CB20-RFQ0001amend001 Web Hosting Services.pdf

AMENDMENT OF SOLICITATION/MODIFICATION OF CONTRACT

1. CONTRACT ID CODE

2. AMENDMENT/MODIFICATION NO.

-001

3. EFFECTIVE DATE

01/24/2020

4. REQUISITION/PURCHASE REQ. NO. 5. PROJECT NO. (If applicable)

AOCBOCODE

Acquisitions Office Congressional Budget Office 425A FHOB 2nd & D Streets, SW Acquisitions@cbo.gov Washington, DC 20515

6. ISSUED BY CODE7. ADMINISTERED BY (If other than Item 6)

9A. AMENDMENT OF SOLICITATION NO.

CB20-RFQ0001

CODE FACILITY CODE

8. NAME AND ADDRESS OF CONTRACTOR (No., street, country, state and ZIP Code) (X)

X 9B. DATED (SEE ITEM 11)

11/06/2019

10A. MODIFICATION OF CONTRACT/ORDER NO.

10B. DATED (SEE ITEM 11)

11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS

X XThe above numbered solicitation is amended as set forth in item 14. The hour and date specified for receipt of Offers is extended, is not extended, Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods: (a) By completing items 8 and 15, and returning ____copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer submitted; or (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER. If by virtue of this amendment your desire to change an offer already submitted, such change may be made by telegram or letter, provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified.

12. ACCOUNTING AND APPROPRIATION DATA (If required)

13. THIS ITEM ONLY APPLIES TO MODIFICATION OF CONTRACTS/ORDERS.

IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14.

CHECK ONE A. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT

ORDER NO. IN ITEM 10A.

B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103(b).

C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF:

D. OTHER (Specify type of modification and authority)

E. IMPORTANT: Contractor is not, is required to sign this document and return _______ copies to the issuing office.

14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.)

Project Title: Web Site Hosting

Purpose of Amendment: This amendment (1) revises the Statement of Work on page 4 of the solicitation; and (2) adds the Q&A document.

(Details provided on the following page)

Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect.

15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME AND TITLE OF CONTRACTING OFFICER (Type or print)

(Signature of person authorized to sign)

15B. CONTRACTOR/OFFEROR 15C. DATE SIGNED

By (Signature of Contracting Officer)

16B. UNITED STATES OF AMERICA 16C. DATE SIGNED

NSN 7540-01-152-8070

Previous edition unusable

STANDARD FORM 30 (REV. 10-83)

Prescribed by GSA FAR (48 CFR) 53.243

Document Number: CB20-RFQ0001 Page 1 of 8

Solicitation No. CB20-RFQ0001 – Amendment No. 001 Page 2 of 8

A. Description of the Changes: The solicitation is hereby amended to incorporate the following changes:

1. Paragraph 17 of the Statement of Work has been revised to have offerors provide additional details on the type of services they provide for disaster recovery. See Attachment 1.

2. Answers to questions from interested offerors have been provided in the Q&A document at Attachment 2.

These changes are reflected in the revised pages included with this amendment.

B. No Adjustment in the Solicitation Due Date for Offers: The due date for offers remains 12:00 p.m.

local time on Tuesday, February 7, 2020.

Section 1 - Continuation Sheet

Number Supplies or Services Quantity Unit Unit Price Total ( Inc. disc., tax, and fees)

1 Base Year: Web Site Hosting Original: 12.000000

Change: 0.000000

Current: 12.000000 MONTH

Period of Performance: 04/01/2020 - 05/31/2021

Description: Contractor shall provide a fully managed enterprise Drupal hosting solution for the agency’s public-facing website. See Statement of Work for details.

2 Option Year 1: Web Site Hosting Original: 12.000000

Change: 0.000000

Current: 12.000000 MONTH

Period of Performance: 06/01/2021 - 05/31/2022

Description: Contractor shall provide a fully managed enterprise Drupal hosting solution for the agency’s public-facing website. See Statement of Work for details.

3 Option Year 2: Web Site Hosting Original: 12.000000

Change: 0.000000

Current: 12.000000 MONTH

Period of Performance: 06/01/2022 - 05/31/2023

Description: Contractor shall provide a fully managed enterprise Drupal hosting solution for the agency’s public-facing website. See Statement of Work for details.

4 Option Year 3: Web Site Hosting Original: 12.000000

Change: 0.000000

Current: 12.000000 MONTH

Period of Performance: 06/01/2023 - 05/31/2024

Description: Contractor shall provide a fully managed enterprise Drupal hosting solution for the agency’s public-facing website. See Statement of Work for details.

5 Option Year 4: Web Site Hosting Original: 12.000000

Change: 0.000000

Current: 12.000000 MONTH

Period of Performance: 06/01/2024 - 05/31/2025

Description: Contractor shall provide a fully managed enterprise Drupal hosting solution for the agency’s public-facing website. See Statement of Work for details.

Document Number: CB20-RFQ0001 Page 3 of 3

Attachment 1

Solicitation No. CB20-RFQ0001 – Amendment No. 001 Page 4 of 18

7. CBO has a strong preference for 24x7 customer support including live chat support, phone support and access to a ticket support system with priority routing. Support personnel must be U.S.-based.

