The file's text, extracted by GovTribe without its formatting.
OFFER FORM OF-8
ONGOING SERVICES REQUIREMENTS
RFP-23-01-UI
OF-8 Ongoing Services Requirements 2 RFP-23-01-UI Table of Contents
| 1.0 | Overview Of Document | 4 |
| 2.0 | Ongoing Services | 4 |
| 2.1 | Hosting (For Saas And Offeror-Hosted Options) | 4 |
| 2.1.1 | Hosting Services | 5 |
| 2.2 | Maintenance And Operations Support | 9 |
| 2.2.1 | System Operations And Administration | 9 |
| 2.2.2 | System Monitoring | 11 |
| 2.2.3 | Incident And Problem Management (Level 1 And Level 2) | 13 |
| 2.2.4 | Uis System Problem Management Services (Level 2 And Level 3) | 17 |
| 2.2.5 | Root Cause Analysis | 19 |
| 2.2.6 | User Account Management | 20 |
| 2.2.7 | Security Administration | 21 |
| 2.2.8 | Storage Management | 25 |
| 2.2.9 | Output Management | 28 |
| 2.2.10 | Batch – Job Control And Scheduling | 30 |
| 2.2.11 | Uis Router Remote Access | 32 |
| 2.2.12 | Database Administration | 33 |
| 2.2.13 | Os, Application And Database Backup And Recovery | 36 |
| 2.2.14 | Change And Release Management | 38 |
| 2.2.15 | Configuration Management | 41 |
| 2.2.16 | Capacity Management | 42 |
| 2.2.17 | Performance Management | 44 |
| 2.2.18 | Disaster Recovery | 46 |
| 2.2.19 | Break Fix Support Services | 48 |
| 2.2.20 | Continuous Improvement Services | 49 |
| 2.2.21 | Minor Enhancements And Ad-Hoc Requests | 50 |
| 2.2.22 | Documentation | 52 |
| 2.2.23 | Service Management And Quality Assurance (QA) | 53 |
| 2.2.24 | Service Level Reporting | 55 |
| 2.3 | Additional Outsourcing (Optional) | 56 |
| 2.4 | Project Onsite Team | 56 |
List of Tables
| Table 1. | Hosting Services - Roles and Responsibilities | 5 |
| Table 2. | UIS System Operations and Administration – Roles and Responsibilities | 9 |
| Table 3. | System Monitoring – Roles and Responsibilities | 11 |
| Table 4. | Incident and Problem Management (Level 1 and Level 2) – Roles and Responsibilities | 13 |
| Table 5. | UIS System Problem Management (Level 2 and Level 3) – Roles and Responsibilities | 17 |
| Table 6. | Root Cause Analysis – Roles and Responsibilities | 19 |
| Table 7. | User Account Management – Roles and Responsibilities | 20 |
| Table 8. | Security Administration – Roles and Responsibilities | 21 |
| Table 9. | Storage Management – Roles and Responsibilities | 25 |
| Table 10. | Output Management – Roles and Responsibilities | 28 |
| Table 11. | Batch – Job Control and Scheduling – Roles and Responsibilities | 30 |
| Table 12. | Remote Access Facilities – Roles and Responsibilities | 32 |
| Table 13. | Database Administration – Roles and Responsibilities | 33 |
| Table 14. | OS and Application and Database Backup and Recovery – Roles and Responsibilities | 36 |
| Table 15. | Change Management and Release Management – Roles and Responsibilities | 38 |
| Table 16. | Configuration Management – Roles and Responsibilities | 41 |
| Table 17. | Capacity Planning – Roles and Responsibilities | 42 |
| Table 18. | System Performance Tuning and Management – Roles and Responsibilities | 44 |
| Table 19. | Disaster Recovery – Roles and Responsibilities | 46 |
| Table 20. | Break Fix Support Services – Roles and Responsibilities | 48 |
| Table 21. | Continuous Improvement Services – Roles and Responsibilities | 49 |
| Table 22. | Minor Enhancements and Ad-Hoc Requests – Roles and Responsibilities | 50 |
| Table 23. | Documentation – Roles and Responsibilities | 52 |
| Table 24. | Service Management and Quality Assurance – Roles and Responsibilities | 53 |
| Table 25. | Service Level Reporting – Roles and Responsibilities | 55 |
| Table 26. | Supplemental Staffing Outsourcing – Roles and Responsibilities | 56 |
| Table 27. | Project Team Onsite – Roles and Responsibilities | 56 |
Overview of Document
This document defines the roles and responsibilities of the State of Hawaii (State) and the Offeror for Ongoing Services:
Ongoing Services:
· Hosting Services
· Maintenance and Operations (M&O) Services
· Additional Outsourcing (Optional)
· Project Team Onsite
Ongoing Services
The purpose of the Ongoing Services section is to describe the tasks and Deliverables the Offeror shall provide to the State throughout the duration of the Contract and to define the expected roles and responsibilities of the State and the Offeror. The following areas are included in the Ongoing Services:
· Hosting Services or SaaS Services, as applicable
· M&O Services
As noted in the RFP, each subsection below outlines the high-level roles and responsibilities of both the State and the Offeror. The State requires the Offeror to assume full management responsibility for the required Offeror and subcontractor personnel and associated services.
Hosting (For SaaS and Offeror-Hosted Options)
Hosting Services Requirements are applicable to SaaS and Offeror-Hosted options and include the services and activities required to provide and support centralized sandbox, development, testing, training, production, and disaster recovery (DR) environments for the State’s Unemployment Insurance System (UIS). The hosted environment includes, but is not limited to, datacenter backbone network, servers, disk storage, tape storage, monitoring tools, security tools, and systems software that support centralized UIS business applications and databases. Track server utilization so that increases and decreases in utilization are noted and appropriate remedial actions are taken, if necessary.
