RFP 24-04_Questions and Answers.pdf

Florida Department of Citrus RFP 24-04 – Managed Informa�on Technology Services

Ques�ons and Answers

1. Q: I did not see where the scope of work listed numbers to quote. Will they be provided?

A: There are no exis�ng updated diagrams or inventories to provide. The Department is in the process of transi�oning from a hybrid private cloud model to a public cloud model and the final configura�ons are not complete. This transi�on will be complete prior to the start of the Contract resultant from this RFP. The following items are in scope as indicated in the Statement of Work:

• The Department maintains one (1) exclusive Microso� tenant which has approximately forty (40) end-users with Microso� G3 licenses purchased through a mandated Value- Added Reseller.

• The exis�ng hardware of approximately fi�y-five (55) endpoints is split between ten (10) physical and virtual servers, running Windows Server, and forty-five (45) end-user devices which are a mixture of Windows 10 and 11.

• One virtual server provides both an applica�on and its related SQL database that is approximately 750 GB total.

• The networking hardware consists of approximately eight (8) to ten (10) Dell and Cisco switches, two (2) For�net firewalls, and fi�een (15) wireless access points with Ubiquity controllers.

• The current total stored data volume we an�cipate being approximately 2.5 TB of structured data.

• The Department maintains a single on-premises AADS domain and its related server.

It is our inten�on to move these to the Azure cloud over the course of the Contract. Most of the groundwork for this transi�on will be completed as indicated above prior to this Contract begins, but the Department will require break/fix and strategic planning support to complete the transi�on.

2. Q: In light of the Easter holiday and its corresponding breaks for families around the state, would the agency consider a two-week extension on the due date for response?

A: No extensions will be granted.

3. Q: Can the work be performed remotely? If onsite work is required, what is the es�mated percentage of onsite work needed?

A: The Department will permit most of the work (90% - 95%) to be performed remotely.

However, it is essen�al that the Contractor provide �mely onsite support if/when required by the SLAs.

4. Q: What is the approximate user count?

A: Please see the Department’s response to Ques�on 1.

5. Q: What is the es�mated budget for this RFP?

A: The Managed Services contemplated in this RFP will come from exis�ng opera�ng funds. The Department will consider the Respondent’s pricing as indicated in the RFP. Respondents are encouraged to provide their best pricing in their Proposal.

6. Q: Is there any local preference for vendors?

A: The Department will consider the locality of Contractors when evalua�ng the vendor’s onsite support capabili�es.

7. Q: What is the es�mated onsite response �me for emergency issues?

A: The Department expects the Contractor to conform to the SLAs listed in the Statement of Work, including an on-site availability of approximately 1 hour for cri�cal issues.

8. Q: Can you please share the �cke�ng system you use and the average number of monthly �ckets?

A: The Department does not currently maintain an ITSM tool independent of our MSP. Our current monthly �cket volume is low for an organiza�on of our size (under 40 users). Broken down by type, our es�mates are as follows: Incidents 20, Requests 10, Changes 5, and Problems

2. As indicated in the RFP, the Department maintains our own desktop support services; the Service Requests submited to our MSP are only escala�ons from IT personnel and not from end users.

9. Q: Do you have an incumbent vendor? If so, are there any pain points with their services?

A: There is an incumbent vendor. The Department desires the services indicated in the RFP at a level which meet the SLAs indicated.

10. Q: Would email submissions be accepted? If not, would only USB submission be accepted?

A: Proposals must be submited in accordance with RFP sec�ons 3.1 and 5. Any submissions not in conformance with these requirements will be deemed non-responsive and not evaluated.

11. Q: Can the Department provide a current inventory or architecture diagram of the infrastructure that falls within the scope of the vendor’s responsibility (e.g. virtual machines, servers, storage arrays, firewalls, switches, etc.)?

A: Please see the Department’s answer to Ques�on 1.

12. Q: For storage, can you provide the consumed quan��es in TB or PB?

13. Q: What is the current mix of on-premises vs. cloud infrastructure, and are there any planned migra�ons or transi�ons during the term of this contract?

14. Q: What hypervisor or virtualiza�on pla�orm is currently in use for on-prem virtual machines?

A: The Department runs MS Hyper-V for virtualiza�on.

15. Q: What is the current backup and disaster recovery pla�orm in use (e.g. Veeam, Azure Backup, na�ve tools), and does the Department expect con�nuity or migra�on?

A: The current backups and recovery scenarios are managed by the incumbent MSP. Per the SOW, the Contractor must propose, have approved, and establish a backup strategy as part of the Managed Services.

16. Q: For backup management, can you provide the number of backup clients that would be in-scope?

17. Q: What backup frequencies and reten�on periods are required? Frequency: Hourly, Daily, Weekly Monthly – Reten�on: Days, Weeks, Months, Years A: Please see the Department’s response to Ques�on 15.

18. Q: What types of data workloads need to be backed up? Virtual Machines and Vendor;

Filesystem Tyes (Windows, Linux, etc.); Databases; Other

19. Q: What is the size of the data types to be protected? Virtual Machines and Vendor; Filesystem Types (Windows, Linux, etc.); Databases; Other A: The Department is not seeking a hos�ng solu�on. Please see the Department’s response to Ques�on 1.

20. Q: What are your performance and scalability requirements? Do you require a specific storage pla�orm? What security requirements have been established for the backup solu�on?

A: The Department is not seeking a hos�ng solu�on. Please see the Department’s response to Ques�on 1.

21. Q: What is the current configura�on of the Microso� Azure environment, including the number of subscrip�ons, resource groups, and ac�ve workloads?

22. Q: How is iden�ty management currently structured across Ac�ve Directory, Azure AD, and Entra ID, and are there any hybrid or federated configura�ons in place?

