FY23 RFI-0003__CLOUD_HOSTING_GAO PUBLIC_WEBSITE (004).pdf

Cloud Hosing for GAO’s Public Website (GAO.gov)

REQUEST FOR INFORMATION (RFI-0003)

1. Objective

2. Background

3. Requirements

3.1. Platform as a Service

3.2. Web Application Firewall and Content Delivery Network

3.3. Platform Capabilities

3.4. Search

3.5. Operating Conditions

3.6. Load Time

3.7. 99.9 Percent Availability

3.8. API Support

3.9. Drupal Application Log File Management

3.10. Customer Support

3.11. Security and Privacy

4. Questions

4.1. General Information Questions

4.2. Product Detail Questions

4.3. Pricing Questions

4.4. Customer Support & Training Questions

4.5. Procurement Questions

4.6. Security Questions

4.7. Service Level Agreement Questions

5. Vendor Responses Requested

Synopsis

The U.S. Government Accountability Office’s is issuing this Request for Information (RFI) as a means of conducting market research (including cost estimates) to identify eligible parties. The eligible parties shall have an interest in, and the resources to support and furnish effort including labor and services, to provide Drupal Platform as a Service (PaaS) hosted in a secure cloud environment that is designed and configured within the continental United States for the Government Accountability Office (GAO).

The Contractor supporting GAO shall follow the Federal Information Security Modernization Act of 2014 (FISMA) and, at a minimum, shall offer an IT solution that is compliant with the legislation’s Agency Program requirements. The Contractor shall incorporate both industry and federal government best practices and standards with the proposed solution.

This is a RFI only and does not constitute a commitment, implied or otherwise, that GAO will take procurement action in this matter. Further, neither GAO nor the Government will be responsible for any cost incurred in furnishing this information.

1. Objective

The goal of this acquisition is to obtain secure cloud-hosting services for GAO’s public website, which runs currently on a Drupal 9.4.x platform using Solr 7.7.x for search.

GAO plans to upgrade to Drupal 10 by September 30, 2023. The cloud-hosting services must be Platform as a Service supporting Drupal 9.4+.

2. Background

The U.S. Government Accountability Office (GAO) is an independent, nonpartisan agency that works for Congress. Often called the "congressional watchdog," GAO investigates how the federal government spends taxpayer dollars. Our mission is to support Congress in meeting its constitutional responsibilities and to help improve the performance and ensure the accountability of the federal government for the benefit of the American people. We provide Congress with timely information that is objective, fact-based, nonpartisan, non-ideological, fair, and balanced.

Through our website, GAO.gov, we provide access to GAO's public products such as reports, written testimonies, and legal decisions, along with information and multimedia on a range of issues facing the nation. We publish 800-1,000 products per year.

3. Requirements

3.1. Platform as a Service

GAO is seeking a cloud-hosted Drupal Platform as a Service (PaaS) solution.

The cloud-hosted service must have all required security, service delivery and hosting capabilities necessary to effectively support the web content management and hosting needs of GAO for its public website. The solution shall be based on current and evolving industry standards and best practices over the course of the contract duration.

3.2. Web Application Firewall and Content Delivery Network

The contractor will provide a Web Application Firewall (WAF), with the option of Content Delivery Network (CDN) that will do the following:

3.2.1. Protect gao.gov against distributed denial-of-service (DDoS) attacks

3.2.2. Protect gao.gov against Cross-site Scripting and SQL Injection

3.2.3. Securely deliver data, videos, applications, and APIs to customers with low latency

3.2.4. Provide configurable settings for both internal and external traffic

3.3. Platform Capabilities

3.3.1. Platform will have the following features for developers and power users to complete common tasks without using a command line interface

3.3.1.1. Platform allows developers and trusted power users to clear site caches on production

3.3.1.2. Platform allows developers to trigger database backups or sync the production database to a lower environment

3.3.1.3. Platform allows developers to change the branch/tag and deploy code on any environment

3.3.2. The platform shall allow Production, Pre-Production, and two lower environments for the public website:

3.3.2.1. Production (Prod)

3.3.2.1.1. Production is the live GAO.gov environment for the Drupal application

3.3.2.1.2. Lives outside of GAO’s network VPN and firewall

3.3.2.2. Information Management (IM)

3.3.2.2.1. IM is the pre-production staging environment. All

content that is to be published to the public website is pushed to IM via API

3.3.2.2.2. Critical to daily operations and serving GAO’s mission to the United States Congress and the public

3.3.2.2.3. Lives within GAO’s network VPN and firewall

3.3.2.3. Develop (Dev)

3.3.2.3.1. Dev is the “daily driver” for testing enhancements, bug fixes, Drupal core and module updates, along with other Operations and maintenance related work.

