ESBD_432148_1751314733411_12 - 3202500148 Attachment 12 Data Center Services.docx

Attachment 12: Data Center Services (DCS) and DCS Templates

1.0 DCS Infrastructure Requirements

The Texas Legislature, by action of House Bill 1516, 79th Legislature (Regular Session), established the foundation of a shared technology infrastructure and directed Department of Information Resources (DIR) to coordinate a statewide program to consolidate infrastructure services. Section 2054.391 requires State agencies included in the Data Center Services (DCS) program to use such services, unless otherwise approved by DIR through a Data Center Services Exemption. DIR currently has executed multi-vendor contracts to provide data center managed services for DIR Customers.

All hosted solutions offered in response to this RFO (including custom developed application, COTS, and Portal or Website managed content) must host the application or solution in the DCS program, using either public or private cloud compute and DCS managed services provided.

Respondents should comprehensively list their infrastructure or compute requirements, to be hosted in either a DCS public or private cloud, for financial review by the Texas Workforce Commission (TWC). The TWC will facilitate the process to request an estimate of the cost to host the solution within the DCS program.

If the Respondent intends to propose SaaS, then the Respondent must demonstrate that the solution clearly meets the National Institute of Standards and Technology (NIST) standard definition of SaaS (NIST Definition of Cloud Computing Special Publication 800-145). The solution must be TX-RAMP certified (or equivalent substitution). TWC will be required to request and receive from DIR a DCS program exemption before a contract can be awarded to a Respondent if the solution is purchased outside of the DCS program.

More details about the DCS Vendor Contracts, Master Services Agreements (MSAs) and Statements of Work (SOW) may be found on DIR’s website at: www.dir.texas.gov.

Respondents should provide one technical solution: either SaaS or DCS hosted and managed. If your proposal is for a hosted solution, it will need to be hosted in the State’s DCS program, which offers both public and private cloud hosting options. This program provides all server management functions including system administration, operating system management and patching, base security services, dedicated local area network connectivity, storage services, backup services and disaster recovery services. Respondents should indicate whether it is proposing fully managed or semi managed DCS infrastructure hosting and compute solutions required.

Respondents are not required to estimate the cost to host within the DCS program, however, Respondents are required to provide complete technical specifications in order for the TWC to estimate.

Collectively, the DCS contracts provide participating Customers mainframe and server operations, both public and private cloud services, disaster recovery, and bulk print and mail services.

1.1 DCS Public and Private Cloud Compute and Software Acquisition As a participating entity in the DCS program, TWC is required to acquire all in-scope infrastructure compute, services and software through the DCS program. Respondents must include complete compute and software infrastructure requirements in their response in order for TWC to estimate DCS costs.

The Successful Respondent is required to participate in the procurement process, including submitting the request for service into the DCS ServiceNow Tool, participating in the requirements gathering sessions, and validating the acquisition proposals received. Proper long-range planning is required in order to ensure compute is provisioned to meet project schedules.

1.2 DCS Process Management

The Successful Respondent will be required to participate in the defined DCS processes for incident management, problem management, change management, release management, configuration management, and request management.

1.3 DCS Public Cloud

Industry leading public cloud services available from DIR Shared Technology Services are hardened public cloud virtual data center solutions with a focus on aligning the DCS Operating Model with Industry Best Practices, technical and security assurances, and onboarding of public cloud services through Amazon Web Services (AWS), Azure, and Google.

Leveraging Cloud Native tooling, the DCS Cloud Service model is poised to align to the value of Cloud Service Providers by evolving capabilities with investment in Service Evolution of the Public Cloud. Our expanded Public Cloud model delivers Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and SaaS services with products and tooling built for and within the Public Cloud to leverage the full benefits of Public Cloud services with the security assurances of DCS.

1.4 Sandbox Public Cloud Support

This operational model is intended for environments with use cases such as proof-of-concepts, sandbox, and lower lifecycle development and testing activities which can operate with network restrictions preventing communication with the DCS Consolidated Data Centers and unsolicited inbound internet communication. Network connectivity to this environment is through a secure Customer Virtual Private Network (VPN) connection provisioned by the DCS managed service provider.

