07._Exhibit B_Solution Requirements.xlsx
XLSX spreadsheet 71 KB Posted
- Attached to
- Short-Term Lending Database
- Solicitation number
- RFP-130477
- Issued by
- Richmond City, Roanoke City, Virginia
About this file
This is Exhibit B: Solution Requirements for RFP SCC-26-018-BFI, a short-term lending database procurement issued by the Virginia State Corporation Commission's Bureau of Financial Institutions. The RFP solicits proposals for an Internet-accessible, real-time database solution to serve Virginia short-term lending licensees and state regulatory users, with proposals due November 20, 2026. The exhibit comprises five tabs outlining detailed solution requirements across functional, technical, implementation, and security categories. Offerors must complete the exhibit by selecting one of five response options for each functional and technical requirement (Base Product, Configuration, Customization, 3rd Party App/Tool, or Cannot Meet) and one of two options for implementation and security requirements (Can Meet or Cannot Meet). Requirements span eligibility verification and query engine capabilities, loan data capture and storage from licensees, comprehensive reporting and analytics functions, user management with role-based access controls, disaster recovery and business continuity planning, and operations and maintenance support throughout the contract term.
The exhibit does not specify pricing terms, contract duration, or renewal options. Requirements address secure data transmission using TLS 1.3 or higher encryption, system hardening aligned with CIS Benchmarks, role-based access controls with least-privilege enforcement, comprehensive audit logging with real-time monitoring, encryption of data at rest using industry-standard algorithms, multi-factor authentication for administrative actions, annual independent security assessments (SOC Type II or ISO 27001 certification equivalent), incident response procedures with defined notification windows, vendor personnel screening, regular vulnerability scanning and penetration testing, secure data disposal across production systems and backups, and alternative secure access methods during primary system outages. The supplier must provide weekly status reports, detailed project schedules with critical milestones within 60 days of contract start, training plans tailored to five user groups, disaster recovery and business continuity plans updated annually with test exercise reports, and transition-out documentation. No incumbent information, set-asides, or specific funding amounts are identified in this requirements exhibit.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 08._Exhibit C_Solution Description.docx | DOCX document | |
| 04._Appendix C_SCC Form.docx | DOCX document | |
| 01._RFP Solicitation.pdf | ||
| 00._RFP Cover Page.docx | DOCX document | |
| 06._Exhibit A _Services Agreement.docx | DOCX document | |
| 02. _Appendix A_Offeror Profile.docx | DOCX document | |
| 03._Appendix B_Proprietary Info Form.docx | DOCX document | |
| 05._Appendix D_Proposed Changes.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Cover Page
RFP SCC-26-018-BFI: Short-Term Loan Database
Exhibit B: Solution Requirements
< Insert Offeror Name >
&"Calibri"&10 &K000000#Confidential_x000D_&1#&"Calibri"&10&K000000 Confidential
1. Instructions
| RFP SCC-26-018-BFI: Short-Term Lending Database | |
| Exhibit B: Solution Requirements - Instructions | |
| Overview of Exhibit B - Solution Requirements (Reqs) | |
| Exhibit B - Solution Requirements includes a total of five tabs: | |
| Tab 1 - Instructions: provides general and detailed instructions for completing Exhibit B: Solution Requirements. | |
| Tab 2 - Reqs Category Descriptions: provides brief descriptions for the major categories of solution requirements. | |
| Tab 3 - Functional & Technical Reqs: captures how Offeror's proposed solution satisfies each requirement. | |
| Tab 4 - Implementation Reqs: captures how Offeror's proposed solution satisfies each requirement. | |
| Tab 5 - Security Reqs: captures how Offeror's proposed solution satisfies each requirement. | |
| Tab 1 - General Instructions | |
| # | Instructions |
| 1 | Offeror must complete and submit Exhibit B with their response to this RFP. |
| 2 | Tabs 1 and 2 of Exhibit B are for informational purposes only; Offeror response is not required. |
| 3 | Do not alter the structure, formatting, and content of Exhibit B in any way when entering data. |
| 4 | Do not lock or otherwise make inaccessible to the SCC any data and information entered by Offeror. |
| Tab 2 - Reqs Category Descriptions | |
| # | Instructions |
| 1 | Offeror should review the requirements category descriptions to aid in understanding the SCC's needs and requirements for the solution. |
| Tab 3 - Functional & Technical Reqs | |
| # | Instructions |
| 1 | Offeror must enter a response for each individual requirement to indicate how the proposed solution will satisfy each requirement. Offeror must select only one of the following options (provided in columns E-I) for each requirement and place an 'X' in the appropriate cell of the worksheet: |
| 1a | Base Product - indicates the requirement can be met "out of the box" by the base product of the solution. May include configuration by the user within the application. |
| 1b | Configuration - indicates the requirement can be met by the solution but requires configuration of one or more elements of the solution that must be performed by a technical resource (either a resource provided by Supplier, or an SCC resource trained by Supplier). Changes or additions to the solution's base code is not considered "configuration." |
| 1c | Customization - indicates that changes or additions to the solution's base code are necessary to satisfy the requirement. |
| 1d | 3rd Party App/Tool - indicates that an application or tool provided by a third party is necessary to satisfy the requirement. |
