RFP-12713 (BIA) and (DRP) Q-A Log 6-9-25.xlsx
XLSX spreadsheet 18 KB Posted
- Solicitation number
- RFP-12713
- Issued by
- Leon County, Florida
About this file
The document is a Question and Answer (Q&A) Log for Request for Proposal (RFP-12713) issued by the Florida Department of Juvenile Justice (DJJ) for a Business Impact Analysis (BIA) and Disaster Recovery Plan (DRP) Development project. The solicitation seeks a vendor to develop a comprehensive Business Continuity Plan with a detailed Disaster Recovery Plan, covering approximately 80 systems and over 100 applications across the agency's technology landscape. The proposal responses are due on June 25, 2025, at 5:00 PM, with responses to be opened on June 30, 2025, at 10:00 AM. The contract term is scheduled from August 1, 2025, to February 28, 2026, with no specified renewal options. The project requires developing new BIA and DRP documents, engaging with 16 program areas, conducting stakeholder workshops with 16 participants, and performing a tabletop exercise involving eight employees.
The procurement is a new initiative with no existing BIA, DRP, or Business Continuity Plan in place, and requires a fixed-price deliverable-based approach. The technology environment is a hybrid on-premises and cloud infrastructure, with one datacenter and headquarters location. No specific budget was disclosed, and the project does not require vendor on-site attendance, though three print copies of the proposal must be submitted via mail or courier. The vendor will be responsible for developing comprehensive documentation, mapping dependencies, and creating recovery strategies aligned with Florida Cybersecurity Standards and NIST Cybersecurity Framework 2.0. No specific set-asides or incumbent vendor were mentioned, and the contract's performance is contingent upon annual legislative appropriation.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| IT-Scope of Work-RFP.docx | DOCX document | |
| IT-Scope of Work-RFP.pdf | ||
| RFP-12713 (BIA) and (DRP) Q & A Log.xlsx | XLSX spreadsheet | |
| RFP-12713 (BIA) and (DRP) Q-A Log 6-16-25-A.xlsx | XLSX spreadsheet | |
| Submission of Proposal for RFP-12713 (PDF).pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Department of Juvenile Justice RFP-12713 Business Impact Analysis (BIA) and Disaster Recovery Plan (DRP) Development |
| Question and Answer Tracking Log |
| Start Date/Time: 05/15/2025 @ 10:00 AM | Response Open Date: |
| End Date/Time: 06/25/2025 @ 05:00 PM | 06/30/2025 @ 10:00AM |
| Question | Answer |
| What is the last date to resA10:B23pond and what date will the all responses be opened? | The last date and time to submit a response is 6-25-2025 at 5:00pm. All reponses will be opened on 06/30/2025 10::00 PM |
| I don't see any information regarding response instructions, and the advertisement status shows WITHDRAWN.Can you confirm if this opportunity is still active? | The correct Advertisement Number is RFP-12713. There was a first version (RFP-12701) that was withdrawn. |
| Could you please provide the full RFP and any other solicitation documents related to the opportunity? | The full Scope of Work is attached to RFP-12713 on the Vendor Information Portal (VIP). |
| Proposal Submission Method: Could you please confirm whether responses must be submitted electronically through MyFloridaMarketPlace, or if a physical/paper submission is required? | Please see the attached document to the RFP in the Vendor Information Portal (VIP) titled "Submission of Bids . |
| We would also like to respectfully ask whether there is a designated period or formal process for submitting clarification questions regarding the scope, deliverables, or other aspects of the project. If so, please let us know the appropriate channel and deadline for doing so. | For a Request for Proposal (RFP) Advertisement, there is not a designated period for subhmitting questions. A question maybe submitted anytime during the advertisement period. |
| Do you require a proposal for this effort or just a price bid? | A proposal including your cost is required. |
| Is there an incumbent on this effort and if so, who is it? | No |
| What is your budget and/or previous contract award amount? | To Be Determined after all proposal are received. |
| I was unable to identify when the deadline to submit questions is. Could you please provide the due date for questions to be submitted? | All proposal must be received by 5:00pm on 6/25/2025 |
| To ensure we provide a fully compliant and complete response, could you please confirm whether a specific proposal structure, format, or set of instructions will be issued? If so, we would appreciate any guidance or documentation you can share regarding submission requirements, evaluation criteria, or volume organization. | There is no specific format or structure required; however, a Word or PDF document will be acceptable. |
| What BIA, DR plan, or DR testing has DJJ completed in the past? | There hasn't been a BIA, DR plan, or DR testing completed in over 5 years. |
| Does DJJ have a Disaster Recovery, Business Continuity or Cybersecurity team that the vendor will be working with? | DJJ has a Cybersecurity team that is also part of the Disaster Recovery team, which will work with the vendor. |
| Which departments are in scope for the BIA? | All program areas of the Department of Juvenile Justice. |
| Please describe your technology landscape (i.e., on-prem, cloud, XaaS) and what is in scope for the DR strategy, plan and testing? | On-prem and cloud hybrid |
| Does DJJ expect the DR strategy to include cost estimates and/or an implementation plan? | Implementation plan |
| How much of the vendor's time is expected to be onsite in Tallahassee? | There is no designated requirement for on-site attendance. |
| What security clearances are required for the vendor? | Not required |
| Does FL DJJ have any existing BIA, BCP and DRP that will be leveraged as a starting point for this initiative or the vendor is expected to develop these document as part of this initiative | The vendor will develop these documents as part of this initiative. |
