RFI: Disaster Recovery Site/Solution

Overview:

The Mission of the National Gallery of Art (NGA) is to serve the United States of America in a national role by preserving, collecting, exhibiting, and fostering the understanding of works of art, at the highest possible museum and scholarly standards.



Like other modern businesses, the Gallery uses information technology (IT) throughout the organization in the execution of its mission. Within this context, the role of the Technology Solutions division within the Office of the Treasurer (TTS) is responsible for the following: (1) analyzing technical requirements of the newly established or revised strategic initiatives and customer services; (2) conducting research to enable the rapid adoption of new architectures and emerging technologies to meet the approved requirements; (3) delivering innovative and highly-available enterprise IT infrastructure and business services; (4) managing NGA's enterprise IT assets, data center and scientific applications and collocation services; and (5) designing and implementing cyber security solutions. The Operations team within TTS (TTS-OPS) serves as the focal point for IT infrastructure needs and to maintain and secure the operational posture of the Gallery's enterprise and mission critical systems. TTS-OPS is the principal entity in managing the network, data center, and partnering with the Office of the Administrator and key Gallery stakeholders in providing telecommunication systems (telephones, mobile devices, voicemail, and voice radio) throughout the Gallery.

Operationally, every production system within the Gallery is designated to one of the four business continuity tiers. The tier categorization is determined based on the importance of the business function it supports and the tier categorization serves as a guide for the urgency and priority during restoration:

" Tier 1: Life/safety systems which are the most critical and must be operational 24 hours/day and 7 days/week to protect the staff, visitors and valuable works of art. If and when a service interruption is identified within this tier, TTS-OPS is responsible for and/or in coordination with the system's owner to restore the service immediately. Examples are: Access Control, Building Automation, Fire Alarm, Mass Notification, Key Management, and critical communications systems (e-mail, remote access, phones, and network).

" Tier 2: Enterprise and departmental systems that a significant number of Gallery staff use to perform their daily duties. Systems within this tier operate near 24 hours/day and 7 days/week to provide major back office, retail, financial and art management services. If and when a service interruption is identified within this tier, TTS-OPS is responsible for and/or in coordination with the system's owner to restore the service by the third business day or sooner if possible. Examples are: Retail Management, Collection Management, Financial Management, Contract Writing, and Digital Asset Management.

" Tier 3: Enterprise and departmental systems that are frequently accessed by Gallery staff, authorized external consortiums, corporate and academic entities, individual researchers and contributors, and patrons. If and when a service interruption is identified within this tier, TTS-OPS is responsible for and/or in coordination with the system's owner to restore the service within one week or sooner if possible.

" Tier 4: Systems that are available to Gallery staff, external users and patrons during Gallery's business/visiting hours. If and when a service interruption is identified within this tier, TTS-OPS is responsible for and/or in coordination with the system's owner to restore the service after systems in Tiers 1-3 are operational.

Presently, most, if not all, of our Tiers 2-4 systems are either hosted and managed by our hosting partner the Smithsonian Institute (SI) or reside at the application specific cloud service providers (example: FEDRAMP for ServiceNow, Microsoft's FEDRAMP Azure/Office 365, various vendor-provided hosting solutions). The systems that are hosted at SI are 95%+ all virtualized (180+ VMs) as depicted within the below two diagrams.



Requirement:

The Gallery has determined it is critical to have one or more disaster recovery sites to ensure business continuity should an event occur which causes a significant outage of one or more critical components of our IT environment. It further requires that a solution be found that is commensurate with our mission, restoration requirements, available budgets, and staff resources. Our immediate focus is to find a solution for the Tiers 2-4 systems. We envision that a second solution may be required for the Tier 1 systems, some of which run on a closed network, and will be seeking information for these systems at a later date but welcome recommendations for both if your solution can be adapted for Tier 1 systems.

Scope:

The goal of this RFI is to explore what is available in the marketplace to address Disaster Recovery (alternate site/solution) for Tiers 2-4 system and what methodology should be considered by NGA as we progress forward. We ask in your response for this Request for Information that you:

1. Provide NGA with a short write-up/whitepaper on how best to rapidly instantiate a highly-available, scalable and secure environment as a Disaster Recovery (DR) site for systems currently hosted at SI within a GovCloud or equally secure infrastructure environment. The intent is to have minimum implementation time, and seamless transfer of system and database resources from NGA to the GovCloud or equally secure environment if and when a disaster is declared.

2. Describe what methodology NGA should employ to perform the selection of systems to be supported as part of the DR solution, given not all systems require formal disaster recovery.

3. Provide information on contract vehicles that are available for your firm to use in responding to the future Request for Proposals.

4. Provide past examples where your firm has successfully deployed a DR capability supporting federal government or non-profit/cultural institutions that is similar in size and scope to the one that NGA is seeking.

Constraints:

" NGA requires that the recommended cloud environment satisfy the security requirements of the U. S. Federal Government and has a Federal Information Security Management Act (FISMA) Moderate Authorization and Accreditation or an equivalently secure environment.

" NGA is a small / independent agency with very limited IT staff; therefore, we are seeking for a solution that doesn't require any staff skill development investment, and has the minimum intervention on our part for the implementation and operation of this new DR capability.

Page Limit:

" White Paper: 8 pages total

" Past Examples: Two (2) examples of similar size and complexity; must be within the last two years

" Format: Contractor format

Technical Contact and Response Deadline:

E-mail responses by September 30, 2016 to Alex Wu, Manager, TTS Operations; a-wu@nga.gov.

Please provide contact information for your firm (name, position/title, e-mail, phone number) for possible follow-up communcation as the NGA continues with market research for this project.