Response to Offeror Questions document.pdf

RFP # 24RFP10154

Digital Evidence Storage and Delivery Solution

VENDOR QUESTIONS AND AGENCY RESPONSES

1) In reference to Section 4.6 “Corporate Qualification” point D, can offerors submit a DUNS & Bradstreet report to demonstrate financial stability?

Yes, this would be acceptable.

2) We understand that SDCI is looking for an offeror-hosted SaaS solution.

However, are you open to hosting the software in the SDCI’s MS Azure Gov cloud or AWS Gov Cloud for cost-efficiency, security control and storage optimization? Please indicate your preference.

No, we are looking for an offeror hosted SaaS solution.

3) We offer 3 different Client Access Licenses (CAL) with varying levels of access and permissions, can SDCI please provide a breakdown of the 130 total users and how many users would require what type of access or permissions?

-Approximately 10 users with full admin access and permissions -Approximately 90 users with read/write access and permissions -Approximately 30 users with read only access and permissions ***ICAC investigations/data involving child sexual abuse material (CSAM) or other sensitive material or data will require the ability to limit access to specific users.***

4) Can you please share any system go-live date targeted by the SDCI?

July 1, 2025

5) Can the SDCI provide a list of common file formats that will be migrated or uploaded to the new system?

There will be no data migration prior to the go live date. The following file types/extensions will be uploaded into the new system; .jpg, .png, .bmp, .giff, .mov, .mpeg, .avi, .wma, .wav, .mp3, .m1a, .mid, ,mdi, .chm, .pdf, .doc, .docx .xls, and Milestone video format.

6) Can the SDCI please provide some insight of some or all of the different sources from which data will be migrated/uploaded into the cloud-based solution?

There will be no data migration.

7) Can the SDCI please specify how much data is to be migrated to the new system?

8) Is SDCI looking for Hot, Cold and Archive storage option for cost saving? If so, what is the estimated volume of storage that may be required for each storage tier?

Approximately 150TB of data in Hot Storage

Approximately 200TB of data in Cold Storage Approximately 700TB of data in Archive Storge

9) Can the SDCI please list any metadata that should also be migrated and provide any significant detail?

There will be no metadata migration.

10) What is the expected timeline for data migration in this project?

11) In reference to section 3.9, Can the SDCI provide details of their existing infrastructure that needs to be integrated with the solution? Is this integration part of the project scope or planned for a later phase?

Milestone, Video Management Software. We would prefer part of the project scope if that is possible.

12) Can the SDCI please specify which digital forensics program they are currently using?

Cellebrite UFED 4PC, Cellebrite Physical Analyzer, Cellebrite Digital Collector, Magnet AXIOM, Magnet OUTRIDER, X-Ways Forensics

13) Can the SDCI please provide an acceptance criteria for all project deliverables, especially regression testing & load testing?

We would anticipate a project deliverable timeline that would include milestones and deadlines. These would be provided and approved by the state in writing.

In regards to regression and load testing, if required, that testing should be completed by the vendor and submitted to the state in writing that it has been completed successfully.

14) Can the SDCI please provide information on their SLA requirements?

We do not have specific SLA Requirements. Please refere to Appendex A regarding our contract requirements.

15) In reference to requirement 3.11.9, can the SDCI please let us know if there is a preference for a yearly subscription model or perpetual software license?

With a hosted cloud solution, it was the assumption that it would a yearly subscription model

16) In reference to requirement 3.3.5, can the SDCI please explain or provide an example scenario?

Direct edge to cloud streaming of video surveillance footage from within the Milestone system to the cloud storage solution with the ability to automatically convert the proprietary video format into a standard .mp4 video file while maintaining the original “first instance” file.

Future program expansions would provide the ability to offer direct edge to cloud streaming of video surveillance footage from within the Milestone system to the cloud storage solution with the ability to automatically convert the proprietary video format into a standard .mp4 video file while maintaining the original “first instance” file.

17) In reference to section 7.4.6 and 7.4.7, can the SDCI please elaborate what they mean & specify if they have a preference for a local vendor or on-site work as opposed to remote?

No Preference

18) In reference to Section XLV in Appendix A, can the SDCI please provide more detail or elaborate?

The format or method for training is up to the vendor. We require the items mentioned in section XLV – Vendor Training Requirements are covered by the vendor through their training process. We want to ensure your employees are trained on the safeguarding of restricted state data and how to report a security incident if there is one.

19) Does the SDCI have any other nice-to-have features they are looking for in cloud-based digital evidence management solution?

Ability to encrypt and limit access to sensitive data such as child sexual abuse material (CSAM).

20) Does SD DCI currently have a Digital Evidence Management System (DEMS) in place?

