RFP-12713 (BIA) and (DRP) Q-A Log 6-16-25-A.xlsx
XLSX spreadsheet 22 KB Posted
- Solicitation number
- RFP-12713
- Issued by
- Leon County, Florida
About this file
The document is a Question and Answer (Q&A) Log for Request for Proposal (RFP-12713) issued by the Florida Department of Juvenile Justice (DJJ) for a Business Impact Analysis (BIA) and Disaster Recovery Plan (DRP) Development project. The procurement seeks a comprehensive business continuity planning initiative covering all program areas of the department, with proposals due by June 25, 2025, at 5:00 PM and responses to be opened on June 30, 2025. The contract term will run from August 1, 2025, to February 28, 2026, encompassing the development of a detailed disaster recovery strategy for approximately 80 systems and over 100 applications in a hybrid on-premises and cloud environment. The project requires developing a complete Business Continuity Plan, conducting stakeholder interviews, performing dependency mapping, and conducting an IT-focused tabletop exercise with eight employees.
The procurement is a new initiative with no existing Business Impact Analysis, Business Continuity Plan, or Disaster Recovery Plan in place. There is no predefined budget, and vendors are expected to provide fixed-price, deliverable-based pricing. The environment includes one datacenter, a headquarters location, and a hybrid infrastructure with Windows servers and SQL databases. The project does not require on-site attendance, though three print copies of the proposal must be submitted via mail or courier. Key requirements include developing recovery strategies, identifying critical business operations, establishing Recovery Time and Point Objectives, ensuring compliance with Florida Cybersecurity Standards and NIST Cybersecurity Framework, and preparing documentation for potential disruption scenarios. The contract's performance and funding are contingent upon annual legislative appropriation and satisfactory contractor performance.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFP-12713 (BIA) and (DRP) Q-A Log 6-9-25.xlsx | XLSX spreadsheet | |
| IT-Scope of Work-RFP.docx | DOCX document | |
| IT-Scope of Work-RFP.pdf | ||
| RFP-12713 (BIA) and (DRP) Q & A Log.xlsx | XLSX spreadsheet | |
| Submission of Proposal for RFP-12713 (PDF).pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Department of Juvenile Justice RFP-12713 Business Impact Analysis (BIA) and Disaster Recovery Plan (DRP) Development |
| Question and Answer Tracking Log |
| Start Date/Time: 05/15/2025 @ 10:00 AM | Response Open Date: |
| End Date/Time: 06/25/2025 @ 05:00 PM | 06/30/2025 @ 10:00AM |
| Question | Answer | ||
| What is the last date to resA10:B23pond and what date will the all responses be opened? | The last date and time to submit a response is 6-25-2025 at 5:00pm. All reponses will be opened on 06/30/2025 10::00 PM | ||
| I don't see any information regarding response instructions, and the advertisement status shows WITHDRAWN.Can you confirm if this opportunity is still active? | The correct Advertisement Number is RFP-12713. There was a first version (RFP-12701) that was withdrawn. | ||
| Could you please provide the full RFP and any other solicitation documents related to the opportunity? | The full Scope of Work is attached to RFP-12713 on the Vendor Information Portal (VIP). | ||
| Proposal Submission Method: Could you please confirm whether responses must be submitted electronically through MyFloridaMarketPlace, or if a physical/paper submission is required? | Please see the attached document to the RFP in the Vendor Information Portal (VIP) titled "Submission of Bids . | ||
| We would also like to respectfully ask whether there is a designated period or formal process for submitting clarification questions regarding the scope, deliverables, or other aspects of the project. If so, please let us know the appropriate channel and deadline for doing so. | For a Request for Proposal (RFP) Advertisement, there is not a designated period for subhmitting questions. A question maybe submitted anytime during the advertisement period. | ||
| Do you require a proposal for this effort or just a price bid? | A proposal including your cost is required. | ||
| Is there an incumbent on this effort and if so, who is it? | No | ||
| What is your budget and/or previous contract award amount? | To Be Determined after all proposal are received. | ||
| I was unable to identify when the deadline to submit questions is. Could you please provide the due date for questions to be submitted? | All proposal must be received by 5:00pm on 6/25/2025 | ||
| To ensure we provide a fully compliant and complete response, could you please confirm whether a specific proposal structure, format, or set of instructions will be issued? If so, we would appreciate any guidance or documentation you can share regarding submission requirements, evaluation criteria, or volume organization. | There is no specific format or structure required; however, a Word or PDF document will be acceptable. | ||
| What BIA, DR plan, or DR testing has DJJ completed in the past? | There hasn't been a BIA, DR plan, or DR testing completed in over 5 years. | ||
| Does DJJ have a Disaster Recovery, Business Continuity or Cybersecurity team that the vendor will be working with? | DJJ has a Cybersecurity team that is also part of the Disaster Recovery team, which will work with the vendor. | ||