| 1e | Cannot Meet - indicates the requirement cannot be met through one of the other four options. |
| 2 | Indicate in column J where the requirement is referenced and described in Offeror's proposal, if applicable. |
| 3 | If Offeror does not provide a response for a requirement, it will be designated as "Cannot Meet" by the SCC. |
| 4 | Offeror should not enter additional information in Exhibit B, such as descriptions, elaborations, exceptions, conditions, or limitations. All additional information pertaining to a solution requirement should be provided in Exhibit C: Solution Description. |
| 5 | Offeror should not edit requirements language in Exhibit B. Any proposed changes to requirements by Offeror should be captured in the appropriate form provided in Appendix D: Proposed Changes. |
| Tab 4 / 5 - Implementation Reqs / Security Requirements | |
| # | Instructions |
| 1 | Offeror must enter a response for each individual requirement to indicate how the proposed solution will satisfy each requirement. Offeror must select only one of the following options (provided in columns E-F) for each requirement and place an 'X' in the appropriate cell of the worksheet: |
| 1a | Can Meet - indicates the requirement can be met by Offeror. |
| 1b | Cannot Meet - indicates the requirement cannot be met by Offeror. |
| 2 | Indicate in column G where the requirement is referenced and described in Offeror's proposal, if applicable. |
| 3 | If Offeror does not provide a response for a requirement, it will be designated as "Cannot Meet" by the SCC. |
| 4 | Offeror should not enter additional information in Exhibit B, such as descriptions, elaborations, exceptions, conditions, or limitations. All additional information pertaining to a solution requirement should be provided in Exhibit C: Solution Description or other relevant section of Offeror's proposal. |
| 5 | Offeror should not edit requirements language in Exhibit B. Any proposed changes to requirements by Offeror should be captured in the appropriate form provided in Appendix D: Proposed Changes. |
&"Calibri"&10 &K000000#Confidential_x000D_&1#&"Calibri"&10&K000000 Confidential
2. Reqs Category Descriptions
| RFP SCC-26-018-BFI: Short-Term Lending Database |
| Exhibit B: Solution Requirements - Requirement Category Descriptions |
| Requirement Category | Description |
| FUNTIONAL & TECHNICAL REQUIREMENTS | |
| Eligibility Verification & Query Engine | Describe real-time verification of Borrower eligibility under current short-term lending requirements. Ensure the system processes all applicant identification fields required by 10VAC5-200-110, provides accurate eligibility determinations, and supports statutory fallback procedures when the database is unavailable. |
| Loan Data Capture & Storage | Describe how the Supplier captures, transmits, and securely stores all required loan application and loan-level data, including Borrower identification fields, loan terms, Licensee information specified in 10VAC5-200-110. |
| Reporting & Analytics | Describe generation of required reports on loan activity, Borrower eligibility outcomes, Licensee query volume, and database usage metrics under current regulatory requirements. Reporting reflects modern installment-loan structures. |
| Security & Confidentiality | Describe the protection of confidential Borrower and Licensee information in accordance with statutory FOIA exemptions under section 6.2-1810(B)(3) and security standards outlined in 10VAC5-200-110(B). Ensure secure transmission of all required data fields. |
| Integration & Interoperatbility | Describe interoperability with Licensee systems and the SCC's internal financial institution information system (the "FIIS"), Licensee loan origination systems, and external data sources required for statutory eligibility checks. Support secure real-time interfaces for transmitting required applicant and lender data. |
| Toll-Free Number/Alternative Means of Database Access | Describe Borrower and Licensee inquiries regarding loan eligibility, technical assistance, and database access issues. Include call logging and backup IVR capability consistent with SCC operational needs as outined in 10VAC5-200-110. |
| User Management | Describe account provisioning, role assignment, and access management capabilities to support secure, controlled, and auditable interactions with all system components. |
| Disaster Recovery & Business Continuity | Describe the development and delivery of plans for disaster recovery and business continuity during outages as required under Section 6.2-1810(B)(1), using statutory fallback mechanisms when the Database is not available. |
| Operations & Maintenance Support | Describe ongoing support for Database functionality, Licensee interfaces, SCC access, and continuous compliance with 10VCA5-200-110 data-handling rules. |
| IMPLEMENTATION REQUIREMENTS | |
| Implementation Support | Describe implementation of the Database in accordance with current statutory and regulatory requirements, including ingestion of required loan-application data fields and compatibility with modern installment-loan structures. |
| Training | Describe the expectations for the Supplier to develop and deliver a training program for various user groups of the Database. Include the development of training materials and the delivery of training. |
| Project Management & Governance | Describe expectations for the Supplier to support governance, status reporting, communication, risk management, and coordination with SCC throughout Database Implementation and deployment. |
| Project Schedule | Describe the timeline and milestones necessary for delivering a fully compliant, SCC-certified Database aligned with current regulations. |