3.3.2.3.2. Lives within GAO’s network VPN and firewall

3.3.2.4. Quality Insurance (QA)

3.3.2.4.1. QA is used for testing significant changes to the

website that require broad stakeholder approval before deployment to production

3.3.2.4.2. Lives within GAO’s network VPN and firewall

3.4. Search

The contractor will provide a search solution that is compatible with Solr 7.7.x or higher. The search solution will have the following features:

3.4.1. Supports an index of 883,477 items (61.26 GB on disk) that will grow 20% or more year over year

3.4.2. Supports full text search of PDFs and other documents

3.4.3. Ability to upload the Solr config.zip file (containing schema.xml, synonyms.txt, elevate.xml, solrconfig_extra.xml, etc.) without needing to submit a support ticket

3.4.4. Compatibility with the following Drupal contrib modules:

3.4.4.1. Search API (https://www.drupal.org/project/search_api)

3.4.4.2. Search API Solr (https://www.drupal.org/project/search_api_solr)

3.4.4.3. Search API AZ Glossary

(https://www.drupal.org/project/search_api_glossary)

3.4.4.4. Search API Attachments

(https://www.drupal.org/project/search_api_attachments) https://www.drupal.org/project/search_api https://www.drupal.org/project/search_api_solr https://www.drupal.org/project/search_api_glossary https://www.drupal.org/project/search_api_attachments

3.4.4.5. Search API Autocomplete

(https://www.drupal.org/project/search_api_autocomplete)

3.4.4.6. Search API Best Bets

(https://www.drupal.org/project/search_api_best_bets)

3.4.4.7. Search API Boost by Date

(https://www.drupal.org/project/search_api_solr_boost_by_date)

3.4.4.8. Search API Spellcheck

(https://www.drupal.org/project/search_api_spellcheck)

3.4.4.9. Facets (https://www.drupal.org/project/facets)

3.4.4.10. Facets (https://www.drupal.org/project/facets)

3.5. Operating Conditions

At a minimum, the platform shall meet or exceed the operating conditions and as-is environment requirements for GAO's public website, shown in Tables 1 and 2 below.

Table 1: Day 1 Operating Conditions

Condition Value

Total number of daily users* 15,030 (average) 5,256 (minimum) 32,267(peak)

Number of daily page views* 29,514 (average) 7,731 (minimum) 51,436 (peak)

Average response time** Under 650 ms with throughput of 600 req/min

Notes: *Source is Google Analytics data 10/1/2021-10/1/2022 **Source is newrelic.com

Table 2: As-is Environment

Component Metric

Uptime (measured in total uptime hours/total hours in the month (including scheduled maintenance))

99.9

Drupal Version 9 and 10 Must be able to support Drupal 10.0.0-beta2 or higher in lower (non-production) environments (i.e., Dev and Stg) upon launch.

Solr Version 7.7.x or higher

Index of 883,477 items (63.78 GB on disk) https://www.drupal.org/project/search_api_autocomplete https://www.drupal.org/project/search_api_best_bets https://www.drupal.org/project/search_api_solr_boost_by_date https://www.drupal.org/project/search_api_spellcheck https://www.drupal.org/project/facets https://www.drupal.org/project/facets

Component Metric

PHP Version 8.1

Production environment* m5a.4xlarge web (normal) Memecache (2048mb) m5a.4xlarge web (normal) Memecache (2048mb) m5a.large varnish(active) m5a.large varnish(not active) m5a.xlarge Database (Primary) FS server m5a.xlarge Database (Secondary) FS Server

IM, Dev, QA environments* m5a.xlarge Web (Normal) Database (Primary) FS server Memcache (64mb) m5a.large varnish(active) m5a.large varnish(not active)

Notes: *For more specific information about the current hosting infrastructure please see AWS’ m5 product details.

