Appendix_B_-_Proposer_Questions.pdf
PDF 115 KB Posted
- Attached to
- Request for Proposal for Hosting Services
- Solicitation number
- 2023-RFP-058
- Issued by
- Cuyahoga County, Ohio
About this file
This document is Addendum No. 2, Appendix D - Proposer Questions for a Request for Proposal (RFP) for Hosting Services issued by the Cleveland Water Department (CWD). The comprehensive questionnaire is designed to solicit detailed information from potential hosting service providers regarding their capabilities for supporting the department's customer information and billing system (CC&B), which serves approximately 400 users and handles billing for water, solid waste, wastewater, and electric customers across Cleveland and surrounding suburbs. The document contains multiple tables with over 137 questions covering critical areas such as hosting management, disaster management, security management, infrastructure management, and service level agreements, with proposers expected to provide detailed responses about their technical capabilities, data center infrastructure, security protocols, system redundancy, monitoring capabilities, and operational practices.
The questionnaire seeks in-depth information about proposers' hosting environments, including whether they own their data centers or subcontract, resource allocation strategies, backup and failover capabilities, security measures, monitoring tools, and proposed service level agreements. Key areas of focus include client data isolation, system failover testing, license requirements, network architecture, performance reporting, and specific technical capabilities across various platforms (Windows, UNIX, Linux, AIX). The document indicates that DPU is seeking a comprehensive hosting solution that can support their current CC&B system, which manages billing for approximately 280,000 accounts, with potential for future customer growth. The proposer is expected to provide detailed technical specifications, demonstrate robust security and disaster recovery capabilities, and offer flexible, scalable hosting solutions that can meet the department's current and future technological needs.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ADDENDUM NO. 2 - APPENDIX D – PROPOSER QUESTIONS
RFP for Hosting Services
For the following table, please indicate Y (for yes) and N (for no) if the proposer meets the requirement. The comment column is provided for any additional information or elaboration that the proposer wishes to include.
Table D-1 Minimum Response Criteria
Requirement Y/N Comment
1 Corporate commitment to providing hosting services
2 More than five years’ experience providing hosting services
3 Hosting experience with more than three public utilities
4 Can provide the hardware and software environment specified
5 SSAE 16 – SOC 2 Type 2 Certification
For the following table, please indicate Y (for yes) and N (for no) if the proposer’s proposal includes providing this service. Please elaborate on any item marked with asterisk (*). The comment column is provided for any additional information or elaboration that the proposer wishes to include.
Description Y/N Comment
Hosting Management
6 Capacity planning and management
7 Performance management*
8 Servers and storage (installation, management, monitoring, patch management, configuration management)
9 Network connections (installation, management, monitoring, patch management, configuration management, redundancy through multiple carriers)
10 Load balancing of network connections
11 Conditioned space
Disaster Management Plan
12 UPS (Uninterruptible Power Supply)
13 Disaster Recovery*
14 Disaster Definition
15 Disaster SLAs
Security Management
16 Overall Security strategy and planning (regularly scheduled)*
17 Authentication, authorization, and access control
18 Network and systems platform infrastructure
19 Internal controls audit
20 Threat and vulnerability detection, implementation, and testing (facility, servers, storage)*
21 Physical security (facility, DPU servers, storage)
22 Cybersecurity*
Infrastructure Management
23 LAN (Datacenter)
24 WAN
25 Does proposer have a Storage Area Network (SAN)?
26 Bandwidth management* (how is it handled)
27 Server solutions
28 Dynamic server scaling (memory and/or cores)*
29 Load balancing servers
30 Storage solutions* (what solutions?)
31 WINDOWS
32 UNIX
33 LINUX
34 AIX
35 Other platforms* (in addition to ones listed above)
36 Security monitoring
37 Intrusion detection and prevention
38 Virtual Private network (clientless vpn)
39 Redundancy and failover (servers, storage, carriers)* (see a plan)
40 High Availability (options)*
41 Technical consulting services
For the following table, please indicate if item is part of the standard offering by placing a Y in the column labeled “Std”. If it is an optional offering, place a “Y” in the column labeled “Opt”. If it is an optional service, please include pricing for it in the fee template. Any item marked with an asterisk (*) please elaborate.
The comment column is provided for any additional information/elaboration that the proposer wishes to include and for any open-ended questions. Comments can also include references to info that is contained within the proposal.
Question Std Opt Comment
Hosting Management
42 Does proposer have its own data center or does it subcontract out this functionality?
43 Are the resources in the data center shared or dedicated to environments?
44 If shared, how are issues with other clients isolated from our environment? How do you ensure there is no impact to our environment?
45 What is the total number of data centers that are owned and operated by proposer?
46 List where are they located and what size they are (square footage, number of customers served, amount of storage, and number of servers supported.