| Quality Assurance & Testing | Describe how the Supplier ensures testing reflects current installment-loan rules, modern loan-data elements, and contemporary eligibility-determination logic. |
| SECURITY REQUIREMENTS | |
| Secure Data Transmission | Describe how the Solution ensures all data exchanges use strong encryption and authenticated communication channels, and how it prevents transmission from unmanaged or insecure devices and networks. |
| System Hardening & Endpoint Protection | Describe how the Solution maintains securely configured systems through hardened baselines, timely patching, actively maintained endpoint protections, and traffic-filtering controls that limit access to only required ports and services. |
| Data Confidentiality & Access Management | Describe how the Solution enforces least-privilege, role-based access to sensitive information, limits or masks non-essential sensitive data, and maintains documented procedures for provisioning, reviewing, and revoking, user acccess. |
| Data Privacy & External Disclosure | Describe how the Solution prevents external release of identifiable or re-identifiable information, ensures only aggregated or anonymized data sets may be shared outside the system, and maintains documented procedures governing review and release of such data. |
| Audit Logging & Monitoring | Describe how the Solution generates and protects comprehensive audit logs for all system activity and supports real-time monitoring and alerting to detect anomalous or unauthorized behavior. |
| Encryption of Data at Rest | Describe how the Solution encrypts sensitive data stored within the Database using modern, industry-recognized algorithms and manages encryption keys securely through appropriate storage, rotation, and administration practices. |
| Authentication & Identity Security | Describe how the Solution supports strong authentication controls, including MFA, secure credential storage, preferred integration with federated identity services using standard protocols, and mechanisms to ensure timely deactivation of accounts for staff who are no longer employed. |
| Security Governance & Operational Controls | Describe how the Supplier maintains a security program aligned with recognized standards, undergoes periodic independent assessments, provides required security documentation, and implements operational procedures and training that support secure system management. |
| Incident Responses & Breach Notifications | Describe how the Supplier maintains an incident response plan, reports security incidents within required timeframes, and supports forensic investigation through preserved logs and system metadata. |
| Vendor & Personnel Security Controls | Describe how the Supplier ensures that personnel and subcontractors with access to sensitive information meet screening requirements, adhere to security and privacy obligations, and are bound by confidentiality agreements. |
| Vulnerability Management & Testing | Describe how the Supplier conducts regular vulnerability scanning, independent penetration testing, and secure code reviews as part of the development and maintenance lifecycle. |
| Data Retention & Secure Disposal | Describe how the Solution retains data only for required periods and disposes of sensitive information through secure, industry‑recognized destruction methods across production systems, backups, logs, and data extracts. |
| Infrastructure & Physical Security | Describe how hosting environments implement industry‑standard physical security controls, including access restrictions, environmental protections, and facility monitoring. |
| Inoperability & Data Portability | Describe how the Solution supports open, documented interfaces for data exchange and provides the SCC with complete, machine‑readable data extracts upon request. |
| Alternative Secure Access Capability | Describe how the Solution provides a secure, reliable fallback method for accessing required system functions during outages of the primary access channel and how this alternative access is documented and communicated. |
| Documentation Access Failures | Describe how the Solution enables authorized users to record and retain evidence of failed access attempts due to system issues and makes those records available for audit and supervisory review. |
| Secure Record Disposal | Describe how the Supplier securely disposes of sensitive records across all storage locations using approved destruction methods and maintains documentation of destruction activities for SCC review. |
&"Calibri"&10 &K000000#Confidential_x000D_&1#&"Calibri"&10&K000000 Confidential
3. Functional & Technical Reqs
| RFP SCC-26-018-BFI: Short-Term Lending Database |
| Exhibit B: Solution Requirements - Functional & Technical Requirements |
| Req. ID | Requirement Category | Requirement | How Requirement Met | Where Referenced in Proposal (if applicable) | ||||
| Base Product | Configuration | Customization | 3rd Party App/Tool | Cannot Meet |
| Eligibility Verification & Query Engine | ||
| R-001 | Eligibility Verification & Query Engine | Upon a Licensee's query, the Database shall advise the Licensee whether the applicant is eligible for a new short-term loan. |
| R-002 | Eligibility Verification & Query Engine | Upon a Licensee's query, if the applicant is ineligible, the Database shall provide the reason for such ineligibility. If the Database advises the Licensee that the applicant is ineligible for a loan, then the applicant shall direct any inquiry regarding the specific reason for such ineligibility to the Database provider rather than to the Licensee. |
| R-003 | Eligibility Verification & Query Engine | The Database shall allow the Licensee to generate a separate printout from the Database showing the results of each loan eligibility query. |
| Loan Data Capture & Storage | ||
| R-004 | Loan Data Capture & Storage | The Supplier shall provide a Database that captures historical loan data from the Licensees or the existing Database provider. |
