| Section |
Reviewer |
Page |
Date |
Original Comment |
Last Reply Author |
Last Reply Date |
Remediated |
Last Reply Text |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| Section Section 1 SYSTEM ARCHITECTURE AND
HOSTING OPERATIONS |
French, Shaun |
12 |
5/26/2025 23:37 |
Required: Does this align with your RPO? |
Liz Carrier |
5/30/2025 11:35 |
1 |
This document and the specific section is addressing IaaS
and Paas, it does not include the SQL DB that includes the data within the
D365 CRM. As this doc is focused on network, we do not think this applies to
the RPO to meet contractual requirement DR 20. Recovery Point Objective, refers to the
maximum amount of data loss an organization can tolerate in the event of a
disaster and this is met through the Azure backup process that is designed to
use 5 minutes incremental and 24 hour full backups. |
| Section Section 1 SYSTEM ARCHITECTURE AND
HOSTING OPERATIONS |
Klinger, Stephanie |
13 |
5/22/2025 13:06 |
Required: The deliverables for the FX Foundation
Release are identified with an a appended to the deliverable. Please correct. |
Patricka Coleman |
6/10/2025 22:10 |
1 |
Updated with correct appendix letter “a”. |
|
| Section Section 1 SYSTEM ARCHITECTURE AND
HOSTING OPERATIONS |
Klinger, Stephanie |
13 |
5/22/2025 13:11 |
Required: UOC-295 and UOC-160 both are IDs for
elaborated requirements. IV&V recommends updating this to reflect correct
user story ID and associated title. |
Patricka Coleman |
6/7/2025 19:38 |
1 |
User IDs updated |
|
| Section Section 2 MONITORING DAILY
OPERATIONS PERFORMANCE |
French, Shaun |
14 |
5/23/2025 7:55 |
Required: How are these made available to the
agency? And at what frequency? Or real time access to tools provided? |
Liz Carrier |
5/30/2025 11:53 |
1 |
These KPI’s are not part of the transfer to Splunk log data that is
required. This access is through the Azure Portal and then to Azure
Monitoring. Is this something that would need to be added into what we are
currently sending to EDW? Please advise. |
|
| Section Section 2 MONITORING DAILY
OPERATIONS PERFORMANCE |
French, Shaun |
15 |
5/23/2025 7:55 |
Deliverable Reviewers self-classify their comments
(Add type, listed below, as first word in comment, in both comment tracker
and Word documents):
Critical: The resolution of these comments, including clarifications, is
essential and must be completed to approve deliverable. Discussion with the
vendor is likely required to resolve. Required:
(Documentation/corrections/formats) The resolution of these comments,
including clarifications, is important and necessary to approve the
deliverable. Conditional approval to move forward - project tasks dependent
upon the approval on this artifact can commence. This artifact will be
eligible for payment upon final approval. Suggestion: The resolution of these
comments is not necessary for the approval of the deliverable.
Clarification: The resolution of this comment is dependent on discussion
between Deliverable Reviewer and vendor. Vendor to reach out to the
Deliverable Reviewer to discuss further PRIOR to remediation and
resubmission. Vendor to update comment(s) with discussion notes. |
Liz Carrier |
5/30/2025 11:59 |
0 |
N/A |
|
| Section Section 2 MONITORING DAILY
OPERATIONS PERFORMANCE |
French, Shaun |
15 |
5/23/2025 7:56 |
Required: How are these violations reported/delivered
to the Agency? |
Liz Carrier |
5/30/2025 12:15 |
1 |
I do not think this should have been in this document. The missing of
SLA’s is handled through Ops and Management. So if we miss an SLA, these
follow that established process. |
|
| Section Section 2 MONITORING DAILY
OPERATIONS PERFORMANCE |
French, Shaun |
22 |
5/23/2025 8:03 |
Required: I don’t see any detail on how you do
this, just that you will be looking for ways.
Would like a firmer plan here. |
Liz Carrier |
5/30/2025 12:48 |
1 |
UOC works with CoreTek (MSP) for monitoring. Bi-weekly meetings are
established to continue to look for ways to improve our processes including
monitoring, incident reporting, etc. |
|
| Section Section 2 MONITORING DAILY
OPERATIONS PERFORMANCE |
French, Shaun |
22 |
5/23/2025 8:03 |
Required: I don’t see any detail on how you do
this, just that you will be looking for ways.