Hosting Services
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
Hosting Services - Roles and Responsibilities
| # |
| Hosting Services - Roles and Responsibilities |
| Offeror |
| State |
| Proposed Hosting Option |
(SaaS, Offeror-Hosted)
| Offeror Response (Y/N) |
| Offeror Comment |
| 2.1.1.1 |
| Provide a primary Tier III (or higher) data center for hosting of the UIS. |
| R, A |
| 2.1.1.2 |
| Provide a secondary Tier III (or higher) alternate data center for production and DR purposes. |
| R, A |
| 2.1.1.3 |
| Provide appropriate onsite contact personnel who have authorized access to rooms and racks for equipment for scheduled installation time, in accordance with security procedures. |
| R, A |
| 2.1.1.4 |
| Provide and install all necessary power distribution boxes, conduits, grounding, surge, equipment racks, and lightning protection and associated hardware. |
| R, A |
| 2.1.1.5 |
| Provide necessary building alterations to meet wiring and any other site requirements. |
| R, A |
| 2.1.1.6 |
| Ensure that the environmental conditions for chosen equipment meet the manufacturer’s requirements. |
| R, A |
| 2.1.1.7 |
| Provide Infrastructure as a Service (IaaS) capabilities including: |
| 2.1.1.8 |
| Providing virtualized server environments. |
| R, A |
| 2.1.1.9 |
| Provisioning of servers and operating systems. |
| R, A |
| 2.1.1.10 |
| Provisioning of storage on demand. |
| R, A |
| 2.1.1.11 |
| Provisioning of server, network, and storage with no single point of failure. |
| R, A |
| 2.1.1.12 |
| Pre-configured access to Internet Service Provider (ISP) and Statewide Area Network (WAN) demarcation points. |
| R, A |
| 2.1.1.13 |
| Capability to replicate (in real or near real time) data to the alternate datacenter (see SLAs in “Attachment A, Service Level Agreement Requirements”). |
| R, A |
| 2.1.1.14 |
| The capability to recover the application and data at the remote DR data center with minimal manual involvement. |
| R, A |
| 2.1.1.15 |
| The capability to migrate an application for the DR data center back to the primary data center with minimal manual involvement. |
| R, A |
| 2.1.1.16 |
| Provide data center security and privacy to meet the State and Federal security requirements. |
| R, A |
| 2.1.1.17 |
| Provide firewall administration. |
| R, A |
| 2.1.1.18 |
| Provide data center Local Area Network (LAN) management. |
| R, A |
| 2.1.1.19 |
| Monitor applications and servers for availability as well as transaction and response time performance. |
| R, A |
| 2.1.1.20 |
| Provide high availability redundant network circuits connecting the hosting data centers to the State’s Next-Generation Network (NGN) to meet network response time and high availability SLAs (see SLAs in “Attachment A, Service Level Agreement Requirements”). |
| R, A |
| 2.1.1.21 |
| Align with IT Service Management industry-accepted best-practice principles such as Information Technology Infrastructure Library (ITIL), Control Objectives for Information and related Technology (CobIT) or similar standard principles. |
| R, A |
| 2.1.1.22 |
| Coordinate with and provide support to the State’s Level 1, Level 2, and Level 3 help desks for incident and service request management and provide Hosting Services support and assistance as necessary to ensure maximum UIS uptime. |
| R, A |
| 2.1.1.23 |
| Support the DR and failover strategy and annual DR testing. |
| R, A |
| 2.1.1.24 |
| Adhere to the Hosting Services SLAs specified in “Attachment A, Service Level Agreement Requirements.” |
| R, A |
Maintenance and Operations Support
System Operations and Administration
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
UIS System Operations and Administration – Roles and Responsibilities
| # |
| UIS Operations and Administration – |
Roles and Responsibilities
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.1.1 |
| Define administrative computing systems requirements and policies (e.g., usage, monitoring agents). |
| R, A |
| 2.2.1.2 |
| Develop procedures for performing systems administration that meet requirements and adhere to defined policies. |
| R, A |
| 2.2.1.3 |
| Review and approve systems administration procedures. |
R, A
| 2.2.1.4 |
| Establish, implement, and maintain technical support policies and procedures that support the State’s operation and support requirements. |
| R, A |
| 2.2.1.5 |
| Set up and manage end-user accounts, perform access control, manage files, and disk space (for in scope operating system (OS) and system software) in accordance with the State requirements. |
| R, A |
| 2.2.1.6 |
| Install and configure OS per UIS requirements. |
| R, A |
| 2.2.1.7 |
| Perform system or component configuration changes necessary to support computing services. |
| R, A |
| 2.2.1.8 |
| Provide agreed UIS support services. |
| R, A |
| 2.2.1.9 |
| Install UIS components. |
| R, A |
| 2.2.1.10 |
| Configure UIS components. |
| R, A |
| 2.2.1.11 |
| Maintain and monitor UIS components. |
| R, A |
| 2.2.1.12 |
| Register encryption keys. |
| R, A |
| 2.2.1.13 |
| Perform required UIS services in line with agreed procedures (e.g., system stop and start, monitoring changes, job scheduling changes, UIS component patching (support package, plug-ins), UIS upgrade (version change or enhancement pack installation, UIS copy, database copy, UIS client copy, specific backup or restore). |
| R, A |
| 2.2.1.14 |
| Perform required UIS services in line with agreed procedures (e.g., database upgrade or patching, UIS kernel patching). |
| R, A |
| 2.2.1.15 |
| Coordinate and perform UIS support services according to agreed procedure. |
| R, A |
| 2.2.1.16 |
| Perform any other system-oriented tasks as they may appear in regular operation and/or with new UIS releases. |
| R, A |
| 2.2.1.17 |
| Install and maintain UIS parameters according to best practices. |
| R, A |
System Monitoring
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
System Monitoring – Roles and Responsibilities
| # |
| System Monitoring – Roles and Responsibilities |
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.2.1 |
| Propose and implement monitoring policies, procedures and standards that meet UIS best practices and the State requirements including: |
| R, A |
| 2.2.2.2 |
| Monitoring of buffers, database buffers, table space fragmentation, database space, unusual growth and propose solution in case of alert. |
| R, A |
| 2.2.2.3 |
| Monitoring of system logs, update error, database corruption, jobs, and propose solution in case of alert. |
| R, A |
| 2.2.2.4 |
| Monitoring of alert notification interface (e.g., Simple Mail Transfer Protocol (SMTP), send mail), and propose a solution in case of an alert. |
| R, A |
| 2.2.2.5 |
| Monitoring of transaction and trace logs, network event logs and traces, garbage collector, memory and CPU utilization, indexes, etc., and propose a solution in case of an alert. |
| R, A |
| 2.2.2.6 |
| Monitoring of middleware (e.g., workflows, in- and out-bound queues) and report to the State according to agreed procedure. |
| R, A |
| 2.2.2.7 |
| Monitoring of end-to-end transaction response time to allow measurements against SLAs (see “Attachment A, Service Level Agreement Requirements”). |
| R, A |
| 2.2.2.8 |
| Review and agree with monitoring procedures. |
R, A
| 2.2.2.9 |
| Implement agreed to monitoring policies, procedures, and standards. |
| R, A |
| 2.2.2.10 |
| Provide console monitoring, troubleshooting, repair and escalation of problems in the hosted environment. |
| R, A |
| 2.2.2.11 |
| Monitor all UIS components as agreed in above mentioned monitoring policies, procedures, and standards. |