| R-005 | Loan Data Capture & Storage | The Supplier shall provide a Database that tracks all short-term lending activity in the Commonwelth by Licensees. |
| R-006 | Loan Data Capture & Storage | At a minimum, the Supplier must ensure the Database includes the following required elements: |
| R-006a | Loan Data Capture & Storage | a. Name of Licensee and license number |
| R-006b | Loan Data Capture & Storage | b. Office location of Licensee |
| R-006c | Loan Data Capture & Storage | c. First and last name OR identification number of employee entering information into the Database |
| R-006d | Loan Data Capture & Storage | d. Applicant's first name and last name |
| R-006e | Loan Data Capture & Storage | e. Last four digits of applicant's driver's license number or identification card number |
| R-006f | Loan Data Capture & Storage | f. Applicant's address |
| R-006g | Loan Data Capture & Storage | g. Applicant's date of birth |
| R-006h | Loan Data Capture & Storage | h. Type of card (driver's license or state issued identification card) provided by applicant |
| R-007 | Loan Data Capture & Storage | If the Database advises a Licensee that an applicant is eligible for loan, the Database shall allow the Licensee to transmit the following additional information to the Database prior to making a loan: |
| R-007a | Loan Data Capture & Storage | a. Application date |
| R-007b | Loan Data Capture & Storage | b. Loan number |
| R-007c | Loan Data Capture & Storage | c. Date of loan |
| R-007d | Loan Data Capture & Storage | d. Principal amount of loan |
| R-007e | Loan Data Capture & Storage | e. Interest rate |
| R-007f | Loan Data Capture & Storage | f. Dollar amount of precomputed interest to be charged until date of loan maturity |
| R-007g | Loan Data Capture & Storage | g. Dollar amount of monthly maintenance fee to be charged |
| R-007h | Loan Data Capture & Storage | h. Dollar amount of each payment |
| R-007i | Loan Data Capture & Storage | i. Dollar amount of total fees and charges |
| R-007j | Loan Data Capture & Storage | j. Annual Percentage Rate (APR) of loan |
| R-007k | Loan Data Capture & Storage | k. Total number of payments |
| R-007l | Loan Data Capture & Storage | l. Date of loan maturity |
| R-007m | Loan Data Capture & Storage | m. If applicable, dollar amount of check given by applicant to secure the loan (i.e., at the time the loan is made). |
| R-008 | Loan Data Capture & Storage | The Database shall allow a Licensee to transmit the following additional information relating to loans made to the Database no later than the end of the business day on the date of the event: |
| R-008a | Loan Data Capture & Storage | a. If a Borrower cancels or rescinds a loan, the date of the cancellation or rescission. |
| R-008b | Loan Data Capture & Storage | b. If a loan is repaid or otherwise satisfied in full, (i) the date of repayment or satisfaction, and (ii) the total net dollar amount ultimately paid by the Borrower in connection with the loan (i.e., principal amount of loan plus all fees and charges received or collected pursuant to § 6.2-1817 of the Code of Virginia, less any amount refunded to the Borrower). |
| R-008c | Loan Data Capture & Storage | c. If a Borrower’s check or electronic draft is returned unpaid because the account on which it was drawn was closed by the Borrower or contained insufficient funds, (i) the date the check or electronic draft is returned unpaid, and (ii) the dollar amount of the check or electronic draft. A Licensee shall transmit such information to the Database no later than five days after the date the check or electronic draft is returned unpaid. |
| R-008d | Loan Data Capture & Storage | d. If a Licensee collects a deposit item return fee from a Borrower, the dollar amount of the deposit item return fee. |
| R-008e | Loan Data Capture & Storage | e. If a Licensee brings a civil action against a Borrower for nonpayment of a loan, the date the proceeding is initiated and the total dollar amount sought to be recovered. |
| R-008f | Loan Data Capture & Storage | f. If a Licensee obtains a judgment against a Borrower, the date and total dollar amount of the judgment. |
| R-008g | Loan Data Capture & Storage | g. If a judgment obtained by a Licensee against a Borrower is satisfied, the date of satisfaction. A Licensee shall transmit such information to the Database on the date the Licensee learns that the judgment has been satisfied. |
| R-008h | Loan Data Capture & Storage | h. If a Licensee obtains a judgment against a Borrower and collects any damages or costs from the Borrower, the dollar amount of the damages or costs. A Licensee shall transmit such information to the Database on the date the Licensee learns that the damages or costs have been paid. |
| R-008i | Loan Data Capture & Storage | i. If a Licensee charges off a loan as uncollectible, the date the loan is charged off and the total dollar amount charged off. |
| Reporting & Analytics | ||
| R-009 | Reporting & Analytics | Supplier shall provide a Database that offers detailed reports, visible and downloadable, via the Internet from the Database on loan activity of Licensee to assist with policy considerations by the Virginia General Assembly, to support any necessary enforcement actions, and to support the examination, supervision, and regulation of the industry by the SCC through the Bureau. |
| R-010 | Reporting & Analytics | Supplier shall provide a database that offers a downloadable report aggregating data for all Licensees and or upon request a report for specific Licensee location, documenting the following at a minimum: |
| R-010a | Reporting & Analytics | a. Number of loan queries submitted to the Database. |
| R-010b | Reporting & Analytics | b. Number of loans consummated by each Licensee. |
