RFP_C5611387_DCAO_Q_A_Set_1_02.27.2024.docx

DCAO RFP C5611387

QUESTIONS AND ANSWER SET #1

Please see Section 3.17.3 for DVBE Incentive information.

1. Source Name:

2. Source Category(Eg. Databases,Flat Files, APIs etc)

2. Source Type (E.g, Structured, Semi structured, un structured):

3. Historical Volume of Data

4. Per day incremental volume (E.g. 1 GB / Day)

5. Frequency Type (E.g. Batch or Real time):

6. Data Formats (E.g. CSV, Parquet, orc, etc.)

Precise data storage and ingestion requirements will be gathered during the requirements gathering phase, but at a high level all data ingestion sources are structured. Current databases are Oracle and MS SQL Server.

- Number of Reports desired:

- Average number of views per report (approx)

- Average number of KPIs per report (approx)

- Average number of Metrics per report (approx)

- User types & personas who are going to access the data along with the defined permission levels

- Different Use cases for which the data will be extracted from the data lake / Data Warehouse

- No of users accessing this reports? Will they be internal users or external as well Please review the deliverables for the SOW. The specific number of reports, KPI’s and Views are still in discussion.

Reporting requirements will be provided during the requirements gathering process after contract award.

The number of jobs will depend on the data model that will be generated after the requirements gathering phase.

4.1 - Data Linkage and Storage Solution

What is the mechanism CDCR will put in place to label data as being highly sensitive?

CDCR is actively revising the data classification policy and will help identify the highly sensitive data elements but will rely on the vendor to use industry best practices for safeguarding data like encryption and role-based access control.

4.1 - Data Linkage and Storage Solution

Our understanding of this requirement is that the tool will need to be hosted on a FedRAMP-approved cloud platform and cloud services such as AWS, Google, or Azure. Is that interpretation correct?

Yes, the interpretation is correct.

4.1 - Data Linkage and Storage Solution

800-53 High with FedRAMP Medium certification required.”

Is FedRAMP Medium equivalent to FedRAMP Moderate?

For the purposes of this requirement, does FedRAMP low meet this requirement?

Medium is equal to Moderate. FedRAMP Moderate compliance is the requirement.

4.1 - Data Linkage and Storage Solution

800-53 High with FedRAMP Medium certification required.”

Does StateRAMP or TX-RAMP compliance constitute meeting the FedRAMP requirements?

No, StateRAMP or TX-RAMP is not a substitute for FedRAMP Moderate compliance.

4.1 - Data Linkage and Storage Solution

Does a FedRAMP 3PAO assessment report meet this requirement?

Per the SAM, the CSP must be FedRAMP Authorized at the Moderate level.

4.1 - Data Linkage and Storage Solution

What level of segregation does this requirement envision?

Does independently granting permissions for “highly sensitive information” versus “information used for analyses” meet this requirement?

CDCR is actively revising the data classification policy and will help identify the highly sensitive data elements but will rely on the vendor to use industry best practices for safeguarding data like encryption and role-based access control.

Visualization Tool

security policies and systems.”

Can you please provide the set of CDCR security policies that must be complied with?

Can you please clarify what is meant by “Compliant with PII” - is there a regulatory framework we should reference?

What would constitute HIPAA compliance?

CDCR security policies and PII compliance follow the CJIS guidelines: https://www.fbi.gov/file-repository/cjis_security_policy_v5-9-1_20221001.pdf/view

Additional State of California Information Security Policies can be found on the California Department of Technology Website in the Statewide Information Management Manual (Section 5300 Information Security): Statewide Information Management Manual (SIMM) - CDT (ca.gov)

HIPAA Regulations can be found in Section 45 of the Code of Federal Regulations or the US Department of Health and Human Services Website: www.hhs.gov/hipaa

Visualization Tool

transaction security and compliance to third-party platforms or hosting providers the Solution uses.”

Can you please clarify this requirement and provide an example of the kinds of configurable controls CDCR is seeking?