8. Hosting solution must provide reliable 24x7x365 server/website monitoring. Escalation during emergency situations a must.

9. Contractor must offer support through documentation and preferably provide developer onboarding and technical training to ensure platform success.

10. Hosting solution must include an easy to use developer dashboard interface to manage the CBO website with the following features:

a. Advanced DevOps operations via dashboard for dev, test and live environments

b. Automated daily backups

c. Developers and CBO Security staff must have the ability to access logs

d. Developers will have the ability to view and download logs

e. Visible git history

f. Manage developer team, generate access tokens and manage SSH authentication keys

g. Site monitoring and status checks

h. Automated alerts during downtime and sitewide failure via email

i. Create sandbox sites or remote development environments

j. On-server development via sftp mode

11. Hosting solution must include preinstalled CLI tools such as Drush, composer, Git and cloud integration tools that allow for running cloud platform hooks or scripts for workflow automation.

12. Hosting solution must be compatible with local development environment tools including Lando for local site and feature development and must offer a reliable upstream workflow and deployment process from the local environment to dev, test, and live.

13. Contractor must offer HTTPS (SSL) certificates for all environments including dev and test environments, with contractor responsible for management of those SSL certificates.

14. Hosting solution must be highly performant and must offer advanced caching capabilities such as Varnish, preferably an integrated global CDN.

15. Hosting solution must be highly reliable and highly secure and provide industry-leading WAF-style rules and must offer DDoS protection filtering to manage denial-of-service attacks, as well as provide protection from malware and other malicious attacks.

16. Hosting solution must include provisions for secure remote (role-based) access and support for SAML integration and enabling security features like multi-factor authentication and single sign-on.

17. Contractor shall provide a description of disaster recovery capabilities, to include rolling back the environment to a previous point in time. Offerors should also address: how they respond to hardware failure or an unforeseen incident at one of their facilities; where the snapshots/backups of the web site are happening; the promised up-time in their standard agreement; the number and location of any co-locations; which co-location(s) the CBO website would get switched to and in what order; how the switch happens, i.e., based on load balance or fail-over; and any other pertinent information.

18. Contractor shall provide a detailed description of all security protection provided to include physical protections of the building/computer room, firewalls (both inbound and outbound), antivirus, IDS/IPS, forensics, and packet capture.

19. Security management must be at the highest level and must include OS/server and database upgrades/patches, rapid response to emergency Drupal security incidents with early notification and a plan for and assuring that all patches and upgrades (particularly those related to security vulnerabilities) are up-to-date.

20. CBO has a strong preference for the automated transmission of log data to CBO’s central data collection (SIEM) via TLS encrypted syslog or secure API. CBO security is primarily concerned

Attachment 2

Questions and Answers for Web Hosting Services Solicitation No. CB20-RFQ0001

January 24, 2020

Question 1: How many websites does the CBO expect to host under this contract?

Answer: CBO has one Drupal website. We only require one for hosting but also need the ability to spin up sandbox or remote development environments.

Question 2: Would CBO be amenable to multiple 24- or 36-month contracts, rather than one 60-month contract, for this work?

Answer: This is not technically a 60-month contract because it has discrete 12-month performance periods. The term of the contract is for the Base Year Period of 12 months with annual options to extend for up to four years. CBO may extend the term of this contract by written notice to the Contractor.

Question 3: Would CBO plan to work with a web development agency or will all development be done internally? If CBO plans to work with an agency, can you provide an overview of the agency's scope of work?

Answer: We have a contract with a company that offers web services. We give them small-to-medium projects and they provide web services (maintenance, core & module updates, developer back-up) when needed. We also have another contractor that works 10-hours per week on small projects. All other development is done by in-house staff.

Question 4: Can CBO summarize the ideal state for this website portfolio?

Answer: Due to CBO’s critical mission for the U.S. Congress, the website needs to be highly available, secure and performant. This is our public-facing website and Hill staff users are considered our main audience.

Question 5: Does CBO have any specific compliance needs for the disaster recovery services?

Answer: CBO does not have any external standards or regulations that these services have to meet. Offerors should include details in their offer about their disaster recovery services and process. This may include:

• How they respond to hardware failure or an unforeseen incident at one of their facilities.

• Where the snapshots/backups of the web site are happening.

• The promised up-time in their standard agreement.

• The number and location of any co-locations, which one(s) cbo.gov would get switched to and in what order.

• How the switch happens, i.e., based on load balance or fail-over.

This information has also been added to the solicitation Statement of Work at paragraph 17 of section 2.3, Requirements, by Amendment No. 001.

Question 6: Since this solicitation has been released as a special Notice, do you anticipate lot of proposal submissions?

Answer: We cannot anticipate how many proposals are going to be submitted. We have made every effort to make this solicitation available to interested offerors despite the technical issues with beta.SAM.gov. We were able to resolve the issue with beta.SAM.gov in mid-January so the solicitation and amendment(s) are posted as the correct type of notice. We will amend the Special Notice if necessary to direct offerors to the solicitation.