Native public cloud console access to Public Cloud IaaS services (with minimal restrictions) is available enabling Customer flexibility operating in the Public Cloud.

Customers are fully responsible for services provisioned within the Sandbox support environments, with minimal Service Component Provider (SCP) support provided.

1.5 Semi-Managed Public Cloud Support

The Semi-Managed Cloud operational model is intended for environments where the Customer is responsible for operating system management and monitoring, application-level support and associated incident and change management. This environment requires connectivity through a DCS managed Direct Connect/Virtual Cross Connect (VXC) solution, delivering integration of private cloud resources with public cloud resources including DCS assurances.

DCS solutions enabled for Customers include the following operational functions for the semi managed environments:

· Native Public Cloud console available with full read access to the cloud environment.

· Specific console roles can be discussed with Public Cloud Manager (PCM).

· SaaS based log aggregation services to capture, extract, transform and load pertinent security and event details from Public Cloud management environments.

· Advanced analytics and data correlation greatly extend the success of forensic research and investigation.

· Capture Azure events via Operations Management Suite (OMS) logs; AWS events via Cloud Trails and Cloud Watch; Google Cloud Platform (GCP) events via Cloud Operations Suite.

· Cloud Access Security Broker solution spanning AWS, Azure and GCP providing sophisticated analytics to identify violation of policy and combat cyberthreats,

· Utilizing the Security Instrumentation platform (SIP) to measure against cybersecurity Key Performance Indicator (KPI) and targets. Tests effectiveness of network, endpoint, and cloud controls.

· Advanced, customizable reporting with comprehensive API access and integration across multiple platforms.

· Endpoint protection online or offline with integration into tools such as Windows System Center for compliance and regulatory requirements and mandates.

The DCS SCP is responsible for:

· Provisioning and deprovisioning,

· Enabling Customer console and IaaS access,

· Acquiring, installing, and patching the operating system,

· Installing and maintaining antivirus,

· Backups and recovery,

· Performing Security Information and Event Management (SIEM) logging, critical watch reporting and security incident response, and

· Asset discovery and Configuration Management Database (CMDB) integration.

1.6 Fully Managed Public Cloud Support

The Fully-Managed Cloud operational model is intended for environments where the DCS SCP is responsible for all aspects of the service lifecycle including provisioning, deprovisioning, ongoing operating system (OS) support, monitoring, environment maintenance, Customer incident request, change requests, and service requests. Connectivity over a new or previously existing VXC between on-premises consolidated data center (CDC) resources and cloud resources enables the extension of DCS assurances to the hybrid environment.

DCS solutions enabled for customers include the following operational functions for the fully managed environments:

· Native Public Cloud console available with full read access to the cloud environment,

· Read access to view inventory and state information of cloud resources.

· Usage and cost reporting and budget management.

· Log aggregation services to capture, extract, transform and load pertinent security and event details from Public Cloud management environments.

· Advanced analytics and data correlation greatly extend the success of forensic research and investigation.

· Capture Azure events via OMS logs; AWS events via Cloud Trails and Cloud Watch; GCP events via Cloud Operations Suite.

· Cloud Access Security Broker solution spanning AWS, Azure and GCP providing sophisticated analytics to identify violation of policy and combat cyberthreats.

· Utilizing the SIP to measure against cybersecurity KPI and targets. Tests effectiveness of network, endpoint and cloud controls.

· Advanced, customizable reporting with comprehensive API access and integration across multiple platforms.

· Endpoint protection online or offline with integration into tools such as Windows System Center for compliance and regulatory requirements and mandates.

· Real-time intervention, blocking, and prevention for any in-process runtime attacks, includes.

· Integration with third-party tools across the entire cloud native lifecycle.

· Web Application Firewall protecting applications in the cloud with consistent policies and management capabilities as on-premise solutions (optional).

The DCS SCP is responsible for:

· Provisioning and deprovisioning,

· Enabling Customer console and IaaS access,

· Acquiring, installing, and patching the operating system,

· Ongoing OS support,

· Installing and maintaining antivirus,

· Monitoring and environment maintenance,

· Performing SIEM logging, critical watch reporting and security incident response,

· Backups and recovery,

· Customer incident request, change requests, and service requests, and

· Asset discovery and CMDB integration.