| Which departments are in scope for the BIA? | All program areas of the Department of Juvenile Justice. | ||
| Please describe your technology landscape (i.e., on-prem, cloud, XaaS) and what is in scope for the DR strategy, plan and testing? | On-prem and cloud hybrid | ||
| Does DJJ expect the DR strategy to include cost estimates and/or an implementation plan? | Implementation plan | ||
| How much of the vendor's time is expected to be onsite in Tallahassee? | There is no designated requirement for on-site attendance. | ||
| What security clearances are required for the vendor? | Not required | ||
| Does FL DJJ have any existing BIA, BCP and DRP that will be leveraged as a starting point for this initiative or the vendor is expected to develop these document as part of this initiative | The vendor will develop these documents as part of this initiative. | ||
| How many applications and systems are in scope of this initiative?Could you provide information for the application and systems in scope including if these applications/systems are home grown or COTS? | Approximately 80 systemsand over 100 applications that consist of proprietary and COTS. | ||
| Can an up-to-date application inventory be provided at the start of the engagement? If yes, please describe details captured in the inventory (e.g., application owner, total users, etc.). | We will provide what we have, but collecting this data is part of the scope of work. | ||
| How many users are in-scope for training? What method is requested to administer the training (e.g., LMS, Live-training, etc.)? | There's a total of 8 employees in-scope for the training. Please provide a price comparison for in-person and online services. | ||
| Can the DJJ please confirm the due date? The procurement site and notification email have conflicting dates | The due date for which segment? | ||
| Is the DJJ seeking a comprehensive Business Continuity Plan, which includes as a subset the Disaster Recovery Plan; or just the Disaster Recovery Plan (the BIA being one component of the Business Continuity Plan)? | DJJ is seeking a comprehensive Business Continuity Plan that will incorporate a detailed Disaster Recovery Plan. | ||
| Can the DJJ provide an estimate of the number of stakeholders that would need to be engaged via workshops (in addition to surveys)? | Sixteen (16) | ||
| Can the DJJ provide an estimated budget for this project? | No | ||
| Does this project require storage of DJJ CJIS data in the consulting firm’s environment, or can we access the data from your environment? | Accessing CJIS data will not be necessary. | ||
| How would the DJJ like the costs to be reflected? Is this a time and materials NTE (not to exceed) contract, or should we propose fixed-price deliverables-based pricing? | Fixed price deliverable | ||
| How many departments are in scope? | One department and 16 program areas. | ||
| Is there an approximate number of applications and systems? | Approximately 80 systemsand over 100 applications that consist of proprietary and COTS. | ||
| Is the tabletop exercise required to be performed in person? | In-person or online. | ||
| How many employees the DJJ anticipate being involved in the tabletop exercise? | Eight (8) | ||
| 1. Contractor Responsibilities 3. A. speaks to Dependency Mapping – Assess and document internal and external interdependencies. Is this intended to be at a high level (Department C received inputs from department A and B in electronic form, and passes the output to Departments D and E on paper), or at a deep dive level showing what servers, storage, and networks are in use for major applications? If a deep dive, does Florida Juvenile Justice already have a CMDB discovery tool such as Device 42, or will this IT interrogative service need to be included? | Deep Dive? | ||
| The RFP speaks to the need to be compliance to “FL 252.365-Emergency coordination officers; disaster-preparedness plans”. Besides disaster recovery plans it speak to the need for Pandemic Plans. Post-COVID-19, does DJJ have documented Pandemic Plans that can be referenced, that need updating, or is this a start from new effort? | Scope doesn’t include a pandemic plan | ||
| How were the schedules determined for the BIA and DR Plan Development in the Timeline? CDW’s professionals have supported BC and DR BIAs and plan development for many years. The number of weeks proposed are unrealistic from a thoroughness and quality perspective. If CDW has a proposed revised schedule will that be acceptable for submission? | Feel free to submit an alternate revised schedule. | ||
| Can DJJ provide the names of its major departments or a sanitized org chart down to the supervisor level, so that the number of BIA participants can be proposed by CDW? This number is key to creating the level of effort estimate and bid on this phase. | Yes, DJJ has 16 major departments. | ||
| Is there an existing DR plan that needs to be updated or is this a net new plan? | This is a new plan. | ||
| Can you provide an overview of the number of and locations of information technology (IT) data centers in the facilities and business operations in scope? | One datacenter and a HQ location | ||
| What is the number of systems and operating systems type in scope? | Approximately 80 systems and over 100 applications that consist of proprietary and COTS...Windows server 2019 | ||
| Are these systems hosted internally, or are these in a colocation or cloud? | On-prem, cloud and at a data center. | ||
