RFQ_No._CFF_7752_Addendum_No._1.pdf

September 5, 2025

REQUEST FOR QUOTE (RFQ) NO. CFF 7752

Information Technology (IT) Technical and Support Services

ADDENDUM No. 1

YOUR ATTENTION IS DIRECTED TO THE FOLLOWING MODIFICATIONS TO RFQ

NO. 7752. ALL CORRECTIONS, ADDITIONS, AND/OR REVISIONS WILL BE NOTED IN

BOLDED FONT ON THE REVISED RFQ PAGES INCLUDED AS PART OF THIS

ADDENDUM.

1. Can the agency clarify how many devices or systems or applications we need to support?

All F5CA’s resources are in a Microsoft GCC space including the full suite from Microsoft O365/Azure services. There are two Azure virtual machines running SQL and IIS, SharePoint based Intranet and File system, Teams Phone server, Entra, Azure Active Directory, 4 mobile devices, approximately 40 laptops.

F5CA’s physical infrastructure has been migrated to the cloud.

There are several custom-built in-house applications that are maintained by civil service IT staff. The contractor could be requested to assist in SQL, Azure VM, or IIS configuration/troubleshooting as needed.

2. How is the agency currently managing the IT Support Services?

IT Support Services are currently provided in a hybrid fashion with applications development, maintenance and support being handled by civil service staff and desktop, network, and security being handled by the existing contractor.

3. Are there any incumbent vendor on this project? If so, for how long they are supporting the agency?

F5CA has received similar services from Infinity Technologies since 2023.

4. How many resources are available to support the IT Support needs of the agency?

There are two civil service IT staff that have defined roles and responsibilities within the scope of IT operations. While the contractor and the civil service staff will communicate, coordinate, and consult with one another, the work is well separated.

5. Are the resources required to be onsite or remote? If onsite is required, mention the minimum hours of onsite support required?

A minimum of one resource is required onsite, at least once a week (anticipating Tuesdays), from 8 am – 5 pm. Additional onsite requirements would be scheduled in advance as needed.

6. Is the agency looking to hire staff to support these services or are you looking to hire a vendor who will do the end-to-end delivery management?

F5CA is looking to hire a contractor to continue the desktop, network and security support services that are currently being handled by contract staff. A specific staff member is assigned to our account so the contractor team member can gain an understanding of the work and needs for F5CA.

7. What was the spend for IT Technical and Support services in the year 2024?

The spend for the previous IT Technical and Support contract in Fiscal Year 2024-25 was $77,141.25 based on services provided during that time.

8. Referring to Key Action Dates (pg. 2), the term dates are 10/15/2025 through 10/13/2027, (24 months or 2 years). However, in Attachment C, Exhibit A Scope of Work, B. Period of Performance, 1. Term of Contract (pg. 13), the term is listed as 36 months (3 years). Which one is the correct expected agreement term?

Please refer to the Key Action Dates (pg. 2), as Attachment C, Exhibit A, Scope of Work is a proposed document.

9. Referring to Attachment C, Exhibit A Scope of Work, C. Work Location (pg. 14), based on the 25-30 hours per week requested, we assume the Service Level Agreement (SLA) would be NBD (Next Business Day) with the best-effort goal of same-day response whenever possible. What is the expected SLA for this engagement?

With the contractor being responsible for desktop, network, and security operations, we would expect service promptly and same day depending on severity of issue, impact of issue, and ease of resolution. Historically, the desktop issues are very straightforward and not overly complex.

10. Referring to Attachment C, Exhibit A Scope of Work, Task 1. Daily System/Network/Desktop Administration Duties, Section 1.1 (pg. 15-16), what is the estimated number of routers, switches, firewalls and/or wireless controllers that you currently have deployed?

F5CA has an ISP model connected to a Palto Alto PA820 Firewall, which connects to a chain of switches that provide connectivity to workstations and certain appliances or systems that may or may not be in the scope of this work.

(Building security, AV system etc. are maintained by the building)

1. Firewall

2. 3-5 passive switches

3. 3 wireless access points

4. Desktop/server computer used for config of the access points

11. Referring to Attachment C, Exhibit A Scope of Work, Task 1. Daily

System/Network/Desktop Administration Duties, Section 1.1 (pg. 15-16), what “cloud-based services” do you currently have and do you have any existing cloud infrastructure (AWS, Azure, GCP)?

All F5CA’s resources are in a Microsoft GCC space including the full suite from Microsoft O365/Azure services. There are two Azure virtual machines running SQL and IIS, SharePoint based Intranet and File system, Teams Phone server, Entra, Azure Active Directory, four mobile devices, approximately 40 laptops.

F5CA’s physical infrastructure has migrated to the cloud.

There are several custom-built in-house applications that are maintained by civil service IT staff. The contractor could be requested to assist in SQL, Azure VM, or IIS configuration/troubleshooting as needed.

12. Referring to Attachment C, Exhibit A Scope of Work, Task 1. Daily

System/Network/Desktop Administration Duties, Sections 1.11 & 1.12 (pg. 16), do you currently have any IT staff we would need to work with in addition to management oversight?

