ATTACHMENT B - RFP Vendor Response Matrix.xlsx
XLSX spreadsheet 24 KB Posted
- Attached to
- Endpoint Backup Software Solution
- Solicitation number
- RFP-122486
- Issued by
- Montgomery County, Virginia
About this file
This is a Vendor Response Matrix attachment for an RFP issued by Virginia Tech's Division of Information Technology for an enterprise-wide endpoint backup software solution. The RFP seeks a comprehensive backup platform capable of protecting all department endpoints across the university's campus, with a platform-agnostic service model designed to support consistent protection for user endpoint devices while optimizing resource management. The solution must address 46 core requirements and 14 preferred requirements spanning endpoint coverage (Windows, macOS, Linux, remote/off-network), storage architecture (cloud-managed SaaS deployment, unlimited storage per user), backup behavior (continuous backup, incremental backups, ransomware recovery), restore and recovery capabilities (self-service and admin-initiated restore, point-in-time recovery, device replacement workflows), security and identity features (encryption, SSO/federation, MFA, role-based access control), deployment and administration (silent mass deployment, centralized policy management, delegated administration, coverage reporting), retention and governance (policy management, legal hold capabilities), and commercial terms (per-user/seat pricing, support models, implementation services).
The response matrix requires vendors to indicate whether each requirement is met through "Yes," "Partial," or "No" responses, specifying the delivery method for each requirement (Out-of-box, Configuration, Customization, or Roadmap) and providing detailed notes and evidence. The RFP explicitly references Virginia Tech's current solution, CrashPlan, indicating this is a replacement procurement where vendors must address large-scale migration capabilities, transition support, and implementation/onboarding services with proposed timelines and cost details. Key preferred capabilities include mobile/tablet support, data residency options, hybrid storage configurations, encryption-key management, advanced analytics and APIs, dedicated technical account managers, pilot/proof-of-concept availability, BYOD support, and automated user provisioning. Vendors must provide comprehensive documentation supporting all feature claims and must address how their solution handles complex scenarios such as shared workstations, labs, kiosks, multi-user environments, and delegated administration across multiple organizational units.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| ATTACHMENT C - Pricing Response.xlsx | XLSX spreadsheet | |
| RFP 544432701 - Endpoint Backup Software Solution_FINAL.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
RFP Vendor Response Matrix
| ATTACHMENT B | |||
| Statement of Needs Response Matrix - Endpoint Backup Software | |||
| Vendor Legal Name | Product Name | Vendor to Fill this Section | |
| Vendor Primary Contact | Date Returned | ||
| Response Guidance | Use Yes / Partial / No. If Partial or No, explain clearly. Also state Out-of-box / Configuration / Customization / Roadmap. |
Req ID Azam, Aftab:
short unique reference label for each requirement Section Ref Azam, Aftab:
| Numbering reference for where the requirement sits in the RFP structure | Category | Requirement | What Vendor Must Answer | Vendor Response |
| (Click the cell and pick an option) | Delivery Method |
(Click the cell and pick an option) Azam, Aftab:
Indicates how the requirement is delivered , whether available by default or requires additional setup.
Out-of-box: Available by default with no setup Configuration: Requires setup or enabling within the product Customization: Requires scripting or modification beyond standard settings
| Roadmap: Not currently available; planned for future release | Notes / Explanation | Evidence / Page Ref | |||
| EP-01 | 8.1.1 | Endpoint Coverage | Support for Windows desktop and laptop endpoints | Confirm whether the solution supports backup of Windows desktop and laptop endpoints. | |
| EP-02 | 8.1.2 | Endpoint Coverage | Support for macOS desktop and laptop endpoints | Confirm whether the solution supports backup of macOS desktop and laptop endpoints. | |
| EP-03 | 8.1.3 | Endpoint Coverage | Support for Linux endpoints | Confirm whether the solution supports backup of Linux endpoints, and list supported Linux distributions if applicable. | |
| EP-04 | 8.1.4 | Endpoint Coverage | Remote/off-network backup over the internet | Confirm whether endpoints can back up securely over the internet when they are off campus, off network, or working remotely, without requiring a normal VPN connection. | |
| EP-05 | 8.1.5 | Endpoint Coverage | Laptop and desktop coverage under one platform | Confirm whether the same product and central management console protect both laptops and desktops. | |