Would like a firmer plan here. |
Liz Carrier |
5/30/2025 12:48 |
1 |
UOC works with CoreTek (MSP) for monitoring. Bi-weekly meetings are
established to continue to look for ways to improve our processes including
monitoring, incident reporting, etc. |
|
| Section Section 2 MONITORING DAILY
OPERATIONS PERFORMANCE |
Klinger, Stephanie |
22 |
5/22/2025 13:09 |
Required: According to JIRA, UOC-568 references
Requirement SEC-047. Please review and make any necessary corrections. In
addition, UOC-568 is not the user story, it is the ID for elaborated
requirement. |
Patricka Coleman |
6/7/2025 19:59 |
1 |
User story IDs updated |
|
| Section Section 3 OPERATIONS PROCEDURES |
French, Shaun |
23 |
5/23/2025 8:04 |
Required: This section describes an example of
how to do a backup, but not a description of the actual implemented
procedures. |
Liz Carrier |
5/30/2025 12:57 |
1 |
Azure backup is a scheduled process, but is included is Section 3.1.1 for
the VM backup. |
|
| Section Section 3 OPERATIONS PROCEDURES |
McDaniel, Dan |
24 |
5/21/2025 10:09 |
Query: This is Step 1 of a
procedure - I count three procedures in this
document arranged in this format.
There is an opportunity here.
Will UOC be compiling these separately with other operational
procedures across the products and processes within its responsibility? If so, could this be shared in the future
in that format? |
Michelle Newbold |
6/9/2025 11:06 |
1 |
6/9 Remediated with Dan. Nothing
was changed. |
|
| Section Section 3 OPERATIONS PROCEDURES |
French, Shaun |
28 |
5/23/2025 8:08 |
Required: Define periodic frequency. |
Liz Carrier |
5/30/2025 13:49 |
1 |
Complete. |
|
| Section Section 3 OPERATIONS PROCEDURES |
Klinger, Stephanie |
34 |
5/22/2025 13:13 |
Clarification: Is this requirement applicable
to Service Desk Release? If no, recommend updating this information to
indicate as such since this deliverable is being reviewed for the Service
Desk Release. |
Michelle Newbold |
6/6/2025 16:53 |
1 |
6/6- AI- if applicable to release A or B6/6. |
|
| Section Section 3 OPERATIONS PROCEDURES |
Klinger, Stephanie |
35 |
5/22/2025 13:13 |
Required: These user story IDs in exhibit 3-14
are incorrect and mismatched with the Story Title. IV&V recommends the
vendor review and update accordingly as they provided the IDs for elaborated
requirements. |
Michelle Newbold |
6/6/2025 16:54 |
1 |
6/6 Need to assign to team member who has access to JIRA. |
|
| Section Section 3 OPERATIONS PROCEDURES |
French, Shaun |
48 |
5/23/2025 8:10 |
Required: I’d like to see process around cert
management and not just the tool. For
example, how do you manage the process of ensuring certs are updated before
they expire and cause outages? |
Liz Carrier |
5/30/2025 14:04 |
1 |
The certificate is set for auto-renew and is the only certification UOC
is managing for the Solution. Exhibit 3-28 shows that auto renew setting. |
|
| Section Section 3 OPERATIONS PROCEDURES |
Bandari, Naveen |
48 |
5/23/2025 15:38 |
Recently there was production certificate
issue that occurred with D365. If possible please include response and
language for the below :What is the monitoring mechanism by UOC?
When do the certificates expire?
Does UOC have any kind of automated mechanism to receive remainders
/alerts? |
Michelle Newbold |
6/9/2025 10:19 |
1 |
6/9- Liz to add detail around D365 (MS certificate management process) |
|
| Section Section 4 ROUTINE MAINTENANCE |
French, Shaun |
50 |
5/23/2025 8:11 |
Required: Only daily? Is your RPO
24 hours? |
Liz Carrier |
5/30/2025 14:05 |
1 |
This document and the specific section is addressing IaaS
and Paas, it does not include the SQL DB that includes the data within the
D365 CRM. As this doc is focused on network, we do not think this applies to
the RPO to meet contractual requirement DR 20. Recovery Point Objective, refers to the
maximum amount of data loss an organization can tolerate in the event of a
disaster and this is met through the Azure backup process that is designed to
use 5 minutes incremental and 24 hour full backups. |
| Section Section 4 ROUTINE MAINTENANCE |
French, Shaun |
50 |
5/23/2025 8:12 |
Required: What are your patching procedures? How do you ensure patches are tested first
in lower environment? What facilities
are in place to perform rollbacks on failures? |
Liz Carrier |
5/30/2025 14:32 |
1 |
Yes all patches are released to the lower environments a week ahead of
production. CoreTek, our MSP, does most of these. And all environments are
restorable from an image to provide for rollbacks. |
|
| Section Section 4 ROUTINE MAINTENANCE |
Klinger, Stephanie |
53 |
5/22/2025 13:16 |
Required: These user story IDs in exhibit 4-6
are incorrect and mismatched with the Story Title. IV&V recommends the
vendor review and update accordingly as they provided the IDs for elaborated
requirements. |
Patricka Coleman |
6/7/2025 19:50 |
1 |
User story IDs updated. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| Count |
19 |
|
|
|
|
|
|
|
|
| Remediated |
18 |
94.74% |
|
|
|
|
|
|
|
| Not Remediated |
1 |
5.26% |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|