Cloud Services RFP 2024

Request For Sealed Proposals By Union County For Information Technology Cloud Services

Download a copy of the RFP Here 

*Scroll down this page in order to see the latest RFP Q&A, Clarifications, and Corrections (last updated 10/4/24)

Union County is seeking written sealed proposals from qualified Cloud service providers for the following Information Technology services: VMWare-based or VMWare compatible virtual computing environment (physical hosts, disk storage, data center hosting, local network), backup/recovery services, network, security, system management, system monitoring, and disaster recovery services.

Complete proposal details and additional information is available online at https://www.unioncountyohio.gov/CloudServicesRFP2024 or upon request through Union County via email at bidresponse@unioncountyohio.gov.

Union County will evaluate and rank all conforming proposals.  The County may conduct discussions with offerors to ensure a full understanding of the proposal.  The County will enter into negotiations with the offeror who submits the proposal the County determines is the most advantageous to the County. The County may negotiate sequentially with more than one offeror.

Proposals must be received no later than 3:00 p.m. EST on October 18, 2024 at the Union County Commissioners Office, 233 West Sixth Street, Marysville, Ohio 43040.  The submitted proposal shall be clearly marked “Proposal for Cloud Services” on the front of the envelope or the top of the package that encloses the proposal documents.

All proposals will be opened at 3:00 p.m. EST on October 18, 2024 in the Union County Commissioners hearing room located at 233 West Sixth Street, Marysville, Ohio.  At that time, proposals will be opened publicly, logged, and the proposal company name and grand total read aloud. Respondents are not required to be present at the proposal opening. Each proposal must contain the full name of the party or parties submitting the proposal and all persons interested therein.

Union County reserves all rights under section 307.862(B)(10) of the Revised Code.  The County reserves the right to cancel or reissue the request for proposals if any of the following apply:  (1) the supplies or services offered through all of the proposals submitted are not in compliance with the requirements, specifications, and terms and conditions in the Request for Proposals; (2) the prices submitted are excessive compared to existing market conditions or exceed the available funds of the County; or (3) the County determines that award of a contract would not be in the best interest of the County.


RFP Q&A, Clarifications, and Corrections Section

1. Is there a cloud preference or a cloud provider that the county is already using?
A: The County is currently using Dartpoints Dublin, Ohio data center (https://dartpoints.com/locations/ohio2/) to host (IaaS) a significant portion of our server environment. We do not have a preferred cloud provider and seek proposed cloud provider solutions from qualified respondents.

2. Is the county expecting to own the cloud hosting, or does it want the service provider to host it and include the price?
A:  The County seeks IaaS pricing as well as several additional services pricing as detailed in the RFP. The County does not wish to own its cloud hosting.

3. Will the service provider reuse the ITSM process and tool currently used by the county? If so, what is the ITSM tool in use?
A:  No, the County is willing to utilize the respondent’s proposed ITSM model/tool. 

4. Should the service provider recommend or use the SLAs and processes already in place at the county? Please provide more details if the county's processes need to be used.
A:  Section 5 of the RFP contains the minimum SLA terms the County expects respondent proposals to meet or exceed. 

5. What monitoring is currently in place, and what tool is used for it?
A:  The County currently uses VMWare Cloud Director Tenant Portal provided by Dartpoints to manage and monitor the County’s server environment. Additionally, Dartpoints support provides a certain level of 24x7 server environment monitoring. We would be pleased to receive proposals that include access to additional server monitoring tools, such as performance, to enhance our monitoring capabilities.

6. What is the BaaS tool and process currently in use?
A:  Dartpoints BaaS service utilizes Veeam. 

7. What is the current DR location, and how frequently does a DR situation occur?
A:  Dartpoints Cincinnati, OH data center. Thankfully, during the three plus years that the County has procured Cloud related services with Dartpoints, we have not incurred a DR incident requiring a server restoration. 

8. What is the process and tool used for current DRaaS?
A:  Darpoints utilizes the Zert0 DR solution.

9. Should we consider a 3-year or 5-year period for managed services post-migration?
A:  The County would be pleased to receive both 3 year and 5 year proposal pricing particularly if the 5 year proposal were to include a greater pricing discount due to the longer term commitment. 

10. As the database used is MS SQL, will the county have its DBA supporting and managing the databases on the new hosting target, or should we include this role in our solution? This is for migration support, ongoing administration, and DR (assuming database-level replication is used for DR purposes).
A:  The County IT staff will be managing the MS SQL databases. We would need to utilize the proposer’s MS SQL expertise only during setup of MS SQL DR at the database level.
 
 11. What tools are currently used in the environment?
A:  We currently outsource our network/firewall device management and support with an IT consulting group, Aunalytics. They possess tools to monitor our County network environment. Our network environment is primarily Cisco.

a. Who owns them?
A:  Aunalytics primarily owns tools used to monitor our network environment. We also utilize Cisco Umbrella licensing which is county owned.

b. What is the current network authentication authority tool used? Who owns that?
A:  We use Microsoft Server AD authentication and Microsoft user account management environment which the County IT manages.
 