No

21) Is SD DCI hoping to obtain a new or replace an existing Digital Evidence Management System (DEMS) or is this RFP simply for the "storage" of the current and future digital evidence items?

SD DCI is hoping to obtain a new Digital Evidence Management System.

22) If a Digital Evidence Management System is required, are there specific software functionality requirements being requested? The RFP does not include any DEMS software functionality requirements in Appendix B.

-Ability create a case within the DEMs based upon case number and upload various types of digital evidence to each case for storage.

-Ability to categorize, store and search for digital evidence based upon a specific case number.

-Ability to encrypt and limit access to sensitive data such as child sexual abuse material (CSAM).

-Ability to transfer digital evidence between users -Ability to provide digital evidence discovery (inside and outside state network) -Ability to apply a specific retention tag or designation to individual items of digital evidence with automatic notifications regarding retention periods that have been reached.

23) If a DEMS is required, are these the only software functionality requirements as included in the second paragraph on page 11?

• Electronically transfer digital evidence between users

• Digital Evidence Discovery (inside and outside state network)

• Community Upload link

• Full Audit Log

Please see question 22.

24) RE: Proposal Due Date / Labor Day Holiday: The proposal due date is Monday, September 2nd which is also the Labor Day holiday. Will the issuing office be open and accepting deliveries on the Labor Day holiday, or should vendors prepare to submit responses by Friday, August 30th?

There will not be someone onsite to accept deliveries on Sept 2, 2024.

However, any propopsals received that have been date stamped by Sept 2, 2024 will be accepted.

25) What is the priority for user metadata, vs. system metadata, vs. audits?

1. User Metadata

2. Audits

3. System Metadata

26) Would you like to convert the proprietary video into a standard .mp4 video file while maintaining the original “first instance” file?

Yes

27) Is the current legacy system still in production?

There is no legacy system.

28) How much downtime can you live with? (i.e., can’t review evidence during the migration)

There is no migration.

29) Is there a timetable/target to get this migration completed?

30) How much bandwidth do you have available towards the migration to the cloud?

31) Are there any additional notes or information you would like to provide?

Please see question 22.

32) Are you looking for an On-premises or cloud DEM solution?

Cloud solution

33) How many officers/users will be using the DEMS SW?

Approx 130

34) How much data will you be storing in the DEMS per year? (i.e. 500TB, 1PB)

Please see questions 8 and 55.

35) How much data do you have on the secondary devices (i.e. CDs/DVDs, Thumb Drives, HDDs) Approximately 500TB to 600TB across multiple devices (NAS, External Hard Drives, etc.) Only a portion of this data will be manually transferred to the DEMs after the go-live date on a case by case basis.

36) Are you migrating off any old systems into the new DEMS?

If so, who are the vendors?

37) Who are your Body Worn Camera and In-Car Vendors?

Do these vendors have APIs/SDKs?

We do not have body worn or in car cameras. However, we do work investigations where body worn camera evidence is collected. The typical body worn camera systems in South Dakota are: Axon and Motorola.

38) Who are the other vendors for your Photo management system, Lab Reports, and others?

Do they also have APIs/SDKs?

We do not have any other vendors for photo management other than the agency RMS which does not hav APIs/SDKs. We do not have any plans to integrate the DEMs with our existing Forensic Lab management software.

39) Are the third-party video files proprietary?

What are the extensions for these proprietary videos? (i.e. G64X, BLK, DAT, EXE)

The VMS that the Division of Criminal Investigation utilizes is Milestone. The video downloads are typically exported in a proprietary format, to keep the original format in-tact. These proprietary files come in an EXE extension file.

40) Do you want to also pull the metadata and the audit trails from your existing systems?

41) Please describe your current evidence gathering workflow.

The SD DCI is a decentralized agency with field offices located all throughout the state. Agents and prosecutors conduct investigations and prosecutons independently or in partnership with state, local and federal LE partners. With regard to digital evidence, the individual agent is responsible for obtaining the various types of digital evidence that are relevant to a specific investigation (i.e.

audio recordings, video recordings, search warrant returns, raw data extractions and forensic images). The agent is then responsible for storing the digital evidence within the agency RMS system, the agency shared network drive, individual NAS storage servers or removable media. The agent is also responsible for manually distributing copies of the digital evidence to prosecutors and other LE partners for investigative purposes or discovery.

42) Is the state of South Dakota open to existing vendor software solutions or are you seeking a custom built solution? Several requirements imply custom-built solutions or requests not typical of SaaS product contracts. For example:

Hosting data within South Dakota’s own AWS GovCloud account. While

Guardify leverages AWS GovCloud currently, it is a multi-tenant architecture platform.

