08._Exhibit C_Solution Description.docx

RFP SCC-26-018-BFI: Short-Term Lending Database Exhibit C: Solution Description

RFP SCC-26-018-BFI: Short-Term Lending Database

Exhibit C: Solution Description

< Insert Offeror Name >

Table of Contents

Overview Exhibit C: Solution Description provides Offeror the opportunity to further describe its proposed solution and to elaborate on how the solution will meet the SCC’s requirements. The response must include a thorough description of the solution, the overall approach to implementing the solution, and the approach to addressing each requirement.

It is the SCC’s expectation that each individual requirement contained in Exhibit B: Solution Requirements will be addressed in Offeror’s response to Exhibit C. Due to the detailed nature of many requirements, however, the SCC expects that, in some instances, individual statements, paragraphs, or other content may be sufficient to address multiple requirements simultaneously.

Exhibit C is a template document that is organized to align with the categories of solution requirements contained in Exhibit B, to include:

· Eligibility Verification & Query Engine

· Loan Data Capture & Storage

· Reporting & Analytics

· Security & Confidentiality

· Integration & Interoperability

· Toll-Free Number/Alternative Means of Database Access

· User Management

· Disaster Recovery & Business Continuity

· Operations & Maintenance Support

· Implementation Support

· Operations & Maintenance Support

· Training

· Project Management & Governance

· Project Schedule

· Quality Assurance & Testing

Security Requirements

· Secure Data Transmission

· System Hardening & Endpoint Protection

· Data Confidentiality & Access Management

· Data Privacy & External Disclosure

· Audit Logging & Monitoring

· Encryption of Data at Rest

· Authentication & Identity Security

· Security Governance & Operational Controls

· Incident Response & Breach Notifications

· Vendor & Personnel Security Controls

· Vulnerability Management & Testing

· Data Retention & Secure Disposal

· Infrastructure & Physical Security

· Interoperability & Data Portability

· Alternative Secure Access Capability

· Documentation Access Failures

· Secure Record Disposal

Exhibit C is intended to be updated in stages throughout the procurement process.

Instructions Offeror must submit Exhibit C: Solution Description as part of its RFP response submission. The Exhibit C file must be used in its entirety as the template to provide Offeror’s narrative responses to the items requested in the Exhibit.

Specific instructions for preparing Exhibit C include:

a. Offeror will modify the electronic version of this Exhibit (as provided by the SCC with the RFP materials) to respond to the requirements herein and by completing all sections within this document. Offeror will refrain from modifying section titles or removing sections.

b. Offeror may remove the SCC-provided guidance (i.e., the italicized text) with each section and any instructions.

c. Although the sections are related, Offeror should refrain from repeating responses in subsequent sections. Be sure to tailor the response for each section specific to the request in that section.

d. Offeror need not restate the requirements from Exhibit B: Solution Requirements, rather it should articulate how its unique solution will meet the requirements.

e. Offeror will include materials specific to its solution for this RFP. Offeror will refrain from providing “marketing materials” and background information already provided to the SCC or otherwise available in the public domain.

f. Offeror will return the completed file as part of its overall response to the RFP, in accordance with the submission and file naming requirements indicated in the RFP Instructions.

g. Note that Exhibit C is intended for Offeror to further describe and elaborate on its solution; it is not intended to capture Offeror’s proposed changes to solution requirements. Any proposed changes to solution requirements must be submitted to the SCC in the appropriate form provided in Appendix D: Proposed Changes.

The Solution Description must contain the components listed in sections 3.0, 4.0, and 5.0 of this Exhibit, and in the order specified.

Functional & Technical Requirements Eligibility Verification & Query Engine < Provide Offeror description and approach for ‘Eligibility Verification & Query Engine’ requirements >

Loan Data Capture & Storage < Provide Offeror description and approach for ‘Loan Data Capture & Storage’ requirements >

Reporting & Analytics < Provide Offeror description and approach for ‘Report & Analytics’ requirements >

Security & Confidentiality < Provide Offeror description and approach for ‘Security & Confidentiality’ requirements >

Integration & Interoperability < Provide Offeror description and approach for ‘Integration & Interoperability’ requirements >

Toll-Free Number/Alternative Means of Database Access < Provide Offeror description and approach for ‘Toll-Free Number/Alternative Means of Database Access’ requirements >

User Management < Provide Offeror description and approach for ‘User Management’ requirements >

Disaster Recovery & Business Continuity < Provide Offeror description and approach for ‘Disaster Recovery & Business Continuity’ requirements >

Operations & Maintenance Support < Provide Offeror description and approach for ‘Operations & Maintenance Support’ requirements >

Implementation Requirements Implementation Support < Provide Offeror description and approach for ‘Implementation Support’ requirements >

Training < Provide Offeror description and approach for ‘Training’ requirements >

Project Management & Governance < Provide Offeror description and approach for ‘Project Management & Governance’ requirements >

Project Schedule < Provide Offeror description and approach for ‘Project Schedule’ requirements >

Quality Assurance & Testing < Provide Offeror description and approach for ‘Quality Assurance & Testing’ requirements >

Security Requirements Secure Data Transmission < Provide Offeror description and approach for ‘Secure Data Transmission’ requirements >

System Hardening & Endpoint Protection < Provide Offeror description and approach for ‘System Hardening & Endpoint Protection’ requirements >

Data Confidentiality & Access Management < Provide Offeror description and approach for ‘Data Confidentiality & Access Management’ requirements >

Data Privacy & External Dislosure < Provide Offeror description and approach for ‘Data Privacy & External Disclosure’ requirements >

Audit Logging & Monitoring < Provide Offeror description and approach for ‘Audit Logging & Monitoring requirements >

Encryption of Data at Rest < Provide Offeror description and approach for ‘Encryption of Data at Rest’ requirements >

Authentication & Identity Security < Provide Offeror description and approach for ‘Authentication & Identity Security’ requirements >

Security Governance & Operational Controls < Provide Offeror description and approach for ‘Security Governance & Operational Controls’ requirements >

Incident Response & Breach Notification < Provide Offeror description and approach for ‘Incident Response & Breach Notification’ requirements >

Vendor & Personnel Security Controls < Provide Offeror description and approach for ‘Vendor & Personnel Security Controls’ requirements >

Vulnerability Management & Testing < Provide Offeror description and approach for ‘Vulnerability Management & Testing’ requirements >

Data Retention & Secure Disposal < Provide Offeror description and approach for ‘Data Retention & Secure Disposal’ requirements >

Infrastructure & Physical Security < Provide Offeror description and approach for ‘Infrastructure & Physical Security’ requirements >

Interoperability & Data Portability < Provide Offeror description and approach for ‘Interoperability & Data Portability’ requirements >

Alternative Secure Access Capability < Provide Offeror description and approach for ‘Alternative Secure Access Capability’ requirements >

Documentation Access Failures < Provide Offeror description and approach for ‘Documentation Access Failures’ requirements >

Secure Record Disposal < Provide Offeror description and approach for ‘Secure Record Disposal’ requirements >

Optional Services < Provide Offeror description and approach for any additional or enhanced Services being proposed > image1.png