RFP27006808 Appendix G Disaster Recovery.docx

DISASTER RECOVERY, BUSINESS CONTINUITY, DATA PROTECTION, AND CONTINUITY OF GOVERNMENT OPERATIONS

1. Scope and Applicability These requirements apply to any proposed Software-as-a-Service (SaaS), cloud-hosted, or Salesforce-based solution that will store, process, transmit, or manage State Executive Branch data.

For purposes of this RFP, “State Data” includes all information created, received, maintained, or transmitted by the Agency, including records subject to public records laws, audit requirements, litigation hold, and statutory retention schedules.

Failure to meet the mandatory requirements of this section may result in disqualification.

2. Continuity of Government Operations The Offeror acknowledges that State Executive Branch systems support essential public services and must remain available during emergencies, disasters, and declared states of emergency.

The Offeror shall:

· Support continuity of government operations.

· Maintain redundant infrastructure across geographically separate regions.

· Ensure no single point of failure.

· Support emergency operations during declared state emergencies.

· Prioritize restoration of State services.

3. Disaster Recovery (DR) Requirements

3.1 Documented Plans

The Offeror shall maintain:

· A documented Disaster Recovery Plan (DRP)

· A documented Business Continuity Plan (BCP)

· Pandemic and workforce continuity procedures

· Incident escalation and communication protocols The Offeror shall provide executive summaries with its proposal.

3.2 Recovery Objectives (Mandatory Disclosure)

Offeror shall provide guaranteed:

· Recovery Time Objective (RTO): 4 hours (not to exceed 8 hours unless justified)

· Recovery Point Objective (RPO): 24 hours The proposal must clearly state:

· Whether RTO/RPO are contractually guaranteed

· SLA credits or penalties for failure

· Historical performance over past 24 months Failure to meet RTO/RPO commitments may constitute material breach.

3.3 Disaster Recovery Testing

The Offeror shall:

· Conduct full DR testing at least annually

· Conduct partial or tabletop exercises semi-annually

· Provide DR test summary results upon request

· Remediate deficiencies within documented timeframes The State reserves the right to request evidence of remediation.

4. Data Backup and Protection The Offeror shall:

· Perform automated backups at minimum daily frequency (hourly preferred for critical systems)

· Encrypt all data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent)

· Maintain geographically separate backup storage

· Protect backups using immutable or ransomware-resistant storage

· Retain backups for a minimum of 365 days (State may require 90–365 days depending on system criticality) For Salesforce-based solutions, the Offeror shall describe:

· Backup of standard and custom objects

· Backup of configuration and metadata

· Backup of workflows, integrations, and permissions

· Sandbox backup capability

· Restoration granularity (record-level, object-level, full-org)

5. Data Retention and Public Records Compliance The Offeror shall:

· Support configurable retention schedules aligned with State records laws

· Preventing deletion of records under legal hold

· Provide full export capabilities for public records requests

· Support audit-ready record preservation

· Ensure no commingling of State Data with other customers’ data The solution must allow the State to:

· Search and export records efficiently

· Produce records in standard, non-proprietary formats

· Preserve metadata for evidentiary purposes

6. Data Ownership and AI Restrictions The State retains exclusive ownership of all State Data.

The Offeror shall:

· Not access, mine, analyze, or monetize State Data beyond contracted services

· Not use State Data to train artificial intelligence models

· Not create derivative datasets without express written authorization

· Not disclose State Data except as required by law and with prior notice All data rights shall survive contract termination.

7. Exit Strategy and Data Portability Upon termination (for convenience or cause), the Offeror shall:

· Provide full data export within 30 days

· Provide schema documentation

· Provide metadata, configurations, and integrations documentation

· Support transition for a minimum of 60 days

· Certify secure destruction of residual data

· Provide certificate of destruction signed by an authorized officer Data must be provided in non-proprietary formats (CSV, JSON, XML, etc.).

The State shall not be subject to excessive extraction or transition fees.

8. Security and Compliance Standards The Offeror shall maintain, at minimum:

· SOC 2 Type II certification

· Annual third-party penetration testing

· Documented vulnerability management program

· Multi-factor authentication for administrative users

· Role-based access controls

· Detailed audit logging The Offeror shall provide:

· SOC 2 report

· Executive summary of penetration tests

· Notification of any material control deficiencies If applicable, Offeror shall indicate compliance with:

· CJIS (if criminal justice data involved)

· HIPAA (if health data involved)

· IRS Publication 1075 (if tax data involved)

· FedRAMP (if applicable)

9. Security Incident and Breach Notification The Offeror shall:

· Notify the State within 24 hours of discovery of any confirmed or suspected security incident affecting State Data

· Provide ongoing status updates

· Deliver a formal written incident report within 3 days

· Cooperate fully with State investigations

· Bear costs associated with breach notification if caused by vendor failure

10. Data Location and Sovereignty The Offeror shall disclose:

· All physical and cloud regions where State Data resides

· Subprocesses with access to State Data

· Data replication practices

· Any cross-border data transfers State Data shall not be stored outside the United States without prior written approval.

11. Audit and Oversight Rights The State reserves the right to:

· Review relevant audit reports

· Request corrective action plans

· Terminate contract for repeated control failures

· Conduct independent security assessments where legally permissible