| EP-06 | 8.1.39 | Endpoint Coverage | Support for shared devices and shared workstations | Confirm whether the solution supports backup for shared devices, shared workstations, labs, kiosks, or other multi-user endpoint scenarios. Briefly explain how backup and restore are handled in these environments, including any licensing, user-account, or access-control considerations. | |
| ST-01 | 8.1.6 | Storage & Architecture | Cloud-managed / SaaS endpoint backup without required on-prem infrastructure | Confirm whether the standard deployment model is cloud-managed/SaaS and whether normal endpoint backup operations can be delivered without requiring Virginia Tech to deploy or manage on-prem backup servers, storage, or other backup infrastructure. If any on-prem component is required, explain exactly what it is and why. | |
| ST-02 | 8.1.7 | Storage & Architecture | Unlimited storage per protected user/seat | Confirm whether the quoted pricing includes unlimited storage per protected user/seat. If storage is not unlimited, explain all limits, fair-use terms, and overage charges. | |
| ST-03 | 8.1.8 | Storage & Architecture | Support for multiple devices under one user license | Confirm whether a single licensed user can protect multiple devices under the same licensing model, without requiring a separate full user license for each device. | |
| ST-04 | 8.1.9 | Storage & Architecture | Included number of devices per licensed user | State the exact number of devices included per licensed user before any extra charges, restrictions, or different licensing rules apply. | |
| ST-05 | 8.1.10 | Storage & Architecture | Additional-device pricing or restrictions | If a user protects more than the included number of devices, explain how those extra devices are priced, limited, restricted, or grandfathered, including any soft limits, fair-use rules, or enforcement approach. | |
| BK-01 | 8.1.11 | Backup Behavior | Continuous or near-continuous backup | Confirm whether the solution continuously or near-continuously backs up endpoint user data as changes occur. | |
| BK-02 | 8.1.12 | Backup Behavior | Incremental backup and file version history | Confirm whether, after the first full backup, only changed data is backed up and earlier file versions are retained for restore. | |
| BK-03 | 8.1.13 | Backup Behavior | Central include/exclude backup policy controls | Confirm whether administrators can centrally define backup include and exclude rules by folder, file path, file type, or user-profile location. | |
| BK-04 | 8.1.14 | Backup Behavior | Lockable backup selection policy | Confirm whether administrators can lock or enforce backup selection policies so users cannot change protected backup scope when required. | |
| BK-05 | 8.1.15 | Backup Behavior | Ransomware recovery support | Confirm whether the solution supports reliable recovery from ransomware events through file version history, point-in-time restore, protected archives, or similar recovery methods. | |
| BK-06 | 8.1.16 | Backup Behavior | Policy-driven backup of user profile and user-data locations | Confirm whether the solution supports centrally managed backup policies focused on user-profile folders or other user-data locations. | |
| RS-01 | 8.1.17 | Restore & Recovery | End-user self-service restore | Confirm whether end users can restore their own files without needing IT assistance. | |
| RS-02 | 8.1.18 | Restore & Recovery | Admin-initiated restore | Confirm whether administrators or help-desk staff can start or assist with file restores for users. | |
| RS-03 | 8.1.19 | Restore & Recovery | Point-in-time and version-based restore | Confirm whether users or administrators can restore earlier versions of files or folders to a selected point in time. | |
| RS-04 | 8.1.20 | Restore & Recovery | Restore to the same device or to a replacement/new device | Confirm whether backup data can be restored to the original device or to a replacement, reimaged, or newly provisioned device. | |
| RS-05 | 8.1.21 | Restore & Recovery | Device replacement and migration workflow | Confirm whether the solution provides a guided device-replacement or migration process that helps preserve user continuity during transition to a new device. | |
| RS-06 | 8.1.40 | Restore & Recovery | Separate control of web restore and desktop/client restore | Confirm whether administrators can separately enable or disable web/browser-based restore and desktop/client-based restore. | |
| SE-01 | 8.1.22 | Security & Identity | Encryption in transit and at rest | Confirm whether data is encrypted in transit and at rest, and briefly describe the encryption approach. | |
| SE-02 | 8.1.23 | Security & Identity | SSO / federation support | Confirm whether the solution supports university SSO login, including systems such as Shibboleth, Microsoft Entra ID, Okta, or other SAML/OIDC-based identity providers. | |
| SE-03 | 8.1.24 | Security & Identity | MFA support | Confirm whether MFA is supported for administrator access and, where applicable, end-user access. | |
| SE-04 | 8.1.25 | Security & Identity | Role-based access control | Confirm whether the solution supports role-based access for central administrators and delegated organizational admins. | |