1.7 Platform as a Service (PaaS)

PaaS services are available to DCS Customers through the following procurement methods:

· Request for Solution (RFS) catalog item via the Shared Technology Services (STS) Service Catalog

· Self-Service access upon Customer request

A VXC is required for integration between the CDC and the Cloud Service Provider PaaS environments.

· Baseline Native Public Cloud console

· access will be available to Customers for the following functions (Note: additional access will be enabled for Customers requesting Self Service access).

· Read access to view inventory and state information of cloud resources.

· Usage and cost reporting and budget management.

· SaaS-based log aggregation services to capture, extract, transform and load pertinent security and event details from Public Cloud Management environments.

· Advanced analytics and data correlation greatly extend the success of forensic research and investigation.

· Capture Azure events via OMS logs; AWS events via Cloud Trails and Cloud Watch; and GCP events via Cloud Operations Suite,

· SaaS-based log aggregation services to capture, extract, transform and load pertinent security and event details from Public Cloud Management environments,

· Advanced, customizable reporting with comprehensive API access and integration across multiple platforms.

· Public Cloud Edge Security Services (PCESS) protecting applications in the cloud with consistent policies and management capabilities as on-premise solutions (optional).

The SCP is responsible for:

· Maintenance and enablement of VXC and Virtual Private Cloud (VPC)/Virtual Network (VNET) ,

· Integration between public cloud IaaS services and PaaS services as needed,

· Fulfillment of RFS requests, and

· Enabling Customer console access

1.8 Self Service PaaS

AWS Self-Service is a service offering that allows DCS Customers greater access and control of their AWS PaaS resources while leveraging a secure environment configured to limit risk.

Customers can access and deploy DIR-approved PaaS resources on demand through the AWS Management Console, AWS Command Line Interface (CLI), AWS Software Development Kits (SDK) and AWS Rest APIs.

The AWS Self-Service environment is enabled with automated controls promoting alignment with STS program Security policies and Managed Service Provider responsibilities. By leveraging Security Control Policies, Identity Access Management (IAM) Permissions Boundaries and IAM roles, Customers can safely increase the rate at which they can consume AWS PaaS resources.

PCM maintains the AWS cloud environment, but Customers can implement PaaS services and their required permission structures on their own in alignment with program operational and security requirements.

1.9 Virtual Cross Connect (VXC)

The DCS SCP uses Megaport to provide a virtual networking solution that allows Customers to securely connect to multiple Cloud Providers without having to establish direct connections between the individual Customer and Cloud Provider.

VXCs provide dedicated bandwidth for the Customer to a Cloud Provider location, including traffic segmentation. AWS and Google require one VXC per DCS Customer, whereas Azure requires two. Two VXCs are recommended for improved network resiliency.

The DCS SCP is responsible for provisioning and management of VXCs.

1.10 Virtual Private Cloud (VPC)

A VPC is a public cloud networking construct roughly analogous to a Virtual Local Area Network (VLAN) in current CDCs. It is designed to enable network and security services to the workloads that run inside the public cloud.

VPCs go by different names based on the Public Cloud provider: Google and AWS calls them VPCs, while Azure calls them VNETs. DCS prefers to use VPCs to mean the network construct used by the Public Cloud Provider.

The DCS SCP is responsible for provisioning and management of VPCs.

1.11 DCS Private Cloud

The Data Center Services program maintains two consolidated data centers geographically separated in order to provide disaster recovery. The Texas Private Cloud (TPC) provides technology infrastructure compute and storage based on standard reference models and managed services options.

Fully managed or Semi-managed support services are available for all compute platforms with multiple service levels.

· Consolidated Fully Managed - Premier Plus

· Consolidated Fully Managed - Premier Plus (UNIX)

· Consolidated Fully Managed - Premier

· Consolidated Fully Managed - Premier (UNIX)

· Consolidated Semi Managed - Standard

· Consolidated Limited Managed – Sandbox

The DCS program supports operating system standards that include:

· Microsoft Windows,

· Red Hat Linux,

· SUSE Linux,

· OES Linux,

· AIX (non-standard - by advanced exception approval only), and

· Oracle Linux (Enterprise Exadata and Fractional Oracle only).