 12. How many locations are currently being supported?
A:  The County IT has dedicated fiber and with the assistance of Aunalytics, supports Layer 2 LAN connections to 8 County buildings within the city of Marysville. 

a. Any current or future projects for expansion or reduction?
A:  No

13. Is there a wireless infrastructure today that supports/owns that hardware?
A:  The County possesses 40+ Meraki WiFi APs configured throughout it’s 8 county buildings.

a. Is that centrally managed or disbursed by location?
A:  Centrally managed via Meraki’s management web portal and a Radius Server.

14. Can we see a list of network inventory?
A:  For the purposes of this RFP, we do not believe this information is necessary in order to provide an adequate proposal. The selected respondent will be provided our network device inventory.

a. Who manages the inventory
A:  Aunalytics and County IT.

i. Is it accurate?
A:  Yes

b. If not, please provide us with a baseline total number of firewalls, routers, switches, and wireless access points in the environment today.

c. Do you currently maintain a backstock of inventory for hot swap spares?
A:  Yes, for certain core network devices.

i. Is that at each location or for specific sites?
A:  The backstock of inventory is usable across all county buildings on our primary LAN. 

15. Who manages the circuits and the procurement of them?
A: County IT.

16. Can you provide access to the current HLD and LLD network infrastructure diagrams?
A:  Yes, this information will be made available to the selected respondent.

17. Do you have any current or future projects that will change the network infrastructure?
A:  No.

18. Are you currently capturing/monitoring Netflow traffic?
A:  No.

19. Who is currently responsible for network equipment’s patching/firmware updates?
A:  IT consultant group Aunalytics.

20. Are you currently utilizing a ZTNA approach? (Zero Trust Networking Access)
A:  No

21. Are you currently maintaining an up-to-date knowledge base about the environment?
A:  Yes

a. If so, who currently manages that knowledge base?
A:  County IT and Aunalytics maintain a network knowledge base.

b. Can you provide the total number of network incidents and change requests submitted in the last 6-12 months?
A:  No.

22. What brands and types of backup hardware are currently in use?
A:  We rely on Dartpoints to supply appropriate BaaS hardware that meets our SLA needs. For backup of on premises servers, we utilize several Buffalo NAS devices.

23. How many sites are part of the backup scope with local backup infrastructure?
A:  4 buildings.
      a) Are they on-premises or cloud-based?
A: mixed = on premises and cloud hosted.

24. What brands, types, and versions of backup software are in use?
A:  Veem.

25. What is the primary purpose of the backup? Is it for disaster recovery, long-term data retention, local operational restores, etc.?
A:  Disaster recovery and local operational restores.

26. What types of issues are you currently experiencing with your backup environment (e.g., aged equipment, lack of resources)?
A:  Outgrowing storage resources and would like improved restore/recovery capabilities. 

27. What aspects of your backup environment are currently working well? What is your current backup success rate?
A:  We are outgrowing our on premises backup licensing so we are looking for a more reasonable cost long term backup solution for our data files.

28. What types of backup-related service level agreements (SLAs) or service level objectives (SLOs) currently exist or are desired?
A: At a minimum, once per 24 hour period backups available to be restored.

29. Should some sort of annual growth be included, or would growth be addressed organically as it occurs?
A: No.

30. Has a business impact analysis been performed for your application environment?
A:  No.

31. Do you have a DR plan document or a document that outlines how to perform recovery activities for the in-scope applications?
A: Yes.

32. Are you currently performing tests on the environment, and if so, have the tests been successful?

A: Yes.

33. How is your storage presented to systems? (for example, fiber, iSCSI, NFS)?
A:  Storage is added as a part of the server environment, configured as available “drives” on the servers directly. 

34. What is the make and model of the SAN storage?
A: Dartpoints provides this hardware.

35. High-level disk configuration information is needed (storage capacity, drive size and speed, amount of cache, number of ports, etc.):
A:  This information will be made available to the selected respondent.

36. What is the current replication method being used?
A: Zert0 managed DR.

37. What is the amount of data to be protected?
A: 19,120GB

38. Is the data's volatility (rate of change) being protected?
A:  Yes, via Zert0’s default high availability settings.

39. What is the estimated yearly rate of growth?
A:  between 5-10% annually. 

40. Is any storage virtualization being done?
A:  Unsure.

41. Do you have the same storage setup at both the primary and secondary sites?
A:  Yes.

42. Are you currently using any load balancing?
A:  No.

43. Will data encryption be needed across the WAN (replication circuit)?
A:  Yes.

44. What is the estimated bandwidth for data replication?
A:  Unknown

45. How much internet bandwidth is required for user access?
A:  1Gbit

46. Will VPN access be required?
A:  Yes.

47. Types of databases and their versions (for example, Oracle Standard or Enterprise, and the version)
A:  Microsoft SQL Server Standard Edition: v2016, v2019, v2022.