3.6. Load Time

Production’s site pages must load in 650 milliseconds or less and have a throughput of 600 requests per minute.

3.7. 99.9 Percent Availability

3.7.1. The platform shall provide a robust, fault-tolerant infrastructure that provides for high availability of 99.9 percent.

3.7.1.1. 99.9-percent availability applies to

3.7.1.1.1. All the pages and functions of the hosted site in

Production and IM*. As a Government website that serves Congress and the public, www.gao.gov must be available to anyone from anywhere in the world.

https://aws.amazon.com/ec2/instance-types/m5/ https://aws.amazon.com/ec2/instance-types/m5/

3.7.1.1.2. IM must have 99.9-percent uptime during Business

Hours Monday through Friday, 5:00am to 11:59pm

ET.

3.7.1.2. Planned services outages are included in the calculation of 99.9-percent availability. As a public website, www.gao.gov must be available 24 x 7 x 365.

3.8. API Support

The platform shall support API over HTTPS to the Drupal application from other GAO-specific applications that live behind GAO’s VPN and firewall.

3.9. Drupal Application Log File Management

3.9.1. The system must provide persistent logging for all hits, including downloads, for the website with storage rolling one month at a time.

3.9.2. The system must provide persistent logging of application and search logs for traffic and other analysis purposes with storage for rolling one month at a time.

3.10. Customer Support

The Contractor shall provide customer support including, but not limited to, system owners and managers, as required. The support includes both the web content management system and the hosted website.

3.10.1. Provide service and support for the GAO solution 24 x 7 x 365 days to include Tier I, 2, 3 help desk support/service center functions defined as:

3.10.1.1. Tier I (Incident response catch/dispatch)

3.10.1.2. Tier 2 (SME engagement)

3.10.1.3. Tier 3 (SME and Contractor engagement as required)

3.10.2. Provide trouble ticketing via customizable online portal/interface with integrated email capabilities.

3.10.3. Provide a mechanism to GAO for the secure bulk retrieval of all data, scripts, software, virtual machine images, and so forth, such as mirroring or copying to GAO—supplied industry standard media. The Contractor's quote shall describe the formats in which data will be provided.

3.10.4. Provide onboarding training to developer staff for the new platform solution(s) in order for them to be fully successful at managing GAO’s environments and code releases.

3.11. Security and Privacy

To ensure compliance with the Federal Information Security Modernization act of 2014 (FISMA), the Contractor, and any subcontractor supporting the implementation of the solution, must demonstrate knowledge and understanding of the NIST SP 800-53 security controls for information systems. The security controls baseline implemented by the vendor must be consistent with the FIPS 199 Moderate Impact level. Additionally, the implementation of the Contractor’s (and subcontractor’s) security controls must be documented in the manner described in the NIST Risk Management Framework, NIST SP 800-37, and Revision 2. The security documentation must describe how the security controls have been implemented for the infrastructure, platform, and software/application.

At the time of the bid, the Contractor must provide such evidence of Compliance for GAO’s review through one of these three methods:

• Fed RAMP authorization package (https://www.fedramp.gov/documents/)

• A current independent security assessment of the Contractor’s (and subcontractors) documented NIST SP 800-53 security controls

• An independent assessment using other internationally accepted security practices with a documented reference or crosswalk to the NIST SP 800-53 controls.

In addition, the Contractor (and subcontractor) shall provide current IT security white papers/ documentation that describe how security has been implemented for the solution’s infrastructure, platform, and software components. The IT security white papers/documentation should include information such as access controls, authentication, boundary protection, change management, customer segregation, contingency/disaster recovery planning, encrypted data transmission capabilities, log management, restricting website access, security monitoring, among other security capabilities.