One example would be the ability to encrypt data extracts that serve as the source for the visualizations and can be configured to be on and off at the data extract level.

and Storage Solution

formerly incarcerated individuals, or individuals on parole, will be made available as a part of this contract?

A minimum of seven (7) years data is required. Refer to Addendum 1 for modifications to this section.

Data Warehouse Design

Data Warehouse Design

Contracting Act Verification Form + Attachment 19

Appendix A- Table 6-1 Ex. 2-3, tab #3 – UT Hourly Rates The RFP identifies two key staff members, and the SOW identifies ten (10) resources. Further, the job classification titles in the Cost Workbook differ from those identified in the SOW.

Please clarify which roles the CDCR is expecting for the project.

Statement of Work contains (roles):

Senior Project Manager (Project Manager), Senior Technical Lead (Technical Lead/Data Warehouse Architect), Data Modeler (Database Developer), Data Engineer (ETL Developer), Business Intelligence Analysts (BI Developer), Senior Enterprise Architect (Cloud Architect), Data Scientist, Senior Software Engineer (Database Administrator), Information Security Specialist (Security Architect), Technical Lead (Transition Lead)

Cost Workbook contains role(s):

Senior Project Manager, Development Lead, Back-End Lead, Testing/QA Lead, Software Quality, Analyst/Tester, Programmer/Developer, Technical Writer, Trainer, Database Administrator, Technical Architect There are two (2) Key Staff required as identified in RFP Section 4.1.3, Staff Qualifications:

1. Senior Project Manager

2. Senior Technical Lead

As indicated in SOW Section 7, MINIMUM CONTRACTOR AND CONTRACTOR STAFF QUALIFICATIONS: “*Key Staff must stay with the project. Other staff may come and go as duties dictate.”

The staff for this project are identified in SOW Section 7 and 8.

Refer to Cost Worksheet Addendum 1 for updated positions.

Can the CDCR please clarify whether the $4.5 million budget includes services and software license costs?

The $4.5 million budget includes services and software license costs.

Can the CDCR please identify these services and on-site systems?

This section is referring to the services and or on-site systems the Contractor will be providing as part of their solution.

Section 7.1 - RFP

Can the CDCR please review and provide the correct number of points allocated for the Cost Workbook?

On Page 38 – Section 5 the RFP states “Cost is a primary evaluation criterion weighted at 40% (500 points) of the total 1,500 points” On Page 45 - Section 7.1 the cost workbook is scored at 600 points.

Refer to Addendum 1 for modifications to this requirement.

Please clarify what comprise the 100,000 external user population. Does this include organizations, individuals, or both?

Refer to Addendum 1 for modifications to this requirement.

On page 118 - “6. Business Intelligence Plan – (maximum 90 points)” On Page 120 14.6 “Business Intelligence Plan Max Point available = 60 Points” Refer to Addendum 1 for modifications to this requirement.

“Preference/Incentive points are TBD” Refer to Addendum 1 for modifications to RFP Section 7.2.11 Socioeconomic Programs.

CDCR/DCAO is not a FedRAMP Sponsoring Agency.

a. Show the digital documents for viewing?

b. Extract data from the documents for inclusion in reports?

Current data sources are structured RDBMS that include some XML blobs. Digital document viewing or extracting data from documents such as word or PDF is not a requirement.

Refer to RFP Section 1.4 Current and Proposed Environment & Attachment 14.5: Narrative Response: Data Aggregation and Integration Plan.

And ATTACHMENT 11: BIDDER QUALIFICATIONS FORM (Number 15, Classification M and Description)

On page 98, it is mentioned that” … ten thousand (10,000) external users” and on page 101, it is mentioned that “… one hundred thousand (100,000) external users”.

Please clarify if it is 10k external users or 100k external users.?

Refer to Addendum 1 for modifications to this requirement.

We also request you to reduce the end users to 50-100 end users.

Refer to Addendum 1 for modifications to this requirement.

1. At least $20M in total project cost.

We request that this requirement be reduced to CDCR’s project budget (see question 7) Refer to Addendum 1 for modifications to this requirement.