A: Currently, the Department maintains the following iden�ty management prac�ces: Hybrid:

yes. Federated: No. Microso� EntraID syncs with ADDS using Microso� Entra Connect.

23. Q: What SIEM solu�on is currently deployed (if any), and does the Department intend for the vendor to replace, extend, or manage that solu�on?

A: The current SIEM solu�on is managed by the incumbent MSP. Per the SOW, the Contractor must propose, have approved, and establish a SIEM strategy as part of the Managed Services.

24. Q: Is the contractor expected to provide or manage endpoint detec�on and response (EDR) or extended detec�on and response (XDR) tooling beyond the infrastructure and cloud layers?

A: No, per the SOW, the endpoint management and protec�on is handled in-house by Department staff.

25. Q: Are there specific compliance or regulatory considera�ons?

A: The Department is subject to all regulatory and compliance considera�ons that apply to a State of Florida agency. Specifically, the Cybersecurity requirements can be found in Rule 60GG-

2. Other considera�ons may apply. The Department does not maintain any specifically protected data such as HIPAA, CJIS, FERPA, GDPR, etc.

26. Q: What monitoring tools are currently used for cloud and on-prem systems, and is the vendor expected to adopt exis�ng tools or bring in their own pla�orm?

A: The current Monitoring tools solu�on is managed by the incumbent MSP. Per the SOW, the Contractor must propose, have approved, and establish a monitoring tools strategy as part of the Managed Services.

27. Q: The SOW references use of an ITSM tool – is the vendor required to use a Department-specified pla�orm, or may we propose our own?

A: The Department does not currently maintain an ITSM tool independent of our MSP. The SOW specifically requires the Contractor to provide and maintain their own ITSM tool for the Department’s use. No data will be migrated from the exis�ng tool provided by the MSP. The ITSM tool should allow for a maximum of five (5) Department users to serve as agents and approximately forty (40) users to submit requests.

28. Q: Can the Department provide an es�mated number of monthly �ckets (e.g. incidents, changes, service requests) related to the systems in scope?

A: Please see the Department’s answer to Ques�on 8.

29. Q: What is the current support model (e.g. �ered helpdesk, hours of coverage), and what response/resolu�on �mes are currently enforced?

A: The Department complies with industry standards. The an�cipated SLA model is found in the Statement of Work and the Department will work with the Contractor on the specifics of a mutually agreeable response/resolu�on model. This model will include an on-site availability of approximately one (1) hour for cri�cal issues, if required by the issue type.

30. Q: Are there any key third-party vendors (outside of Microso�) currently suppor�ng your IT environment that the selected vendor will be expected to interface with?

A: The Department occasionally contracts with an outside Audio/Visual vendor who supports our conference room equipment used by the Florida Citrus Commission for public mee�ngs.

31. Q: For the “Project-Based Services” hourly rate in Atachment G, can the Department clarify the types of projects that may be requested and the an�cipated volume or frequency of such work?

A: Project Based Services are any items which do not fall under the defini�on of Managed Services in the SOW. The Department an�cipates Project-Based Services will be infrequent and would apply only to large scale project support such as major upgrades or replacement of a significant por�on of the exis�ng infrastructure.

32. Q: Will there be any transi�on period or knowledge transfer from an incumbent provider (if applicable), and how should that be reflected in the proposed pricing or schedule?

A: The Department will conduct onboarding of the selected Contractor as soon as possible a�er the Award, and the Contract will commence on July 1, 2025. The exis�ng contract expires on June 30, 2025, and the incumbent vendor has no obliga�on to provide knowledge transfer.

Given the nature of Managed Services, the selected vendor should have sufficient resources assigned to onboarding commensurate with any contract of this nature and should price their services accordingly in the model provided.

33. Q: Is it acceptable to use a blend of off-shore and on-shore resources for managed services to enable the most cost-effec�ve pricing?

A: The Department is an agency of the State of Florida. Use of any non-United States based service providers, technical support for any services, or access to any State of Florida data from outside the United States is strictly prohibited by applicable statutes. All writen and verbal support services must be provided in conversa�onal English, and the Department reserves the right to request replacement of resources if their communica�on cannot be understood to the degree where it impedes opera�ons.

34. Q: Will Florida Department of Citrus (FDOC) consider a managed solu�on that is provided en�rely by remote staff? i.e. without any on-site support unless there is a full disaster situa�on.

A: Please see the Department’s response to Ques�on 3.

35. Q: Approximately, what is FDOC’s opera�ng budget for the services requested in the RFP?

A: Please see the Department’s response to Ques�on 5.

36. Q: The table below for device counts is needed for an accurate quote. Contractor provides a by-device cost so iden�fying every device being managed is cri�cal for an accurate quote for the FDOC. Please complete the quan��es and OEM and Model:

QTY Device/Service type OEM/Model VM or Hypervisor Hosts - Standard Virtual or Physical Windows SERVERS- residing on host Machines or on Azure

Virtual or Physical Linux/UNIX - residing on VMWare host Machines or Azure

Cloud Tenant(s) Admin - Standard 1 L3 Router\Switches & 2 L3 Wireless Controller(s) 2 L2 Switch 6

Firewall 2 Load Balancer Backup Application and OEM Type/Version Backup Target Tier 1 Backup Target Tier 2 Storage Array OEM and Type 0 SAN Switch 0 Microsoft SQL Server Instances – Standard and in Azure 2 Notebooks/Desktops 30

37. Q: Are there training manuals now for each so�ware and SOP (Standard Opera�ng Procedures)?

A: This informa�on is not available.

38. Q: What technology is used today for backup and disaster recovery? Is there so�ware in place today, and if so, which?

39. Q: What is the current AZURE cloud footprint?

40. Q: Are there support contracts in place for all Device vendors/OEM – if not, what devices are not under support and why?