| R, A |
| 2.2.2.12 |
| Provide preventive measures for proactive monitoring and self-healing capabilities to limit outages that impact service delivery. |
| R, A |
| 2.2.2.13 |
| Monitor batch and job scheduling. |
| R, A |
| 2.2.2.14 |
| Proactively monitor table spaces. |
| R, A |
| 2.2.2.15 |
| Monitor defined interfaces. |
| R, A |
| 2.2.2.16 |
| Monitor long running jobs or processes and shortage of available processes, and report to the State according to agreed to procedures. |
| R, A |
| 2.2.2.17 |
| Monitor, identify and report UIS problems and availability from the perspective of the end user. |
| R, A |
| 2.2.2.18 |
| Resolve or assist in resolving application problems in accordance with SLAs (see “Attachment A, Service Level Agreement Requirements”), and escalate as required. |
| R, A |
Incident and Problem Management (Level 1 and Level 2)
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
Incident and Problem Management (Level 1 and Level 2) – Roles and Responsibilities
| # |
| Incident and Problem Management (Level 1 and Level 2)- Roles and Responsibilities |
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.3.1 |
| Propose incident and problem management policies, procedures, and standards. |
| R, A |
| 2.2.3.2 |
| Review the State’s incident and problem management policies, procedures, and standards; propose changes to meet the State requirements and organization. |
| R, A |
| 2.2.3.3 |
| Adapt and implement incident and problem management procedures per the State requirements. |
| R, A |
| 2.2.3.4 |
| Establish operations and service management quality assurance and control programs. |
| R, A |
| 2.2.3.5 |
| Approve operations and service management quality assurance and control programs. |
R, A
| 2.2.3.6 |
| Perform quality assurance and quality control programs. |
| R, A |
| 2.2.3.7 |
| Establish incident/problem classification by priority. |
| C, I |
| R, A |
| 2.2.3.8 |
| Establish incident/problem workflow, escalation, communication and reporting processes that help to achieve the SLAs (see “Attachment A, Service Level Agreement Requirements”). |
| R, A |
| 2.2.3.9 |
| Review and approve incident/problem classification, prioritization, workflow, communication, escalation and reporting processes. |
R, A
| 2.2.3.10 |
| Manage entire incident/problem lifecycle including detection, diagnosis, State status reporting, repair, and recovery. |
| R, A |
| 2.2.3.11 |
| Ensure incident resolution activities conform to defined change control procedures. |
| R, A |
| 2.2.3.12 |
| Manage efficient workflow of incidents including the involvement of third-party providers (e.g. public carriers, ISP). |
| R, A |
| 2.2.3.13 |
| Coordinate end-user support activities with the Offeror. |
R, A
| 2.2.3.14 |
| Coordinate any UIS incident management reporting, tracking, escalation, and resolution activities with the State. |
| R, A |
| 2.2.3.15 |
| Provide the State with access and input capabilities to Offeror’s incident and problem management tracking system to allow for incident and related problem monitoring and ad hoc reporting. |
| R, A |
| 2.2.3.16 |
| Coordinate and take ownership of UIS related problem resolution with the State and third parties. |
| R, A |
| 2.2.3.17 |
| Perform Root Cause Analysis (RCA) of incidents, document findings and take corrective actions for in scope services. Resolve problem and/or substantiate that all reasonable actions have been taken to prevent future reoccurrence. |
| R, A |
| 2.2.3.18 |
| Periodically review the status of open incidents and related problems and the progress being made in addressing problems. |
| A |
| R |
| 2.2.3.19 |
| Conduct incident and problem management review sessions and provide listing and status of same categorized by problem impact. |
| R, A |
| 2.2.3.20 |
| Participate in incident and problem management review sessions and provide listing and status of same categorized by problem impact. |
| A |
| R |
| 2.2.3.21 |
| Identify and recommend possible enhancement opportunities for improved operational performance and potential cost impact. |
| R, A |
| 2.2.3.22 |
| Authorize closure of the State initiated Critical and High priority incidents. |
R, A
| 2.2.3.23 |
| Approve minor enhancement projects to implement operational improvements. |
R, A
| 2.2.3.24 |
| Super User Support |
| 2.2.3.25 |
| Answer end-user "how-to" questions (i.e., the most basic type of questions). |
R, A
| 2.2.3.26 |
| Deliver end-user refresher training. |
R, A
| 2.2.3.27 |
| Log incidents with the help desk or directly into the incident and problem management system (e.g., self service). |
R, A
| 2.2.3.28 |
| Capture and log enhancement requests. |
R, A
| 2.2.3.29 |
| Escalate to Level 1 help desk or UIS Support Center. |
R, A
| 2.2.3.30 |
| Help Desk (Level 1) |
| 2.2.3.31 |
| Perform password and end-user id resets. |
R, A
| 2.2.3.32 |
| Troubleshoot, manage, track and report problems end users experience with desktop applications, hardware, and software. |
R, A
| 2.2.3.33 |
| Troubleshoot, manage, track and report problems end users experience specific to the operational environment. |
| R, A |
| C, I |
| 2.2.3.34 |
| Troubleshoot, manage, track and report problems end users experience with UIS. |
| R, A |
| C, I |
| 2.2.3.35 |
| Perform initial triage in order to troubleshoot, manage, track and report problems end users experience with UIS. |
| R, A |
| C, I |
| 2.2.3.36 |
| Escalate to Level 2 support to manage, track and report problems end users experience with UIS. |
R, A
| 2.2.3.37 |
| Provide ongoing communication to end user as to the status of issue and resolution Level 2 (i.e., should also be available as self service). |
| R, A |
| C, I |
| 2.2.3.38 |
| Perform problem escalation, review, and reporting. |
| R, A |
| C, I |
| 2.2.3.39 |
| Maintain Level 1 problem escalation procedures. |
R, A
| 2.2.3.40 |
| Maintain Level 2 application support escalation procedures. |
| R, A |
UIS System Problem Management Services (Level 2 and Level 3)
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
UIS System Problem Management (Level 2 and Level 3) – Roles and Responsibilities
| # |
| UIS System Problem Management (Level 2 and Level 3) – Roles and Responsibilities |
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.4.1 |
| Initiate problem resolution priority and assign resources. |
| R, A |
| 2.2.4.2 |
| Analyze UIS problems. |
| R, A |
| 2.2.4.3 |
| Provide ongoing updates on problem resolution status. |
| R, A |
| 2.2.4.4 |
| Coordinate Level 2/3 application problem management for the UIS. |
| R, A |
| 2.2.4.5 |
| Track and report incidents and problems. |
| R, A |
| 2.2.4.6 |
| Troubleshoot, manage, track, and report operational problems with disk sub-systems, operating system, network, etc. |
| R, A |
| 2.2.4.7 |
| Troubleshoot, manage, track, and report operational problems that are result of database and application issues. |
| R, A |
| 2.2.4.8 |
| Troubleshoot, manage, track, and report desktop application installation issues. |
| R, A |
| 2.2.4.9 |
| Escalate problems as necessary according to incident and service management procedures. |
| R, A |
| 2.2.4.10 |
| Coordinate with and provide support to the State’s help desk for incident and service request management. |
| R, A |
| 2.2.4.11 |
| Provide Level 2 technical support and assistance as necessary to ensure maximum UIS uptime. |
| R, A |
| 2.2.4.12 |
| Establish, staff, and operate a Level 3 UIS support help desk responsible for: |
Receive and log incidents received from Level 1 and Level 2 help desks.
