Response to Offeror Questions document.pdf

RFP # 24RFP11465

Digital Evidence Storage and Delivery Solution

VENDOR QUESTIONS AND AGENCY RESPONSES

1) How much existing data will be brought into the system for:

• Active Cases

There will be no data migration or transfer of existing data.

• Inactive Cases

There will be no data migration or transfer of existing data.

2) Will existing data be loaded all at once or over an extended period of time? If it will be a large chunk and then followed by more data over an extended period, how large will the initial chunk be?

There will be no data migration of existing data.

3) How much new data needs to be budgeted for per year?

It is estimated that additional data requirements each year will range between 100TB to 300TB. The 1PB of data storage listed in the RFP is the estimated total cumulative storage capacity that will be needed for data growth over the next several years with the ability for infinite growth as time goes on.

4) Is the average length of time that cases are active known?

No

5) Is the average length of time that evidence must be retained known?

No

6) In addition to the listed file types is the storage and viewing of RAW digital camera files a requirement? (NEF, CR3, etc.)

No

7) Is integration with 3rd party tools such as Adobe Photoshop, Microsoft Office, etc. a requirement?

As long as the documents or files are viewable within the solution this requirement would be met. The ability to send email messages from within the system is required but the email capability does not have to be a 3rd party integration.

8) Is direct capture of images/video/audio from a mobile app a requirement?

This is not a requirement but is a nice-to-have option.

9) Is video redaction a requirement?

This is not a requirement but is a nice-to-have option.

10) Is acquisition (upload) of entire un-zipped directory structures a requirement?

Yes

11) Is a dedicated single-tenant environment a requirement?

A dedicated single-tenant environment within our agency would be required.

12) Is the State expecting a fully custom-built DEMS or is the State expecting a COTS solution for the DEMS?

The state is open to all solutions.

13) Can the State please confirm that the budget for this DEMS project is $100K/Year (as stated on Page 12, Section 3.9.5)? Is that annual budget amount fixed?

Yes

14) Will the State consider accepting electronic responses via email of the RFP response (vs. 5 hard copies) in the requested formats (Word and PDF)?

Yes, we have amended the RFP to reflect this change. Please refer to section 1.6.2

15) Given the numerous requests for clarification, will the State consider extending the deadline for the response submissions?

No. However, we have amended the RFP to allow electronic submissions in order to give vendors options in how they want to submit their proposal.

16) On page 8, Section 3.2, can you please clarify if there is a change in storage requirements on this RFP from the previous?

There is no change in the storage requirements on this RFP from the previous.

See question #3.

17) On the last version it was stated that there was no data conversion required. Is that still the case?

Yes

18) If no data conversion is needed, can you help us understand what is meant by 1PB of storage needed currently with unlimited growth? We interpret that to mean you want to load 1PB of data into the system during implementation, and then want unlimited storage moving forward for new case files. Is that an accurate interpretation?

• If the answer to the above is - yes, we do want to migrate 1PB of data, can you please provide details of that data? For example, how is it organized, what types of metadata fields are there, how many locations in the state is the date located, what extraction capabilities does your systems have, etc.

No data conversion is needed of existing data. The 1PB of data is the estimated total storage capacity that will be needed for cumulative data growth over the next several years with the ability for infinite growth as time goes on. See question #3.

19) How many full-time employees are employed at the Office of the Attorney General?

As stated in section 3.9 of the rfp, approximately 130 agency users:

• Approximately 10 users with full admin access and permissions

• Approximately 90 users with read/write access and permissions

• Approximately 30 users with read only access and permissions

20) On page 10, section 3.8, Can the state confirm if there are any other third-party integrations required besides Milestone?

That is correct.

21) On page 10, section 3.9.5, The State has asked for a very robust system, inclusive of 1PB of storage currently, unlimited storage moving forward and a potential data migration. Will the state be rejecting offers if they come in over the budgeted $100k annual mark?

Yes, appropriations have allotted our agency $100k annually for this project.

22) Is the requested solution under this RFP (#24RFP11465) the same desired solution issued under the recent RFP (#24RFP10154)?

Yes

• If yes, why is SD DCI reissuing a new RFP?

It was a business decision by the state to minimize project requirements and release the allotted annual budget for this project.