Within 15 days of the request, the Contractor (and subcontractor) shall provide access to GAO, or their designee acting as their agent, security documentation needed to verify compliance with the requirements for an Information Technology security program. The Contractor (and subcontractor) shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

The Contractor (and subcontractor) shall ensure that GAO will have an opportunity to review, at least annually, the current security artifacts mandated by the Fed RAMP Program Management Office, by the current versions of NIST SP 800-37 and NIST SP 800-53 guidelines, or by the internationally accepted security practices.

The Contractor (and subcontractor) shall ensure that its environment remains compliant with the control standards of Federal Information Security https://www.fedramp.gov/documents/

Modernization Act of 2014 (FISMA), the current NIST standards related to: FIPS 140-2, and current NIST Special Publications 800-37, 800-53, 800-60, 800-61, 800-70, and 800-163. In addition, the Contractor (and subcontractor) must provide GAO with any documentation it requires for its security-related reporting requirements within 15 days of a request.

3.11.1. Security Audit Log Management

3.11.1.1. The system shall provide an automated mechanism to collect log files (including syslog, web and application server logs, event logs, etc.) for security analysis purposes and shall be reviewed by the Contractor on a routine basis.

3.11.1.2. The Contractor shall ensure that the automated mechanism allows GAO to periodically review the logs that can be exported into a format ingestible by an event correlation engine such as Splunk or in an .xlsx, .csv, .pdf, or .txt file format.

3.11.1.3. The Contractor shall retain audit log records on-line for at least ninety (90) days and preserve audit log records off-line for a period of 365 days.

3.11.2. Authentication

3.11.2.1. The system shall authenticate GAO users using modern authentication services such as Active Directory Federation Services (ADFS).

3.11.2.2. The system will also support minimum password strength requirements (minimum 12 characters, mixture of upper and lowercase letters, mixture of letters and numbers, includes at least one special character !, @, #, %, ? etc.)

3.11.2.3. The system supports two-factor authentication via SMS message, mobile app (mobile app will work both on Android and iOS devices e.g. Google Authenticator and Authy).

3.11.2.4. The system will also generate emergency recovery codes at the creation of all user accounts.

3.11.3. Permissions

Platform permissions will be granular in nature to allow GAO to create the following user roles:

3.11.3.1. Administrator: User has full permissions to the platform and any teams/applications associated with the account. User is able to create and modify permissions, roles, teams, and applications.

User has SSH access. They also receive all notifications on support tickets.

3.11.3.2. Senior Developer: User has full access to all environments.

They have full access to the application and can invite other members to join the application and assign their permissions.

User has SSH access. They also receive all notifications on support tickets.

3.11.3.3. Developer: User has full access to the environments they are assigned to. User has SSH access. They also receive all notifications on support tickets that they create or are added as a stakeholder to.

3.11.3.4. Cache-clear: User has the ability to clear site caches on production and lower environments. User does not have the ability to deploy code, backup databases, or SSH into the environment.

3.11.4. System Availability

3.11.4.1. Whenever there is an interruption in service, the Contractor (and subcontractor) must inform GAO of the estimated time that the system or data will be unavailable. The estimated timeframe for recovery of the service must consistent with the agreed upon service level agreements (SLA) and system availability requirements.

3.11.4.2. The Contractor (and subcontractor) must provide regular updates to GAO on the status of returning the service to an operating state according to SLA and system availability requirements.

3.11.4.3. The Contractor (and subcontractor) must provide a Root Cause Analysis (RCA) within 5 business days of interruption in service.

The RCA must be in plain language and understandable for non-technical stakeholders.

3.11.5. Comprehensive Backup and Restoration

3.11.5.1. The Contractor (and subcontractor) shall have a backup and restoration process that will ensure no more than 24 hours of data is loss.

3.11.5.2. The Contractor (and subcontractor) shall respond to GAO’s restoration request within one (1) business day of request.

3.11.5.3. The Contractor (and subcontractor) shall restore an agreed upon GAO dataset that is part of the regular backup schedule.

The Contractor shall ensure that such testing takes place, semi-annually, at a minimum.

3.11.5.4. Data backups shall be maintained or replicated at a site geographically disparate from the production site such that the loss of one data center does not prohibit recovery of data within the prescribed RTO. The backup site must be in the continental United States.