Categorize and log IT inquiries/problems/requests.
Determine inquiry/problem request/resolution requirements.
Resolve inquiry/problem according to SLAs.
Escalate to UIS software vendor(s), if necessary).
Identify problem characteristics and, if possible, root cause.
Notify the State Level 1 and Level 2 help desk, as required.
Monitor problems until problem is resolved.
Provide ongoing communication and reporting on the status of problems.
Communicate resolution status and provide closure notification.
Perform trend analysis of incidents and problems and report findings on a monthly basis.
R, A
Root Cause Analysis
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
Root Cause Analysis – Roles and Responsibilities
Roles and Responsibilities
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.5.1 |
| Provide RCA policies, procedures, and standards. |
| R, A |
| 2.2.5.2 |
| Develop procedures for performing RCA that meet requirements and adhere to defined policies. |
| R, A |
| 2.2.5.3 |
| Approve RCA procedures. |
R, A
| 2.2.5.4 |
| Conduct proactive trend analysis to identify recurring problems. |
| R, A |
| 2.2.5.5 |
| Track and report recurring problems or failures and provide associated consequences of problems, including business impact to the State. |
| R, A |
| 2.2.5.6 |
| Recommend solutions to address recurring problems or failures. |
| R, A |
| 2.2.5.7 |
| Approve solutions to address recurring problems or failures. |
R, A
| 2.2.5.8 |
| Identify root cause of the State defined Critical and High Priority Incidents and recommend appropriate resolution action. |
| R, A |
| C, I |
| 2.2.5.9 |
| Approve solutions to address Critical and High Priority Incidents. |
R, A
| 2.2.5.10 |
| Provide status reports detailing the RCA and the procedure for correcting recurring problems of Critical and High Incidents until closure, as defined by the State. |
| R, A |
User Account Management
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
User Account Management – Roles and Responsibilities
| # |
| User Account Management - |
Roles and Responsibilities
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.6.1 |
| Manage and perform UIS User Account (UA) maintenance, including: |
New UAs UA refresh UA copy (e.g., complete UA copy) Cross-instance UA copy UA deletion R, A
| 2.2.6.2 |
| Approve UIS UA maintenance. |
R, A
| 2.2.6.3 |
| Perform setup and monitoring of security and authorization configuration. |
| R, A |
| 2.2.6.4 |
| Define access privileges. |
| R, A |
| 2.2.6.5 |
| Assign new UAs. |
| R, A |
| 2.2.6.6 |
| Define procedure to provide access keys, VPN, etc. |
| R, A |
Security Administration
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
Security Administration – Roles and Responsibilities
| # |
| Security Administration – Roles and Responsibilities |
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.7.1 |
| Define UIS security requirements, standards, procedures, and policies including regulatory requirements. |
R, A
| 2.2.7.2 |
| Assist in developing security standards, policies, and procedures including, but not limited to integration of industry best practices. |
| R, A |
| 2.2.7.3 |
| Conduct risk assessment to identify control or security gaps. |
| R, A |
| 2.2.7.4 |
| Provide security plan and infrastructure based on security requirements, standards, procedures, policies, incorporating federal, State, and local requirements and risks. |
| R, A |
| 2.2.7.5 |
| Review and approve security plans. |
R, A
| 2.2.7.6 |
| Implement physical and logical security plans consistent with the State security policies and industry standards. |
| R, A |
| 2.2.7.7 |
| Establish access profiles and policies for adding, changing, enabling/disabling, and deleting logon access of State employees, agents, and subcontractors. |
R, A
| 2.2.7.8 |
| Perform logon/security-level access trainings at the OS and system software level as detailed in profiles and policies. |
| R, A |
| 2.2.7.9 |
| Report security violations to the State per approved policies. |
| R, A |
| 2.2.7.10 |
| Resolve security violations internal to the State. |
X
| 2.2.7.11 |
| Review all security patches relevant to the environment and classify the need and speed in which the security patches should be installed as defined by the State security policies. |
| R, A |
| c, i |
| 2.2.7.12 |
| Install security patches. |
| R, A |
| 2.2.7.13 |
| Perform periodic security audits. |
| c, i |
| R, A |
| 2.2.7.13A |
| Perform on-demand and unannounced penetration testing. |
R, A
| 2.2.7.14 |
| Provide documentation of the performance by an experienced third-party consultancy of external penetration tests on, at least, a quarterly basis, and internal network security audits at least annually. The audits should be against International Organization for Standardization (ISO) 27001/2 and in compliance with Statement on Standards for Attestation Engagements (SSAE16). |
| R, A |
| 2.2.7.15 |
| Provide documented requirements (e.g., design and audit procedures) for network security to ensure that other customers will not compromise its shared-service infrastructure. |
| R, A |
| 2.2.7.16 |
| Maintain all documentation required for security audits, internal controls and control testing. |
| R, A |
| c, i |
| 2.2.7.17 |
| Place and support systems with particularly sensitive data in controlled access areas. Only end users with authorized access permission will be allowed to enter these areas. |
| R, A |
| 2.2.7.18 |
| Assist with third-party security audits. |
| R, A |
| 2.2.7.19 |
| Perform prompt removal of end users when access is no longer required. |
| R, A |
| 2.2.7.20 |
| Review of the end user access list at least every 90 days to ensure terminated staff accounts or unused end user accounts have been removed from the UIS. |
| C, I |
| R, A |
| 2.2.7.21 |
| Provide a documented policy for "hardening" the underlying virtualized infrastructure that its services run on. |
| R, A |
| 2.2.7.22 |
| Provide validated and documented procedures for configuration management, patch installation and malware prevention for all servers and PCs involved in service delivery. |
| R, A |
| 2.2.7.23 |
| Provide documented set of controls to ensure the separation of data and security information among customer applications. |
| R, A |
| 2.2.7.24 |
| Provide review of the security of applications and any supporting code (e.g., AJAX, ActiveX controls, Java applets) used. |
| R, A |
| 2.2.7.25 |
| Provide content monitoring and filtering, or data loss prevention inappropriate for data flows. |
| R, A |
| 2.2.7.26 |
| Provide adequate protection of data that is covered by regulatory or other compliance requirements. |
| R, A |
| 2.2.7.27 |
| Provide documented procedures to perform background checks on personnel with administrative or other privileged access to servers, applications, or customer data. |