Data is protected by the Dell EMC Data Protection Suite, which writes to replicated tapeless systems in the alternate data center for Disaster Recovery purposes.

All DCS compute platforms use DCS enterprise SAN storage except for the Fractional Intel VxRail hyper-converged infrastructure (HCI) that uses an internal VSAN technology.

The DCS program offers CDC virtual compute solutions for Intel (Windows / Linux), and IBM Power System Platforms (by exception approval only) based on Customer business needs. See below for more information.

1.12 Fractional Intel Virtualization (Consolidated Data Center) The Fractional Intel Virtualization solution is an Infrastructure as a Service (IaaS) providing an Intel virtualized environment based on VCE/VBlock converged infrastructure, Dell EMC VxRail hyperconverged infrastructure (HCI)or the Cisco UCS compute systems supporting Windows and Linux operating systems.

Reliability is supported with the use of VMware virtualization and high availability clustering.

Flexible configurations are available in 1vCPU and/or 2GB memory increments. Maximum limits are 500GB memory and 72vCPU for HCI or 64vCPU for VBlock.

Optionally, Customer-dedicated Cisco Intel UCS blades are supported with Customer-specified compute, memory, and hypervisor or bare metal configurations that leverage the shared VBlock or UCS infrastructure.

1.13 Enterprise SAN Storage

The DCS program provides enterprise SAN storage services using a four-tiered approach. The tiered storage methodology supports the use of various types of data storage architecture, pricing, and recovery. The solution is based on DellEMC Vmax Enterprise Storage, is protected by redundant architecture, and can be replicated to an alternate Consolidated Data Center (CDC).

1.14 Non-HCI Server SAN Storage Tiers

· Tier 0 - All SSD storage: Highest IOPS and fastest response times

· Tier 1 – Ultra high-performance storage: Generally, for very high database transactions

· Tier 2 – High performance storage: OS and production databases requiring high performance

· Tier 3 – Medium performance storage: Standard storage requirements

1.15 HCI VMware vSAN Storage Tiers

The VxRail HCI uses VMware vSAN which provides all flash storage to the hyper-converged environment. VMware vSAN is a hyper-converged, software-defined storage (SDS) product developed by VMware that pools together direct-attached storage devices across a VMware vSphere cluster to create a distributed, shared data store.

1.16 HCI Server vSAN Storage Tiers

· Tier 1 – Ultra high-performance storage: Generally, for very high database transactions

· Tier 2 – High performance storage: OS and production databases requiring high performance

· Tier 3 – Medium performance storage: Standard storage requirements

1.17 Private Cloud Managed Support Services (available for all compute platforms)

1.17.1 Fully Managed Private Cloud

The SCP is responsible for all aspects of the IaaS lifecycle, including provisioning the:

· Ongoing OS support,

· Ongoing database and middleware support (where optional services are selected),

· Hardware maintenance,

· Incident, change and Customer service requests,

· Service Catalog Requests,

· Asset discovery and CMDB integration,

· All base security functions (e.g., antivirus, patching, SIEM), and

· Optional advanced security available.

1.17.2 Semi-Managed Private Cloud

The Customer is responsible for OS support and all application-level support as summarized below.

SCP Responsibilities

· Provisioning

· Acquiring, installing, and patching the OS

· Installing and maintaining antivirus protection

· Performing SIEM logging, critical watch reporting and security incident response

· Performing hardware container maintenance and reboots

· Responding to incidents and Service Catalog requests related to hardware

· Asset discovery and CMDB integration

Customer Responsibilities

· OS management

· Monitoring

· Creating and managing incidents, change requests, and Service Catalog requests

1.18 Database Standards

Database management support for multiple database platforms are classified as two groups. Each platform allows for support and management of a database environment with Customer privileged access and with varied availability requirements for each unique Customer.