| SE-05 | 8.1.26 | Security & Identity | Audit logging | Confirm whether the solution logs the restore activity, admin actions, policy changes, device activity, and access events. | |
| SE-06 | 8.1.27 | Security & Identity | Tenant / organization segregation | Confirm whether the solution allows central IT to manage the whole environment while giving each department or business unit its own separate admin scope, users, devices, and policies. | |
| SE-07 | 8.1.41 | Security & Identity | Granular restore-right controls by role | Confirm whether restore permissions can be controlled by role, including self restore, web restore, cross-device restore, and administrator restore rights. | |
| AD-01 | 8.1.28 | Deployment & Admin | Silent mass deployment | Confirm the endpoint agent can be deployed silently at scale. | |
| AD-02 | 8.1.29 | Deployment & Admin | Integration with endpoint-management tools | Confirm support for deployment through endpoint-management tools such as Intune, Jamf, BigFix, SCCM, RMM (Remote Monitoring and Management), Kaseya or equivalent platforms. | |
| AD-03 | 8.1.30 | Deployment & Admin | Centralized policy management | Confirm backup behavior, file selection, retention, and restore controls can be centrally managed. | |
| AD-04 | 8.1.31 | Deployment & Admin | Delegated administration | Confirm the solution allows central IT to give departments or business units limited or granular admin access to manage only their own orgs/users/devices, while the central team keeps full oversight and higher-level admin control. | |
| AD-05 | 8.1.32 | Deployment & Admin | Coverage and health reporting | Confirm the system reports device coverage, backup success/failure, stale devices, last backup time, and related health indicators. | |
| AD-06 | 8.1.42 | Deployment & Admin | Device-based / hostname-based registration or deployment | Confirm the solution supports device-based, hostname-based, or other non-user-based registration and deployment methods for shared workstations, lab devices, kiosks, or other special-purpose endpoints, without requiring a separate agent installation or registration workflow for each user on the same device. | |
| AD-07 | 8.1.43 | Deployment & Admin | Policy inheritance and override across org hierarchy | Confirm whether the solution supports a hierarchical administrative structure where policies can be inherited from parent levels and selectively overridden at lower levels, such as by department, business unit, group, or similar administrative scope. If different terminology is used, explain the equivalent model. | |
| RC-01 | 8.1.33 | Retention & Governance | Retention and version-history policy management by central IT and also by the authorized org/sub-org admins | Confirm whether the solution allows central IT and authorized delegated administrators to manage retention and file-version history policies within their assigned administrative scope, including support for inherited settings and selective overrides where permitted. If the solution uses different terminology for administrative hierarchy, explain the equivalent model. | |
| RC-02 | 8.1.34 | Retention & Governance | Retention of deleted files | Confirm deleted files can be retained for a configurable period. | |
| RC-03 | 8.1.35 | Retention & Governance | Secure customer data deletion, return, and contract-exit handling | Describe how customer backup data is securely deleted, sanitized, retained, exported, or returned at contract end or upon customer request, including timelines, responsibilities, and whether deletion confirmation/certification is provided | |
| CM-01 | 8.1.36 | Commercial & Support | Per-user/seat pricing and pricing basis | Provide list price and proposed price per user/seat, state whether pricing is monthly or annual, and describe what is included in the seat price. | |
| CM-02 | 8.1.37 | Commercial & Support | Quoted pricing includes unlimited storage | Confirm clearly whether the quoted price includes unlimited storage for protected users/endpoints. If not, explain all storage limits, fair-use restrictions, overage charges, and any conditions that could increase cost. | |
| CM-03 | 8.1.38 | Commercial & Support | Support model, support channels, and SLAs | Describe the standard support model, support channels, hours of support, response and escalation times by severity level, and any premium or named-support options. Also state whether support is provided for administrators only or for both administrators and end users. | |
| PR-08 | 8.1.45 | Deployment & Admin | Large-scale migration tools and transition support | Confirm whether the vendor provides proven tools, bulk processes, and technical support to migrate users, devices, and backup relationships from an existing endpoint-backup platform at scale, including migration planning, cutover, coexistence where needed, issue escalation, and post-migration stabilization. Also describe any major migration limitations. |
Azam, Aftab:
About migration capability at scale: tools, bulk processes, cutover, stabilization, and limitations.