| How many applications are in scope? | Approximately 80 systems and over 100 applications that consist of proprietary and COTS. | ||
| How many physical machines are in scope? | Approximately 80 systems | ||
| Has a BIA been attempted or completed in the recent past? | The department has never created a BIA. | ||
| Do you have a current DR failover capability for alternate processing? Please provide an overview | No | ||
| 1. What are your current Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) defined in your environment? Were those determined informally by perceived need or formally by a BIA in the past? | Currently not defined. | ||
| 1. Does the DJJ follow the ICS or NIMS structures for emergency management and incidents? | No the Department does not. | ||
| what are the onsite requirements for the vendor to complete the identified deliverables? Is the vendor able to perform some of these tasks virtually, and if so, what ones? | There is no designated requirement for on-site attendance. | ||
| Though you have indicated in the Q&A log that there is no specific format or structure required for the submission, you mention that a Word or PDF document will be acceptable which implies a digital submission. Can you clarify if you are asking for the response to be in digital format or in printed hard copy format? | Via mail carrier is acceptable | ||
| With Florida's broad definition of "public records", should a separate redacted copy of the proposal be submitted to protect any information considered to be confidential in nature and protected under Florida statutes | If the proposal contains any confidential information, please ensure that it is submitted in an encrypted format. | ||
| Can local service providers hand deliver or use a courier service to deliver the bid to the address indicated on the submission instructions in lieu of mailing the bid via USPS? | Yes you may use a courier service or hand deliver the bid | ||
| Does the cost proposal need to be in a separate document or should it be included as a section of the proposal narrative? | Please include as a section of the proposal narrative. | ||
| The Scope of Work, page 2 - Location of Work lists Tallahassee, FL. Would you please confirm that a hybrid staffing plan, which includes a series of site visits plus remote work, is an acceptable staffing plan approach for this engagement? | There is no designated requirement for on-site attendance. | ||
| How many print copies of our proposal must be submitted? | Three (3) | ||
| There are some components listed under Part A. Business Impact Analysis (BIA) that are Business Process Analysis (BPA) requirements. Although the two processes are complimentary, they are distinctively separate. Should respondents assume that a BPA is also a part of the required deliverable or is a completed BPA already on file? This will be important information to consider in the proposal development process | DJJ does not have a BPA, and it is not included in the deliverables. | ||
| Could you kindly confirm the due date and time for submitting proposals? I want to ensure we stay aligned with all requirements and timelines. | Bid must be received By: 06/25/2025 05:00 PM | ||
| What elements are required to be included in the proposal? (i.e. company background, technical approach, key personnel, past performance examples?) | Company overview (legal name, location) , background, technical approach, key personnel. | ||
| Is there a price range, predefined labor categories or hours that are anticipated for this project, or are we free to estimate and price based on our own estimated level of effort? Is there a particular format that you would like the pricing, and are there specific elements of pricing you would like included? | price based on our own estimated level of effort? | ||
| Is this work a new procurement or has this been performed before by another vendor? If so, can you share the vendor, level of effort or award information associated with the previous award? | This is a new procurement. | ||
| Is there a page length for the proposal? | No | ||
| The bid information stated that proposals must be mailed to the address listed; I just want to confirm that you are not accepting electronic delivery of proposals via email? | Correct. We are not accepting electronic delivery of proposals. | ||
| Does the RFP request DRP more focused around RTO or RPO specific to running in native cloud (Azure or AWS)? | Azure | ||
| Are there any existing BIA or DRP documents that this project should review or build upon? | No | ||
| Are there any departments or third parties that must be included in the dependency mapping? | Yes | ||
| Will DJJ provide an inventory of major systems and applications currently in use? | We will provide what we have, but collecting this data is part of the initiative. | ||
| Does DJJ have any systems hosted in the cloud or with external vendors that require special DR planning? | Yes, Our environment is hybrid and on-prem , Northwest Regional Data Center. | ||
| What level of documentation already exists for current IT recovery procedures? | The contract between NWRDC where the primary servers are stored. | ||
| What is the expected scope of the tabletop exercise? Should it focus on IT only or include business processes as well? | The tabletop should focus on IT. | ||
| Are field offices included in the BIA and DR plan? If so how many locations? | No | ||