There are two civil service IT staff that the contractor would communicate, collaborate, and complete IT work alongside as applicable.

13. Does F5CA anticipate one primary resource covering the entire scope, or multiple specialized roles (e.g., system/network administrator, helpdesk, security)?

F5CA would expect one individual to serve as the primary contact with a team/chain of command at their disposal to escalate and resolve more complex technical issues.

14. How much of the work must be performed onsite in Sacramento versus remotely?

Refer to the response for Question No. 5 of this document.

15. Can you share the anticipated timeline and scope of the headquarters relocation project (e.g., planned move date, size of IT environment)?

The relocation is underway and is estimated to be completed by the end of September 2025.

16. What are the primary technology platforms in place today (e.g., operating systems, virtualization, cloud services, security/backup tools)?

Microsoft Azure Virtual Machines running Windows 2022 Server, SQL and IIS are on both machines. These machines are used as Dev and Prod for our custom in-house built and maintained applications.

Azure AD for all user and computer accounts, Microsoft SharePoint serves as the Intranet and File Storage, Entra, transition to Teams phones is underway.

The Azure servers are backed up by Azure. All user files and shares are on OneDrive/SharePoint now. They are also backed up by Spanning, which is a cloud-to-cloud backup.

17. Regarding security compliance, are there specific CDT controls or frameworks (NIST, ISO, FedRAMP) that must be followed, or is adherence to CDT’s general guidelines sufficient?

State security and privacy policies, and corresponding standards and procedures are accessible online in the State Administrative Manual (SAM), Chapter 5300, and NIST 800-53

18. For knowledge transfer to future civil service IT staff, what level of documentation and training is expected?

The level of documentation should be sufficient so that an incoming staff member could review the contractor-produced document and have a complete understanding of how the network is designed, how security is implemented, how data is stored and backed up. Any key system should be contained in the document with a description of what it does, what special accounts might be required, and how to view and configure the related settings.

http://sam.dgs.ca.gov/TOC/5300.aspx https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final

19. The RFQ references 25–30 hours per week. Will hours flex depending on workload (e.g., higher during relocation, lower during steady state)?

Relocation will be completed prior to the commencement of this contract. The hours are fairly consistent each week in terms of on-site requirements and what work may be required remotely. Of course, if special projects arise or large onsite events are held or managed by F5CA, there could be the need for additional hours. Unless an IT service emergency occurs, any out-of-band hours would be coordinated in advance.

20. Are travel and parking costs at F5CA HQ reimbursable, or should they be built into hourly rates?

Please refer to Best Value Determination (Sample), (pg. 9). Note: Parking is free at the F5CA office.

21. Are subcontractors allowed for specialized roles (e.g., IT security) if the prime vendor is

SB-certified?

F5CA requires a designated team member who handles most of the work with their skills and background. It is expected this individual will coordinate with other members in their team/chain of command to escalate and resolve more technical issues as needed.

22. Beyond weekly progress reports, are there other formal deliverables (e.g., relocation plan, IT documentation binders, disaster recovery test results) that we should include?

An online document folder should be maintained by the contractor that details the specifics of F5CA IT operations. The level of documentation should be sufficient so that an incoming staff member could use it to access IT systems, understand configuration settings, and be able to make modifications.

The IT contractor will have a role in preparing the IT Technology Recovery Plan required annually by CDT. This is a technical document that already exists and which requires updating as network/system/configuration changes occur.

23. Will contractor performance be evaluated against service levels (e.g., ticket resolution times, uptime), or only by completion of deliverables?

Contractor performance will be evaluated based on providing services and deliverables as agreed upon.

24. Can you clarify the evaluation weighting for “best value” (e.g., cost vs.

experience/qualifications)?

Please refer to Review of Quotes for Award (pg. 8).

25. For the optional interviews during the week of September 15, will they focus on the technical capabilities of proposed staff or on the overall approach?

Interviews will be conducted if the bid evaluators require additional information, so the focus will be dependent on what information is provided and if the evaluators identify gaps in what is needed.

26. Is there a current incumbent vendor providing these IT support services, and if so, will knowledge transfer from that vendor be part of the scope?

Refer to the response for Question No. 3 of this document and Attachment C, Exhibit A, Scope of Work (pg. 13).

27. Approximately how many users, devices, and servers are in scope for support under this contract?

• Two Azure VMs running Windows, SQL and IIS

• Approximately 32-45 Users

• Four Mobile phones, 1 multi-function copier, approximately 32-45 laptops

• Three Wireless Access Points

• Two to five passive switches

• One Palo Alto PA 820

• O365 Suite including SharePoint for file storage

28. Question: Number of users being supported by I.E. users, user endpoints, end users, number of servers, licenses (Office 365, Acrobat Pro, etc.)

Refer to the response for Question 27.

29. Provide the estimates of the number of: users, desktops, laptops, workstations, servers, licenses to manage and type.

Refer to the response for Question 27.