3.11.5.5. The Contractor (and subcontractor) shall provide a Failover should there be loss of a data center. The Failover will be automatic and result in a minimal outage (under three hours) for GAO and its customers.

3.11.6. Data Management

3.11.6.1. The Contractor (and subcontractor) shall maintain all of GAO’s data, including backup data, within the continental United States. The staff managing the data and/or systems maintaining GAO data shall be employed within and working from a system that is within the continental United States.

3.11.6.2. The Contractor (and subcontractor) shall ensure that GAO maintains ownership of all data stored in the hosted environment and that GAO will be permitted to access the data at any time.

3.11.6.3. The Contractor (and subcontractor) shall ensure that GAO data is being properly segregated from and thus inaccessible by the Contractor’s other clients.

3.11.6.4. The Contractor (and subcontractor) shall not access, use, or disclose GAO data unless specifically authorized by the terms of this contract or a task order issued hereunder. If authorized by the terms of this contract or a task order issued hereunder, any access to, or use or disclosure of, GAO data shall only be for purposes specified in this contract or task order.

3.11.6.5. The Contractor (and subcontractor) shall provide the Contracting Officer all GAO data and GAO-related data in the format specified in this document or as directed by the Contracting Officer.

3.11.6.6. The Contractor (and subcontractor) shall dispose of/purge GAO data and GAO-related data in an agreed upon manner and provide the confirmation of disposition to the Contracting Officer in accordance with contract closeout procedures. The data disposal/sanitization process shall be consistent with the current version of NIST SP 800-88, Guidelines for Media Sanitization.

3.11.6.7. The Contractor (and subcontractor) shall adhere to GAO Records Management Program Order 0410.1 and GAO’s

Records Retention Schedules. The documents are available upon request.

3.11.7. Vulnerability Management

3.11.7.1. Prior to deployment of the Platform, the Contractor (and subcontractor) shall ensure that the scan results (OS/APP/DB) for GAO’s hosted environment are provided for review by the GAO Project Manager and Information System Security Officer.

3.11.7.2. The Contractor (and subcontractor) shall be responsible for all patching and vulnerability management (PVM) of the Platform’s software and other systems’ components supporting services provided under this agreement so as to proactively prevent the exploitation of IT vulnerabilities that may exist within the Contractor’s operating environment. Such patching and vulnerability management shall meet the requirements and recommendations of the current version of NIST SP 800-40.

3.11.7.3. The Contractor (and subcontractor) shall ensure that the CVSS v3.0 specifications for critical and high risk vulnerabilities are patched within 3 and 15 days of discovery, respectively. After patching occurs, the remediated Common Vulnerabilities and Exposures (CVE) will be shared with the GAO Project Manager and Information System Security Officer.

3.11.8. Incident Response

3.11.8.1. The Contractor (and subcontractor) shall have an

incident/breach notification process that is tested annually. The GAO ISSO for the system shall have an opportunity to review the annual test results.

3.11.8.2. The Contractor (and subcontractor) shall ensure that GAO is notified of all incidents, to include system outages and equipment failures, within an agreed upon timeframe consistent with federal government guidance.

3.11.8.3. The Contractor (and subcontractor) shall report incidents in a manner consistent with the current NIST SP 800-61 guidelines that is ultimately agreed upon by GAO to ensure that critical information is provided in a timely manner.

3.11.8.4. The Contractor (and subcontractor) will share contact information, to include GAO staff, of key incident response personnel for the hosting environment. The contact information shall be reviewed periodically to ensure accuracy and completeness.

3.11.9. Media Protection

3.11.9.1. The Contractor (and subcontractor) shall ensure that all electric and hard-copy deliverables, are labeled in a manner that is agreed upon by GAO.

3.11.9.2. The Contractor (and subcontractor) shall ensure that GAO data that resides on mobile/portable devices (e.g., USB flash drives, external hard drives, and SD cards) are encrypted using a NIST-approved tool. In all cases where GAO data are stored in mobile, easily transportable devices, the data must be encrypted at rest.

3.11.9.3. The Contractor (and subcontractor) shall ensure that external transmission/ dissemination of any GAO data is encrypted.