RFP

If so please provide examples of the existing reports, to show the number of reports and columns in these reports?

Please clarify what new data will be required in the new reporting?

Reporting requirements will be provided during the requirements gathering process after contract award.

RFP

RFP

Please provide any current KPIs / Metrics. Will additional ones be provided or will they need to be identified as part of the requirements gathering.

KPIs will be provided during the requirements gathering process, after contract award.

And, in addition to the list of source applications, is there an estimate of the tables/columns used in the current reporting processes (i.e. the ones to be replaced by this new process).

Yes, all data ingestion sources are structured and in a relational database. This project is a net new implementation and is not replacing any existing reporting.

Statement of Work

Please clarify what level of segregation is required.

CDCR is actively revising the data classification policy and will help identify the highly sensitive data elements but will rely on the vendor to use industry best practices for safeguarding data like encryption and role-based access control. Physical separation is not required.

RFP

Please clarify whether these enterprise applications are not using OLTP DBs, or if there is an expectation to use APIs or message brokers to ingest data from the apps.

Enterprise Applications are using OLTP databases.

RFP

RFP

Understanding we are starting with 5 TB.

Estimated to be 15% or less annually. Refer to Addendum 1.

Do you intend to use the same SAS in the new D/W also? (depending on how complex and elaborate the models are)?

Please see RFP Exhibit 2-1 for DCAO Requirements.

And whether the requirement for the Data Scientist to be proficient with “unstructured data” about new model developments?

All data ingestion sources are structured and in a relational database. Currently analytics is done mainly using SQL.

Even in that case, please clarify that your processing, based on today's requirements, requires heavy SQL-type processing with known rules?

All data ingestion sources are structured and in a relational database. Currently analytics is done mainly using SQL. Advanced Analytics (machine learning, Text analytics, Geospatial analytics, GenAI, Graph analytics, etc) is not needed at this time.

partnering with CDT on CalCloud The solution shall be cloud agnostic and be able to run on any major cloud platform (Government Cloud preferred over commercial cloud offerings) such as AWS, Azure, Google etc.

Please refer to SOW Section 4, item 3.

Regarding the user base - policymakers, administrators, field staff, and researchers - What is the approximate number of users for this portal?

And how often are they expected to use the portal?

Refer to Addendum 1 for modifications to this requirement.

Has the client considered budgeting costs as data size grows, which will impact cost over time?

Yes.

Please clarify how expansive is the level of access? Smaller access points provide a more secure connection… Please refer to SOW Section 4: Scope of Services.

Please clarify if the proposed solution is cloud-based, will CDCR consider data encryption initiated by cloud provider encryption keys?

For example, google generally uses subfile chunks and distributes data then uses individual encryption keys for each chunk. Google also uses other keys to encrypt their hard drives. AWS and Azure use different methods but with similar results.

All appropriate layers of the systems shall be encrypted and CDCR shall ensure control over the encryption for both confidentiality and availability requirements.

For example, Kafka is regularly used in data pipelines and you can find cloud-managed/hosted solutions of Kafka in Azure and Google (though it's through a Google partner) Please see SOW Section 4: Scope of Services and Exhibit 2-1 DCAO Requirements.

Please clarify any current software to help enforce the data privacy policies?

CDCR is open to using both COTS (Commercial off the Shelf) and open-source products.

For example, using tools like pulumi or Ansible/Terraform to help build out the infrastructure to make it easier to deploy across multiple cloud providers.

Or once a specific cloud provider has been selected will it be acceptable to use specific deployment tools provided by that cloud provider such as Azure’s ARM (azure resource manager) templates?

CDCR does not require the solution to be deployed across multiple cloud providers.

Though 4 hours seems like a large window of time, this would ultimately be determined by the size of data, network connect speeds, and the ETL work required for the data.

The requirement is based on an average. Refer to Addendum 1.

Will CDCR consider rephrasing the time requirement to a Mutually acceptable time window?

The State has reviewed this request and no change will be made.

For example, in some cases the ability to write data to the data warehouse may be impacted by network outages from the source system, technically this could be considered an outage.