47 What is the location and mailing address of the hosting site you are recommending?
48 Why are you recommending this location?
49 What is the staffing level and experience at this location relevant to the DPU project.
50 Where is the backup data center located?
51 Why is that location recommended?
52 Is the backup location subject at the same or different natural disasters as the hosting site? If so, what are they?
53 Does proposer provide remote operations for its data centers?* Do they have offsite support for their offsite data center
54 Provide DPU with a description of the disaster recovery plan that describes the steps that would be taken in responding to a network failure or a facility failure.*
55 Does proposer execute site failover once a year?
56 Does proposer have redundant power to its facilities?
57 Does proposer have uninterruptible power supplies (UPS)?
58 Can proposer quantify the number of operational hours it can run on standby?
59 Has proposer had any major power failures within the last five years?
60 What was the response of the backup power systems?
61 What type of testing procedures do you maintain?
62 How do you notify DPU about testing and with what lead time?
63 Describe what environmental controls and backups (e.g. heating, cooling, humidity) are in your facility.
64 Does proposer have zoned smoke detection and fire suppression?
65 Are proposer’s data centers audited and certified by independent third parties?
66 What kind of auditing does the proposer undergo?
67 When was the last audit and what was the result?
68 Does proposer notify clients when audits have been performed and what the results were?
69 Please supply a map of proposer’s internet backbone topology with as much detail as possible.
70 Describe the physical circuit diversity with respect to how the circuits enter each data center.
71 Please list bandwidth and connectivity options.
72 Does proposer have a peering policy?
73 Does proposer have more than two telecommunication peering partners?
74 Can proposer specify the speed of each circuit entering each data center?
75 Does proposer dynamically route traffic?
76 Does proposer provide automatic failover of the internet connection if there is a failure?
77 Is proposer’s network certified by one of the major network equipment providers?
78 Does proposer offer Software VPN?
79 Hardware VPN?
80 Client-less VPN? (preferred)
81 Are there any single points of failure in the network?*
82 Is there a limit to the amount of data that can be transferred from DPU to the hosted servers each month? What is the impact of this.
Please list out/describe.
83 Has the proposer implemented measures to prevent a single point of failure from bringing down an application?
84 How does proposer calculate network availability?
85 Are any subcontracted personnel used in the management of the data center?
86 Are customers allowed access to the data center floor?
87 Does proposer provide load balancing within each data center as well as between the primary and secondary data center, if applicable?
88 What procedures do you employ to minimize interruption for maintenance, upgrades, or replacement?
89 Does DPU own all data (clicks, user profiles, data bases, etc.)?
90 Describe what requirements DPU and the equipment must meet to connect to the proposer?
91 Discuss how proposer will provide for additional growth to meet DPU needs.*
Security Management
92 Can proposer provide a custom security policy for DPU?
93 Does proposer conduct background checks for support personnel?
94 What security measures are in place for exiting employees?
95 Are firewalls shared across various customers?
96 Does proposer have requirements for DPU’s firewall?
97 Does proposer have documented intrusion detections procedures?
Please describe.
98 Does proposer undergo external security assessments?
99 Does proposer have 24x7x365 monitoring of the facility? Please describe.
How does vendor restrict access to:
100 Facility
101 Data Center Floor
102 Specific Customer Areas
103 Server Caged Area
104 Cabinets
105 Racks
106 Servers
107 Storage
108 Other
109 When was the most recent time someone compromised the security of the proposer’s network with the last five years?
110 What was the lesson learned and how was security improved as a result?
111 Can proposer describe the type and level of encryption supported?
Infrastructure Management
Does proposer provide:
112 Operating system patches installation?
113 Operating system minor upgrades?
114 File system management support?
115 Proactive software patches?
116 Hardware/CPU performance monitoring?
117 Capacity monitoring?
118 Monitoring logs and scaling information?
119 Daily backups for the application and database?
120 Store backups in an offsite storage facility?
121 24x7x365 monitoring of the entire solution, up to and including the customer application?
122 Does proposer have client data isolation scheme?
123 Can proposer provide real time or close to real time failover for the application in the event primary facility system fail? Close to real time is one (1) hour or less?
124 What tools does proposer use for monitoring? E.g. agents, activity logs, sniffers, etc.
Does the customer have access?
125 What types of ITIL/ITSM process capabilities does proposer employ to manage infrastructure?*
126 Does proposer provide access to performance reports on network uptime, downtime, and system outages?
Does the customer have access?
127 Does proposer provide DPU staff access to server and system logs?
128 Does proposer provide immediate notification of unplanned/emergency server outages/upgrades?
129 Can proposer provide DPU notification of planned server outages/upgrades at least 2 weeks in advance?
130 What backup frequency, strategy, and retention does proposer recommend?
131 Does proposer conduct system failover tests for critical systems? If so, how often.
132 DPU plans to provide the licenses for all DPU side, client software including CC&B, Oracle RDBMS.
Describe which licenses are for what products DPU is expected to provide over and above these?
133 Provide a diagram and a description of the architecture, servers, CPU’s, memory, SAN, and networking to meet DPU requirements.
Service Level Agreements
134 Does proposer offer a written service level agreement with economic remedies?
135 Does proposer offer a standard SLA or is it custom developed for every client?
136 How does proposer report performance against SLA?
137 Is the SLA included in the price quote?
File details come from the government source that posted it. Updated .