| What is the count of applications required in this exercise? | Approximately 80 systems and over 100 applications that consist of proprietary and COTS. | ||
| Please confirm that the requirement for this procurement is to build the BIA and DRP, but does not include deployment of the DRP. | Correct, it doesn’t include the deployment of the DRP; only testing the DRP is conducted through a tabletop exercise. | ||
| Does FL DJJ have any existing BIA, BCP and DRP that will be leveraged as a starting point for this initiative or the vendor is expected to develop these document as part of this initiative | Vendor to develop these documents. | ||
| How many applications and systems are in scope of this initiative?Could you provide information for the application and systems in scope including if these applications/systems are home grown or COTS? | Approximately 80 systems and over 100 applications that consist of proprietary and COTS. | ||
| Can an up-to-date application inventory be provided at the start of the engagement? If yes, please describe details captured in the inventory (e.g., application owner, total users, etc.). | duplicate | ||
| Timeline flexibility: Will the Department accept alternative timelines and task milestones from the one provided in Section C. Deliverable Table, provided all of the deliverables are completed within the stated 26 weeks? | Feel free to submit an alternate revised schedule. | ||
| Scope clarification: The RFP scope includes "a detailed, modular DRP aligned with industry standards," including "roles, procedures, and dependencies." Because system- or service-level recovery procedures are owned by different IT service teams, it is a best practice to maintain separate recovery procedure documents for each system or service. Can the Department confirm that the DRP deliverable excludes detailed system- or service-level technical recovery procedures? | Separate recovery procedures are necessary for both our Network Team and our Application Team. | ||
| The event posting on MFMP shows an end/date time of June 25th. Please confirm the submission date for vendor responses. | Correct | ||
| DJJ posted a ‘Bid Submission Information’ document on May 19th. The advertisement number, commodity code and description contained in the document do not match this solicitation. Please confirm this document is incorrectly associated with this procurement and vendors may submit responses via e-mail? | Advertisement Number:RFP-12713, Commodity Codes: 80172101 | Crisis management and recovery service | |
| 81111700 | Management information systems MIS | ||
| 81111808 | System analysis service | ||
| 81112004 | Disaster recovery services | ||
| 81141801 | Safety or risk analysis | ||
| This RFx does not specify a contracting mechanism, or a specific set of terms and conditions vendors must adhere to. Please confirm that the State of Florida Alternate Contract Source for NASPO is an acceptable contract vehicle for this effort. | The General Contract Conditions are outlined in PUR 1000 which will be included in the selected vendor's contract for review. http://dms.myflorida.com/content/download/2933/11777 | ||
| The Statement of Work document provides information on the scope of the project but does not specify a format for vendor responses (executive summary, experience, proposed team, approach to work etc). Please clarify DJJs expectations for the format and information vendors should provide in developing their response? | Vendors have the flexibility to submit their proposal in a way that best showcases their strengths. | ||
| Please provide the evaluation criteria, scoring approach and process that will be used in reviewing vendor proposals and making an award determination. | Unavailable | ||
| Has DJJ performed a BIA in the past? If so, how long ago? | duplicate | ||
| Does DJJ have an existing application inventory with designated application and data owners, as well as criticality today? | No | ||
| Row 3 of this log as published by Florida Department of Juvenile Justice states that this is SS-12737 Single Source Skybase Communication. Is this a sole-source solicitaion? | No it is not a Single Source advertisement. The error on the Q & A Spreadsheet has been corrected. | ||
| Please confirm when we can expect responses to our submitted questions? Timely feedback will support us in meeting the RFP submission deadline. | Yes | ||
| Approximately how many Business Units or Departments within DJJ are expected to participate in the BIA process? (For example, is one BIA survey anticipated per unit or function?) | 12 program areas, 12 surveys | ||
| Will BIA interviews be conducted directly with functional/operational business stakeholders (e.g., student services, program or degree leaders), or will business liaisons (e.g., business analysts, application owners, IT representatives) provide input on their behalf? | directly | ||
| Is there an existing formal list of critical production applications? If so, is it documented or accessible via systems such as a CMDB or ServiceNow? | no | ||
| Are Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) formally defined by the business, or are they currently based on IT Services’ assumptions regarding data loss tolerance? | not defined | ||
| Does DJJ utilize an application tier classification model (e.g., Tier 0, 1, 2) with defined criteria aligned to business needs? | no | ||
