.6 requires a minimum of 10 Gbps redundant internet connectivity at the primary hosting facility via physically diverse paths. For a cloud-hosted solution, where connectivity comes from the cloud provider's backbone rather than dedicated circuits, what evidence will the State accept for this requirement?

I am unable to answer this question at this time.

10. Which CMS product and version does SCEMD use today? Is the CMS license or subscription held by SCEMD, or must it be included in the Offeror's price?

We use Umbraco. The offeror is not responsible for the CMS. Just hosting.

11. Is the Contractor responsible only for the hosting infrastructure? Or does the scope also include maintaining the CMS application itself (core and module or plugin updates, security patches, and fixes to custom code)?

The offeror is not responsible for the CMS. Just hosting.

12. Apart from the CMS-managed website, what other applications or integrations must the environment host or support? For example, the number of sites and domains, databases, public forms, search, interactive maps or lookup tools, and third-party data feeds.

There are 3 domains and I believe it is one database.

13. When does SCEMD's current hosting arrangement end? Will the current provider supply a full export of the content, database, configuration, and media to support migration?

The contract ends 12/31/26. A full export will be migrated.

14. Given the 2027-01-01 estimated start date, the 2026-11-16 award posting, and the rule that no work may begin before a purchase order is issued, what production cutover date does SCEMD expect? Will SCEMD allow a period of parallel operation with the current environment?

The cutover date is 1/1/27. I don’t see why not while we test.

15. Is the historical figure of about one million requests per minute (Section III.3) measured at the CDN edge (total public requests) or at the origin web servers? What share of emergency traffic is dynamic, non-cacheable content?

It should be considered that the one million requests per minute is dynamic.

16. To size and price the "unmetered/unlimited" bandwidth requirement (Section III.3, item 7), can SCEMD provide approximate monthly data transfer (in TB) and request volumes for a typical month and for the highest-traffic activation month of the last three years?

SCEMD.org

2025: average of 39,853 active users per month. The total number of active users for the entire year was 478,232. The monthly traffic fluctuated throughout the year, reaching a peak of 137,304 active users in January.

2024: average of 57,539 active users per month. The total number of active users for the entire year was 690,468. The year saw significant peaks in August, September, and October, with the highest traffic occurring in September at 182,007 active users. (Due to Hurricane Helene) IMPORTANT TO NOTE: We have seen traffic with visitors up to 100,000 in A DAY with 300,000 page views during a major emergency.

1.16GB - 2150 files Earthquake.sc 2025: 703 monthly active users - Highest Month: August with 2,508 users 2024: 81 monthly active users - Highest Month: November with 1,601 users 100MB - 230 files Hurricane.sc 2025: Average of 4,358 monthly active users - September 2025 saw the highest activity with 18,823 active users.

2024: average of 9,834 monthly active users - August 2024 saw the highest activity with 52,288 active users.

55MB - 150 files

17. Over the last three to five years, how many activations per year required emergency-mode capacity, and how long was the longest one?

Every activation requires emergency mode to insure the scemd.org does not crash. On average the activation lasts about 2 weeks. The longest one was about 50 days.

18. Line item 0001 is quantity 5 with unit of measure "each," and the tendering text says quantities are estimates. Does each unit represent one contract year, so that the unit price is the firm annual price and the extended price is the five-year total used to find the low bid?

Yes.

19. With a single unit price applied to every unit, how should Offerors include one-time transition and migration costs incurred in the first year, given the Unbalanced Pricing provision and the Termination Due to Unavailability of Funds clause (no reimbursement of costs amortized beyond the initial term)?

There will not be a separate transition and migration cost.

20. Will the State pay monthly invoices in arrears for hosting services delivered in each month, or does it expect a different billing frequency? (The Payment and Interest clause states that payment will not be made on partial deliveries.)

Yearly invoice.

21. Section III, "Delivery Date: Purchase Order (Modified)," states: "All recovery shall be delivered within 4 hours after receipt of purchase order." Can the State confirm this refers to the four-hour Recovery Time Objective in Section III.8? Or is it a separate requirement tied to purchase order issuance?

I think it refers to the 4-hour recovery time. In section III.

22. Section III.8 says that availability during an activated emergency is "a higher-priority SLA tier as described in Section 9." Section 9 sets severity response targets but no emergency availability figure.

What availability target, if any, applies during an activated emergency?

I am unable to answer that question at this time.

23. Section III.7 requires backup replication to a "geographically separate alternate storage location, distinct from the primary production and failover processing sites." Is a separate data center location within the same cloud region as one of the processing sites acceptable? Or must the backup location be in a third, separate geographic region?

It might be acceptable.

24. Section III.4 requires an independent penetration test upon SCEMD request. To price this requirement, how often does SCEMD expect to request one (for example, once a year)?

Annually.

25. Will SCEMD's CMS authoring users sign in through a State-provided identity provider (single sign-on with State-managed MFA)? Or should the Contractor provide identity and MFA services for those users?

The contractor should provide the service.

26. Will the State kindly consider issuing a submission deadline extension from at least one (1) week from the date of which answers to questions are released? This will give all offerors sufficient time to review any changes and/or clarifications, and prepare responses accordingly in the best interest of the State.

No.