# MODIFIABLE REQUEST FOR PROPOSALS (RFP) TEMPLATE
## Project Title: Adobe ColdFusion, Classic ASP & VB6 Migration to Oracle APEX 24.2
- **RFP Document Reference**: `VNA-RFP-005` (Companion to Solution Brief `VNA-SB-005`)
- **Issuing Organization**: `[INSERT ORGANIZATION / COMPANY NAME]`
- **Issue Date**: `[2026-10-27]`
- **Proposal Due Date**: `[INSERT DATE, e.g., +30 Calendar Days]`
- **Reference Architecture Portal**: https://coldfusion-to-oracle-apex.web.app/
- **Template Attribution**: This site is designed by Viscosity.AI

---

## SECTION 1: ISSUING ORGANIZATION PROFILE & PROCUREMENT SCHEDULE (MODIFIABLE)

> **Instructions for RFP Author**: Replace all bracketed placeholders (`[...]`) below with your organization's specific dates, contacts, and environment metrics before issuing to prospective bidders.

| Procurement Milestone | Target Date / Entry (Modifiable) |
|---|---|
| Issuing Organization Name | `[Insert Legal Entity Name]` |
| Primary Procurement / Technical Contact | `[Insert Name, Title, Email]` |
| RFP Issue Date | `[2026-10-27]` |
| Vendor Written Questions Due | `[Insert Date - Week 2]` |
| Organization Responses to Vendor Q&A | `[Insert Date - Week 3]` |
| Final Vendor Proposals & Pricing Due | `[Insert Date - Week 4]` |
| Technical Architecture Demos / Oral Presentations | `[Insert Date - Week 5]` |
| Target Contract Award & Phase 0 Kickoff | `[Insert Date - Week 6]` |

### 1.1 Executive Summary & Business Objectives
`[INSERT COMPANY NAME]` ("Organization") is soliciting competitive proposals from qualified enterprise architecture and engineering firms to modernize and transition our current **Adobe ColdFusion (.cfm, .cfc), Classic ASP (.asp), VB6 & PHP** environment to **Oracle APEX 24.2, ORDS REST APIs, PL/SQL & Autonomous Database**.

Our primary business and technical objectives are:
- ColdFusion (`<cfquery>`, `<cfoutput>`, `<cfcomponent>`) and Classic ASP (VBScript ADO recordsets) mix raw SQL strings, HTML table rendering, and session state inside thousands of loosely coupled `.cfm` and `.asp` files.
- Security teams flag ColdFusion and legacy IIS servers continuously for remote code execution CVEs and unparameterized SQL concatenation.
- Rewriting data-heavy ColdFusion or VB6 apps into sprawling microservices takes years because 80% of the application is simply querying, filtering, validating, and updating relational database tables.

---

## SECTION 2: CURRENT ENVIRONMENT BASELINE INVENTORY (MODIFIABLE)

Bidders must size their technical delivery plan and fixed-fee milestone pricing against the baseline inventory table below:

| Inventory Dimension | Current Baseline Count / Footprint (Modifiable) | Target Modernization SLA / Objective |
|---|---|---|
| Legacy Source Stack (`Stack X`) | Adobe ColdFusion (.cfm, .cfc), Classic ASP (.asp), VB6 & PHP | Full retirement / modernization |
| Target Architecture (`Stack Y`) | Oracle APEX 24.2, ORDS REST APIs, PL/SQL & Autonomous Database | Production-grade HA/DR & security |
| ColdFusion / ASP / VB6 Screens | `[Insert Count, e.g., 160 templates]` | 100% functional parity & optimization |
| Embedded CFQUERY / ADO Report Queries | `[Insert Count, e.g., 480 queries]` | Automated AST & schema uplift |
| Query Fan-Out Rationalization (Cloned CFQUERYs -> Core SQL + Runtime Filters) | `[Insert Count, e.g., 78 % fan-out reduction]` | `[Target Rationalization / SLA]` |
| Target Cutover Downtime Window | `[e.g., < 15 Minutes / Near-Zero Downtime]` | Rehearsed parallel run + rollback plan |
| Security, Compliance & Identity | `[e.g., SSO/MFA via Entra ID / Okta, Row-Level VPD, Audit Logs]` | Zero critical/high CVEs at Go-Live |

---

## SECTION 3: MANDATORY TECHNICAL SCOPE OF WORK & DELIVERABLES (MODIFIABLE)

The selected partner shall execute the project across four gated phases (**Phase 0: AST Discovery & Architecture Blueprint**, **Phase 1: Core Foundation & Data/Code Conversion**, **Phase 2: Integration, Runtime Filtering & UAT**, and **Phase 3: Parallel Run, Cutover & Hypercare**).