A: Laptops and desktops are purchased with a 3-year extended support warranty. Other infrastructure is purchased with the standard manufacturer’s warranty.

41. Q: This RFP asks that “The Contractor shall implement, maintain, and text backup and disaster recovery (DP) solu�ons for all systems and data within scope”. Is there no data backup in place now? If there is, what OEM is it and is it func�onal?

42. Q: Is there a CMDB in place now? If so, does the FDOC want it replaced or take it over as is?

A: The Department does not maintain an exis�ng CMDB, nor does our current vendor. Per the SOW, the Contractor must establish and maintain a CMDB that meets the standards included.

43. Q: What type of database(s) was/were deployed, Azure SQL Database, Azure SWL Managed Instance, or SQL Server on Azure VMs?

44. Q: How many were deployed?

45. Q: Is HA deployed? If so, that type, Zone Redundancy, Built-In Availability, Always On

Availability Groups, Failover Groups, Availability Sets, or Failover Cluster Instances?

46. Q: What version of MS SQL Server is deployed?

47. Q: Are end-points currently managed by direct, in-house employees of the FDOC, or is this func�on contracted to a third-party vendor?

A: The Department currently maintains in-house staff for endpoint management. Per the RFP and SOW, the Department an�cipates this rela�onship to con�nue as indicated.

48. Q: Can you provide an es�mate count of the current infrastructure environment (e.g., number of VMs, servers, storage, network devices, firewalls)?

49. Q: What is the current architecture and size of your Azure environment? (Subscrip�ons, tenants, resource groups, services in use)

50. Q: How many Microso� 365 tenants, users, and licenses are currently in use?

51. Q: Can you provide details on Power Pla�orm usage? (Power Apps, Power BI, Dataverse environments, connectors, DLP policies) A: The Department does not currently use the Power Pla�orm. The adop�on of this technology in the future is part of the implementa�on of Florida PALM at the Department. The design, development, and implementa�on of these capabili�es will be the responsibility of another vendor and a separate contract, but the establishment of specific environments, connectors, and DLP policies are the responsibility of the Contractor under the Managed Services.

52. Q: What components are included in your Azure Synapse environment? (Workspaces, pipelines, SQL/Spark pools, data flows) A: The Department does not currently use the Power Pla�orm. The adop�on of this technology in the future is part of the implementa�on of Florida PALM at the Department. The design, development, and implementa�on of these capabili�es will be the responsibility of another vendor and a separate contract, but the establishment of specific workspaces, and maintenance of pipelines, SQL/Spark pools, and data flows established by that vendor are the responsibility of the Contractor under the Managed Services.

53. Q: Are there any current or planned hybrid infrastructure elements (e.g., on-prem domain controllers, VPNs, file servers)?

54. Q: What iden�ty provider(s) are currently in use (Azure AD/Entra ID, Okta, etc.)? Azure/Entra

A: Please see the Department’s response to Ques�on 22.

55. Q: What security tools and pla�orms are currently in place? (e.g., Sen�nel, Defender for Endpoint, 3rd-party firewalls) A: The Department is currently deploying Sen�nel One which should be completed by the start of this contract. The Department also uses Microso� Defender for endpoints.

56. Q: What are the specific regulatory compliance requirements FDOC must meet? (HIPAA, CJIS, FERPA, GDPR, etc.)

A: Please see the Department’s response to Ques�on 25.

57. Q: Is there an exis�ng SIEM pla�orm, or would you require us to implement and operate one?

A: Please see the Department’s response to Ques�on 23.

58. Q: What is your current posture and policy around Zero Trust, MFA, condi�onal access, and

RBAC?

A: The Department does not have an exis�ng agency-level policy regarding these items. The Department is an agency of the State of Florida, subject to statewide policy, and as such would work with the awarded contractor to develop and implement such policies to the standards required by the State of Florida.

59. Q: What ITSM pla�orm is currently in use, if any? Will the Contractor be expected to transi�on from an exis�ng system?

A: Please see the Department’s response to Ques�on 27.

60. Q: What is the average monthly volume of service requests, incidents, and changes expected under this contract?

A: Please see the Department’s response to Ques�on 8.

61. Q: Will FDOC require integra�on between the ITSM tool and other pla�orms (e.g., iden�ty systems, CMDB, monitoring tools)?

A: Please see the Department’s response to Ques�ons 8 and 27.

62. Q: What tools or pla�orms are currently used for system monitoring, aler�ng, and telemetry?

A: Please see the Department’s response to Ques�on 26.

63. Q: Can you provide samples or expecta�ons for repor�ng formats for SLA performance, incidents, compliance, and governance?

A: Please see the Department’s response to Ques�on 29.

64. Q: How mature are your exis�ng ITIL processes (change, incident, problem)? Are you seeking improvements from the Contractor?

A: The SOW requires the Contractor to establish and maintain mature ITSM processes using ITIL or another applicable standard. The Contractor should describe these processes and how they apply in their Proposal as requested by the RFP instruc�ons.

65. Q: How many monthly or quarterly mee�ngs are expected with the Contractor for service reviews and roadmap discussions?

A: The requirements for Service Review Mee�ngs are included in the Statement of Work. The Department expects the Contractor to abide by these requirements unless modified by mutual agreement in wri�ng.

66. Q: What is the expected onboarding period for transi�on and knowledge transfer? Will there be a formal transi�on-in phase?

A: Please see the Department’s response to Ques�on 32.

67. Q: Are there any mission-cri�cal legacy systems that require special support or integra�on?

A: Nothing outside of the requirements listed on the RFP.

68. Q: What is the expected turnaround �me for security incident response and root cause analysis?

A: Please see the Department’s response to Ques�on 29. The Department will consider the severity of each incident to determine the appropriate �meframe for root cause analysis.

