RFP 25-03 Amendment No. 3.pdf

STATE OF WASHINGTON

OFFICE OF THE SECRETARY OF STATE

IT DIVISION

RFP 25-03 OSOS MIGRATION TO WA TECH TENANT

AMENDMENT NO. 3

(March 24, 2025)

SUMMARY

This Amendment No. 3 to RFP 25-03 contains: (1) the agenda of the Preproposal Conference held on March 18, 2025; (2) the compiled questions received from vendors at the Preproposal Conference and the OSOS official answers to each of the vendors’ questions.

PREPROPOSAL CONFERENCE AGENDA

RFP 25-03

OSOS Migration to WaTech Tenant

Office of the Secretary of State, IT Division

PREPROPOSAL CONFERENCE

Tuesday, March 18, 2025

9:00 a.m. - 10:00 a.m.

(via Microsoft Teams)

AGENDA

I. Welcome & Introductions

Jim Webster, RFP Coordinator, Operations Division, Office of the Secretary of State Justin Bouscal, Senior IT Architect, Office of the Secretary of State

Sam Anderson, Chief Information Security Officer, Office of the Secretary of State

Evan Soderquist, IT Project Manager, Office of the Secretary of State

Joe Gonzalez, IT Operations Manager, Office of the Secretary of State Angel Olivas, ISR Security Analyst, Office of the Secretary of State

II. Important Information for Bidders on Solicitation Process (Jim Webster, 5 minutes)

A. RFP Coordinator is Sole Contact for Questions/Communications B. Resources for Official Answers, RFP Amendments, and Notifications

Washington Electronic Business Solution (WEBS) OSOS Current Procurements Webpage

C. Questions & Answers Ask questions but follow up with an email to RFP Coordinator Answers at conference are unofficial; official answers will be posted on March 24, 2025 All questions and official answers will be posted on April 1, 2025

D. Important Dates

March 28, 2025 – Last Day for Questions

April 1, 2025 – All Questions & Answers will be posted

April 18, 2025 – Proposal Due Date

May 12, 2025 – Apparent Successful Bidder Announced

July 1, 2025 – Contract Start Date

III. Background and Objectives of RFP (Evan Soderquist & Justin Bouscal, 5-10 minutes)

IV. Question and Answer Session

V. Final Comments

PREPROPOSAL CONFERENCE

QUESTIONS & ANSWERS

1. Any particular format that you want bidders to send the written questions to the RFP Coordinator?

A: No specific format is required for submitting written questions.

2. Does OSOS already know the list of migration tools that are approved at WaTech?

A: No. The migration tools will need to be approved by OSOS, ISR Division, which approvals will account for WaTech requirements and restrictions.

3. Does OSOS know what tools bidders will need in order to be successful with the migration or do bidders need to go through the approval process based on the tools that we like?

A: No. Any tools a vendor would like to use would have to be sent to the OSOS Information Security team. They will do research on any said tool to make sure there are no security vulnerabilities. The OSOS CISO will make the final decision on approval of the tools. Additionally, the tools may require review by WaTech – there are some preapproved tools that can be identified further into the project during discussions with WaTech.

4. Will the feasibility study be made available to bidders or just the winning bid?

A: For reasons concerning network security, OSOS originally planned to release the feasibility study previously solicited for the OSOS migration to WaTech tenant only to the vendor awarded the contract pursuant to this solicitation. Following the March 18th Preproposal Conference with vendors, and after hearing and internally discussing the concerns raised, we can appreciate the difficulty bidders may have developing a viable, quality and cost-effective proposal without it. Accordingly, OSOS has determined to make the feasibility study available to requesting bidders as of a certain date and time yet to be determined, but with certain sensitive information redacted. Vendors who wish to receive a copy of the redacted study when it is ready for release must email the RFP Coordinator Jim Webster at jim.webster@sos.wa.gov. with their request by no later than 5:00pm Pacific Time on Monday, March 31, 2025. OSOS will make every effort to complete the review and redaction process as soon as is reasonably practicable to give bidders sufficient time to make effective use of it in preparing their proposals. If OSOS encounters delays, it may extend the deadline for submitting proposals.

5. Is subcontracting allowed?

A: Yes.

6. Can firms use offshore resources to perform the services required under the solicitation?

A: No. Offshore resources are not permitted for work on this migration.

7. Can the OSOS expand a little bit on entanglement? Is there anything that's being decided to leave behind or decommission, as opposed to things that are going to be integrated in and consolidated?

A: Any decommissioning or consolidation of existing resources is slated to be complete before the migration begins.

8. What does the end state look like?

A: Our end state is to be fully compliant with applicable RCWs and WaTech policies.

9. Are resources required to be located in Olympia, WA or can resources work remotely?

A: Resources can work remotely. The vendor awarded the contract pursuant to this solicitation, and any subcontractor or resource proposed by the winning , is not required to be located in Olympia or to perform any duties at OSOS physical facilities.

10. Can non-citizens work on the migration?

A: Yes, non-citizens based on US soil are permitted to work on this project.

11. Do you have volume which we can understand in terms of users, devices, groups?

A: There are roughly 1000 user objects, 350 actual staff, 500 workstations, about 250 servers, and a heavy Azure presence, primarily PaaS resources.

12. Does the OSOS anticipate another study will need to be done before the implementation work begins on the migration?

A: Yes. There should be an expectation that additional study will be required in order to successfully plan and schedule the migration.

13. The RFP stated the vendor needs to have experience migrating to the WaTech tenant. Is that a requirement and if so, will any bidder be disqualified without possessing that experience?