| PR-14 | 8.1.46 | Retention & Governance | Legal hold, preservation, and retention-lock capability | Confirm whether the solution supports legal hold, preservation, retention lock, or equivalent workflows to prevent deletion of backup data when required for legal, compliance, or investigation purposes. If unsupported, explain. |
| PR-18 | 8.1.47 | Commercial & Support | Implementation, onboarding, and migration services | Describe the implementation, onboarding, training, and migration services available to help Virginia Tech transition from its current solution, CrashPlan, to the proposed solution, including the proposed transition approach, major phases, timeline, deployment support, user/device transition, issue escalation, and post-migration assistance. Also state which services are included in standard service and which are separately charged. Provide numeric cost details in the Vendor Pricing Response sheet under PC-06 and proposed timeline details under PC-07. |
Azam, Aftab: About implementation/onboarding/migration services and whether those services are included or separately charged.
| PR-01 | 8.2.1 | Endpoint Coverage | Mobile/tablet support | Confirm whether mobile or tablet backup is supported. If unsupported, state No. |
| PR-02 | 8.2.2 | Storage & Architecture | Data residency / region choice | Confirm whether backup data can be stored in selected geographic regions and explain options. |
| PR-03 | 8.2.3 | Storage & Architecture | Hybrid, local, and alternate storage options | Confirm whether the solution supports backup to alternate storage targets such as local attached disk, external drive, NAS/file share, customer-owned storage, object storage, or hybrid combinations with cloud storage, if needed. |
| PR-04 | 8.2.4 | Backup Behavior | Bandwidth, CPU, and endpoint performance controls | Confirm the solution allows administrators to control bandwidth usage, CPU usage, and other backup-performance settings on endpoints so backups can be tuned to reduce user impact. |
| PR-05 | 8.2.5 | Backup Behavior | Pause/resume and backup behavior controls for roaming or limited-connectivity users | Confirm the solution allows backup activity to be paused, resumed, or tuned for roaming users, laptops, metered networks, and temporary low-bandwidth conditions. |
| PR-06 | 8.2.6 | Restore & Recovery | Cross-device restore by authorized admins | Confirm the solution allows authorized administrators to restore backup data from one protected device to a different device when needed, such as during device replacement, migration, or recovery. |
| PR-07 | 8.2.7 | Restore & Recovery | Search within backup history / archives | Confirm whether users or administrators can search for files within backup history or archives before restoring them. |
| PR-09 | 8.2.9 | Restore & Recovery | Bare-metal or full-image endpoint recovery | Confirm whether the solution supports full-image or bare-metal recovery of an endpoint, including restore of the operating system, applications, and settings. If unsupported, state No. |
| PR-10 | 8.2.10 | Security & Identity | Encryption-key ownership and key-management options | Describe who manages the encryption keys, whether customer-managed keys are supported, whether vendor-managed keys are supported, and what key-management options are available for different deployment models or service tiers. |
| PR-11 | 8.2.11 | Deployment & Admin | Alerts, dashboards, and device health visibility | Confirm the solution provides dashboards, alerts, and health visibility for unhealthy, stale, failed, or non-compliant devices. |
| PR-12 | 8.2.12 | Deployment & Admin | API and raw data export access | Confirm whether the solution allows raw and report-ready data exports, or API access, for key objects such as users, organizations, devices, alerts, and backup activity for reporting, automation, and integration with other systems. |
| PR-13 | 8.2.13 | Deployment & Admin | Integration with enterprise identity systems | Confirm whether the solution integrates with enterprise identity systems such as Active Directory, Microsoft Entra ID, Shibboleth, Okta, or other SAML/OIDC-based identity providers for user and admin management. |
| PR-15 | 8.2.15 | Retention & Governance | Audit trail and compliance review support | Confirm whether the solution provides audit logs, activity history, and reporting that support security review, compliance review, and investigation of administrative or restore activity. |
| PR-16 | 8.2.16 | Retention & Governance | Central data retention and handling policy controls | Confirm whether the solution allows central IT to define and manage policy controls for endpoint data retention, handling, and governance. |
| PR-17 | 8.2.17 | Commercial & Support | Dedicated TAM (Technical Account Manager), named support contacts, and premium support options | State whether the vendor offers a Technical Account Manager (TAM), named support contacts, or other premium support options, and explain what is included and whether these services are separately charged. |