| R, A |
| 2.2.7.28 |
| Provide documented procedures for superuser privilege management and database activity monitoring controls or the equivalent to detect inappropriate behavior by personnel with administrative access. |
| R, A |
| 2.2.7.29 |
| Provide documented process for evaluating security alerts from the OS and application vendors, shielding systems from attack until patched, and installing security patches and service packs. |
| R, A |
| 2.2.7.30 |
| Provide and execute documented procedures for security monitoring and log management functions, and use write-once technology or other secure approaches for storing audit trails and security logs. |
| R, A |
| 2.2.7.31 |
| Provide documented established procedures for vulnerability management, intrusion prevention, incident response, incident escalation, and investigation. |
| R, A |
| 2.2.7.32 |
| Demonstrate that the security staff average more than four years of experience in information and network security. |
| R, A |
| 2.2.7.33 |
| Demonstrate that more than 75% of the Offeror’s security staff has security industry certification (e.g., Certified Information Systems Security Professional, Global Information Assurance Certification, or equivalent). |
| R, A |
| 2.2.7.34 |
| Demonstrate that staff has vendor certification for the specific firewall equipment they will manage. |
| R, A |
| 2.2.7.35 |
| Provide documented identity management and help desk procedures for authenticating callers before resetting access controls, establishing and/or deleting accounts. |
| R, A |
Storage Management
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
Storage Management – Roles and Responsibilities
Roles and Responsibilities
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.8.1 |
| Recommend techniques and procedures to ensure disk storage resources are utilized in an efficient and cost-effective manner, as well as meeting business requirements. |
| R, A |
| 2.2.8.2 |
| Maintain and improve storage resource efficiency and space requirements. |
| R, A |
| 2.2.8.3 |
| Regularly review backup and recovery procedures to demonstrate recoverability. Verify that actual practices are in concert with State business requirements and procedures and report the results. |
| R, A |
| 2.2.8.4 |
| Provide data storage and data management services (e.g., RAID array, SAN, NAS, tape, optical). |
| R, A |
| 2.2.8.5 |
| Provide data backup and restoration services in accordance with State-established policies. |
| R, A |
| 2.2.8.6 |
| Secure backup media in independently certified, U.L. Class II media storage vaults that meet the design and construction requirements of National Fire Protection Association (NFPA)232, Standard for the Protection of Records. |
| R, A |
| 2.2.8.7 |
| Perform periodic incremental and full tape backups/exchange backup tapes with storage at an off-site facility. |
| R, A |
| 2.2.8.8 |
| Provide input processing activities (e.g., loading third-party media, receipt, and/or transmission of batch files). |
| R, A |
| 2.2.8.9 |
| Maintain a tape library management system and transport tapes to the production area as needed. |
| R, A |
| 2.2.8.10 |
| Maintain data set placement and manage data catalogs. |
| R, A |
| 2.2.8.11 |
| Manage file transfers and other data movement activities. |
| R, A |
| 2.2.8.12 |
| Manage input media availability to meet processing service levels. |
| R, A |
| 2.2.8.13 |
| Manage the media inventory to ensure that adequate media resources are available. |
| R, A |
| 2.2.8.14 |
| Acquire and manage consumables (e.g., tape, disks) in support of the State's backup requirements for the data center. |
| R, A |
| 2.2.8.15 |
| Plan, execute and report on the replacement of media in the scratch tape pool before 80% of its expected life (i.e. as defined by the media manufacturer) on a going-forward basis. |
| R, A |
| 2.2.8.16 |
| Monitor and control storage performance according to storage and data management policies. |
| R, A |
| 2.2.8.17 |
| Monitor and demonstrate compliance with the State’s retention and storage requirements. |
| R, A |
| 2.2.8.18 |
| Monitor the execution of utilities that report on fixed/pool record capacity for the UIS and provide reports, as necessary. |
| R, A |
| 2.2.8.19 |
| Effectively track, manage, communicate, and resolve all tape exceptions. |
| R, A |
| 2.2.8.20 |
| Ensure all replaced media (e.g. tapes and disk storage are cleared of data, pursuant to NIST 800-88 requirements. Any media no longer required should be destroyed or shredded in a similar fashion. |
| R, A |
| 2.2.8.21 |
| Exchange backup tapes with off-site storage facility. |
| R, A |
| 2.2.8.22 |
| Provide secure off-site storage for designated media and transport media to off-site location as required. |
| R, A |
| 2.2.8.23 |
| Periodically test and verify validity of tapes. |
| R, A |
| 2.2.8.24 |
| Perform periodic audits to ensure proper cataloging of media. |
| R, A |
| 2.2.8.25 |
| Report disk space and tape utilization. |
| R, A |
| 2.2.8.26 |
| Manage tape storage service provider. |
| R, A |
| 2.2.8.27 |
| Perform recoup for UIS production databases on a regular basis and verify that roll-in is done after verifying reports. |
| R, A |
| 2.2.8.28 |
| Perform restores of test systems in accordance with State approved policies and procedures. |
| R, A |
| 2.2.8.29 |
| Schedule and execute implementation of additional DASD required for UIS. |
| R, A |
Output Management
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
Output Management – Roles and Responsibilities
| # |
| Output Management - Roles and Responsibilities |
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.9.1 |
| Develop and document output management (OM) requirements and policies, including transport, delivery locations and schedule requirements. |
| R, A |
| 2.2.9.2 |
| Define business requirements for printer, fax, and OM. |
R, A
| 2.2.9.3 |
| Define application requirements for printer, fax, and OM. |
| R, A |
| 2.2.9.4 |
| Define technical requirements for printer, fax, and OM. |
| R, A |
| 2.2.9.5 |
| Approve technical requirements for printer, fax, and OM |
R, A
| 2.2.9.6 |
| Develop and document OM procedures that meet requirements and adhere to defined policies. |
| R, A |
| 2.2.9.7 |
| Review and approve OM procedures. |
R, A
| 2.2.9.8 |
| Procure OM equipment. |
| R, A |
| 2.2.9.9 |
| Configure, monitor, test and manage OS printer / fax / OM queues and spool files. |
| R, A |
| 2.2.9.10 |
| Ensure that output devices are functioning, including performing or coordinating routine maintenance. |
| R, A |
| 2.2.9.11 |
| Maintain printer / fax / OM application parameters. |
| R, A |
| 2.2.9.12 |
| Manage application printer / fax / OM processes and output queues at the application layer. |