• If no, how does the current RFP differ from the previously released RFP?

• Do the answers from the previous RFP (#24RFP10154) hold true for the current RFP (#24RFP11465)?

It depends on if the question has to do with something we have changed or removed from the requirements or scope of work.

23) If a proposer has additional products including case management for prosecutors or case management modules for law enforcement, would you be interested in seeing additional product information regarding these modules?

Or digital evidence management only?

Vendor is welcome to share this information, but that information will not be used in the consideration of this RFP.

24) Is an interface required for Central Square?

No

25) Can SD DCI provide a full list of required interfaces?

None

26) How long do you anticipate it will take for responses to the questions we send your way regarding this RFP (are you willing to answer them as you receive them within a few business days, or should we expect to receive responses to all questions on October 18th)?

We will publish them on or before Oct 18th. We post them in a batch to give all Vendors the equal opportunity to review the answers at the same time.

• If you are sending out the responses in one full batch after the Q&A deadline, will you be willing to extend the bid submission date as the answers may be dependent on if a vendor can submit their response?

Unfortunately, due to the tight timeline of funding for this project, we are not able to extend the deadlines.

27) What technologies are currently used for integrations (ie SOAP, RESTful, etc)?

There are no planned integrations.

28) How is security managed for each current integration?

There are no planned integrations.

29) The proposal deadline is November 1, 2024. Is there a time deadline (ex: by 12pm CT or 5pm CT)?

11:59pm CST

30) Have funds been designated in the present yearly budget, forthcoming budget, or obtained through a grant for this project?

Yearly budget

31) How long does SD DCI expect the implementation process to take?

Please refer to the RFP schedule. That would be the preference, but open to alternative schedules if those are not reasonable for your solution. However, if you include them in your response, they will be taken into account in our decision.

32) Can the SD DCI please provide some insight of some or all of the different sources from which data will be migrated/uploaded into the cloud-based solution?

There will be no migration of existing data. New data will be uploaded into the cloud-based solution using existing computers, computer systems and computer hardware. The types of data being uploaded to the cloud-based solution will include the following: audio recordings, video recordings, digital photographs, video surveillance footage of various file formats, forensic raw data extractions from cell phones and mobile devices, forensic image files from computers, hard drives & etc., PDF documents, Microsoft Word documents, Microsoft Excel documents, and other document types.

33) How much of the one petabyte of data is cold/archive storage versus active case use? Additionally, is one petabyte needed annually for new cases coming into the platform or for the files that need to be migrated?

No migration of existing data is needed. The 1PB of data is the estimated total storage capacity that will be needed for cumulative data growth over the next several years with the ability for infinite growth as time goes on. Currently, it is estimated that approximately 100TB to 300TB of data storage will be needed for active use with any remaining data storage being cold/archive storage.

34) Is SD DCI open to Hot, Cold, and Archive storage options for cost saving?

Yes If so, what is the estimated volume of storage that may be required for each storage tier?

Approximately 100TB of data in Hot Storage Approximately 200TB of data in Cold Storage Approximately 700TB of data in Archive Storge

• Would SD DCI want the vendor to host the cold and archived storage?

Yes

35) Are there any unique situations we should be aware of? No

36) RFP Section 1.5: Is the anticipated go-live date a hard deadline for any specific technical or process reason? E.g., licensing expiring, system being decommissioned, etc.

Funding

37) RFP Section 3.3.6: Is the 24/7 support and management requirement specifically for the cloud system to be available 24/7, or that vendor resources are available for contact/support 24/7?

Solution must be available 24/7. Contact/support must be available business hours M-F/8-5 CST

38) RFP Section 3.9: Given that current digital evidence is stored in a variety of locations/mediums (external hard drives, thumb drives, CDs/DVDs, other removeable storage media), is it the expectation that the vendor assist in identifying/collecting/uploading all existing evidence to the cloud? Or would tool(s) provided to the individual DCI and AG users to self-upload their files be sufficient?

Tool(s) provided to the individual DCI and AG users to self-upload their files will be sufficient.

39) RFP Section 3.9: Once all existing evidence has been uploaded to the cloud environment, is the responsibility for wiping/destruction of any physical media storage the responsibility of the state or the vendor?