69. Q: Will the outgoing provider (if any) support knowledge transfer or transi�on assistance?

70. Q: What is the expected go-live date, and is there a con�ngency �meline in case of delays?

71. Q: What backup solu�ons are currently in place (e.g., Azure Backup, Veeam)? Are they cloud-na�ve?

72. Q: Are there any compliance standards or tools mandated by the State Data Center or state oversight en��es, such as the Department of Management Services (DMS), that the FDOC must adhere to? For example, requirements related to infrastructure compliance, data governance, log reten�on or portability, and Security Opera�ons Center (SOC) procedures.

A: There are no procedure-level compliance standards for these items. The Department is not hos�ng services in the NRDC or other DMS controlled facili�es. The Respondent should discuss and include relevant informa�on in their Proposal should it consider that informa�on part of their value proposi�on.

73. Q: Will FDOC allow any work to be performed Offshore or must is all be within the Con�nental

US?

A: Please see the Department’s response to Ques�on 33.

74. Q: What is the current VM backup policy – frequency, reten�on, tooling?

75. Q: Is infrastructure-as-code (IaC) currently used for Azure deployments?

A: Please see the Department’s response to Ques�on 52.

76. Q: How many Power Pla�orm environments exist? Any sandbox/test/staging setups?

A: Please see the Department’s response to Ques�on 51.

77. Q: Is Power BI used at scale, and do you have any tenant-wide restric�ons?

A: The Department does not currently use Power BI. The adop�on of this technology in the future is part of the implementa�on of Florida PALM at the Department. The design, development, and implementa�on of these capabili�es will be the responsibility of another vendor and a separate contract, but the establishment of specific workspaces, and maintenance of pipelines, SQL/Spark pools, and data flows are the responsibility of the Contractor under the Managed Services.

78. Q: Are there any cross-tenant connectors or B2B access in place?

A: There are none.

79. Q: What is the current SIEM pla�orm in use?

80. Q: How are vulnerability scans scheduled and reported?

A: The incumbent MSP provides these services. A Nessus scan is completed weekly, and the results are sent to the Department for review. Items that are not informa�onal are remediated.

81. Q: Are there recent audit reports or gap assessments we can review?

A: There are none.

82. Q: Is Microso� Defender for Cloud/Endpoint/Purview in use?

A: Please see the Department’s response to Ques�on 55.

83. Q: Please share the last DR test report and its outcomes.

A: This informa�on is not available. The current MSP performs tests periodically and any unsuccessful backups are rerun.

84. Q: What is the RPO/RTO objec�ve for cri�cal systems?

A: This is currently undefined. Please see the Department’s response to Ques�on 15.

85. Q: Are there any workloads that don’t fall under DR coverage?

A: There are no workloads which are out of scope for DR coverage.

86. Q: Are any 3rd-party BaaS (Backup as a Service) tools in use?

87. Q: How many Azure AD groups/roles are currently ac�ve?

A: There are currently 151 Azure AD groups/roles currently ac�ve.

88. Q: Are just-in-�me (JIT) access or PIM policies enabled?

A: Please see the Department’s response to Ques�on 58.

89. Q: What ITSM tool is currently in use (ServiceNow, etc.)? Will the vendor need to bring their own?

90. Q: What integra�ons exist with CMDB, monitoring tools, or endpoint �cke�ng?

A: Please see the Department’s response to Ques�ons 27 and 42.

91. Q: Please provide an inventory snapshot export covering: Azure resource groups and regions, Number of VMs and types, Synapse pipelines and workspace details A: Please see the Department’s response to Ques�ons 1, 51, and 52.

92. Q: M365 services in ac�ve use (Teams, Exchange, SharePoint) A: The Department currently uses Microso� 365 Teams, Exchange, SharePoint, and OneDrive.

93. Q: What is the current size, License types and spread of Azure and M365 tenant environments?

94. Q: What is used for patching Intune SCCM, or some other tool?

A: The current patching solu�on is managed by the incumbent MSP. Per the SOW, the Contractor must propose, have approved, and establish a patching strategy as part of the Managed Services.

95. Q: Database Types and number of instances?

96. Q: Is a 24x7 team required for all components?

A: No. The Department’s business hours are from 8AM to 5PM M-F. A�er hours work for maintenance windows and emergencies.

97. Q: What are the expected thresholds for P1 to P4 SLA adherence?

98. Q: What monitoring tools are currently in use (e.g., Azure Monitor, SCOM, PRTG, Datadog, Splunk)?

99. Q: Can you provide a current inventory of all on-prem servers, firewalls, and network devices?

100. Q: Can you provide sample alert volume (e.g., daily/weekly) for last month?

101. Q: Is there any expecta�on for future expansion of scope (e.g., inclusion of endpoint management)?

A: No. The Department has full-�me staff dedicated to endpoint management.

102. Q: Are there any out-of-scope items that may later require one-off support?

A: Any items of this type would be covered by Project-Based Services.

103. Q: Who owns the data in the ITSM tool — the Department or the Contractor?

A: Please see the Department’s response to Ques�on 27. Per the Contract, all data created for the Department is Department property under the defini�on of Public Records Chapter 119, F.S.

and must be retained by the Contractor according to State of Florida Statutes or transmited to the Department upon termina�on of the Contract. The Contractor may propose a format for transmission to the Department at Termina�on.

104. Q: Can the Department export all historical records upon termina�on?

A: Please see the Department’s response to Ques�on 103.

105. Q: Should the ITSM tool integrate with any exis�ng �cke�ng or monitoring systems used by the Department (e.g., ServiceNow, Splunk)?