48. Number of databases
A: 75

49. Number of instances per database
A:  1

50. What is the current replication strategy between primary and secondary sites (for example, Data Guard, data log transfer, mirroring, etc.)?
A:  Uses Zert0.

51. How often is the data replicated?
A:  Hourly or less.

52. What is the storage size of the database?
A:  Unknown.

53. How is the change process managed between the primary and secondary sites?
A:  As far as removing servers (or adding/removing resources from the hosted environment), the County works with Dartpoints support to remove them from the production environment and DR environment. 

54. What is the expected contract duration?
 A:  The County did not specify an agreement term length but anticipates receiving proposals offering multi-year agreement terms. We expect that we will likely receive proposals offering 3 or 3+ year terms.

55. Is it possible to include higher RPO (Recovery Point Objective) and RTO (Recovery Time Objective) than those initially requested? Our standard is 4 hours.
 A:  The County will consider proposals which include lengthier RPO and RTO but proposal scoring for this area will favor proposals that meet or exceed the terms listed in our RFP.

56. Could you provide detailed information on the necessary connectivity requirements and the required bandwidth for internet access in both Production and Disaster Recovery (DR) environments?
 A:  The County’s current hosted server environment at Dartpoints data center, benefitting from a State of Ohio smart mobility project, utilizes dedicated fiber strands between the County main campus in Marysville and Dartpoints data center in Dublin, OH.  We are unsure of the minimum Internet bandwidth needed but would estimate between 1Gbit to 5Gbit Internet for the production environment and 1Gbit Internet for the DR environment but are looking to respondents, based on their experience, to recommend appropriate bandwidth based on our organization and server environment size listed in the RFP.

57. What is the address that the production and DR site would need to connect to?
 A:  Union County Main St building, 128 South Main St, Marysville, OH 43040.

58. Is there a specific location preference for hosting the requested workloads? We can provide Ashburn, Dallas and Chicago.
 A:  The County has no preference, we would discuss production and DR environment location options with the selected respondent. 

59. Can potential presentations or interviews be conducted remotely?
 A:  Yes.

60. Is the county using any Public Cloud Providers today?
 A: No.

61. Would the county consider a two-week extension?
 A: No.

62. Can responses be submitted digitally?
 A: The County is requiring both a hard copy and digital submission.

63. Can you please provide us with a baseline total number of firewalls, routers, switches, and wireless access points in the environment today?
A:  3 Firewalls, 20 layer 3 Routers, 41 layer 2 Switches, 40+ WAPs

64. CJIS compliance requirements?
 A:  Please visit these links for documentation regarding these requirements:

CJIS Resources:

a. https://le.fbi.gov/cjis-division/cjis-security-policy-resource-center

b. https://le.fbi.gov/cjis-division/cjis-security-policy-resourcecenter/cjis_security_policy_v5-9-5_20240709.pdf

65. Linux OS details?
 A: Ubuntu Linux (64-bit), 2.6.x Linux (64-bit), Red Hat Enterprise Linux 6 (64-bit).

66. Are there any VMs or applications with requirements to remain on a specific version of VMware?
 A:  No.

67. What is the current network bandwidth allocated for data transfer between the County’s on-premise infrastructure and Dartpoints? Additionally, what bandwidth capacity will be available during the migration?
A:  10Gbit; 1Gbit Internet.

68. Do existing disaster recovery plans include runbooks and test plans, or should the creation of these documents be incorporated into our services.
 A:  Disaster recovery plans and runbooks do exist, but these are incomplete.

69. Will DR involve rerouting of public IPs?
 A:  Yes.

70.  Does the County own a public IP range? If not, please specify the number of public IPs required for disaster recovery scenarios.
 A:  No, we lease them. 10.

71. Are there any specific firewall or network security policies that need to be maintained for traffic flowing between the cloud environment and County sites? 

  1. If so, which need to be replicated to the DR network?

A:  Yes. We will work with the selected vendor at the appropriate stage in the migration and setup process to determine security policies to be replicated.

72. Does the County’s network configuration require support for any specific protocols or ports for applications in scope?
 A:  Yes, depending on the permission level provided to the County IT staff or configuration of County IT staff accounts for managing the hosted server environment, we may need to work with the vendor’s support staff in order to temporarily remove and re-add web servers into the DMZ for OS and other updates or port changes if new applications are added that have specific port requirements.

73. Could you provide a diagram or describe the County’s current WAN architecture, including any MPLS, VPN, or SD-WAN connections currently in use?
 A:  Union County utilizes dual Sophos XGS firewalls, HA configured, and configured for VPN.