State

40) RFP Section 3.9: Is the data currently housed within the Central Square Pro- Suite RMS system expected to be migrated to the cloud environment?

No

41) RFP Section 3.9: Are integrations required for the digital forensics programs currently used? (Cellebrite UFED 4PC, Cellebrite Physical Analyzer, etc.)

No

42) RFP Section 3.9.2: Does existing data being migrated to the cloud need to be categorized into specific cases within the DEMS system? If so, does the responsibility for categorization of existing data lay with the vendor or the State?

State

43) RFP Section 3.9.4: Is it an expectation that end users can view all formats of files embedded within the REMS system, or would users instead be allowed to download the data for viewing within the specific software e.g., excel, word documents.

See question #7.

44) RFP Section 3.9.5: Given the potential for a higher level of effort to migrate existing data to the cloud environment versus ongoing costs for support of the cloud environment, is the outlined budget a strict limit for the first year of implementation and go-live?

There is not requirement for vendor to migrate existing data. The outlined budget is a strict limit for first year of implementation and go-live, as well as foreseeable annual renewal of the same service.

45) Can Vendors request to submit proposals online or via email?

No

46) Can the SD DCI please share insight on why the RFP was re-released as the scope of work remains the same?

See question #22

47) Can the SD DCI please segregate requirements in “mandatory” & “nice-to-have" to allow vendors to propose a more cost-effective solution which fits within the defined budget?

We have amended the RFP to reflect this information. Please reference rfp sections 3.3 and 3.9

48) Can the SD DCI please provide insight on how the budget was set in light of the extensive set of requirements and scope of work? What is driving the budget?

Appropriations allotted $100k annually for this project.

49) In reference to section 3.9, can the SD DCI please confirm whether they require the DEMS to integrate with the digital forensic systems listed? If yes, please define the scope of integration.

The SD DCI does not require integration with any of the listed digital forensic systems.

50) In reference to section 3.3.9, can the SD DCI provide insight on how they define “incident”?

Any incident that results in an unintended loss of data.

51) In reference to section 3.3.10 & Security & Vendor Questions, can the SD DCI please confirm whether they require Geo-redundant storage (GRS) or locally redundant storage (LRS) as part of the disaster recovery strategy?

Typically the state uses ZRS for data of this type. ZRS keeps 3 copies in the same region but in separate buildings which gives satisfactory redundancy options

52) Section 3.9.1 - “This will include evidence/data retention categories and automated alerts” Question: Can you clarify what kind of automated alerts are required? Alerts for when data retention is reached?

Yes, automated alerts for when data retention has been reached.

53) Section 3.9.2 - Digital Evidence Management System Question: What DEMS is currently being used on-prem?

None

54) Section 9 – Scanning. “As part of the review of the offeror’s RFP....The state will use commercially available, industry standard tools to scan a non-prod environment with non-prod data...” Question: What environment will be scanned? Is the offeror expected to build out a non-production demo environment for the purposes of scanning?

Per section 3.10.3, the vendor will provide a test system. The test system should mirror the production configuration and security, with non-production data. This test system is what would be scanned.

55) Section 3.10.10 - “Include in your submission....Annual security training and awareness” Question: Is the offeror expected to host security training and awareness for State employees or does this refer to the training the offeror holds for their employees?

Training the offeror holds for their employees

56) Section 4.10 - Non-Standard Hardware and Software Question: Does this section only apply to software that will be used by state employees? For instance, would this section apply to situations where the solution includes software or tools that only the vendor will use?

This applies to software that must be installed on state employee workstations and does not apply to software the vendor uses.

57) Section 3.9.5 Question: Does the stated annual budget include cloud service provider hosting costs?

Yes

58) Is the South Dakota AG data currently stored on prem or in the cloud?

On prem

59) How much data will be transferred at implementation? Is it 1 Petabyte?

No existing data will be transferred at implementation. The 1PB of data is the estimated total cumulative storage capacity that will be needed for data growth over the next several years with the ability for infinite growth as time goes on.

See question #3.

60) How many Terabytes are added each year and do you have a year over year growth rate for the last 5 years?

DCI does not currently have a DEMS so the past growth rate is not known. See question #3 for estimated storage requirements.

61) How far back does the data go?

We will not be migrating any existing data.

62) How often does South Dakota AG access data outside of your required retention period?