| Are current disaster recovery capabilities based on IT’s existing backup and recovery processes? If so, do they meet the business’s continuity requirements? | Currently does not have a DR | ||
| Is there a formal disaster recovery strategy in place? If not, is developing one an expected deliverable of this project? | No | ||
| Does a documented business continuity strategy exist for end-user recovery? If not, should this be included as a project outcome? | Yes | ||
| Has IT management established Data Loss Exposure thresholds based on business requirements? | No | ||
| Is the business’s data loss tolerance formally documented today, or is defining this an expected outcome of the BIA? | No | ||
| What cloud-native security services are currently in use (e.g., Azure AD, RBAC, Azure Policies, scope layers)? | Azure-AD | ||
| How is cybersecurity currently monitored or managed by IT Services? | cybersecurity applications | ||
| Is there a formal IT security awareness program in place for staff, students, and third-party contractors? If so, are there mandatory training requirements? | Yes | ||
| What operating systems are used for virtual machines (e.g., Windows, Linux)? | Windows | ||
| Which database platforms are used in production (e.g., SQL Server, MySQL, DB2)? | SQL | ||
| In the absence of a primary data center, how and where is the network infrastructure (e.g., routers, circuits, load balancers) managed? | We have a datacenter | ||
| Have applications been mapped to their respective servers or server clusters? Is this information readily available, or should it be developed as part of this engagement? | No | ||
| Is there a current inventory of systems and applications available? | Not organized | ||
| Do application documentation sets include recovery requirements and strategies? | No | ||
| What percentage of applications are Software-as-a-Service (SaaS), either hosted or managed by third-party vendors? | 30% | ||
| Is there an existing governance framework that DJJ would like to leverage for this project, or is the expectation to develop a new governance model from the ground up? | Ground up | ||
| Approximately how many locations and applications does DJJ have in its environment? | duplicate | ||
| Will the Department accept alternative timelines from the one provided in Section C. Deliverable Table, provided all of the deliverables are completed within the stated 26 weeks? | duplicate | ||
| The RFP scope includes a detailed, modular DRP aligned with industry standards. Can the Department confirm that the DRP is not required to include detailed technical instructions for the recovery of each IT system or service? These procedures are usually owned by one or more IT teams which maintain separate recovery procedure documents for each system or service. | It does include detailed technical instructions | ||
| What is the structure or format for the proposal | duplicate | ||
| Is there a rubric to reference to ensure all the components are included in the submission | No | ||
| Will DJJ provide Department laptops to access DJJ materials | Staff will provide requested information | ||
| Can this work be performed remote? If not, what would the anticipated on-site components consist of? | duplicate | ||
| What contractual terms and conditions will govern the performance of the Services? Also, please provide guidance on the selected Vendor's ability to request changes to the terms and conditions of this engagement? | The General Contract Conditions are outlined in PUR 1000 which will be included in the selected vendor's contract for review. http://dms.myflorida.com/content/download/2933/11777 | ||
| Is it acceptable for proposal responses to be hand delivered to the Department or is mailing a hard copy the only option to submit a response | hand delivered also | ||
| 1. How many departments, divisions, or business units will be involved in the Business Impact Analysis and Disaster Recovery Planning efforts? | 12 program areas | ||
| 2. What’s the total employee size, and how many individuals are considered key personnel for business continuity, risk, or stakeholder coordination? | 12 key personnel, 3500 employees | ||
| 3. Are there any remote offices, or geographically dispersed locations that should be considered in the planning scope? | no | ||
| 4. Approximately how many business applications are currently used—such as ERP, CRM, or custom software? | duplicate | ||
| 5. Is there an existing Business Continuity Plan that can be reviewed, or is this the first time you are creating one? | first time | ||
| 6. Approximately how many security policies relating to Disaster Recovery need to be reviewed? | 5 | ||
| 7. Are there on-premises or co-located data centers that should be included in the analysis and recovery planning? If so, how many? | Yes, 2 locations | ||
| 8. What departments will be involved in the interview process, planning workshops, and tabletop exercises as part of the project? | tabletop-IT | ||
| 9. Are there any specific preferences or constraints around training delivery—such as virtual vs. in-person sessions, language requirements, or content formats? | It can be virtual or in-person | ||
| 10. For the DR Tabletop Exercises, are there any particular DR scenarios you are interested in testing? | No | ||
| 11. Can the work be done remotely, or are onsite visits required (e.g., Stakeholder Interviews, Training)? | duplicate |
File details come from the government source that posted it. Updated .