1.18.1 Standard Databases

· Oracle

· MS SQL

· MySQL

· DB2

1.18.2 Non-Standard Databases

· Sybase

· Informix

· Adabas

Enterprise Exadata is an option for Oracle Real Application Cluster (RAC) databases requiring high performance and high availability. Enterprise Exadata is a shared Oracle engineered system that provides an isolated multi-tenant environment. Enterprise Exadata provides virtual machine clusters consisting of two Oracle virtual machines with a minimum configuration of 4 cores and 64 GB RAM each and up to 9600 GB of storage and can be scaled up with additional cores, memory and storage.

1.19.2 Enterprise Exadata Minimum Oracle Database Software and Option requirements:

· Oracle Enterprise Edition

· Oracle Real Application Clusters (RAC)

· Oracle Diagnostics Pack

· Oracle Tuning Pack

· Oracle Database Vault

· Oracle Advanced Security

· Database Lifecycle Management Pack

· Oracle Cloud Management Pack

· Oracle Partitioning

1.19.3 Fractional Oracle

Fractional Oracle is a potential refresh target for small databases and Oracle applications. Fractional Oracle alleviates the software licensing issues with running Oracle Database software on VMware because it allows for sub-capacity licensing on Intel. It also provides better scalability and resiliency than bare metal servers. Fractional Oracle runs on the same converged infrastructure hardware (VBlock Cisco blades) as Fractional Intel and takes advantage of existing support resource units. However, Oracle Linux KVM is used as the virtualization software instead of VMware. Fractional Oracle supports Oracle Linux, RHEL, and Windows virtual machine operating systems.

· Minimum Fractional Oracle vCPUs is 2 and can be scaled in increments of 2 to a maximum of 60 vCPU. Virtual memory can be allocated in 2 GB increments up 500 GB.

· Minimum Oracle Database software requirements for Fractional Oracle.

· Oracle Standard or Enterprise Edition version 19c.

· Oracle RAC is not required in the Fractional Oracle environment, but it is an available option for databases requiring high availability.

1.19.4 Database Services Support Options

The DCS Database support options provide DCS Customers with greater flexibility to support application development, release initiatives, and aggressive application business availability requirements. The DCS program uses a two-level approach to support.

Fully Managed: Maintains the level of support that has historically been provided for databases.

Semi-Managed: The Customer has the majority of privileges and responsibilities but retains service provider support for availability, monitoring, maintenance, backups, patching and upgrades.

1.20 Private Cloud Hardware and Software Currency

The DCS hardware infrastructure is refreshed on a 60-month refresh cycle. Operating software, database software, and application utility tools are required to be within n or n-1 of the currently supported versions of the software manufacturer. The Respondent is required to ensure the application software developed for TWC’s Online Occupational Training will support the DCS standard hardware and software platforms as described in the DCS Standard Configurations.

1.20.1 Level I Help Desk

If needed for the solution, the Successful Respondent is required to maintain a Level I help desk to triage all calls prior to submitting an incident to the DCS Support Center. Once the Successful Respondent has determined or suspects the cause of an incident is related to a DCS infrastructure component, the Successful Respondent will log into the DCS Support Center’s system to report the incident in accordance with the DCS Services Management Manual.

1.20.2 Functions Retained by TWC – Not Provided by Data Center Services For clarity, the following services are not provided by DCS Service Providers. In developing your response, the Respondent should clearly understand that the requestor (agency) performs these functions as needed.

· End-user computing, including desktop, mobile, and LAN-attached multi-function devices.

· Network support, including WAN/LAN support outside of the State data centers, voice/phone support.

· Help desk (Level I – all services).

· Expert troubleshooting and support for all non-DCS services.

· Technology planning, strategies, and visioning.

· Project management.

· Disaster recovery planning and testing for all retained services.

· Business continuity planning for agency processes.

· Packaged imaging systems (scanners, servers, optical disks, etc.).

· Coordination of data center print services, including coordinating form changes with business units, volume trending.

· Data security, security design and policy development, systems access requests (directory/file, ID creation and removal, determination of access rights).

· Logical database administration.

· Application development, support, maintenance, and monitoring.

· Electronic payment processing services.

· Data import and export to the environment (FTP services).

· Reporting services.