Never

63) Are there other software applications that vendors will be expected to interface with? If so, please provide list of specific applications.

No

64) Would the South Dakota AG be open to a 5-year agreement?

yes

65) Does the South Dakota AG expect onsite training? If so, how many locations?

How many people?

The SD AG’s Office expects onsite training or relatable remote training on the product we ultimately purchase. The in-depth training expected will be more focused on the Admin users, with that being approximately 10 users.

66) I didn’t see Appendix B, I did some searching and found the attached Appendix B attached to another RFP we had reviewed, can you confirm if it is the one we should use for this response.

https://atg.sd.gov/docs/SecurityandVendorQuestions.pdf

67) Would the option for additional unique deployment for the ICAC-sensitive workloads be of interest?

Yes, it would be of interest but will not have an effect on the outcome of this

RFP.

68) Would Commercial Cloud be an option that is also CJIS compliant?

The state would be open to any cloud solution, as long as it meets the requirements listed in section 3.1.

69) These sections in the RFP seem to be intended for a custom software development. Please clarify how this will be applied for a SaaS product (we feel that these are not relevant for SaaS product implementation and should be removed from the RFP):

The State is not aware of the types of solutions that may be proposed by vendors, and these questions are part of the standard IT template.

• Sections 3.10.3.1 - about BIT applying code changes to production systems. Since iCF is a SaaS product, the code changes deployed to production will only be done from iCF staff. BIT can give us go/no-go based on their criteria.

• 3.10.3.3 - This section is about BIT shutting down production system for any reason. This will impact all SD BCI users and cannot be done. Also, BIT will not have the access or right to shut down our production system.

• 3.10.7, 3.10.8: talks about UAT plans and backout component. This does not apply to SaaS products https://atg.sd.gov/docs/SecurityandVendorQuestions.pdf

• 3.10.2: talks about virtualized environment. This requirement is for on-prem software.

• 3.10.14: Testing plans - Since we are offering a SaaS product, this test plan should be internal to SD BCI or BIT. The iCF team will conduct its own testing to get the system ready for the UAT of BCI users.

• 4.2: project staffing roles - For the implementation of a SaaS product, we only need a implementation manager and a training manager. The rest of the roles are relevant only for custom software development.

• 4.3: Staff Resumes: This section is not applicable.

• 4.5 Corporate qualifications: Questions J,K,L,M,N are talking about

“projects” and “staff”. This should refer to product and implementation references.

• 4.7: relevant project experience: Does not apply for a product

• 7.4.4,5,6: these again refer to “project and staff” experience. They do not belong in an RFP for a product implementation

• 7.8: Qualification of personnel: does not apply to this RFP

• 16: refers to giving access to SD BCI (or BIT) access to source code, source code documentation etc. This does not apply to a product implementation RFP

• 23: Background checks: iCF already complies with the need to do background checks for its employees who have access to the customer data to comply with the CJIS and SOC2 regulations. Since this is not a custom software development, giving employee details to SD to do background checks is not required.

• BIT Clauses XXVIII, XXIX, XXX, XXXI, XXXII, XXXIII, XXXIV, XXXV, XXXVI, XXXVII, XLVI, XXXIXI: These are standards related to hosting the code on your on prem environment. This should not apply to SaaS vendors.

70) Do they have an AWS GovCloud or Azure Government Cloud where this solution should be hosted? Or is it expected that we bring this account as part of the RFP?

State does, but we are expecting the Vendor to host.

71) Where are the security and vendor questions in the RFP that will be part of the Technical Review as specified in the section 1.17 about Discussions?

https://atg.sd.gov/docs/SecurityandVendorQuestions.pdf

72) In section 3.3, there is a requirement to support “onboarding and ongoing services” related to

• In 3.3.1 AWS enrolment - what kind of support is expected here?

Vendor will setup whatever is needed for them to host our solution in the cloud and will support what they setup for us.

• In 3.3.2 Monitoring and audit - what kind of support is expected?

Vendor will make sure that our solution is working and available for our agency needs. Vendor will audit who is using the system and how it is used in case there is an issue with a breach or an unruly user incident.