| How many applications and systems are in scope of this initiative?Could you provide information for the application and systems in scope including if these applications/systems are home grown or COTS? | Approximately 80 systemsand over 100 applications that consist of proprietary and COTS. |
| Can an up-to-date application inventory be provided at the start of the engagement? If yes, please describe details captured in the inventory (e.g., application owner, total users, etc.). | We will provide what we have, but collecting this data is part of the scope of work. |
| How many users are in-scope for training? What method is requested to administer the training (e.g., LMS, Live-training, etc.)? | There's a total of 8 employees in-scope for the training. Please provide a price comparison for in-person and online services. |
| Can the DJJ please confirm the due date? The procurement site and notification email have conflicting dates | The due date for which segment? |
| Is the DJJ seeking a comprehensive Business Continuity Plan, which includes as a subset the Disaster Recovery Plan; or just the Disaster Recovery Plan (the BIA being one component of the Business Continuity Plan)? | DJJ is seeking a comprehensive Business Continuity Plan that will incorporate a detailed Disaster Recovery Plan. |
| Can the DJJ provide an estimate of the number of stakeholders that would need to be engaged via workshops (in addition to surveys)? | Sixteen (16) |
| Can the DJJ provide an estimated budget for this project? | No |
| Does this project require storage of DJJ CJIS data in the consulting firm’s environment, or can we access the data from your environment? | Accessing CJIS data will not be necessary. |
| How would the DJJ like the costs to be reflected? Is this a time and materials NTE (not to exceed) contract, or should we propose fixed-price deliverables-based pricing? | Fixed price deliverable |
| How many departments are in scope? | One department and 16 program areas. |
| Is there an approximate number of applications and systems? | Approximately 80 systemsand over 100 applications that consist of proprietary and COTS. |
| Is the tabletop exercise required to be performed in person? | In-person or online. |
| How many employees the DJJ anticipate being involved in the tabletop exercise? | Eight (8) |
| 1. Contractor Responsibilities 3. A. speaks to Dependency Mapping – Assess and document internal and external interdependencies. Is this intended to be at a high level (Department C received inputs from department A and B in electronic form, and passes the output to Departments D and E on paper), or at a deep dive level showing what servers, storage, and networks are in use for major applications? If a deep dive, does Florida Juvenile Justice already have a CMDB discovery tool such as Device 42, or will this IT interrogative service need to be included? | Deep Dive? |
| The RFP speaks to the need to be compliance to “FL 252.365-Emergency coordination officers; disaster-preparedness plans”. Besides disaster recovery plans it speak to the need for Pandemic Plans. Post-COVID-19, does DJJ have documented Pandemic Plans that can be referenced, that need updating, or is this a start from new effort? | Scope doesn’t include a pandemic plan |
| How were the schedules determined for the BIA and DR Plan Development in the Timeline? CDW’s professionals have supported BC and DR BIAs and plan development for many years. The number of weeks proposed are unrealistic from a thoroughness and quality perspective. If CDW has a proposed revised schedule will that be acceptable for submission? | Feel free to submit an alternate revised schedule. |
| Can DJJ provide the names of its major departments or a sanitized org chart down to the supervisor level, so that the number of BIA participants can be proposed by CDW? This number is key to creating the level of effort estimate and bid on this phase. | Yes, DJJ has 16 major departments. |
| Is there an existing DR plan that needs to be updated or is this a net new plan? | This is a new plan. |
| Can you provide an overview of the number of and locations of information technology (IT) data centers in the facilities and business operations in scope? | One datacenter and a HQ location |
| What is the number of systems and operating systems type in scope? | Approximately 80 systems and over 100 applications that consist of proprietary and COTS...Windows server 2019 |
| Are these systems hosted internally, or are these in a colocation or cloud? | On-prem, cloud and at a data center. |
| How many applications are in scope? | Approximately 80 systems and over 100 applications that consist of proprietary and COTS. |
| How many physical machines are in scope? | Approximately 80 systems |
| Has a BIA been attempted or completed in the recent past? | The department has never created a BIA. |
| Do you have a current DR failover capability for alternate processing? Please provide an overview | No |
| 1. What are your current Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) defined in your environment? Were those determined informally by perceived need or formally by a BIA in the past? | Currently not defined. |
| 1. Does the DJJ follow the ICS or NIMS structures for emergency management and incidents? | No the Department does not. |
| what are the onsite requirements for the vendor to complete the identified deliverables? Is the vendor able to perform some of these tasks virtually, and if so, what ones? | There is no designated requirement for on-site attendance. |
| Though you have indicated in the Q&A log that there is no specific format or structure required for the submission, you mention that a Word or PDF document will be acceptable which implies a digital submission. Can you clarify if you are asking for the response to be in digital format or in printed hard copy format? | Via mail carrier is acceptable |