Certified encryption modules must be used in accordance with the current FIPS Publication, “Security requirements for Cryptographic Modules,” FIPS 140-2, level 2, at a minimum.

The transport layer security (TLS) protocol shall be version 1.2, at a minimum. There shall be no obsolete TLS protocols used in the transmission of GAO data.

3.11.9.4. The Contractor’s (and subcontractor’s) chain of custody practices for media containing GAO information that is transported outside of controlled areas, such as the data center, must ensure accountability. This can be accomplished through appropriate actions such as logging and/or a documented chain of custody form.

3.11.9.5. The Contractor (and subcontractor) shall ensure that data that is being shared with GAO or with GAO-designated recipients by e-mail shall also be encrypted and password-protected by contract staff using an agreed upon tool such as PKZip.

Password distribution shall be handled securely to minimize potential compromise. Alternatively, a secure portal for secure messaging or for secure file transfers, for example, can be used.

3.11.10. Personnel Security

3.11.10.1. The Contactor (and subcontractor) shall require all employees and representatives, and any others (e.g., subcontractor employees) who will have access to GAO data, the architecture that supports GAO data, or any physical or logical devices/code, to pass the appropriate background investigation required by the Government in compliance with HSPD -12 and OPM’s Federal Investigations Notice 15-03.

3.11.10.2. Contractor (and subcontractor) personnel performing work under this contract shall have, at a minimum, a Tier-2, Public Trust, favorably adjudicated background investigation before accessing GAO data, the architecture that supports GAO data, or any physical or logical devices/code. The assigned personnel must maintain the level of clearance required for the life of the contract.

3.11.10.3. If the Contractor (and subcontractor) does not have staff meeting this requirement, the Contractor shall be responsible for costs associated with GAO’s efforts to initiate the background investigation process.

3.11.10.4. If more than ten contract staff (and subcontract staff) can access GAO’s hosted environment and data, the Contractor (and subcontractor) shall assign specific staff who (1) will support GAO’s overall coding, troubleshooting, and system administration needs, and (2) has and can sustain a favorably adjudicated Tier-2 security clearance.

3.11.10.5. Contract (and subcontractor) personnel must sign a non-disclosure agreement, and must be a U.S. citizen or have lawful U.S. resident status.

3.11.10.6. Upon contract award, if the Contractor (and subcontractor) personnel assigned to support GAO do not meet the Tier-2 background investigation requirement, GAO will require that completed SF-85P forms be submitted securely to GAO’s Industrial Security section for review and processing.

3.11.10.7. Any time changes occur with a contractor’s (and

subcontractor’s) personnel security clearance, the Contractor shall contact the GAO COR, who will ensure that GAO’s Personnel Management Branch is informed. GAO will conduct the appropriate reviews and will request pertinent information for review.

3.11.10.8. The Contractor (and subcontractor) will be responsible for the cost for any Tier-2 background investigations for newly assigned Contractor personnel supporting GAO’s hosted environment.

3.11.11. Privacy Protections

3.11.11.1. The Contractor (and subcontractor) shall provide privacy protections that are consistent with the NIST Special Publication 800-144 – “Guidelines on Security and Privacy in Public Cloud Computing” and other applicable standards and guidelines.

3.11.11.2. The Contractor (and subcontractor) shall adhere to GAO Privacy Program Order, 0450.1. The documentation will be made available, upon request.

3.11.12. Protection of Information at Rest

3.11.12.1. The Contractor (and subcontractor) shall provide security mechanisms for handling data at rest and in transit in accordance with the current, implemented version of the FIPS Publication “Security Requirements for Cryptographic Modules,” or FIPS 140-2, level 2, at a minimum. The transport layer security (TLS) protocol shall be version 1.2, at a minimum. There shall be no obsolete TLS protocols used in the transmission of GAO data.

3.11.13. Secure Communications

3.11.13.1. As described in the NIST SP 800-53 System and

Communications Protection control family, the Contractor (and subcontractor), upon request, must be able to restrict access to GAO’s hosted environment based on an agreed upon public (non-RFC 1918) IPv6 and IPv4 address(es) through a secure connection or through the use of an IP restrictions/whitelisting mechanism.