| R, A |
| 2.2.9.13 |
| Perform spool administration and logical printer management inside the system. |
| R, A |
| 2.2.9.14 |
| Investigate and resolve application related printer / fax / OM problems. |
| R, A |
| 2.2.9.15 |
| Investigate and resolve infrastructure related printer / fax / OM problems. |
| R, A |
| 2.2.9.16 |
| Provide OM device maintenance and service. |
| R, A |
| 2.2.9.17 |
| Provide technical team with output device IP address / technical configuration. |
| R, A |
| 2.2.9.18 |
| Cancel output jobs at O/S level. |
| R, A |
| 2.2.9.19 |
| Configure printer / fax / OM profile parameters in the application. |
| R, A |
| 2.2.9.20 |
| Support and maintain printer / fax / output application. |
| R, A |
| 2.2.9.21 |
| Support and maintain printer / fax / output integration components on the application. |
| R, A |
| 2.2.9.22 |
| Support and maintain printer / fax / output integration components on the server. |
| R, A |
| 2.2.9.23 |
| Support and maintain printer / fax / output integration server. |
| R, A |
| 2.2.9.24 |
| Provide print OM and distribution. |
| R, A |
| 2.2.9.25 |
| Separate and organize printed output materials accordingly. |
| R, A |
| 2.2.9.26 |
| Ensure that printed output is delivered to the State specified delivery locations according to schedule. |
| R, A |
| 2.2.9.27 |
| Acquire and manage consumables (e.g., paper, print ribbons, ink, and tapes) and coordinate acquisition of additional materials, as needed. |
| R, A |
Batch – Job Control and Scheduling
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
Batch – Job Control and Scheduling – Roles and Responsibilities
| # |
| Batch – Job Control and Scheduling - Roles and Responsibilities |
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.10.1 |
| Define job scheduling requirements, application software interdependencies, and rerun requirements for all production jobs. |
| R, A |
| 2.2.10.2 |
| Define requirements and maintain documentation of all job scheduling and re-run requirements. |
| R, A |
| 2.2.10.3 |
| Define test and demand batch scheduling requirements. |
| R, A |
| 2.2.10.4 |
| Utilize and manage scheduling tools for automating job execution (e.g., job workflow processes interdependencies, rerun requirements, file exchange functions, and print management). |
| R, A |
| 2.2.10.5 |
| Produce and distribute job schedule. |
| R, A |
| 2.2.10.6 |
| Create, maintain, and update code required for job control and scheduling. |
| R, A |
| 2.2.10.7 |
| Identify job scheduling changes to improve application job stream effectiveness. |
| R, A |
| 2.2.10.8 |
| Provide job scheduling, job execution, reporting and resolution, taking into account infrastructure and UIS interdependencies. |
| R, A |
| 2.2.10.9 |
| Execute test and demand batch jobs on appropriate systems. |
| R, A |
| 2.2.10.10 |
| Maintain database of job scheduling, contact, rerun, and interdependencies. |
| R, A |
| 2.2.10.11 |
| Perform quality control on test-to-production results. |
| R, A |
| 2.2.10.12 |
| Perform job monitoring. |
| R, A |
| 2.2.10.13 |
| Monitor failed job. |
| R, A |
| 2.2.10.14 |
| Assess impact of failed jobs. |
| R, A |
| 2.2.10.15 |
| Provide notification to end users of failed jobs. |
| R, A |
| 2.2.10.16 |
| Recover/resolve from failed jobs. |
| R, A |
| 2.2.10.17 |
| Validate job results and re-run per instructions. |
| R, A |
| 2.2.10.18 |
| Terminate/cancel jobs per requests or pre-defined procedures. |
| R, A |
| 2.2.10.19 |
| Provide job rejection analysis with error notification to the end user. |
| R, A |
| 2.2.10.20 |
| Provide quality control for reprocessing activities (e.g., batch reruns). |
| R, A |
| 2.2.10.21 |
| Provide schedule status. |
| R, A |
| 2.2.10.22 |
| Notify the State and maintain a history of job completion results. |
| R, A |
UIS Router Remote Access
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
Remote Access Facilities – Roles and Responsibilities
| # |
| Database Management Administrations - Roles and Responsibilities |
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.11.1 |
| Define remote access (RA) policies and procedures. |
| R, A |
| 2.2.11.2 |
| Approve RA policies and procedures |
R, A
| 2.2.11.3 |
| Participate in defining and accept RA policies and procedures. |
| R, A |
| 2.2.11.4 |
| Install, test, and provide technical support, administration and security administration for RA hardware and software. |
| R, A |
| 2.2.11.5 |
| Perform system or component configuration changes necessary to support remote access services. |
| R, A |
| 2.2.11.6 |
| Monitor and report UIS Router intrusions attempts. |
| R, A |
Database Administration
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
Database Administration – Roles and Responsibilities
| # |
| Database Management Administrations - Roles and Responsibilities |
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.12.1 |
| Define authorization requirements for users, roles, schemas, etc. |
| R, A |
| 2.2.12.2 |
| Approve authorization requirements for users, roles, schemas, etc. service request. |
R, A
| 2.2.12.3 |
| Provide security administration including managing role and user database permissions in accordance with approved State policies and procedures. |
| R, A |
| 2.2.12.4 |
| Perform database restores from export dumps or backups. |
| R, A |
| 2.2.12.5 |
| Create/refresh databases (e.g., development, quality assurance (QA), and training) from production data. |
| R, A |
| 2.2.12.6 |
| Execute authorization change requests. |
| R, A |
| 2.2.12.7 |
| Define database creation, configuration, upgrade, patches, and refresh requirements. |
| R, A |
| 2.2.12.8 |
| Execute database creation, configuration, upgrades, patches, and refresh. |
| R, A |
| 2.2.12.9 |
| Execute all database system level changes (e.g. initialization parameters). |
| R, A |
| 2.2.12.10 |
| Execute all schema changes for all database instances. |
| R, A |
| 2.2.12.11 |
| Define database data definition requirements for applications (e.g., MAC for tables, triggers, and attributes). |
| R, A |
| 2.2.12.12 |
| Execute database data definition requirements for applications (e.g., MAC for tables, triggers, and attributes). |
| R, A |
| 2.2.12.13 |
| Maintain documentation for all database instance parameters and system settings. |
| R, A |
| 2.2.12.14 |
| Maintain consistency of non-sizing and non-platform specific database parameters and system settings across all like instances (i.e., consistency must be maintained according to established development to QA to production life cycle). |
| R, A |
| 2.2.12.15 |
| Define database definition and manipulation requirements for applications and developer schemas. |
| R, A |
| 2.2.12.16 |
| Execute database data definitions for non-managed applications and developer schemas. |
| R, A |
| 2.2.12.17 |