• 3.3.3,4,5 - these pertain to upload and archiving of data. In a SaaS product, the archive, backup and restore are done automatically based https://atg.sd.gov/docs/SecurityandVendorQuestions.pdf on user input. What sort of support is expected here? Even for uploads, iCF has applications which can upload without frequent inputs. We want to understand what kinds of support is expected.

Vendor will make sure that our solution is working and available for our agency needs.

73) What format are the videos stored in the Milestone system?

The Milestone video format includes the XProtect Smart Client Player. It is preferred to store these videos in this format as it is the recommended format for security, data protection and is the most lossless format.

74) What kind of integration with Milestone is expected?

None

75) What data reports are expected as per section 3.4? Need a list of these reports BIT does not expect any reports. This is setting the expectation that the state has full access to its data to do what it wants with, which includes reporting. If the agency has a list of reports it knows it needs, those should be listed in the Scope of Work.

76) Please clarify if these requirements are part of the scope for this RFP. In section 3.7, there is a requirement to

• Upload videos to the cloud

• Convert the Milestone videos to mp4

The Milestone integration is optional, with some vendors already having existing Milestone integrations. Having the ability to upload video evidence from the on-prem servers to the cloud is necessary, having direct edge to cloud streaming is not. The Milestone file types have been referenced in Question #73

77) In section 3.8, we are expected to provide a diagram describing how our system will integrate with state infrastructure. We need a list of such systems with which our system is expected to integrate with. Also, we need the diagram which shows how the state systems work together.

There are no known integrations at this time and given the wide range of possible solutions, we don’t have a single diagram that would cover all scenarios for vendor systems connecting to the state’s infrastructure. This will be worked through with any vendors that move on to the technical review portion of the procurement process when we can speak to each vendor’s solution individually.

78) Is the DEMS expected to integrate with your forensics programs listed in section 3.9 like Cellebrite UFED 4PC, and so on?

No

79) In section 3.9.1: the cloud storage system is expected to have capability for infinite growth. Is this expected to increase in size with a corresponding increase in pricing also?

See question #21.

80) Need information about the file formats listed in section 3.9.4: Are the files with .wma, .m1a, .chm etc open files or are they encrypted or use proprietary codecs?

Most, if not all, will be open files. If not, the proprietary viewing program and or software will be packaged with the video file.

81) Also, are the .giff files mentioned in section 3.9.4, the same as .gif files?

Yes, that was a typo.

82) Require the criteria used by BIT for shutting down production systems as described in section 3.10.3.3.

This has to do with on prem and can be ignored. These questions are part of the standard IT template.

83) Need a copy of BIT’s security and performance requirements as referred to in section 3.10.5 Security and performance requirements pertain to the condition that any issues that arise from a security scan need to be remedied or explained properly to the BIT Security team. See below for the @state.sd.us Domain Name policy:

84) Need a copy of BIT’s processes and procedures as referred to in section 3.10.8.

This has to do with on prem and can be ignored. These questions are part of the standard IT template.

85) Section 11 talks about termination of the contract if state does not approve the funding for this product. Will the state request funding to use the DEMS every year? Or is it being approved in 5 year chunks?

State is open to both. However, If contracted for multiple years, it will be stated in the contract that the contract can be terminated before next renewal period if the state is not allotted the annual funding for this project.

86) Require the UAT standards for approving a SaaS product. The RFP has detailed requirements for a custom development (in section XXVIII) The State is not aware of the types of solutions that may be proposed by vendors, and these questions are part of the standard IT template.

87) The requirements listed in section XXIX are factored into the SOC2 requirements for SAAS companies. Will SD accept the SOC2 certification and the report which lists the deliverables for section XXIX?

A SOC2 report can be used.

88) What’s the size of current and archival data that needs to be uploaded to cloud (as per section 3.7)?

The Milestone data to be archived to the cloud will be for newly created cases.

There will not be existing data needing archived.

89) What’s the expected size of files/cases to be uploaded to the DEMS every year?

See question #3.

90) How many cases will be created every year?

Approximately 1,500 cases per year.

91) How many cases will be archived every year?

This is not known.

92) How many user accounts required outside of the DCI - like in partner Law Enforcement agencies, Prosecutors etc.

Outside user accounts are not required. However, the DCI will need the ability to electronically share digital data and information with partner Law Enforcement agencies and Prosecutors through an upload/download mechanism.