| R-010c | Reporting & Analytics | c. Number of ineligible loans by each Licensee and specific reasons for the ineligibility. |
| R-010d | Reporting & Analytics | d. Total number of Licensees and locations registered to the Database at month end and status of each Licensee and location. |
| R-010e | Reporting & Analytics | e. Other information requested by the Bureau. |
| R-011 | Reporting & Analytics | Supplier shall provide other specialized reports as requested by the Bureau at no cost. |
| Security & Confidentiality | ||
| R-012 | Security & Confidentiality | The Supplier shall notify the Bureau's specified point-of-contact of misuse of the database by a Licensee within one (1) day of becoming aware of such misuse. |
| R-013 | Security & Confidentiality | The Supplier shall take all actions necessary to ensure and protect the confidentiality and security of the information contained in the Database and ensure maximum availability and reliability of the Database to support business operations. |
| R-014 | Security & Confidentiality | The Supplier shall limit Licensee Database access in accordance with the provisions of Chapter 18 of Title 6.2 of the Code of Virginia and related regulations promulgated by the SCC. |
| R-015 | Security & Confidentiality | The Supplier shall take all actions necessary to ensure and protect the confidentiality and security of the information contained in the Database and ensure maximum availability and reliability of the Database to support business operations. |
| R-016 | Security & Confidentiality | The Supplier shall limit Licensee Database access in accordance with the provisions of Chapter 18 of Title 6.2 of the Code of Virginia and related regulations promulgated by the SCC. |
| Integration & Interoperability | ||
| R-017 | Integration & Interoperability | The Supplier shall provide a Database with an option for the Database to interface directly with each Licensee's point-of-sale system. |
| R-018 | Integration & Interoperability | The Supplier shall provide a Database that accepts an initial file and periodic updates generated by the Bureau's FIIS to populate the Database with the Licensee's identifying information (name, address, control number, etc.) in a format acceptable to both parties. |
| Toll- Free Telephone Number/Alternative Means of Database Access | ||
| R-019 | Toll- Free Telephone Number/Alternative Means of Database Access | The Supplier shall obtain and provide a toll-free telephone number to advise Borrowers of the specific reason for their ineligibility. |
| R-020 | Toll- Free Telephone Number/Alternative Means of Database Access | The Supplier shall record the date, time, source (Borrower or Licensee), and purpose of all inquiries received through the toll-free number and any alternative means of database access. |
| R-021 | Toll- Free Telephone Number/Alternative Means of Database Access | The Supplier shall provide an alternative means of database access, such as a telephone interactive voice response system, that is available 24/7 for the purpose of transmitting the information required by the regulations and obtaining applicant eligibility information. |
| User Management | ||
| R-022 | User Management | Supplier shall create the following user groups: |
| R-022a | User Management | a. Agency Administrators shall have the ability to create, remove, and modify user accounts, and to assign or update user roles, including granting Administrator privileges. Administrators shall have access to all data stored within the system and the capability to generate or run reports. Initial Administrator access must be provisioned directly by the third‑party service provider. |
| R-022b | User Management | b. Agency Users shall have access to the data stored in the system and the ability to generate or run reports. Users shall not have the capability to create, remove, or modify user accounts. |
| R-022c | User Management | c. Licensee Administrators shall have the ability to create, remove, and modify user accounts, and to assign or update user roles, including granting Administrator privileges. Administrators shall also be authorized to transmit data to the system and correct data within the system. Initial Administrator access must be provisioned directly by the third‑party service provider. |
| R-022d | User Management | d. Licensee Users shall have the ability to transmit data to the system. |
| R-023 | User Management | Supplier shall facilitate training and provide to the SCC and Licensees updated training materials related to system enhancements and changes, operational changes, and other solution changes as needed. This shall be completed prior to the implementation of enhancements and changes for the duration of the Contract. |
| Disaster Recovery & Business Continuity | ||
| R-024 | Disaster Recovery & Business Continuity | Supplier shall develop and maintain a solution Disaster Recovery Program for the duration of the contract that includes the following, at a minimum: |
| R-024a | Disaster Recovery & Business Continuity | a. Supplier shall provide to the SCC a detailed, step-by-step Disaster Recovery Plan (DRP) deliverable |
| R-024b | Disaster Recovery & Business Continuity | b. Supplier shall provide to the SCC an updated Disaster Recovery Plan (DRP) deliverable on an annual basis |
| R-024c | Disaster Recovery & Business Continuity | c. Supplier shall conduct Disaster Recovery test exercises on an annual basis |
| R-024d | Disaster Recovery & Business Continuity | d. Supplier shall provide to the SCC a Disaster Recovery Test Exercises Report on an annual basis |
| R-025 | Disaster Recovery & Business Continuity | Supplier shall develop and maintain a solution Business Continuity Program for the duration of the contract that includes the following, at a minimum: |
| R-025a | Disaster Recovery & Business Continuity | a. Supplier shall provide to the SCC a detailed, step by step Business Continuity Plan (BCP) deliverable |