| Define and execute database performance and tuning scripts in order to keep databases running at optimal performance for the State’s workload. |
| R, A |
| 2.2.12.18 |
| Perform database tuning and optimizations. |
| R, A |
| 2.2.12.19 |
| Perform database capacity utilization analysis. |
| R, A |
| 2.2.12.20 |
| Perform database imports/exports. |
| R, A |
| 2.2.12.21 |
| Utilize and administer appropriate database management tools across all database instances (i.e., performance metrics and historical data must be available for trending and reporting over a minimum of 6 months). |
| R, A |
| 2.2.12.22 |
| Identify locking conflicts, latch contention, and rollback requirements, etc. for all database instances. |
| R, A |
| 2.2.12.23 |
| Report locking conflicts, latch contention, rollback requirements, etc. for all database instances, and resolve as required. |
| R, A |
| 2.2.12.24 |
| Provide technical assistance and subject matter expertise to the State and third-party vendor support, as requested by the State. |
| R, A |
| 2.2.12.25 |
| Provide data dictionary expertise, end user data assistance, data warehouse metadata definition, data mapping functions, and creation of data cubes. |
| R, A |
| 2.2.12.26 |
| Monitor database and generate automatic trouble tickets for problems. |
| R, A |
| 2.2.12.27 |
| Open, track, and manage to resolution all database problems. |
| R, A |
| 2.2.12.28 |
| Plan and coordinate database upgrades and patches. |
| R, A |
| 2.2.12.29 |
| Patch database software as needed according to established development to QA to production lifecycle. |
| R, A |
| 2.2.12.30 |
| Manage database communication software configuration, installation, and maintenance. |
| R, A |
| 2.2.12.31 |
| Provide database storage management. |
| R, A |
| 2.2.12.32 |
| Approve database backup schedules, retention periods, and backup levels (e.g., full, incremental, or differential). |
R, A
| 2.2.12.33 |
| Define and execute the State’s database backup and recovery policies. |
| X |
| C, I |
| 2.2.12.34 |
| Perform UIS database administration, including: |
| R, A |
| 2.2.12.35 |
| Scheduled database maintenance and support |
| R, A |
| 2.2.12.36 |
| Table management and reorganization |
| R, A |
| 2.2.12.37 |
| Index analysis |
| R, A |
| 2.2.12.38 |
| Creation and management of tables and indexes |
| R, A |
| 2.2.12.39 |
| Growth analysis |
| R, A |
| 2.2.12.40 |
| File localization |
| R, A |
| 2.2.12.41 |
| File systems distribution |
| R, A |
| 2.2.12.42 |
| Schedule database specific related jobs (e.g., running database statistics). |
| R, A |
| 2.2.12.43 |
| Perform database copies and application database refreshes. |
| R, A |
| 2.2.12.44 |
| Backup of database archive of logs. |
| R, A |
| 2.2.12.45 |
| Provide and configure database storage management systems. |
| R, A |
OS, Application and Database Backup and Recovery
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
OS and Application and Database Backup and Recovery – Roles and Responsibilities
| # |
| OS, Application and Database Backup and Recovery - Roles and Responsibilities |
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.13.1 |
| Define and approve UIS backup and restore strategy. |
| C, I |
| R, A |
| 2.2.13.2 |
| Develop and implement UIS data backup and restore procedures in accordance with approved State strategy. |
| R, A |
| 2.2.13.3 |
| Define backup times, schedules, and point of restore based upon the State requirements. |
| R, A |
| 2.2.13.4 |
| Approve requirements for backup times and schedules. |
R, A
| 2.2.13.5 |
| Create and maintain backup scripts. |
| R, A |
| 2.2.13.6 |
| Maintain backup architecture (e.g., tape library and drives). |
| R, A |
| 2.2.13.7 |
| Test central/remote application backup and restore procedures based on State approved guidelines. |
| R, A |
| 2.2.13.8 |
| Perform complete/incremental backup. |
| R, A |
| 2.2.13.9 |
| Monitor the backup processes. |
| R, A |
| 2.2.13.10 |
| Verify the backup media integrity. |
| R, A |
| 2.2.13.11 |
| Notify the State when a backup has failed. |
| R, A |
| 2.2.13.12 |
| Label backup media. |
| R, A |
| 2.2.13.13 |
| Maintain backup library. |
| R, A |
| 2.2.13.14 |
| Synchronize UIS backup and restore tape rotation. |
| R, A |
| 2.2.13.15 |
| Prepare application and database for restore processes. |
| R, A |
| 2.2.13.16 |
| Restore single and/or multiple objects from the UIS backup media. |
| R, A |
| 2.2.13.17 |
| Restore complete and/or incremental UIS backup as required. |
| R, A |
| 2.2.13.18 |
| Monitor the UIS restore process. |
| R, A |
| 2.2.13.19 |
| Store copies of the backups in a vault and/or off-site facility. |
| R, A |
| 2.2.13.20 |
| Roll forward from the archive logs after a restore (i.e., point in time recovery). |
| R, A |
| 2.2.13.21 |
| Validate the integrity and the consistency of the restored information. |
| R, A |
| 2.2.13.22 |
| Validate the integrity and the consistency of restored information at the database layer. |
| R, A |
| 2.2.13.23 |
| Validate the integrity and the consistency of restored information at the application layer. |
| R, A |
| 2.2.13.24 |
| Validate the integrity and the consistency of restored information at the OS layer. |
| R, A |
| 2.2.13.25 |
| Perform business-level validation of the integrity and consistency of the restored data. |
R, A
| 2.2.13.26 |
| Notify the State when the restore has been completed. |
| R, A |
Change and Release Management
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
Change Management and Release Management – Roles and Responsibilities
| # |
| Change and Release Management Roles and Responsibilities |
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.14.1 |
| Provide UIS change and release management procedures and standards based on State policies. |
| R, A |
| 2.2.14.2 |
| Approve change classifications (e.g., impact, priority, risk) and change authorization process. |
R, A
| 2.2.14.3 |
| Review and approve UIS change and release management policies, procedures and standards; propose changes to meet the State requirements and organization. |
R, A
| 2.2.14.4 |
| Maintain overall accountability for the UIS change management activities. |
| R, A |
| 2.2.14.5 |
| Implement standard procedures and methods for each type of change including application services, interfaces, hardware, operating systems, databases, storage, network, batch schedule changes, etc. |
| R, A |
| 2.2.14.6 |
| Document and classify proposed changes to the UIS, which include cost and risk impact and back-out plans for changes; and establish release management plans for major changes. |
| R, A |
| 2.2.14.7 |
| Develop and maintain a schedule of planned changes to be reviewed and approved, as required, by the State. |
| R, A |
| 2.2.14.8 |
| Authorize, approve, and/or alter scheduled changes for any change requests. |