Shared Technology Services/Customer Program Responsibilities Overview

Systems/Environment Monitoring

· Application

R

Security Monitoring and Management

· Application

R

Support Services

· Application

R

Event Management

· Application

R

Asset & Configuration Management

· Application - Software discovered is populated in STS CMDB. Agency responsibility for Business and relationship correlation of application data in MSI provided APM (Application Portfolio Management System)

R

Identity and Access Management

· Application - Includes DB where Customer not choosing Optional STS DB support services

R

3202500148 Mobile Credential Wallet 3202500148 Mobile Credential Wallet

DCS RFO LANGUAGE| POLICY |VERSION 10.0 |VERSION DATE: 2/2/2023

DCS RFO LANGUAGE| POLICY |VERSION 10.0 |VERSION DATE: 2/2/2023

2.0 DCS Template – Private Cloud High Level Architecture (HLA) / Rough Order of Magnitude (ROM)

What type of Service are you looking for? (TWC ONLY)

Is this request for an HLA/ROM or RFS? (TWC ONLY)

Solution Title

Short Description

Applicable Service

Detailed Description

Business Justification (TWC ONLY)

Target Implementation Date (TWC ONLY)

Are you the Primary Contact for this request? (TWC ONLY)

Primary Contact Name & Title (TWC ONLY)

Primary Contact Telephone Number (TWC ONLY)

Primary Contact Email (TWC ONLY)

2.1 DCS Template – Public Cloud High Level Architecture (HLA) / Rough Order of Magnitude (ROM)

What type of Service are you looking for? (TWC ONLY)

Is this request for an HLA/ROM or RFS? (TWC ONLY)

Solution Title

Short Description

Applicable Service

Detailed Description

Business Justification (TWC ONLY)

Target Implementation Date (TWC ONLY)

Are you the Primary Contact for this request? (TWC ONLY)

Primary Contact Name & Title (TWC ONLY)

Primary Contact Telephone Number (TWC ONLY)

Primary Contact Email (TWC ONLY)

2.2 DCS Template – Software as a Service (SaaS) / Platform as a Service (PaaS) Provide brief 40-character summary

Are you providing a quote with this request? Y/N

Is this product available through a DIR Cooperative Contract? Y/N (Please provide the DIR Cooperative Contract Number, if applicable)

What SaaS or PaaS are you looking for? (TWC ONLY)

Select the cloud provider Amazon AWS Microsoft Azure Google Cloud Other Provide Details Please provide product details. Please provide product details such as functionality (ie database, data analysis, DevOps) and the infrastructure that is included in the SaaS/PaaS product offering (ie compute, storage, etc).

What is the business justification for this request? (TWC ONLY) Procurement Terms (TWC ONLY FOR THE REST OF THE FORM) It is incumbent on the governmental entity seeking permission from DIR to acquire technology products or services through the state’s Shared Technology Services program to ensure that it follows applicable state procurement statutes and rules, including but not limited to Texas Government Code Sec. 2157.068 relating to the acquisition of Automated Information Systems (AIS) commodity items.

I agree this procurement follows applicable state procurement statutes and rules.

All documentation related to the required procurement activities for this request must be retained and you agree to provide this to the STS program if requested.

I agree all documentation will be retained and presented to STS if requested.

Terms & Conditions

Disclaimer: It is important to note that billed rates WILL VARY based on actual Enterprise RU consumption at the time the service is received. Please note the multi-year estimate may fall outside the current Vendor contract terms, which could impact future fiscal year pricing.

Termination of Services: If DIR Customer terminates certain Services, that it requested and approved, for convenience, DIR Customer shall pay the remaining requisite unrecovered costs that have already been incurred prior to the notice of termination, such unrecovered costs will be calculated in accordance with the relevant DIR Shared Services Contract, SMM, or other DIR Customer approved terms. DIR Customer understands that it may not be able to terminate services or receive any refund of a pre-payment after approving the relevant financial solution.

Above standard STS terms must be agreed to before this request may be submitted.

I Agree

**DCS Templates and supporting documentation must be included in Response Package 1 Files (Table 2, Online Occupational Training RFO), Attachment 12 Data Center Services (DCS) and DCS Templates, “ABC_TWC_RFO_3202400011_DCS_Templates.docx” image1.wmf