3.11.13.2. The solution must provide connectivity that is able to access the Contractor’s (and subcontractor’s) main and disaster recovery locations from GAO’s Headquarters and Alternate Computing Facility locations. Oftentimes, the VPN connectivity will require two (2) VPNs with four (4) tunnels. If an IP whitelisting/restrictions mechanism is used, it must be able to detect, reject and log attempts at spoofing IP addresses per IETF Best Common Practice 38 (https://tools.ietf.org/html/rfc2827).

3.11.13.3. The Contractor (and subcontractor) shall deploy strong cryptography and end-to-end application layer encryption to protect customer PINs, user passwords, email transmissions, web traffic, and other sensitive data in networks and data at rest. The level of encryption used must comply with the current, implemented version of the FIPS Publication “Security Requirements for Cryptographic Modules,” or FIPS 140-2, level 2, at a minimum. The transport layer security (TLS) protocol shall be version 1.2, at a minimum. There shall be no obsolete TLS protocols used in the transmission of GAO data.

3.11.13.4. The Contractor (and subcontractor) shall encrypt customer account and transaction data which is transmitted, transported, delivered or couriered to external parties or other locations, taking into account all intermediate junctures and transit points from source to destination.

3.11.14. Security Alerts, Advisories, and Directives

3.11.14.1. The Contractor (and subcontractor) shall ensure that contractor personnel with responsibilities for system administration, monitoring, and/or security, receive security alerts, advisories, and directives for the Contractor’s solution(s). The Contractor shall ensure that designated GAO personnel receive the same alerts, advisories and directives.

4. Questions

4.1. General Information Questions

4.1.1. Please provide information about your organization, including contact information.

4.1.2. Describe the type, quantity, experience, and qualifications of personnel/labor categories and other organizational resources that would be used to meet the technical requirements

4.1.3. Information on whether your organization is foreign owned/foreign controlled and if foreign national employees would be required to perform this effort.

4.1.4. Who are some of your current Drupal PaaS customers?

4.1.4.1. Please provide a representative list of current clients that are similar in size and scope to our organization.

4.1.4.2. Include date implemented and contact information

4.2. Product Detail Questions

4.2.1. Please provide us a high-level summary of your product Drupal PaaS.

4.2.1.1. Describe your organization's ability to meet the technical requirements described in this RFI. Please do not simply restate the technical requirements in your response.

4.2.1.2. Please tell us what makes your Drupal PaaS better or stand out over your competition.

4.2.1.3. How are platform updates handled?

4.2.1.4. How frequently is the platform updated?

4.2.1.5. How do you notify the customer of platform updates prior to implementation?

4.2.2. Users

4.2.2.1. Is there a limit on the number of power users, developers, and administrators?

4.2.3. Describe how your platform support third-party search services that are not hosted within your environment.

4.2.4. Describe your approach to meeting the uptime requirement including, when, if at all you would fail over to a backup environment. Also include your approach to upsizing the environment to meet uptime requirements, determining when to downsize the environment and the impacts of that upsizing on your pricing.

4.3. Pricing Questions

4.3.1. Describe your pricing structure and how it accounts for usage.

4.3.2. If customer elects to remove an add-on (Search, WAF, etc.) during a period of performance how does the pricing change?

4.3.3. Please provide an annual estimate for using the Drupal PaaS over 5 years.

4.3.4. Is training included in pricing?

4.3.4.1. If not, please explain.

4.4. Customer Support & Training Questions

4.4.1. What type of customer support is available?

4.4.2. Is training provided?

4.4.2.1. How soon is training provided after implementation and how often afterwards?

4.4.2.2. Is training provided after updates?

4.4.2.3. Do you provide training materials? How?

4.5. Procurement Questions

4.5.1. Do you offer your product through a government wide acquisition contract (GWAC) or Federal Supply Schedule (FSS) (i.e. GSA, NASA

SEWP, NIH NITAAC)?