Deeper access to privileged infrastructure typically incompatible with purchasing commercial SaaS solutions:

o 3.5 Data Access Requirements- State to own the data tables and be able to manipulate data, run reports as needed, pull code tables, access raw data, and develop dashboards as needed through Microsoft Power BI, ESRI, Tableau and associated platforms.

o 3.11.3 BIT access to existing or independent test environments for releases.

o 3.11.3.2 BIT approving releases to production.

o 3.11.4 All solutions acquired by the State that are hosted by the offeror, including Software as a Service, or hosted by a third-party for the offeror will be subjected to security scans by BIT.

Additionally, 9.0 Scanning noting scan occurring during RFP process.

o Section XXVII.E and Section XLII. Access to Source and Object Code o Section XXXIX.B.A-N internal software implementation and procedures.

3.11.8 The successful offeror will use the approved BIT processes and procedures when planning its project, including BIT’s change management process.

Open to both

43) Security and Vendor Questions (Appendix B): While [vendor] commonly responds to information security questionnaires, this content cannot be shared publicly or retained in public record. Can non-competitive, reviewing entities enter into an NDA for access separate from primary RFP deliverables?

Please comply with Paragraph 1.14 of the RFP as it related to proprietary information.

44) [3.11.6] Could you please clarify which specific metrics you are looking to track with the monitoring tools to determine the health of the solution? For example, are you interested in tracking storage usage, the number of cases or investigations, or other relevant data points?

The intent is to be able to make sure the solution stays up or issues are resolved quickly for your team. Some type of tool that montiors uptime or performance, like Azure Application Insights, would meet those needs.

45) [3.2.4]On average how many active investigations does the Attorney General’s Office or its investigative agencies take part in annually?

Approximately 1,500 invesgiations per year.

46) [3.2.4]How many cases are filed per year by the Attorney General’s Office?

Please see question 45.

47) What systems and processes does the Attorney General’s Office currently use to collect evidence or discovery from their law enforcement or other investigative partners?

Currently the SD DCI and the SD Attorney General’s Office are using external hard drives, thumb drives, CDs/DVDs, and other removeable storage media to collect or share discovery with LE partners. Depending on the type of digital evidence, it is then stored within the the agency RMS system, the agency shared network drive, individual NAS storage servers or removable media.

48) [3.10 ]What systems and processes does the Attorney General’s Office currently use to share evidence or discovery with their partners or defense counsel?

Currently for all files exept video and extremely large files, they are shared through the DCI RMS web client. For video and extremely large files, they are burned to a CD.

49) [3.3.3]Can you elaborate further on what functionality and specific features the Attorney General’s Office is looking for to receive and share evidence with its partners and defense attorneys?

The SD DCI and the SD Attorney General’s Office is looking for a way to share both a data upload and data download feature with partners and potentially defense attorneys. This could be in the form of upload/download links or limited and controlled access to a specific file/folder.

50) How is the evidence for these cases being managed currently by the Attorney General’s Office staff?

Currently housed in the DCI RMS or on an internal agency drive share.

51) [3.3.5]How is the Attorney General’s Office currently editing and/or transcribing video and audio evidence?

ExpressScribe

52) [ 3.8 ]Can you explain further what functionality the state is looking for by asking for an integration between systems currently in use and a digital evidence management solution?

There is no cloud digital evidence solution currently in use for our video evidence VMS solution (Milestone). The goal is to create a cloud solution that could be integrated with Milestone directly, or the ability to upload Milestone video evidence from our on Prem service to the cloud. This would be for video that is deemed as “evidence” and needs to be retained for investigative purposes.

53) [ 3.8 ]Please list all systems that will need to be integrated, and specify what type of system it is and whether it is cloud-based.

Milestone – On Prem

54) [3.3.7]Please list what systems the Attorney General’s Office requesting data be migrated from.

None

55) [3.2.4] How much of the one petabyte of data is cold/archive storage versus active case use? Additionally, is one petabyte needed annually for new cases coming into the platform or for the files that need to be migrated?

It is currently estimated that approximately 350TB of data storage would be needed for active case use while the remainder of the petabyte would be for cold/archive storage. Some data may be manually migrated once the DEMs platform is up and running but there will be no vendor initiated data migration into the new system. Additional annual data storage capacity is anticipated to be approximately 500TB or less per year.

56) [3.3.14] Could you be more specific and share if is it required to have a community upload link for RFP consideration or can this be implemented in the product roadmap upon acceptance?

An existing Community Uplad Link functionality is preferred but could this functionality could be implemented upon acceptance as long as the ability to add this functionality is certain.

