RFI_HSFE60-15-I-0027_-_Questions_and_Answers_08_20_2015_FINAL.pdf

August 20, 2015 Page 1 of 3

Question Number

Document Item Page

Question/Comment Recommendations FEMA Response

1 RFI_HSFE60-

15-I-0027 n/a

As part of this initiative is there or will there also be a push to help FEMA further participate in federal government's Cloud First policy? (The mandate that agencies take full advantage of cloud computing benefits to maximize capacity utilization, improve IT flexibility and responsiveness, and minimize cost.) n/a

Moving to NITC would help FEMA meet this mandate since NITC is a cloud provider.

RFI_HSFE60-

15-I-0027 n/a

We assume the intent of hosting in this GOGO facility is to streamline the ATO process by piggy backing on the existing certifications (I.E. FedRAMP); does this preclude the option of using other existing FedRAMP certified environments such as Amazon’s AWS and GovCloud environments?

n/a

FEMA is proposing a GOGO but does not intend to preclude other environments. We are soliciting industry input.

RFI_HSFE60-

15-I-0027 n/a

Are hosted systems currently able to run simultaneously in both the Kansas City and St. Louis data centers or is St. Louis used strictly for Disaster recovery? If not, is the data connection between the sites capable of this sort of configuration and would a more advanced high-availability architecture be a consideration for deployment? n/a

Hosted systems can run in both environments, but St. Louis is primarily for disaster recovery. FEMA and NITC would be open to discuss specific solutions to support active or other high-availability options.

4 RFI_HSFE60-

15-I-0027 n/a

Is there an alternate site available in a different geographical region as well (I.E.

outside of Missouri)?

n/a

NITC's primary disaster recovery site is St. Louis but they have other sites. Kansas City is a Tier IV data center and St. Louis is a Tier III data center.

NITC has other sites outside of Missouri.

5 RFI_HSFE60-

15-I-0027 n/a Has the current Direct contract received C&A security compliance? Can you share what portion of the process is completed? n/a

FEMA does not share information on its IT systems security compliance.

6 RFI_HSFE60-

15-I-0027

If the vendor or customer has no physical hardware that is running DSA software, and only virtualized guests, would the NITC provide a virtualized environment? n/a

NITC supports virtualized environments; most systems within NITC are virtual.

7 RFI_HSFE60-

15-I-0028

What tools are used for Disaster Recovery? What are the expected RTO and RPO in the NITC environment?

n/a

Depending on the platform, NITC uses SRM, disk mirroring tools, DNS, load balancing, etc. RTO is within 24 hours and in most cases systems are up and certified to be handed over to the customer within 6 to 12 hours.

8 RFI_HSFE60-

15-I-0029

Is the NITC Data Center able to host third party software that supports the DSA vendor solution? n/a

NITC supports third party software and can do so to support the DSA.

9 RFI_HSFE60-

15-I-0030

Who is the "customer" referenced in the RFI - is it FEMA or is it the DSA Contractor?

n/a FEMA is the customer. NITC will not enter into a hosting agreement with a private contractor.

10 RFI_HSFE60-

15-I-0031

What access will the vendor have to NITC facilities?

n/a

Access of properly authorized individuals will be determined by the level of service that FEMA negotiates with NITC. NITC provides access to customers to maintain their environment.

11 RFI_HSFE60-

15-I-0031

Would the Government please confirm that the "their" in the RFI statement " ...

seeking information on if an interested contractor/vendor could host their vendor software for servicing Direct-side flood insurance policies ..." means the interested DSA offeror.

n/a

FEMA is seeking input from interested DSA offerors.

RFI_HSFE60-

15-I-0031 n/a

The DSA contractor will be performing to agreed SLAs. Would the Government please indicate what the Recovery Time and Recovery Point Objectives (RT/RPOs) provided by NITC are for the system and what priority will be given to the DSA application following an outage?

n/a

The cause of the outage would determine how long it would take to recover. Through monitoring and/or customer notification of an outage, NITC would engage immediately and move it through the appropriate escalation process to resolve the issue. If a massive or center-wide outage were to occur, customers would be prioritized based upon criticality of the system. For example life and limb services would be given the highest priority. NITC would prioritize DSA against all impacted systems and the availability of resources to resolve the issue.