R, A
| 2.2.14.9 |
| Review release management details and alter, as appropriate, to meet the needs of the State (e.g., back out plan, go/no go decision). |
| R, A |
| 2.2.14.10 |
| Notify the State of changes, including the timing and impact of the change. |
| R, A |
| 2.2.14.11 |
| Coordinate change requests across service providers. |
| R, A |
| 2.2.14.12 |
| Manage SWAT teams for critical incidents related to the UIS. |
| R, A |
| 2.2.14.13 |
| Resolve incidents that fall across the various domains. |
| R, A |
| 2.2.14.14 |
| Develop a business contingency plan (e.g., a back out plan) for each release. |
| R, A |
| 2.2.14.15 |
| Document and coordinate the change management and release management schedules across the UIS, OS, hardware, database management system storage, network, facilities, etc. |
| R, A |
| 2.2.14.16 |
| Implement change and adhere to approved detailed release plans. |
| R, A |
| 2.2.14.17 |
| Report on the status of scheduled changes (e.g., UIS, server, OS, infrastructure, network, integration changes, and batch job schedule). |
| R, A |
| 2.2.14.18 |
| Schedule and conduct change management and release management meetings to include review of planned changes and the results of changes. |
| R, A |
| 2.2.14.19 |
| Verify the changes implemented meet the objectives established by introducing the change and resolve any negative impacts. |
| R, A |
| 2.2.14.20 |
| Monitor UIS changes and report the results of changes and impacts. |
| R, A |
| 2.2.14.21 |
| Assess impact of UIS production changes, prior to and after the implementation of changes. |
| R, A |
| 2.2.14.22 |
| Assess impact of OS changes prior to and after the implementation of the changes. |
| R, A |
| 2.2.14.23 |
| Administer the version control system as it relates to release management of the State’s custom configuration, extensions, etc. Of the UIS. |
| R, A |
| 2.2.14.24 |
| Modify configuration database, asset management items, and service catalog, if applicable, to reflect any implemented changes. |
| R, A |
| 2.2.14.25 |
| Maintain master copies of new versions of the UISs in a secured software library and update configuration databases, accessible to the State. |
| R, A |
Configuration Management
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
Configuration Management – Roles and Responsibilities
| # |
| Configuration Management - Roles and Responsibilities |
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.15.1 |
| Define configuration management policies. |
R, A
| 2.2.15.2 |
| Establish processes and procedures for tracking configuration changes. |
| R, A |
| 2.2.15.3 |
| Approve configuration management processes and procedures. |
R, A
| 2.2.15.4 |
| Utilize and maintain configuration management tools. |
| R, A |
| 2.2.15.5 |
| Establish interfaces to problem and incident management, change management, technical support, maintenance, and asset management processes. |
| R, A |
| 2.2.15.6 |
| Establish guidelines for physical and logical separation between development, QA, and production and the process for deploying and back out of configuration items. |
| R, A |
| 2.2.15.7 |
| Approve guidelines for physical and logical separation between development, QA, and production and the process for deploying and back out of configuration items. |
R, A
| 2.2.15.8 |
| Establish configuration baselines as reference points for rebuilds and provide ability to revert to stable configuration states. |
| R, A |
| 2.2.15.9 |
| Establish process for verifying the accuracy of configuration items, adherence to configuration management processes and identify deficiencies. |
| R, A |
| 2.2.15.10 |
| Provide the State with configuration management reports as required and defined by the State. |
| R, A |
| 2.2.15.11 |
| Audit configuration management process and the accuracy of the configuration data. |
R, A
Capacity Management
Offerors shall respond “Yes” or “No” to each requirement in the table below. A “No” response without providing a comment may cause the Offer to be rejected.
Capacity Planning – Roles and Responsibilities
| # |
| Capacity Planning – Roles and Responsibilities |
| Offeror |
| State |
| Offeror Response |
| Offeror Comment |
| 2.2.16.1 |
| Establish a comprehensive capacity management planning process. |
| R, A |
| 2.2.16.2 |
| Utilize and implement tools that allow for the effective capacity management monitoring/trending of IT infrastructure, systems software, and other IT components. |
| R, A |
| 2.2.16.3 |
| Identify future business requirements that will alter capacity requirements; determine capacity management trends and provide reports to the State. |
| R, A |
| 2.2.16.4 |
| Manage capacity plan based on requirements (e.g., number of users and new applications). |
| R, A |
| 2.2.16.5 |
| Gather business requirements for additional users, new applications, etc. |
| R, A |
| 2.2.16.6 |
| Utilize application capacity requirements to define database modifications and issue appropriate change requests. |
| R, A |
| 2.2.16.7 |
| Utilize application capacity requirements to define OS modifications and issue appropriate change requests. |
| R, A |
| 2.2.16.8 |
| Utilize application capacity requirements to define disk sub-system modifications and issue appropriate change requests. |
| R, A |
| 2.2.16.9 |
| Utilize application capacity requirements to define network modifications and issue appropriate change requests. |
| R, A |
| 2.2.16.10 |
| Assess capacity impacts when adding, removing, or modifying applications. |
| R, A |
| 2.2.16.11 |
| Perform monitoring of activities of IT resources (e.g., application, OS, server, database, network, disks, desktops, and laptops) usage to enable proactive identification of capacity and performance issues. |
| R, A |
| 2.2.16.12 |
| Capture trending information and forecast future State capacity requirements. |
| R, A |
| 2.2.16.13 |
| Assess incidents and problems related to throughput performance. |
| R, A |
| 2.2.16.14 |
| Recommend changes to system (e.g., components) to improve service performance. |
| R, A |
| 2.2.16.15 |
| Assess impact, risk, and cost of capacity changes. |
| R, A |
| 2.2.16.16 |
| Maintain capacity levels to optimize the use of existing IT resources and minimize the State’s costs to receive the services at the contracted service levels. |
| R, A |
| 2.2.16.17 |
| Ensure adequate capacity exists within the IT environment to meet service level agreements (SLAs) requirements (see “Attachment A Service Level Agreements and OF-7 Service Level Agreement Requirements”), taking into account daily, weekly and seasonal variations in capacity demands. |
| R, A |
| 2.2.16.18 |
| Provide utilization and capacity reporting. |
| R, A |
Performance…
This is the start of the file's text. The full file is on GovTribe.