CB11-RFQ0001 QAs.docx

Questions and Answers for Web Hosting Solicitation # CB11-RFQ0001 6/27/2011

Question 1: Is this work a new requirement for the CBO or is it a recompete of an existing contract?

Response: The work under this RFQ is a new requirement for CBO. The website is currently being hosted internally by the agency. [Ref. RFQ SOW ¶3.2] Question 2: The Statement of Work does not list any FISMA compliance security requirements. What FISMA security compliance (e.g. NIST 800-53, operational controls, management controls, technical controls) is expected to be provided by the vendor?

Response: As a Legislative Branch agency, CBO is not required to comply with NIST or FISMA. However the intent of various requirements in the Statement of Work (i.e., Contractor shall provide a detailed description of all security protection provided, to include physical protections of the building/computer room, firewalls, antivirus, IDS/IPS, forensics, and packet capture; Contractor shall provide a description of disaster recovery capabilities, to include rolling back the environment to a previous point in time; Contractor should specify internal methodology for change control of system software) were all intended to determine the Contractor’s ability to deliver various aspects of NIST/FISMA compliance. [Ref. RFQ SOW ¶3.3] Thus, rather than stating compliance with FISMA regulation X, offerors should describe their capabilities or plans and how those plans are implemented as they relate to our requirements.

Question 3: What risk categorization has been assigned to this system (FIPS199 Low, Moderate or High)?

Response: CBO considers the risk categorization to be Moderate.

Question 4: Who is going to be responsible for FISMA compliance documentation (System Security Plan, Contingency Plan, Configuration Management Plan Risk Assessment, System Hardening, Initial Vulnerability Scan Reports)? Vendor or CBO?

Response: Vendor – however CBO would not require full reporting on all aspects of FISMA. (See also the response to Question 2.)

Question 5: Is having experience managing similar solutions for other Federal Agencies a requirement?

Response: Experience with other Federal agencies is not a requirement.

Question 6: Will successful vendor be required to demonstrate compliance with NIST Special Publication 800-53 Revision 3?

Response: No, however CBO may require documentation on specific components of 800-53. (See also the response to Question 2.)

Question 7: Can we have subcontractors?

Response: You may use subcontractors for this project. Your offer should include sufficient information about the subcontractor(s) where appropriate (i.e., past performance information, technical capability, etc.).

Question 8: Do the front-end web server and back-end DB server have the same hardware specs?

Response: There is no hard requirement that the web server and the database server have the same hardware specs.

Question 9: Are there only 2 servers total in both the production and staging environment? (4 total) Response: The agency requires a 99.9% uptime guarantee. CBO has a preference for solutions that are redundant at every point. Offerors may propose a four-server solution (a single web server and single database server in production and a single web server and a single database server in staging) if the proposal also includes sufficient evidence that such a solution will meet the 99.9% uptime requirement.

Question 10: Is RHEL 5 okay? We have not officially released RHEL 6 yet.

Response: The agency has a strong preference for solutions running the latest versions of Linux, Apache, MySQL and PHP. All software, regardless of version, must be running the latest updates and patches.

Question 11: Do production and staging need to be in separate Data Centers?

Response: No.

Question 12: The requirements mention, “Hosting solution must be front-end load-balanced to facilitate adding web front-ends as necessary.” [Ref. RFQ SOW ¶3.3.4] Does this mean there are multiple web servers from the onset?

Response: See the response to Question 9. The agency requires 99.9% uptime, and has a strong preference for a solution that does not include any single-point-of-failure.

Question 13: Our standard backup plan includes 6 daily incremental backups and a weekly full backup- can you let us know the total amount of data we’ll be backing up each month? GB’s is fine.

Response: CBO estimates that a single full backup of the website and database will be less than 26GB for the first year of operation.

Question 14: Ref. RFQ SOW ¶3.3, Requirement #7 – “Contractor will provide complete management of the entire LAMP environment, including infrastructure and software.”

Would CBO please define “complete management?” Industry standards within the Datacenter community manage the environment up to the OS level. Does this meet CBO’s requirement? If not, could you expand upon “complete management”?

Response: The Contractor will be responsible for managing the network, hardware, operating system, and application infrastructure components (including Apache, MySQL, and PHP). CBO will maintain the application and all content.

Question 15: Ref. RFQ SOW ¶3.3, Requirement #15 – “Contractor shall specify a solution for backing up the site to CBO. The solution must include provisions for backup of the entire site (including structure, contents, and database) to CBO daily, and a full system backup to CBO weekly.”

Will CBO provide equipment at the CBO site for the daily, and a full system backup to be sent to? Or is it CBO’s intention that the solution for backing up the site to CBO would include required hardware and software for CBO’s site to be provided by the offeror? Or is it CBO’s intention that daily, and weekly full system backup be done and be available to CBO on demand?

Response: The requirement is that the backups be physically housed at CBO on equipment owned by the agency. We have requested that offerors provide the methodology for how they will accomplish this as there are multiple solutions and CBO does not have an existing system in place for this.