4.5.2. How long does an average onboarding take?

4.5.3. Describe your approach and timeframes for transitioning in a site such as ours to your platform.

4.5.4. Describe your approach and timeframes for transitioning out a site such as ours from your platform

4.6. Security Questions

4.6.1. What are the vendor’s capabilities and policies for protecting our data (both physically and procedurally)?

4.6.2. Is the PaaS FedRAMP certified?

4.6.3. Is the PaaS FISMA compliant at the moderate level?

4.6.4. If the vendor has its provisional authorization revoked, the Contractor’s hired independent third party assessment organization (3PAO) indicates that an authorization/re-authorization is not recommended, and/or the system’s Plan of Action and Milestones (POA&M) lists any critical or high risk deficiencies that are not being addressed in a timely manner as outlined by Fed RAMP and/or NIST guidelines, what is the penalty?

4.6.5. How is the Drupal application itself protected and how is that protection maintained over time?

4.6.6. How does the vendor meet general and industry-specific security and compliance standards, such as Security Standards Council or the National Institute of Standards and Technology (NIST)?

4.7. Service Level Agreement Questions

4.7.1. Do you have Service-Level Agreements and a strong history of service-level performance?

4.7.2. Describe how your availability SLA meets our requirement to include planned outages.

4.7.3. How transparent is the cloud vendor in sharing SLA performance (daily, weekly, or monthly)? Are there alerts available to indicate when an SLA is at risk?

4.7.4. Are the SLAs measureable and results-oriented so we can determine service level performance?

4.7.5. If the vendor misses SLA performance objectives, how does the company handle the penalty?

4.7.6. Describe your SLA with respect to resolving issues in a lower environment (e.g., dev, QA, Staging) and how that differs from you SLA with respect to the production environment.

5. Vendor Responses Requested

Disclaimer: This information is for GAO internal planning purposes only. All interested organizations are invited to respond. Please provide responses to the following statements and/or questions and organize your responses accordingly.

Information provided by the vendor should include recent and relevant experience and include two to four examples. GAO highly encourages vendors to provide specific qualifications where vendor recommendations have been performed. When specific qualifications are provided, include contract information such as client organization, value, and percentage self-performed work in relation to the entire effort.

RFI responses must be specific about how your solution meets the requirements and questions above and include:

• Name of Company

• Point of Contact for the response with Title/email/phone

• Pricing model for providing this solution.

• Two to four examples of recent and relevant experience. For examples provided, include information such as client organization, value, and percentage of self-performed work in relation to the entire effort.

• Whether your solution is available open market and/or via a Government-wide Acquisition Contract (GWAC) or Federal Supply Schedule (FSS) such as GSA, NASA SEWP, NITAAC, etc.

6. Point of Contact for Inquiries and Submissions

All inquiries / questions regarding this RFI must be directed to Glenn Hamilton, Contract Specialist, and Cedric Mitchener, Contracting Officer, via email to hamiltonge@gao.gov and mitchenerc@gao.gov, with “Cloud Hosting for GAO’s Public Website (GAO.gov) RFI Inquiry” in the subject line. Inquiries must be received no later than February 1, 2023 at 1:00 p.m. ET. Responses to all inquiries received by this deadline will be posted electronically and made publicly available at sam.gov. An email confirmation of receipt from GAO will be sent within a one-week period to the designated point of contact.

Questions / inquiries received after the date will not be answered.

All responses to this RFI are required to be submitted via e-mail by close of business on February 21, 2023. All responses must be directed to Glenn Hamilton, Contract Specialist, and Cedric Mitchener, Contracting Officer, via email to hamiltonge@gao.gov and mitchenerc@gao.gov, with “Cloud Hosting for GAO’s Public Website (GAO.gov) RFI Response” in the subject line.

No solicitation exists; therefore, do not request a copy of the solicitation. If a solicitation is released, no decision where it will be published/synopsized. It is the responsibility of mailto:hamiltonge@gao.gov mailto:hamiltonge@gao.gov potential offerors/bidders to monitor these sites for the release of any solicitation or synopsis.

7. DISCLAIMER

GAO will not publicly disclose proprietary information obtained as a result of this RFI. To the full extent that it is protected by law and regulations, information identified by a respondent as Proprietary or Confidential will be kept confidential.

5. Vendor Responses Requested