A: No, bidders will not be disqualified if they have not performed a state agency tenant migration with WaTech.

14. We want to understand the WaTech environment as it pertains to the current state of compliance. Is that something you can help us answer?

A: The vendor awarded a contract pursuant to this solicitation will work closely with WaTech and OSOS to understand the shared tenant environment for compliance and other purposes.

15. The Information Assurance Technical (IAT) Level III certification. Does the OSOS have a list of certifications that may qualify for that?

A: CISSP fulfills the requirement for the IAT Level III certification.

16. Can the vendor who completed the feasibility study bid on the current RFP?

A: Yes.

17. Is WaTech currently NIST 853R4 certified?

A: No.

18. Is WaTech Microsoft Cloud Security Benchmark (MCSB) certified as well?

A: More information on WaTech Cloud can be found on:

https://watech.wa.gov/services/cloud/public-cloud

19. Are there any departmental certifications required for interdepartmental work between OSOS and WaTech?

A: The closest thing that we could encounter is protecting critical information, due to our election systems.

20. Please clarify the volumetrics on how many SharePoint sites there are and size of those sites, what integrations they have, and are they highly customized or highly static?

A: There are 275 SharePoint sites, 184 with Teams integrations. They range from default settings to highly customized. There will need to be some review and cleaning up of these sites.

21. Is it possible to share up to date architecture diagram(s) of the existing environment?

A: Architectural diagrams will be provided to the vendor awarded a contract pursuant to this solicitation.

22. Is the expectation that the winning bidder will provide specific training modules for this migration, or can we leverage something like the state's Pluralsight implementation for cloud information?

A: A training plan that includes the State’s Pluralsight subscription is acceptable – the requirement is that OSOS IT and general staff, through the efforts of the vendor awarded a contract pursuant to this solicitation, attain a comfort level with operating in the shared tenant environment; specifically, that they have a familiarity with and understand the restrictions and limitations of the shared tenant structure because they did not exist in the previous environment.

23. Pertaining to the cost proposal, is the OSOS looking for a firm fixed price or a rate card for hourly rates?

A: Fixed price is what we are expecting to see in the cost proposal.

24. Should the cost proposal cover only resource costs, or should it also account for any required infrastructure the OSOS will require for tools and licensing?

A: Any costs above and beyond “resource costs” should be clearly identified.

25. Does the two-year engagement include any post migration support and maintenance?

A: Yes, the post-migration support and maintenance is included in that two-year timeframe, and should include the training that is referenced in the RFP.

26. Is the current tenant for M365 commercial or GCC?

A: GCC.

27. The applications listed on page 5 of the RFP, are any of those replacements or changes to existing applications? Would they be subject to a structured procurement process?

A: The intent of this section is to analyze the enterprise applications and anything that's linked to our tenant to ensure that it's compatible with what is in WaTech’s tenant. WaTech has different requirements based on being a multi-organization tenant. If OSOS needs to replace those applications due to some incompatibility with the WaTech tenant, it’s unlikely that a competitive solicitation would be required.

28. Is there an incumbent vendor for this project?

A: No.

29. Are there any ongoing or planned security audits that are required to be aligned with this migration?

A: It’s likely that some type of audit or security assessment, such as penetration testing, will be performed at some point in time, but OSOS will attempt to scope that appropriately to avoid impacting the migration.

30. Are there any specific predefined milestones that the agency expects the awarded vendor to follow during the engagement?

A: Yes, those milestones should be articulated in each bid’s management proposal in the project timeline and work breakdown structure.

31. Will there be restructuring of the SharePoint and Teams content? Will file share data be part of this migration?

A: We find it highly likely there will be some restructuring of our SharePoint and Teams content. For instance, WaTech has strict requirements for naming, and we don't believe we're in alignment with those naming standards. Yes, file share data will be part of this migration, there is a significant amount(>100TB) of data residing on Windows Server file shares in the office.

32. Are there plans to move any application or rearchitecting, or can it be assumed that OSOS is going to reallocate the subscription from our current tenant into your WaTech tenant?

A: The method of migrating Azure resources is yet to be determined. The feasibility study identified two methodologies of migration – it will be expected of the vendor awarded a contract pursuant to this solicitation to work with OSOS to identify and implement the preferred method.

33. Are there plans to move OSOS’s Azure infrastructure application, or can it be assumed that OSOS will need to reallocate the subscription?

A: The current plan is to migrate the Azure applications.

34. The migration will lead to realignment of OSOS data and application infrastructure as per the compliance and regulatory needs of the WaTech tenant, is that correct?

A: Yes.

35. Does OSOS have any kind of encryption enabled, for e-mail encryption or data encryption in source that will not adapt to WaTech’s Purview and sensitivity labels? Will the migration require decryption before the migration stage?

A: The only encryption being utilized is the built in encryption functionality in Outlook to communicate with WaTech and other external partners. Decryption will depend on if the keys migrate tenants or not. There is no email encryption.

36. Are there any planned major application changes (re-architecture, re-platform) during the migration period?

A: No. Any changes that would be performed would be deferring to the migration schedule.

37. Are there any specific restrictions or limitations in WaTech’s shared tenant that we should be aware of?

A: There are a lot of restrictions and limitations, but that's not something OSOS can provide in a list.

38. On the payment revenue management system, OSOS did not provide much info. Is CFD on-prem or something else currently. How’s CFD currently sitting?

A: CFD is currently a hybrid of on premises resources and Azure resources. It’s currently slated to be fully Azure hosted by June 30, 2025.

39. Is Archived mail and litigation in scope for the Exchange migration?

A: Yes.