57) There are a couple of references to a ‘State Cloud’ environment in the RFP, specifically in the System/Product section questions #1 & #3. Is this reference meant to reference access to a greenfield (raw/brand new) environment that we as the contractor would be helping to instantiate or is this a reference to a larger existing cloud environment that the State of Sout Dakota already has established and that we would be expected to integrate the proposed solution into?

We are looking for a hosted cloud solution A supplemental question would be, if there is an existing cloud environment the BIT team is maintaining today, is there any information as to what onboarding requirements/accreditation, beyond meeting CJIS cloud requirements, that we would be expected to align with?

We are not looking to host this on the state cloud environment maintained by

BIT

58) Section 3.10 Scope of Components or Phases seems to have a sentence that isn’t fully completed. More specifically, the paragraph right before section 3.11 ends with the words ‘Lastly, the’ and we wanted to ensure there wasn’t any missing context that you wanted communicated. It seems to be that this is perhaps a copy and paste remnant from the previous sentence in that paragraph which starts out with similar wording, but we wanted to confirm we weren’t missing anything.

The last two words of “Lastly, the” in this paragraph should have been deleted, please regard them.

59) In order to provide as full and considered a response as possible, we would respectfully request a 2 week extension to the due date of the RFP.

Due to the tight timeline of the project funding, we will not be extending the RFP.

60) Regarding Section 3.2 on page 8, can you give more details on the 1PB of data that is looking to be migrated? Ie - how is the data structured? Is it broken out into cases, if so, how many cases? Is there relevant meta data that needs to be mapped into the new system? What types of files are contained in this data set?

No data will be migrated

61) Regarding the case management integration, is there a desire to have your digital evidence management system display data into your case management system?

We do not plan to do a case management integration.

62) What case management solution are you using today?

Central Square Pro Suite

63) Regarding section 3.8 on page 10, can the state elaborate on what interfaces to 3rd party systems it is expecting to need?

Milestone

64) Regarding section 3.11.6 on page 13, can the state provide more information on the monitoring tool's requirements?

Please refere to question 44.

65) What amount of new storage is expected to be uploaded annually?

Please see question 55.

66) What digital forensic program does the State want to host in the cloud environment?

Cellebrite Physical Analyzer & Magnet AXIOM

67) Is it acceptable that the digital forensic program to be a separate application from the digital evidence management system?

Yes, a separate application is acceptable.

68) Can you describe the integration capabilities required with the Milestone VMS?

Please see question 53.

Questions regarding the legacy system – Nothing to answer in this section since we are not migrating from a legacy system.

1) Please select any of the following that apply:

• We will need a one-time migration from old historical secondary devices

(e.g., CD/DVD, VHS, thumb drives) into a new back-end.

• We will need a one-time migration from an existing DEMS/CMS/RMS to a new one.

• We will need an integration with our backend to support ongoing digital evidence capture.

• Other. Describe:

2) Who is the manufacturer of the system you want to migrate from?

3) Is this a onetime migration or an ongoing migration/integration?

4) What types of assets are in the system? (i.e., videos. photos, audio files, documents)

5) If there are proprietary video files, what are the extensions and who are the manufacturers? (i.e., .g64x – Genetec)

6) Are the video files one single file or several segments for a recorded event? (For example, if it is a one-hour video clip then it is a single file of 1.5GB or it can be six files of ten minutes each totaling 1.5GB.)

7) What database is being used to keep the metadata and audits? (i.e., SQL, mysql, progress)

8) Can you provide a DB schema of the architecture?

9) Does the legacy system have APIs or an SDK to export files?

10) Can we get sample files?

11) Can we get a sample database?

12) Is there system metadata? (i.e., lightbar, brakes, weapon pull, GPS)

13) Is there EXIF metadata for photos or any file?

14) Does the legacy system have folder structures that need to be maintained?

15) For data migration, which of the following is true (select one):

• All assets consist of only one file.

• Some assets contain more than one file, but all files are in the same folder.

• Some assets contain more than one file and/or contain subfolders.

• Unknown

16) For data migration, maintaining the original folder structure of the migrated data in the backend is (select one):

• Unknown

• Preferred

• Unnecessary or not applicable

• Critical Please Explain:

17) Please describe your current evidence gathering workflow process.

18) If known, approximately how many terabytes of data need to be migrated in total and/or per month?

Questions regarding the new system - Nothing to answer in this section since this RFP is our way of deciding on a new system.

19) Who is the manufacturer of the system you want to migrate to?

20) Does the new system support folder structures?

21) Does the new system support prepending audits?

22) Does the new system support system metadata? (i.e., lightbar, brakes, weapon pull,

23) Does the new system have APIs?

24) Does the new system support proprietary video?

25) Does the new system support EXIF metadata for photos or any files?