| With Florida's broad definition of "public records", should a separate redacted copy of the proposal be submitted to protect any information considered to be confidential in nature and protected under Florida statutes | If the proposal contains any confidential information, please ensure that it is submitted in an encrypted format. |
| Can local service providers hand deliver or use a courier service to deliver the bid to the address indicated on the submission instructions in lieu of mailing the bid via USPS? | Yes you may use a courier service or hand deliver the bid |
| Does the cost proposal need to be in a separate document or should it be included as a section of the proposal narrative? | Please include as a section of the proposal narrative. |
| The Scope of Work, page 2 - Location of Work lists Tallahassee, FL. Would you please confirm that a hybrid staffing plan, which includes a series of site visits plus remote work, is an acceptable staffing plan approach for this engagement? | There is no designated requirement for on-site attendance. |
| How many print copies of our proposal must be submitted? | Three (3) |
| There are some components listed under Part A. Business Impact Analysis (BIA) that are Business Process Analysis (BPA) requirements. Although the two processes are complimentary, they are distinctively separate. Should respondents assume that a BPA is also a part of the required deliverable or is a completed BPA already on file? This will be important information to consider in the proposal development process | DJJ does not have a BPA, and it is not included in the deliverables. |
| Could you kindly confirm the due date and time for submitting proposals? I want to ensure we stay aligned with all requirements and timelines. | Bid must be received By: 06/25/2025 05:00 PM |
| What elements are required to be included in the proposal? (i.e. company background, technical approach, key personnel, past performance examples?) | Company overview (legal name, location) , background, technical approach, key personnel. |
| Is there a price range, predefined labor categories or hours that are anticipated for this project, or are we free to estimate and price based on our own estimated level of effort? Is there a particular format that you would like the pricing, and are there specific elements of pricing you would like included? | price based on our own estimated level of effort? |
| Is this work a new procurement or has this been performed before by another vendor? If so, can you share the vendor, level of effort or award information associated with the previous award? | This is a new procurement. |
| Is there a page length for the proposal? | No |
| The bid information stated that proposals must be mailed to the address listed; I just want to confirm that you are not accepting electronic delivery of proposals via email? | Correct. We are not accepting electronic delivery of proposals. |
| Does the RFP request DRP more focused around RTO or RPO specific to running in native cloud (Azure or AWS)? | Azure |
| Are there any existing BIA or DRP documents that this project should review or build upon? | No |
| Are there any departments or third parties that must be included in the dependency mapping? | Yes |
| Will DJJ provide an inventory of major systems and applications currently in use? | We will provide what we have, but collecting this data is part of the initiative. |
| Does DJJ have any systems hosted in the cloud or with external vendors that require special DR planning? | Yes, Our environment is hybrid and on-prem , Northwest Regional Data Center. |
| What level of documentation already exists for current IT recovery procedures? | The contract between NWRDC where the primary servers are stored. |
| What is the expected scope of the tabletop exercise? Should it focus on IT only or include business processes as well? | The tabletop should focus on IT. |
| Are field offices included in the BIA and DR plan? If so how many locations? | No |
| What is the count of applications required in this exercise? | Approximately 80 systems and over 100 applications that consist of proprietary and COTS. |
| Please confirm that the requirement for this procurement is to build the BIA and DRP, but does not include deployment of the DRP. | Correct, it doesn’t include the deployment of the DRP; only testing the DRP is conducted through a tabletop exercise. |
| Does FL DJJ have any existing BIA, BCP and DRP that will be leveraged as a starting point for this initiative or the vendor is expected to develop these document as part of this initiative | Vendor to develop these documents. |
| How many applications and systems are in scope of this initiative?Could you provide information for the application and systems in scope including if these applications/systems are home grown or COTS? | Approximately 80 systems and over 100 applications that consist of proprietary and COTS. |
| Can an up-to-date application inventory be provided at the start of the engagement? If yes, please describe details captured in the inventory (e.g., application owner, total users, etc.). | duplicate |
| Timeline flexibility: Will the Department accept alternative timelines and task milestones from the one provided in Section C. Deliverable Table, provided all of the deliverables are completed within the stated 26 weeks? | Feel free to submit an alternate revised schedule. |
| 2. Scope clarification: The RFP scope includes "a detailed, modular DRP aligned with industry standards," including "roles, procedures, and dependencies." Because system- or service-level recovery procedures are owned by different IT service teams, it is a best practice to maintain separate recovery procedure documents for each system or service. Can the Department confirm that the DRP deliverable excludes detailed system- or service-level technical recovery procedures? | Separate recovery procedures are necessary for both our Network Team and our Application Team. |
File details come from the government source that posted it. Updated .