106. Q: Are there any limits on customizing the Service Catalog and workflows in the ITSM tool?

107. Q: Is there a preferred or mandated SIEM solu�on (e.g., Azure Sen�nel, Splunk), or is this up to the Contractor?

108. Q: Are there any restric�ons on where logs, backups, and monitoring data can be stored?

A: No State of Florida data may be stored, accessed, or otherwise transmited outside the United States.

109. Q: What are the �melines and protocols for no�fying the Department of security incidents?

A: Please see the Statement of Work for the an�cipated Service Level Agreement (SLA) model.

110. Q: What is the expected response �me and format for compliance/audit documenta�on requests?

A: Please see the Statement of Work for the an�cipated Service Level Agreement (SLA) model.

111. Q: How will change approvals be coordinated between Department and Contractor?

A: The Contractor will propose, and the Department will approve, this process during onboarding.

112. Q: What’s the SLA for approving or rejec�ng a change request ini�ated by the Contractor?

A: Please see the Department’s response to Ques�on 111.

113. Q: Will the Contractor provide a shared knowledge base or documenta�on portal?

114. Q: Will user/admin training be provided on tools like Power Pla�orm, Synapse, or backup systems?

A: The Contractor will provide trained staff to perform the Managed Services as part of the SOW.

As these capabili�es are future state for the Department, the Contractor may propose a plan to add these staff capabili�es prior to their being needed by the Department. The Department will provide access to the implementa�on vendor during the implementa�on for knowledge transfer and architecture support.

115. Q: What tools will be used for infrastructure monitoring, performance aler�ng, and remote diagnos�cs?

116. Q: What’s the escala�on path if the issue is a gray area between endpoint and infrastructure?

A: Per the SOW, the Department and Contractor will establish a mutually beneficial approach to co-managed services.

117. Q: Is a�er-hours support limited to P1 only? Are there any blackout periods (e.g., holidays)?

A: Please see the Department’s response to Ques�ons 29 and 96.

118. Q: How will one-�me requests outside of managed scope be tracked and billed?

A: Please see the Department’s response to Ques�on 102.

119. Q: Are there any penal�es or service credits for repeated SLA breaches?

A: The Department may elect to apply financial consequences or service credi�ng at its discre�on as mutually agreed between the Department and Contractor as is deemed in the best interests of the State of Florida.

120. Q: Please provide the current approximate count of physical servers, virtual machines, and container hosts (by OS family) that fall within the Contractor’s “Infrastructure Management” scope. (SOW 3.1.1)

121. Q: How many core/edge switches, routers, firewalls, load balancers, and wireless controllers are presently in-scope for monitoring and configura�on management? (SOW 3.1.1)

122. Q: How many Azure subscrip�ons, resource groups, and ac�ve virtual networks exist today, and what is the aggregate number of Azure virtual machines and PaaS services (App Services, SQL instances, etc.) to be administered? (SOW 3.1.2)

123. Q: Please indicate the total licensed user count, the mix of subscrip�on �ers (e.g., E3 vs E5), and any GCC/High or other compliance-specific tenants in use. (SOW 3.1.2)

124. Q: How many produc�on and non-produc�on Power Pla�orm environments and Dataverse databases are currently deployed? How many Azure Synapse Workspaces and pipelines are ac�ve? (SOW 3.1.2) A: Please see the Department’s response to Ques�ons 51 and 52.

125. Q: What is the current protected data volume (TB) and desired reten�on schedule for (i) VM snapshots, (ii) SQL backups, and (iii) Synapse data stores? (SOW 3.1.5)

126. Q: For the past 12 months, please provide monthly averages for (a) Service Requests, (b) Incidents (by P1–P4), (c) Changes, and (d) Problems. (SOW 4.1)

127. Q: How many standard vs. emergency changes were implemented in the last fiscal year, and what is the CAB mee�ng cadence the Department follows today? (SOW 3.1.7 & 4.1.6) A: There were no emergency changes in the past fiscal year. Please see the Department’s response to Ques�on 111.

128. Q: Beyond the 24×7 P1 requirement, are there defined peak business hours during which faster response or on-site availability is expected? (SOW 5.1.3) A: Please see the Department’s response to Ques�on 96.

129. Q: Which security pla�orms (e.g., Defender for Endpoint, Sen�nel, third-party SIEM, vulnerability scanners) are already licensed and should be retained by the Contractor? (SOW 3.1.3) A: Please see the Department’s response to Ques�ons 23 and 55.

130. Q: Besides SOC 2 and HIPAA noted in the SOW, are there addi�onal mandates (CJIS, PCI, FERPA, etc.) the Contractor must explicitly support? (SOW 3.1.3 & 3.1.8)

131. Q: Is enterprise-wide MFA already enforced for all users and administrators, or will ini�al rollout and end-user enablement be within project scope? (SOW 3.1.3) A: The Department has enabled Mul�-Factor Authen�ca�on.

132. Q: For the required annual penetra�on test, does FDOC have a preferred third-party provider or tes�ng methodology (e.g., external only vs external + internal)? (SOW 3.2.1) A: The Department has no preferred vendor; the Contractor shall propose all procedures for the annual penetra�on test per the SOW, including vendor.

133. Q: Does the Department currently use an ITSM solu�on, and if so, is the Contractor expected to replace it or transi�on/extend the same pla�orm? (SOW 4.1)

134. Q: Will FDOC supply an ini�al authorita�ve asset list or discovery export to seed the CMDB, or must the Contractor perform full discovery from scratch? (SOW 4.2) A: Please see the Department’s response to Ques�on 42.

135. Q: Approximately how many endpoint-related catalog items and workflows must be recreated or migrated into the Contractor-hosted ITSM tool at contract start? (SOW 4.1.8 – 4.1.10) A: None. Please see the Department’s response to Ques�on 27.