| R-025b | Disaster Recovery & Business Continuity | b. Supplier shall provide to the SCC an updated Business Continuity Plan (BCP) deliverable on an annual basis |
| R-025c | Disaster Recovery & Business Continuity | c. Supplier shall conduct Business Continuity test exercises on an annual basis |
| R-025d | Disaster Recovery & Business Continuity | d. Supplier shall provide to the SCC a Business Continuity Test Exercises Report on an annual basis |
| Operations & Maintenance Support | ||
| R-026 | Operations & Maintenance Support | Supplier shall perform routine, non-emergency system maintenance and upates outside of SCC business hours (6 AM - 10 PM EST) and provide SCC with at least five business days notice. |
| R-027 | Operations & Maintenance Support | Supplier shall provide SCC and Licensees with on-demand access to all training materials associated with the Database. |
| R-028 | Operations & Maintenance Support | Supplier shall update any role-based user guides, job aids, reference materials, and other documentation to aid SCC in utilizing the Database as necessary to remain current and accurate |
| R-029 | Operations & Maintenance Support | Supplier shall provide to SCC an updated Transition Out & Turnover Plan deliverable on an annual basis for the duration of the Contract. |
| R-030 | Operations & Maintenance Support | Supplier shall provide to SCC an updated Operations & Maintenance and End User Support Plan deliverable on an annual basis for the duration of the Contract. |
| R-031 | Operations & Maintenance Support | Supplier shall provide to SCC an updated System Security Plan deliverable on an annual basis. |
&"Calibri"&10 &K000000#Confidential_x000D_&1#&"Calibri"&10&K000000 Confidential
4. Implementation Reqs
| RFP SCC-26-018-BFI: Short-Term Lending Database |
| Exhibit B: Solution Requirements - Implementation Requirements |
| Req. ID | Requirement | ||||
| Category | Requirement | How Requirement Met | Where Referenced in Proposal (if applicable) | ||
| Can | |||||
| Meet | Cannot Meet |
| Implementation Support | ||
| R-032 | Implementation Support | Supplier shall provide weekly conference calls during system development, system implementation and transition, and extending untill all system functionality has been accepted by SCC. |
| R-033 | Implementation Support | Supplier shall provide to SCC a Database Design deliverable. |
| R-034 | Implementation Support | Supplier shall provide to SCC a System Security Plan deliverable. |
| R-035 | Implementation Support | Supplier shall provide to SCC a Solution Deployment, go-live and Acceptance Plan deliverable. |
| R-036 | Implementation Support | Supplier shall submit to SCC documentation prior to go-live that demonstrates that all Medium or High web-based vulnerabilities have been remediated. |
| R-037 | Implementation Support | Supplier shall provide to SCC an Implementation Closeout Report on a monthly basis following Go-Live until acceptance of Database implementation has been been received from SCC. |
| R-038 | Implementation Support | Supplier shall provide an Operations & Maintenance and End User Support Plan prior to go-live. |
| R-039 | Implementation Support | Supplier shall provide to SCC a Transition Out & Turnover Plan deliverable within 60 days of go-live. |
| Training | ||
| R-040 | Training | Supplier shall provide to SCC a Training Plan deliverable that details training to SCC and Licensees. |
| R-041 | Training | Supplier shall provide to SCC and the Licensees role-based user guides, job aids, reference materials, and other documentation to aid SCC in utilizing the Database |
| R-042 | Training | Supplier shall provide to SCC and Licensees training materials tailored to the specific training needs of the following individual user groups: |
| R-042a | Training | a. Agency Administrator |
| R-042b | Training | b. Agency User |
| R-042c | Training | c. Licensee Administrator |
| R-042d | d. Licensee User | |
| R-042e | Training | e. Other Bureau support staff as designated by the Bureau. |
| R-043 | Training | Supplier shall deliver and facilitate training sessions using a variety of methods (e.g., webinars, online courses, etc.) that are specific to the defined individual user groups. |
| R-044 | Training | Supplier shall provide SCC and Licensees with on-demand access to all training materials associated with the Database. |
| Project Management & Governance | ||
| R-045 | Project Management & Governance | Supplier shall conduct a Project Kickoff meeting with SCC stakeholders. |
| R-046 | Project Management & Governance | Supplier shall attend and contribute to weekly project status meetings. |
| R-047 | Project Management & Governance | Supplier shall attend and contribute to ad hoc project status meetings as requested by the SCC. |
| R-048 | Project Management & Governance | Supplier shall provide to the SCC a Project Status Report on a weekly basis that contains the following information, at a minimum: |
| R-048a | Project Management & Governance | a. Summary of project activities relative to the approved project schedule |
| R-048b | Project Management & Governance | b. Summary of progress against Critical Milestones |
| R-048c | Project Management & Governance | c. Summary of work completed during the status reporting period |
| R-048d | Project Management & Governance | d. Summary of planned work for the upcoming status reporting period |
| R-048e | Project Management & Governance | e. Summary and analysis of project issues and risks log |
| R-049 | Project Management & Governance | Supplier shall attend and contribute to all project working meetings as requested by SCC. |
| R-050 | Project Management & Governance | Supplier shall provide project-related information to the SCC as requested. |