Also, whether the 97.5 % uptime include scheduled maintenance windows?

The availability is for the system as a whole and includes both reading and writing. It does not include the scheduled maintenance windows.

A documented and tested process to scale up (or down) would meet this expectation.

Also, the ability to do so depending on the component could impact the availability of the full platform (see question above) This requirement is related to the system elasticity and the ability to scale up and down without system downtime.

what hardware the application is currently hosted on, what type of license CDCR has for software, and what constraints CDCR has concerning upgrading either.

Also is this hosted on-prem?

Power BI is cloud based and is automatically updated by Microsoft, Tableau is on-premise and licensed for 16 cores. Current version is 2022.3.8

If so, please provide what is currently implemented?

Is it Active Directory and hosted on-prem?

If it is In a mixed environment, a different version and license may be required.

For example, Azure has cloud-based active directory, which can be integrated into an existing on-prem system CDCR currently has role-based access control through an on-premise Active Directory.

Please provide a detailed list of all audit requirements.

To include details such as audit schedule.

For example, quarterly audit report of all admin access to CDL Refer to Addendum 1, Exhibit 2-1, Item 9.

If so, please provide the standard format currently used and retention requirements.

Retention requirements could add additional platform requirements to meet these expectations.

Refer to Exhibit 2-1, Item 3 and 8.

And if there are an expected number of webinars/workshops quarterly, annually etc.?

The timeframe for continued support shall be until the end of the contract.

The number of webinars/workshops shall be as needed by the CDCR and mutually agreed upon by the Contractor and CDCR after contract award.

And implementation of the plan is projected to be much later?

The state has considered this request and declines to add this statement. The time frames are critical for the project.

Will CDCR accept a proposed solution defined this way?

CDCR will accept proposals with parallel processes.

135.

136.

Vendor would work with CDCR on this and be part of their scheduled maintenance calls.

Please provide CDCRs Change Management and Incident Managed processes.

Please see SOW Section 9 Deliverables or Tasks G: Deliverable 7: Maintenance Plans and Knowledge Transfer.

137.

Will CDCR consider off the shelve solutions for platform performance monitoring?

CDCR is open to using both COTS (Commercial Off The Shelf) and open-source products.

And if CDCR currently has a maintenance schedule? If so, please provide that schedule.

Please clarify how much notice does CDCR require in advance for scheduled maintenance?

The maintenance windows will be outside of the expected uptime. The schedule shall be driven by the platform requirements. Advance notice a week ahead of the scheduled maintenance is acceptable.

For example end user attempting to load a large visual report from home with power internet connection. Or a network outage at a source data location.

The Service Level Agreements are based on averages.

140.

1. At least $2M in total project cost;

2. A solution that has at least one hundred (100) internal end users and ten thousand (10,000) external users; and

3. A solution that provides a secure data exchange interface with multiple external systems.”

Attachment 11: Numbers 12 and 14 reference “Large and Complex IT Systems,” which is not defined in the instructions.

Please confirm that projects should meet the definition in Attachment 10 to be considered relevant.

Refer to Addendum 1 for modifications to this requirement.

1. At least $2M in total project cost;

2. A solution that has at least one hundred (100) internal end users and ten thousand (10,000) external users; and

3. A solution that provides a secure data exchange interface with multiple external systems.”

Attachment 11: Number 15 has a mandatory requirement of a solution “used by at least one hundred (100) internal end users and one hundred thousand (100,000) external users.”

Please confirm that the user count should be “at least one hundred (100) internal end users and ten thousand (10,000) external users” as defined in Attachment 10.

Refer to Addendum 1 for modifications to this requirement.

Does CDCR prefer a single reporting solution, or should the data warehouse continue to support the three existing reporting solutions (PowerBI, Tableau and Oracle Analytics Server)?

CDCR prefers a single reporting solution.

How many REST APIs are in the existing systems?

How many SOAP APIs are in the existing systems?

How many batch data loads are in the existing systems?

No APIs are currently being used but might be used in the future.