136. Q: Are there exis�ng Board or FCC-mandated templates (e.g., monthly KPI dashboards, fiscal year scorecards) that the Contractor must adopt unchanged? (SOW 4.1.5 & 4.1.6) A: There are no exis�ng standards or templates. Using industry’s best prac�ces, the Department and the Contractor will establish data, format, and frequency as mutually acceptable during the Contract.

137. Q: Beyond the percentages in SOW 5.1.3, are there predefined financial credits or liquidated damages associated with missed SLA targets? (RFP 2.3.7 & SOW 5) A: Please see the Department’s response to Ques�on 119.

138. Q: Is there an incumbent managed-services provider, and will crossover support or knowledge-transfer sessions be available during the transi�on period? (RFP 3.1 / SOW Intro)

139. Q: Does FDOC an�cipate significant infrastructure or user-base growth (e.g., new offices, major marke�ng ini�a�ves) within the ini�al three-year term that should be reflected in scalability pricing assump�ons? (RFP 1.2 & Contract Term) A: No. The Department’s staffing and infrastructure are an�cipated to be stable for the ini�al contract term.

140. Q: Please provide a detailed network equipment list of all devices in scope to include the following: Device type (Router, Switch, Wireless LAN Controller, Wireless Access Point, VPN Concentrator, Firewall); Manufacturer; Model; Loca�on (Site).

141. Q: Please provide a detailed list of in scope Transport (Circuit) include the following: Circuit Type; Provider; Bandwidth; Loca�on (Site).

142. Q: What remote access services are in scope?

A: The Department is migra�ng to a public cloud-hosted model available through general internet access. There is no remote access needed.

143. Q: What are the network security requirements? Is AAA in scope for vendor? E.g. TACACS A: It is an�cipated that Authen�ca�on, Authoriza�on, and Accoun�ng (AAA) will be handled by the individual Microso� pla�orm(s) with no augmenta�on required.

144. Q: What is in scope regarding firewall policy management?

A: All network management is included in Managed Services. See the Statement of Work.

145. Q: Is DNS/DHCP/IPAM in scope for vendor? If so, how is it managed and operated today?

A: Please see the Department’s response to Ques�on 144.

146. Q: Describe the type of maintenance on the networking devices today (8x5, 5x12, 7x24, spare , depot) A: The Department’s physical network is small and requires litle physical maintenance. The 8x5 onsite model should be sufficient.

147. Q: Please provide the total number of hard and so� IMAC events for each type of device.

148. Q: What are the expected SLAs for the data network?

149. Q: Are there any exis�ng or future network "projects" in scope? Is network refresh in scope? If so, what is the schedule?

A: No. The Department’s network needs are stable. Any Project-Based Services will be requested at �me of need.

150. Q: Are all network devices covered under OEM maintenance agreement for replace or repair?

A: The Department’s worksta�ons are purchased with a 3 year warranty but the warranty is not extended even if the device remains in produc�on. Infrastructure is bought with standard manufactures warranty.

151. Q: Can all network devices be monitored by Ping and SNMP?

A: The Department has recently implemented network and firewall rules, but some rou�ng is s�ll needed for ping replies to work especially between exis�ng VLAN’s.

152. Q: Will FDOC retain ownership of all network equipment?

A: Yes.

153. Q: Will FDOC retain ownership of all transport?

A: The Department retains ownership of connec�vity.

154. Q: Will FDOC provide "Smart Hands and Feet" at all in scope loca�ons to assist vendor remote management with problem determina�on?

A: Yes. However, the Contractor must provide on-site support when required.

155. Q: Will vendor be expected to u�lize FDOC tool set, or vendor provided tools? What third party tools are used today to manage the network environment?

A: Per the SOW, the Contractor shall provide their own tools for SIEM, ITSM, and CMDB. The Department hosts its infrastructure in the Microso� Cloud.

156. Q: Please provide a detailed list of infrastructure to be managed by vendor. Please include hardware, opera�ng systems, backup and recovery so�ware, cloud services, middleware, databases, so�ware packages that are part of this solicita�on. Exhibit 1 - SOW

157. Q: Please provide monthly number of problem �ckets by severity for the past one year.

(Exhibit 1 - SOW 5 SLA)

158. Q: Please provide monthly change �ckets by priority level for the past one year. (Exhibit 1 -

SOW 5 SLA)

159. Q: Who manages the IT infrastructure for the department today? (RFP) A: The Department’s IT infrastructure is currently managed by the incumbent MSP, with the Department providing endpoint and desktop support using in-house staff.

160. Q: Is there a target dura�on for transi�on of services from current team/incumbent to the new vendor?

161. Q: Please provide access to knowledge bases and documenta�on to accurately scope and price the transi�on effort needed. (Exhibit 1 - SOW)

162. Q: Does the department have a disaster recovery plan, tested procedures, and playbooks? Or will the vendor be required to develop those? (Exhibit 1 - SOW 3.1.5) A: Please see the Department’s response to Ques�on 15. The Department maintains a COOP with a warm site in a different geography. All employees have laptops and can work remotely.

Our infrastructure is kept in the Azure cloud. Some refinement and documenta�on may be required in the future.

163. Q: To provide a quality response which requires answers to ques�ons asked we request an extension of two weeks to the response deadline. (RFP) A: Please see the Department’s response to Ques�on 2.

164. Q: Which observability so�ware does the department use for monitoring of infrastructure?

(RFP)

165. Q: Would you consider gran�ng a one week extension to the proposal due date?

If no extension is provided, could the mail-in requirement be removed and only electronic submissions are required?

A: Please see the Department’s response to Ques�ons 2 and 10.

166. Q: For pricing purposes, can you please confirm the total number of users to be supported?

167. Q: Please clarify the place of performance. Will remote or hybrid work be acceptable?

A: Please see the Department’s response to Ques�on 3.