### 3.1 Core Architectural Requirements
1. **[MODIFIABLE REQUIREMENT 1]**: Automated CFM/CFC/ASP Tag & Query Harvester: Our parser scans your `.cfm`, `.cfc`, `.asp`, and `.frm`/`.bas` source tree, extracting every `<cfquery>` / ADO SQL block, form post target, session variable, and scheduled job.
2. **[MODIFIABLE REQUIREMENT 2]**: SQL Hardening & PL/SQL Package Consolidation: Inline SQL queries scattered across `.cfm` pages are parameterized with strict bind variables and consolidated into compiled Oracle PL/SQL packages inside the database.
3. **[MODIFIABLE REQUIREMENT 3]**: Declarative APEX 24.2 UI Generation: Multi-hundred-line ColdFusion HTML tables and form post handlers are replaced by declarative APEX Interactive Reports, Interactive Grids, and Modal Forms backed by Universal Theme 42.
4. **[MODIFIABLE REQUIREMENT 4]**: Enterprise Identity & Scheduled Job Migration: Legacy ColdFusion `Application.cfc` session management and CFAdmin scheduled tasks are migrated to Viscosity AMP (SAML/OIDC SSO) and `DBMS_SCHEDULER` / APEX Automations.
5. **[MODIFIABLE REQUIREMENT 5]**: Query Fan-Out Rationalization & Runtime/Inference Filtering: Instead of migrating cloned reports and DataWindows 1-for-1, our AST SQL parser clusters queries by their canonical core JOIN graph, builds governed Oracle 23ai views only for those core queries, and generates dynamic WHERE clauses, faceted filters, and ad-hoc report variations at runtime and via AI inference (APEX 24.2 Smart Filters & Select AI).

### 3.2 Component-Level Conversion & Deliverable Matrix
Bidders must confirm compliance with each component conversion requirement below:

| Req ID | Legacy Artifact / Baseline Workload | Required Target Architecture | Engineering Method & Acceptance Criteria | Priority (Modifiable) |
|---|---|---|---|---|
| REQ-01 | ColdFusion `<cfquery>` / Classic ASP ADO SQL | Parameterized PL/SQL Packages & APEX Region Sources | Automated SQL Extraction + Bind Variable Hardening | `[Mandatory / Optional]` |
| REQ-02 | ColdFusion `<cfform>` / `<cfgrid>` / HTML Tables | APEX 24.2 Form Regions & Interactive Grids | Declarative Component Replacement | `[Mandatory / Optional]` |
| REQ-03 | ColdFusion Components (`.cfc`) & SOAP Web Services | PL/SQL Packages + ORDS AutoREST / OpenAPI 3.1 | RESTful Endpoint Modernization | `[Mandatory / Optional]` |
| REQ-04 | ColdFusion `<cfdocument format="PDF">` | APEX Native PDF Printing / APEX Office Print (AOP) | Server-Side Report Template Conversion | `[Mandatory / Optional]` |
| REQ-05 | CFAdmin Scheduled Tasks / Windows Task Scheduler | Oracle APEX Automations & `DBMS_SCHEDULER` | Database-Native Job Orchestration | `[Mandatory / Optional]` |
| REQ-06 | Cloned Reports / Queries Differing Only by WHERE Clause or Group-By (Query Fan-Out) | Canonical Core SQL View + APEX 24.2 Runtime / AI Inference Filters | AST Join-Graph Clustering (75-90% Report Count Reduction) | `[Mandatory / Optional]` |

### 3.3 Mandatory Platform & Tooling Standards
- Oracle APEX 24.2 (Automations, Native PDF Printing, REST Data Sources)
- Oracle REST Data Services (ORDS) for replacing `.cfc` web services
- Viscosity AMP for centralized authentication, role management, and audit trails
- Oracle SQLcl Liquibase for version control and automated deployment

---

## SECTION 4: VENDOR TECHNICAL Q&A QUESTIONNAIRE & SCORING RUBRIC

Bidders must provide direct, concise written responses to each question below. The Issuing Organization's evaluation committee will grade responses using the embedded benchmark criteria.

### Vendor Question 1: Why convert ColdFusion to Oracle APEX instead of React or .NET?
- **Bidder Response Requirement**: Provide a concrete architectural explanation, reference toolset, and verifiable production proof. Generic marketing statements will be scored zero.
- **Evaluation Benchmark (What High-Scoring Responses Must Demonstrate)**: ColdFusion was originally designed as a tag-based database-to-HTML rapid development tool. Oracle APEX operates on the exact same data-centric paradigm but runs natively inside the Oracle Database with modern security, responsive UI, and zero middle-tier servers to patch.
- **Evaluator Score (0 to 10 Points)**: `[   / 10 ]`