| R-051 | Project Management & Governance | Supplier shall prepare and provide to the SCC in advance meeting agendas for meetings facilitated by Supplier. |
| R-052 | Project Management & Governance | Supplier shall provide to the SCC minutes and notes for meetings facilitated by Supplier within two business days following the meeting. |
| Project Schedule | ||
| R-053 | Project Schedule | Supplier shall provide to the SCC during Project Initiation, within 60 days of contract start, an integrated project schedule that includes, at a minimum: |
| R-053a | Project Schedule | a. Demonstrated compliance with defined dates for Critical Milestones |
| R-053b | Project Schedule | b. A summary-level view of the schedule that contains project phases and major milestones |
| R-053c | Project Schedule | c. Project phases, milestones, activities, and deliverables required to deliver all components of the proposed solution |
| R-053d | Project Schedule | d. The start date, end date, and estimated duration of each phase, milestone, activity, and deliverable |
| R-053e | Project Schedule | e. The resources assigned to complete each activity |
| R-053f | Project Schedule | f. Dependencies between project phases, milestones, activities, and deliverables, to include dependencies based on factors and requirements internal and external to the Exchange |
| R-053g | Project Schedule | g. Any other relevant, supporting details to support effective execution in accordance with the schedule |
| R-054 | Project Schedule | Supplier shall provide to the SCC an updated integrated project schedule on a weekly basis. |
| Quality Assurance & Testing | ||
| R-055 | Quality Assurance & Testing | Supplier shall conduct testing to validate all regulatory updates and provide SCC with: |
a. Test plans;
b. Test scripts;
c. Results; and
d. Remediation plans.
R-056 Quality Assurance & Testing Supplier shall upate all relevant documentation including technical, user, training, and administrative, whenever changes are implemented.
&"Calibri"&10 &K000000#Confidential_x000D_&1#&"Calibri"&10&K000000 Confidential
5. Security Requirements
| RFP SCC-26-018-BFI: Short-Term Lending Database |
| Exhibit B: Solution Requirements - Implementation Requirements |
| Req. ID | Requirement | ||||
| Category | Requirement | How Requirement Met | Where Referenced in Proposal (if applicable) | ||
| Can | |||||
| Meet | Cannot Meet |
| Secure Data Transmission | ||
| E001 | Secure Data Transmission | The solution shall ensure all data transmitted between users, systems, and services is protected using strong encryption protocols (eg, TLS 1.3 or higher) |
| E002 | Secure Data Transmission | The solution shall prevent transmission from unmanaged, untrusted, or insecure devices and networks |
| E003 | Secure Data Transmission | The Supplier shall ensure secure authentication of endpoints participating in data exchange |
| System Hardening & Endpoint Protection | ||
| E004 | System Hardening & Endpoint Protection | System configurations shall follow hardened baselines consistent with industry frameworks such as CIS Benchmarks or equivalent |
| E005 | System Hardening & Endpoint Protection | The Supplier shall apply security patches on a timely basis aligned with severity ratings and threat exposure |
| E006 | System Hardening & Endpoint Protection | All servers, components, and endpoints interacting with the solution shall use actively maintained anti-malware protections |
| E007 | System Hardening & Endpoint Protection | The solution shall employ firewalls or equivalent filtering technology limiting traffic only to required ports and services |
| Data Confidentiality & Access Management | ||
| E008 | Data Confidentiality & Access Management | The solution shall enforce role-based access control (RBAC) ensuring least-privilege access to sensitive information |
| E009 | Data Confidentiality & Access Management | Sensitive data (including PII) shall be limited, masked, or partially redacted when not essential for system operation |
| E010 | Data Confidentiality & Access Management | The Supplier shall maintain documented procedures for provisioning, reviewing, and revoking user access |
| Data Privacy & External Disclosure | ||
| E011 | Data Privacy & External Disclosure | The solution shall ensure that no externally shared data identifies or enables re-identification of individuals or specific transactions |
| E012 | Data Privacy & External Disclosure | Only aggregated, anonymized, or derivative data sets may be released outside the system or vendor organization |
| E013 | Data Privacy & External Disclosure | The Supplier shall have documented procedures controlling the review and release of aggregate data |
| Audit Logging & Monitoring | ||
| E014 | Audit Logging & Monitoring | The solution shall generate comprehensive audit logs for all data access, submissions, administrative actions, and configuration changes |
| E015 | Audit Logging & Monitoring | Audit logs shall be protected from alteration and retained according to industry-standard retention practices |
| E016 | Audit Logging & Monitoring | The solution shall support real-time monitoring and alerting for anomalous or unauthorized activity |
| Encryption of Data at Rest | ||
| E017 | Encryption of Data at Rest | Sensitive data stored within the system shall be encrypted using modern, industry-recognized algorithms (eg, AES‑ or equivalent) |
| E018 | Encryption of Data at Rest | Encryption keys shall be stored, rotated, and managed according to secure key management practices |
| Authentication & Identity Security | ||
| E019 | Authentication & Identity Security | The solution shall support strong authentication, including multi-factor authentication (MFA) for administrative and sensitive actions |
| E020 | Authentication & Identity Security | Integration with federated identity services using standard protocols (eg, SAML 0, OIDC) is strongly preferred |