168. Q: Does the FDOC permit the use of offshore resources (resources based outside the US) to deliver any por�on of the Managed IT Services? (SOW 3.1.2, 3.1.6)

169. Q: The SOW men�ons 24/7 monitoring and incident response. Does the FDOC also require a 24/7 staffed service desk for handling user requests and non-cri�cal issues, or are business hours sufficient with on-call escala�on for cri�cal incidents outside of those hours? (SOW 3.1.4, 3.1.6) A: No. Per the SOW, the Department will handle the end user and desktop service desk du�es.

170. Q: Can the FDOC provide an approximate count of servers, workloads (e.g., databases, web applica�ons), and applica�ons deployed across its cloud environments (Azure, M365, Power Pla�orm, Synapse)? Are there any current architecture documents that the FDOC can share?

(SOW 3.1.1, 3.1.2)

171. Q: Are there any on-premises or hybrid cloud components that would fall under the scope of Managed IT Services, or is the environment primarily cloud-based? Will the provider be required to provide on-premises services? (SOW 3.1.1)

172. Q: Does the FDOC currently u�lize a Security Informa�on and Event Management (SIEM) solu�on? If so, does the FDOC have a preference for the awardee to integrate with its exis�ng SIEM or deploy a new SIEM as part of the Managed Services? (SOW 3.1.3)

173. Q: Can the Department clarify the extent of administra�ve customiza�on and ongoing support expected from the Contractor for Department use of the ITSM tool (e.g., Service Catalog configura�on, role-based access, and �cket workflow for endpoint services), and whether those ac�vi�es are expected to be included within the flat-rate managed services fee? (SOW 4.1.8) A: Please see the Department’s response to Ques�on 27. Please see the Statement of Work for Service Catalog requirements.

174. Q: The SOW states that the contractor must provide and maintain an ITSM tool. May the department please provide the exis�ng ITSM tool's name. Does the Department have a preference for an ITSM tool? (SOW 4)

175. Q: How does the Department envision the Contractor’s role in monitoring and op�mizing cloud usage costs—will the Contractor be expected to proac�vely recommend architectural or service changes based on observed cost paterns, or only provide repor�ng for Department-led decisions? (SOW 3.1.2) A: Please see the Department’s response to Ques�on 1. While the Contractor is not directly responsible for hos�ng, as a strategic partner the Department would expect periodic reviews and recommenda�ons from the Contractor’s exper�se, especially during Power Pla�orm, Azure Synapse, and Power BI deployments and their changes to exis�ng infrastructure.

176. Q: How does the Department define the boundaries of governance responsibili�es between the Department and Contractor for Power Pla�orm environments, especially with regard to ci�zen developer ac�vity, DLP enforcement, and managing shared resources like connectors and gateways? (SOW3.1.8) A: Please see the Department’s response to Ques�on 51. The Contractor will be responsible for ALM ac�vi�es between environments and monitoring the integrity of exis�ng shared assets. The Department will contract separately for development services and provide the Contractor with an authorized list of ci�zen developers, if any.

177. Q: Can the Department elaborate on the expected scope and depth of the annual risk and compliance assessment—specifically, should the Contractor align the assessment with specific regulatory frameworks (e.g., SOC 2, NIST 800-53), or will the Department provide a custom control set? (SOW 3.1.8) A: The annual risk and compliance assessment must be aligned with Florida Administra�ve Code

60GG-2.

178. Q: Could the Department clarify the preferred cadence, level of detail, and delivery format (e.g., dashboards, PDF reports, live access) for the periodic service performance repor�ng requirements, and whether specific KPIs or thresholds are already defined or will be co-developed post-award? (SOW 4.1.5) A: Please see the Department’s response to Ques�on 65.

179. Q: What level of autonomy or authority will the Contractor have in coordina�ng with third-party vendors for support or licensing (e.g., Microso� Premier Support), or will procurement ac�ons remain solely with the Department? (SOW 3.1.6, 3.1.9) A: The Department is an agency of the State of Florida. As such, all license purchases must be made by the Department, and all vendor rela�onships must involve Department personnel rendering final decision or ac�ons. The Contractor is expected to support the Department in issue resolu�on by providing data, exper�se, and advice, as needed.

180. Q: Can the Department clarify whether the scope includes managing and providing administra�ve support to the Change Advisory Board (CAB)? (SOW 3.1.7)

181. Q: Can the Department clarify what core or standard Business Hours are to dis�nguish them from a�er-hours support? (SOW 3.1.6)

182. Q: Can the Department confirm that the Ini�al Response Time for Priority 2 (P2) - High, Priority 3 (P3) - Medium, Priority 4 (P4) - Low is during normal / standard Business Hours and only Priority 1 (P1) - Cri�cal requires 24x7 response. (SOW 5.1.3) A: We abide by industry standards. Please see the Department’s response to Ques�on 29.

183. Q: Is there any pre-proposal conference scheduled for this RFP?

A: No. There is no pre-proposal conference.

184. Q: Kindly share the list of Tools available in place. Also confirm, if Vendor can leverage those tools ?

A: Please see the Statement of Work for tools to be provided by the Contractor.

185. Q: Which SIEM tool is currently in use? If none, is the vendor expected to propose and implement one?

186. Q: Will logs from endpoint devices be fed into the SIEM pla�orm (considering they are out of Vendor’s scope)?

187. Q: Are there exis�ng patch management tools and schedules in place, or should the Vendor define a new process?

A: Please see the Department’s response to Ques�on 94.

188. Q: What are the RTO/RPO targets for cri�cal systems?

A: There are no cri�cal systems with RTO/RPO requirements under the control of the Department.

189. Q: Is there a current DR site, or should the Vendor design one?

A: The Department will u�lize the Microso� tenant and Azure services for disaster recovery to be managed by the Contractor.

