Questions and Answers - DCSC-23-RFP-163.pdf

Offeror Questions and Answers

DCSC-23-RFP-163

Legal Case & Document Management System

1. Towards the top of page there is a requirement that the solution be FedRAMP compliant, which would mean a vendor hosted solution. Would the organization consider a solution that is hosted in the client data center or the client cloud, or does the solution need to be hosted in the vendor cloud? Thanks for your prompt response.

Answer:

The solution can be hosted in Courts’ Microsoft Azure Gov cloud if the vendor is able to provide cloud managed services, e.g., migration, configuration, optimization, security, and maintenance. Access will be granted to perform these services.

2. When they mention, optimization, security and maintenance are they referring to our application or are they referring to the security, optimization and maintenance of the server environment in your Azure cloud?

Answer:

The vendor is responsible for supporting the infrastructure to run the application hosted in the Court-owned Microsoft Azure. Administration entails performing regular maintenance, security patching, and updating infrastructure components required to run the application within MS Azure. It also entails providing performance monitoring and system health checks. The Court's IT team will provision the virtual machine(s) per the vendor's specifications, configure, and maintain any other infrastructure to ensure all

Court locations have the required network, workstation, peripheral, and software to access the applications.

3. Referring to Page 38 of 47, Tab D TAB D – PAST PERFORMANCE / CUSTOMER

SERVICE “References should include customers who have had experience with the proposed project manager and lead staff.” Must each reference refer to the proposed PM and Lead Staff, or can the PM and Lead Staff be referenced in different past performances? Can personnel be referenced in individual past performances? One reference for the PM, one referring to the Lead AE for example?

Past Performance references and evaluations forms may, but are not required to, identify a particular project manager or other named personnel. Therefore, the sentence cited in the offeror’s question (“References should include customers who have had experience with the proposed project manager and lead staff.”), and only that sentence, is stricken in its entirety and replaced with the following new sentence:

“If possible, past performance references and past performance evaluation forms should include customers who have had experience with the proposed project manager.”

All other terms and conditions in Section L (Instructions, Conditions and Notice to Offerors) remain unchanged.

4. Has the District of Columbia Courts received demonstrations from any firms or for any products related to the RFP?

The Courts cannot share this information. Offerors will be required to provide a virtual demonstration as described in Section L.16 (p.41) of the RFP. The anticipated demonstration dates are September 11-13.

5. Can the District of Columbia Courts share the budget appropriated for the opportunity?

The Courts cannot share this information.

6. Does the District of Columbia Courts have a preferred implementation timeline?

The Courts would like to implement the System as soon as possible, preferably no later than the end of November.

7. Please clarify what is meant by a "FedRamp Compliant" solution. FedRamp has

"Authorized" or "Ready" products, or products undergoing authorization, at varying levels. Is DC limiting responses to FedRamp Authorized solutions only? If so, what impact level is sought - Low, Moderate, or High?

Answer:

The Courts will accept FedRAMP Authorized or Ready designations. If the offeror’s solution has a Ready designation, the Offeror is expected to obtain an Authorized designation after 12 months. The Courts require a FedRAMP moderate impact level.

The following provisions in Section C (Description/Specifications/Work Statement) are amended accordingly:

Section C.5(n) (p. 7) is replaced in its entirety with the following: “FedRAMP

Authorized or Ready designation. If the offeror’s solution has a Ready designation, it is expected to obtain an Authorized designation after 12 months.”

Section C.9(a) (p. 8) is replaced in its entirety with the following: “Comply with NIST-

800-53 security controls. A FedRAMP Moderate Cloud Service Provider is required.”

All other terms and conditions in Section C remain unchanged.

8. Given the upcoming holiday weekend, would DC be amenable to extending the response deadline by one-week?

The Courts cannot extend the deadline for submission of proposals.