| E021 | Authentication & Identity Security | User credential storage must follow industry best practices (eg, salted hashing, no plaintext storage) |
| Security Governance & Operational Controls | ||
| E022 | Security Governance & Operational Controls | The Supplier shall maintain a security program aligned to recognized standards such as NIST CSF, ISO 17799/27001, or CIS Critical Controls |
| E023 | Security Governance & Operational Controls | The Supplier shall undergo periodic independent assessments (SOC Type II, ISO 00 certification, or equivalent) and provide a report as a deliverable on an annual basis. |
| E024 | Security Governance & Operational Controls | The Supplier shall provide assessment reports upon request |
| E025 | Security Governance & Operational Controls | The Supplier shall provide documented operational procedures for data handling, redaction, encryption, access control, and system operation |
| E026 | Security Governance & Operational Controls | Personnel shall receive periodic security awareness and role-specific training |
| Incident Response & Breach Notification | ||
| E027 | Incident Response & Breach Notification | The Supplier shall maintain an incident response plan detailing identification, containment, remediation, and recovery activities |
| E028 | Incident Response & Breach Notification | Any security incident involving sensitive data shall be reported to the sponsoring agency within a defined notification window (eg, hours) |
| E029 | Incident Response & Breach Notification | The solution shall support forensic investigation through preserved logs and system metadata |
| Vendor & Personnel Security Controls | ||
| E030 | Vendor & Personnel Security Controls | Personnel with access to sensitive information shall undergo appropriate background screening |
| E031 | Vendor & Personnel Security Controls | Subcontractors shall adhere to all security and privacy requirements described herein |
| E032 | Vendor & Personnel Security Controls | Confidentiality and non-disclosure agreements shall be required for all relevant staff |
| Vulnerability Management & Testing | ||
| E033 | Vulnerability Management & Testing | The Supplier shall conduct regular vulnerability scanning of both infrastructure and application layers |
| E034 | Vulnerability Management & Testing | Annual independent penetration testing shall be performed by qualified professionals |
| E035 | Vulnerability Management & Testing | Secure code review (static and dynamic analysis) shall be incorporated into the development lifecycle |
| Data Retention & Secure Disposal | ||
| E036 | Data Retention & Secure Disposal | Data shall be retained only for operationally necessary periods or contractual requirements |
| E037 | Data Retention & Secure Disposal | All data disposal activities shall follow secure destruction practices (eg, cryptographic wiping) |
| Infrastructure & Physical Security | ||
| E038 | Infrastructure & Physical Security | Hosting environments shall follow recognized industry physical security standards typical of reputable data centers or certified cloud platforms |
| E039 | Infrastructure & Physical Security | The Supplier shall ensure physical access controls, environmental protections, and monitoring are in place |
| Interoperability & Data Portability | ||
| E040 | Interoperability & Data Portability | The solution shall support open, documented interfaces (eg, JSON/REST, XML) for data exchange |
| E041 | Interoperability & Data Portability | The Supplier shall ensure full data portability by providing the sponsoring agency access to complete and machine-readable data extracts upon request |
| Alternative Secure Access Capability | ||
| E042 | Alternative Secure Access Capability | The Offeror shall provide a secure, reliable alternative method for accessing the system in the event that the primary Internet-based access is unavailable due to circumstances beyond the user’s control. |
This alternative access method must:
Be secure and authenticated Support submission of required data Support retrieval of eligibility or decision information Be maintained to ensure availability during outages Be documented and communicated to authorized users
Examples may include secure telephone-based access (e.g., IVR), secure SMS gateway, or other vetted fallback channels.
| Documentation Access Failures | ||
| E043 | Documentation Access Failures | The Supplier shall ensure that authorized users have a method to record and retain evidence of failed attempts to access the system when such failures are due to technical issues beyond the user’s control. |
This capability must support documentation of:
the nature of the technical problem, the date and time of the attempted access, and any relevant system error or communication failure information available at the time.
The Supplier shall maintain these records in accordance with audit retention requirements and make them accessible to authorized agency personnel upon request.
| Secure Record Disposal | ||
| E044 | Secure Record Disposal | The Supplier shall securely dispose of all records containing sensitive or personal financial information when such records are no longer required for operational, contractual, or legal purposes. |
Secure disposal must include one or more of the following methods:
secure electronic deletion (e.g., cryptographic wipe), secure physical destruction (e.g., shredding or incineration), use of a certified third‑party destruction service.
The Supplier shall apply these requirements to:
production systems, backups, logs, data extracts, exported reports, and any records stored on Supplier-managed or Supplier‑controlled systems.
The Supplier shall maintain documentation of destruction activities and make such documentation available upon agency request.
image1.png
File details come from the government source that posted it. Updated .