190. Q: What is the expected frequency of DR tes�ng beyond the annual valida�on?

A: Please see the Statement of Work for Disaster Recovery requirements.

191. Q: Is there any specific scope that requires Business hours support? Kindly confirm.

192. Q: How will the Department determine whether a task is considered part of 'rou�ne Managed Services' versus 'Project-Based Services'?

A: Please see the Department’s response to Ques�on 31.

193. Q: Is there a defined project intake and approval process and �meframe?

A: Please see the Statement of Work regarding Project-Based Services.

194. Q: Please confirm whether vendors are required to be registered as a business en�ty in the State of Florida at the �me of proposal submission, or if registra�on is acceptable upon contract award and prior to execu�on."

A: Vendors must be properly registered with the appropriate agencies to conduct the applicable business. All vendors must be registered in MFMP in order to receive payment at the �me of the Award.

195. Q: Are there are any limita�ons on Vendor using any resources outside of the United States? (SOW 3.1)

196. Q: How many loca�ons house in-scope devices? (SOW 3.1.1) A: The Department maintains one (1) physical office in Bartow, Florida and one (1) Microso� Tenant in the GCC Azure cloud.

197. Q: Please provide a detailed inventory of in-scope devices. Please include quan�ty, manufacturer and model. (network, collabora�on and data center) (SOW 3.1.1)

198. Q: How many monthly Incident, Requests, Problems and Changes take place on average for the in-scope devices on a monthly basis? (SOW 3.1.1)

199. Q: Will an export of the last 12 months of Incidents, Requests, Problems and Changes be provided to Vendors for review? (SOW 3.1.1)

200. Q: Is there a list of supported applica�ons running on in-scope servers available and if so, please provide that list along with the number of users of the applica�ons? (SOW 3.1.1)

201. Q: Can the Department please provide an Azure resource report to review in-scope cloud services? (SOW 3.1.2)

202. Q: How many and what level of Microso� licensing is in place today? (SOW 3.1.2)

203. Q: Where does the Department currently procure their Microso� licensing from? (SOW 3.1.2) A: The Department is an agency of the State of Florida who holds an Enterprise Agreement with Microso�. Our Microso� so�ware is purchased and managed through an authorized list of Value-Added Resellers.

204. Q: What EDR tool is in place today? (SOW 3.1.3) A: All system administra�on tools are provided by the incumbent MSP. Per the SOW, the Contractor shall provide these tools in the future.

205. Q: What type and how many firewalls? Is there a firewall management pla�orm in place? (SOW 3.1.3)

206. Q: What is the Department using for MFA? (SOW 3.1.3) A: The Department uses Microso� EntraID for Mul�-Factor Authen�ca�on.

207. Q: How many domain controllers are in place? (SOW 3.1.3)

208. Q: Is the Department u�lizing Entra ID? (SOW 3.1.3)

209. Q: How many end users? (SOW 3.1.3)

210. Q: How many servers (virtual and physical)? (SOW 3.1.3)

211. Q: What is the total number of assets that require vulnerability scanning? (SOW 3.1.3)

212. Q: Is there a current vulnerability scanner in place the Department plans to keep? (SOW 3.1.3)

213. Q: Are there exis�ng systems owned by the Department that will be managed by the vendor or is the vendor expected to bring all systems? (SOW 3.1.4)

214. Q: What is the exis�ng Backup solu�on? Will the Department plan on keeping it and having the chosen vendor manage it? Or does the Department want a brand new backup solu�on? (SOW 3.1.5)

215. Q: Are there any specific data reten�on requirements to maintain? (SOW 3.1.5) A: The Department is an agency of the State of Florida whose reten�on requirements are set by the Florida Department of State.

216. Q: If new backup solu�on is requested, please provide this informa�on: Total amount of consumed data on servers; Physical; Virtual; Size of External Repository in GB; Memory provisioned on servers (for DR); Current bandwidth: (SOW 3.1.5)

217. Q: What exis�ng DR environments, plans, backup solu�ons and business con�nuity plans and systems are currently in place, and will the Vendor be requested to take over management of any exis�ng backups solu�ons or system or will Vendor be requested to provide backup solu�ons or systems? (SOW 3.1.5)

218. Q: Is there an exis�ng change management process and ITSM system in use to track changes and is that the same as the Department ITSM for incidents, requests, and problems (SOW 3.1.7)

219. Q: Annual Penetra�on Tes�ng: What is the total number of internal devices? (SOW 3.2.1)

A: The exact number varies from year-to-year. The Department es�mates that the total number of devices involved in the penetra�on tes�ng will not exceed seventy-five (75) in any given year.

220. Q: Annual Penetra�on Tes�ng: What is the number of external facing IPs? (SOW 3.2.1) A: The exact number varies from year-to-year. The Department es�mates that the total number of external facing IPs will not exceed five (5) in any given year.

221. Q: Is there an exis�ng ITSM owned by the department that will be used by the vendor (SOW 4.1)

222. Q: How many Department staff will need access to the ITSM to manage endpoint related incidents, requests, changes and problems? (SOW 4.1)

223. Q: Is there an exis�ng CMDB and if so, will an export of that be available to Vendor for review and poten�al import into the new CMDB? (SOW 4.2)

224. Q: Is this a currently funded contract?

A: Please see the Department’s response to Ques�on 5

225. Q: Is there a target budget or funding range associated with the project?

A: Please see the Department’s response to Ques�on 5

226. Q: Can you provide a high-level architecture or inventory of the current IT environment, including systems, cloud pla�orms, and on-premises assets under management?

227. Q: What is the current # of assets to be managed? Although endpoint management is not in scope, given it will be included in the ITSM tool, we request the endpoint total #’s also.

228. Q: Understanding that we will provide an ITSM tool upon award, for migra�on purposes, what ITSM…