| PR-19 | 8.2.19 | Commercial & Support | Pilot, proof-of-concept, or evaluation availability | Confirm whether the vendor can provide a pilot, proof of concept, trial, or evaluation tenant so Virginia Tech can validate features, administration, reporting, and restore workflows before full commitment. |
| PR-20 | 8.2.20 | Endpoint Coverage | Support for personally owned or bring-your-own devices (BYOD) | Confirm whether the solution supports backup of personally owned or bring-your-own devices (BYOD), and explain any policy, licensing, security, or administrative limits that apply. |
| PR-21 | 8.2.21 | Reporting & Monitoring | Scheduled reports and advanced data exports | Confirm whether the solution supports scheduled reports, advanced data exports, and recurring delivery of operational, administrative, or compliance-related data. |
| PR-22 | 8.2.22 | Endpoint Experience | End-user web portal and desktop client experience | Describe the end-user web portal and desktop client experience for checking backup status, restoring files, searching backup history, and performing other self-service actions. |
| PR-23 | 8.2.23 | Deployment & Admin | Central administration across multiple organizations or units | Confirm whether the solution supports central administration across multiple organizations, departments, or business units, while still allowing separate scopes, policies, and delegated admin controls for each unit. |
| PR-24 | 8.2.24 | Backup Behavior | Open/locked file backup support | Confirm whether the solution can back up open or locked files, including support for Windows VSS or equivalent mechanisms where applicable. |
| PR-25 | 8.2.25 | Endpoint Coverage | External drive backup support | Confirm whether the solution can back up approved external or USB drives attached to protected endpoints, and explain any policy, licensing, or security limits. |
| PR-26 | 8.2.26 | Reporting & Monitoring | Backup verification and recoverability checks | Confirm whether the solution verifies backup integrity or recoverability and can alert on missed files, corrupt archives, or verification failures. |
| PR-27 | 8.2.27 | Networking & Performance | Proxy server support | Confirm whether endpoint backup traffic can work through enterprise proxy servers, including support for authenticated proxy configurations where applicable. |
| PR-28 | 8.2.28 | Deployment & Admin | Automated user provisioning and deprovisioning | Confirm whether the solution supports SCIM or equivalent automated user lifecycle provisioning and deprovisioning. |
| PR-29 | 8.2.29 | Deployment & Admin | Bulk user or device onboarding | Confirm whether administrators can bulk import, provision, or onboard users or devices for large deployments or migrations. |
| PR-30 | 8.2.30 | Endpoint Coverage | ARM-based Windows device support | Confirm whether the solution supports ARM-based Windows devices such as Microsoft Surface devices, and list any platform limitations. |
Azam, Aftab: Does the backup product support Windows devices that use ARM processors, such as some Microsoft Surface models?
Azam, Aftab:
short unique reference label for each requirement Azam, Aftab:
About migration capability at scale: tools, bulk processes, cutover, stabilization, and limitations.
Azam, Aftab:
Numbering reference for where the requirement sits in the RFP structure Azam, Aftab: About implementation/onboarding/migration services and whether those services are included or separately charged.
Azam, Aftab:
Indicates how the requirement is delivered , whether available by default or requires additional setup.
Out-of-box: Available by default with no setup Configuration: Requires setup or enabling within the product Customization: Requires scripting or modification beyond standard settings
| Roadmap: Not currently available; planned for future release | AD-08 | 8.2.31 | Deployment & Admin | Training / onboarding resources and admin documentation | Describe available training, onboarding resources, administrative documentation, and implementation guides provided to customers. |
| PR-31 | 8.2.32 | Deployment & Admin | Automatic agent/client update management | Confirm whether endpoint backup agents can be automatically updated to newer supported versions, and explain how update timing, approval, rollout control, and version management are handled. | |
| PR-32 | 8.2.33 | Reporting & Monitoring | User-facing backup status and failure notifications | Confirm whether the solution can automatically notify end users about backup success, failure, missed backups, or other important backup status events, and describe the available notification methods. | |
| PR-33 | 8.2.34 | Reporting & Monitoring | Scoped reporting for delegated org/sub-org admins | Confirm whether delegated administrators can view, run, and receive reports only for the users, devices, and backup activity within the organizations or sub-organizations they manage. | |
| PR-34 | 8.2.35 | Backup Behavior | Cloud-sync awareness and exclusion handling | Confirm whether the solution allows administrators to define exclusion rules, or otherwise intelligently handle cloud-synced data sources such as OneDrive, Google Drive, and iCloud to prevent duplicate backup, unnecessary storage growth, and restore conflicts. |
File details come from the government source that posted it. Updated .