### Vendor Question 2: What if our ColdFusion app connects to SQL Server or MySQL?
- **Bidder Response Requirement**: Provide a concrete architectural explanation, reference toolset, and verifiable production proof. Generic marketing statements will be scored zero.
- **Evaluation Benchmark (What High-Scoring Responses Must Demonstrate)**: We migrate the underlying schema to Oracle Database 23ai / Autonomous Database (or connect APEX to external databases via REST Data Sources / Database Links) as part of the same turnkey sprint.
- **Evaluator Score (0 to 10 Points)**: `[   / 10 ]`

### Vendor Question 3: What is included in the downloadable PDF Solution Brief?
- **Bidder Response Requirement**: Provide a concrete architectural explanation, reference toolset, and verifiable production proof. Generic marketing statements will be scored zero.
- **Evaluation Benchmark (What High-Scoring Responses Must Demonstrate)**: The PDF Solution Brief provides the complete ColdFusion/ASP-to-APEX tag mapping reference, security hardening checklist (OWASP Top 10 compliance in APEX), and a TCO calculator.
- **Evaluator Score (0 to 10 Points)**: `[   / 10 ]`

### Vendor Question 4: How do you prevent report and query fan-out bloat, and how do you guarantee zero vendor lock-in?
- **Bidder Response Requirement**: Detail your methodology for clustering redundant legacy queries/reports into canonical core SQL views with runtime or AI-inference filtering, and specify customer code/data ownership upon project completion.
- **Evaluation Benchmark (What High-Scoring Responses Must Demonstrate)**: Bidder must demonstrate deterministic AST SQL clustering (collapsing 75%-90% of cloned reports into core database views with runtime predicates), 100% customer ownership of all DDL, PL/SQL, application source code, and Terraform scripts, and zero proprietary runtime lock-in.
- **Evaluator Score (0 to 10 Points)**: `[   / 10 ]`

### Vendor Question 5: Describe your automated regression testing, parallel run, and zero-downtime cutover methodology.
- **Bidder Response Requirement**: Specify how data parity, business-rule equivalence, and rollback safety are verified prior to production cutover.
- **Evaluation Benchmark (What High-Scoring Responses Must Demonstrate)**: Bidder must provide automated row-count and cryptographic hash reconciliation, automated unit/UI test suites (e.g., utPLSQL, Playwright), and a rehearsed cutover runbook with sub-minute rollback capability.
- **Evaluator Score (0 to 10 Points)**: `[   / 10 ]`

---

## SECTION 5: COMMERCIAL PRICING & LICENSING MATRIX (MODIFIABLE)

Bidders must complete the fixed-price milestone table below and disclose all recurring software or cloud consumption assumptions.

| Milestone / Cost Category | Deliverable & Acceptance Gate | Fixed Fee / Annual Cost (USD) | Estimated Duration (Weeks) |
|---|---|---|---|
| **Phase 0: Discovery & AST Code/Schema X-Ray** | Verified inventory, dead-code manifest, core SQL fan-out map, and final blueprint | `$[Insert]` | `[2 - 3 Weeks]` |
| **Phase 1: Target Environment & Automated Uplift** | Provisioned target stack, schema migration, and core business logic conversion | `$[Insert]` | `[4 - 8 Weeks]` |
| **Phase 2: UI, Integrations, Reporting & UAT** | Completed application/portal screens, runtime reports, AOP templates, and UAT sign-off | `$[Insert]` | `[3 - 6 Weeks]` |
| **Phase 3: Production Cutover & Hypercare** | Rehearsed cutover, reconciliation sign-off, documentation, and 30-day hypercare | `$[Insert]` | `[2 - 3 Weeks]` |
| **Optional: Annual Managed Services / Support** | 24x7 monitoring, patching, DBA performance tuning, and quarterly enhancements | `$[Insert / yr]` | `[12 Months]` |

---

## SECTION 6: PROPOSAL EVALUATION SCORECARD (MODIFIABLE)

| Evaluation Criterion | Weight (%) | Description |
|---|---|---|
| **1. Technical Architecture & Automation Tooling** | `35%` | Depth of AST automation, query fan-out rationalization, database/cloud architecture, and zero lock-in. |
| **2. Verifiable Production Experience & References** | `25%` | Proven track record delivering identical `ColdFusion & Classic ASP to Oracle APEX` engagements with measurable outcomes. |
| **3. Cutover Safety, Testing & Compliance** | `20%` | Rigor of data reconciliation, automated regression testing, security/compliance controls, and rollback safety. |
| **4. Commercial Value & Total Cost of Ownership (TCO)** | `20%` | Transparent fixed-fee milestone pricing and 3-to-5 year software/cloud licensing savings. |
| **TOTAL** | **`100%`** | |

---
*Template Reference: `VNA-RFP-005` | Companion Portal: https://coldfusion-to-oracle-apex.web.app/ | This site is designed by Viscosity.AI*