NATIONAL FLOOD INSURANCE PROGRAM

REQUEST FOR INFORMATION

HSFE60-15-I-0027

QUESTIONS AND ANSWERS

August 20, 2015 Page 2 of 3

Number

Document Item Page

Question/Comment Recommendations FEMA Response

NATIONAL FLOOD INSURANCE PROGRAM

REQUEST FOR INFORMATION

HSFE60-15-I-0027

QUESTIONS AND ANSWERS

RFI_HSFE60-

15-I-0031 n/a

Would the Government please indicate what monitoring service will FEMA obtain from NITC and what system metrics will be provided to the DSA contractor?

n/a

This dependent upon the services selected (PaaS, Managed, IaaS, Co-location) and what FEMA determines appropriate to provide the contractor.

NITC does not usually provide contractors system level metrics (such as utilization etc.) as these are not generally needed for daily operations. Under a break/fix, performance or other such instances this information would be made available. If FEMA feels this is necessary, FEMA and NITC can discuss and determine what is appropriate to provide, at what level and how often.

RFI_HSFE60-

15-I-0031 n/a

The resulting solution will have a DSA and a NITC help-desk. Would the Government please indicate what tools are used by NITC to manage service requests and how the DSA contractor will access these to provide a coherent service to clients?

n/a

NITC uses BMC Remedy to manage incident, problem and change activities. If FEMA approves, NITC will work with the contractor to either provide access or find alternative means to allow the contractor access to the information they need to support FEMA.

RFI_HSFE60-

15-I-0031 n/a

Security needs to be considered from an end-to-end system perspective. Would the Government please indicate what the roles and responsibilities of NITC security management are?

n/a

This depends on the services selected, i.e., PaaS, Managed, IaaS, Co-location. NITC is a FEDRAMP certified, FISMA high data center. PaaS would have the highest level of NITC involvement down to Co-location, which has the least. Co-location is physical security and little else. PaaS would support OS patching, etc. Regardless of the service(s) selected, NITC and FEMA will determine the appropriate roles and responsibilities to ensure the systems are secure. Not all systems are created equal and in some cases customers wish to have a larger/smaller role in keeping their systems secure; NITC will adjust as appropriate.

RFI_HSFE60-

15-I-0031 n/a

Would the Government please indicate if FEMA expects NITC to provide an enclave that is all inclusive of functionality of daily operations (applications, print/scan, call center software etc.) for national flood insurance program?

Would the Government please indicate how many VLANS per enclave?

n/a

FEMA is soliciting industry input about the feasibility of hosting all operations at a GOGO.

NITC strives to be as efficient as possible with these resources and limits most to five VLANS.

This is not a hard and fast rule. NITC will work with the customer to identify the true needs and will meet those needs.

17 RFI_HSFE60-

15-I-0031 n/a

Would the Government please indicate what FIPS 199/200 system categorization level (i.e., Moderate, High) is required for the DSA system?

n/a

The potential impact is Moderate if the loss of confidentiality, integrity, or availability could be expected to have a serious adverse effect on organizational operations, organizational assets, or individuals.

Amplification: A serious adverse effect means that the loss of confidentiality, integrity, or availability might: (i) cause a significant degradation in mission capability to an extent and duration that the organization is able to perform its primary functions, but the effectiveness of the functions is significantly reduced; (ii) result in significant damage to organizational assets; (iii) result in significant financial loss; or (iv) result in significant harm to individuals that does not involve loss of life or serious life threatening injuries.

August 20, 2015 Page 3 of 3

Number

Document Item Page

Question/Comment Recommendations FEMA Response

NATIONAL FLOOD INSURANCE PROGRAM

REQUEST FOR INFORMATION

HSFE60-15-I-0027

QUESTIONS AND ANSWERS

18 RFI_HSFE60-

15-I-0031 n/a Would the Government please indicate how traffic that in and out of NITC is monitored, and if NITC is compliant with the TICAP initiative? n/a

FEMA will be responsible for TICAP compliance, as appropriate.

19 RFI_HSFE60-

15-I-0031 n/a Would the Government please indicate if NITC is required to provide office space for 3rd party vendor support, if required? n/a

NITC is not required to provide office space for third party support, but will find space as required for short periods of time.

Sheet1