ATTACHMENT C

FUNCTIONAL REQUIREMENTS

The terms “System”, “Software”, and “Application” is used throughout this exhibit. These terms are meant to represent the Consultant’s proposed software and infrastructure, as applicable.

1. Consultant must respond to each individual requirement by entering an ‘X’ in one of the columns provided. Select the appropriate response using the following guidelines below.

· If the System requires specialized configuration, Consultant must enter required configuration in the “Describe” section provided.

· If the requirement is satisfied by third-party software, please indicate the third-party product proposed.

· Consultant must provide an explanation of the work required to perform the modification in the “Describe” section provided.

2. Consultant is strongly encouraged to provide a brief explanation of how the requirement will be satisfied.

· Consultant may also include screen shots, diagrams, samples, and inventories for any requirement listed.

· If unable to meet the requirement, Consultant must offer a brief explanation or propose an alternative way to meet the requirement.

Table of Contents

A.

Admin & Operations

The System must provide an email template builder supporting subject and body creation, including rich‑text formatting capabilities and reusable templates to standardize communications.

The System must allow authorized staff to configure automated communications for election workers based on time‑ or status‑based triggers (e.g., missed training).

B.

Inventory

C.

Polling Place Management

D.

Workers & Training

E.

Campaign Finance

The System could support the following Campaign Finance functionality. Systems without Campaign Finance capabilities will still be considered.

ATTACHMENT D

CLOUD TECHNICAL CAPABILITIES

The terms “System”, “Software”, and “Application” is used throughout this attachment. These terms are meant to represent the Consultant’s proposed software and infrastructure, as applicable.

1. Consultant must respond to each individual capability by entering an ‘X’ in one of the non-grey columns provided. Select the appropriate response using the following guidelines below. If the columns are grey, provide a description in the “Describe” column. It is highly recommended that a technical resource completes this attachment.

· If the System requires specialized configuration, Consultant must enter required configuration in the “Describe” section provided.

· If the capability is satisfied by third-party software, please indicate the third-party product proposed.

· Consultant must provide an explanation of the work required to perform the modification in the “Describe” section provided.

2. Consultant is strongly encouraged to provide a brief explanation of how the capability will be satisfied for each capability.

· Consultant may also include screen shots, diagrams, samples, and inventories for any capability listed.

· If unable to meet the capability, Consultant must offer a brief explanation or propose an alternative way to meet the capability.

The System will not be allowed to use the City’s email system. Describe how the System will send emails.

The proposed System must be hosted under a valid and registered domain name (e.g., https://yourcompany.vendor.com) and not solely accessible via an IP address. The System must:

· Provide a fully qualified domain name (FQDN) for the hosted service.

· Not make use of raw IP addresses for production access, user login, or application endpoints.

The System must run over a web browser.

The System must not require a thick or thin client for both administrative- and end-users.

All functionality is supported over a web browser.

System supports current browser versions, including but not limited to Firefox, Chrome, Edge and implements modern web standards.

If the System doesn’t run over a web browser, describe how the software runs (for example, via a thick client).

If via a thick or thin client, software must support remote, unattended/silent installation and configuration.

If the System provides a native mobile application, describe how the application renders on smart phones and/or tablets, including any hardware or operating system limitations.

If a mobile application is available, it continues to be functional during loss of network connectivity, e.g. store locally and automatic sync when network connectivity is available. Describe how this can be achieved.

Software is designed to run on a wide variety of form factors using a responsive or native design.

Application Security

System does not require users to have local administrator rights to access or use the solution.

System design adheres to the principle of least privilege (see, for reference, NIST’s definition: https://csrc.nist.gov/glossary/term/least_privilege).

Consultant shall provide a comprehensive, third-party penetration testing report annually, detailing the testing scope, methodology, and a prioritized list of findings.

Application must comply with OWASP top 10 risks for web applications.

System operates with controls applied by mobile device and mobile application management technology services (MDM, MAM).

Application must support SAML for modern authentication protocols for single sign-on for City users and provide a mechanism for additional identity provider for constituents.

Data Security

System has the ability to classify data elements and unstructured data that are regulated as private or otherwise not public under local, state or federal law.

System has the ability to mask and/or redact regulated non-public data from system views, query results, and outputs.

System has the ability to classify and prevent changes to structured or unstructured data elements that are considered official (immutable) government records within the System.

System has the ability to support input validation to maintain data quality and integrity.

System has the ability to prevent unauthorized users from changing or deleting data.

System has the ability to secure data transferred between the client (i.e. on City devices, client devices, or a web browser) and the application.

System has the ability to encrypt data, including backups, at rest and in transmission.

System must ensure confidentiality, integrity and availability of the data.

Secure Maintenance

Describe how Consultant maintains an active vulnerability and threat-monitoring program that conforms to the following standards:

· Zero-day vulnerabilities are remediated within two business days

· Critical and high vulnerabilities are remediated within 30 business days

At minimum, System supports versions of software with a standard of Current Minus Two (two versions behind most recent release).

Cybersecurity

System must protect City data and services with a firewall or other City-approved solution that excludes all network traffic to environments hosting City data and services, except that which is explicitly allowed. Examples of untrusted networks include:

· Internet

· Other customer networks

· Consultant management network

· Consultant corporate network

System employs and monitors network and host-based intrusion detection and prevention solutions to protect City data and services. This includes anti-malware capabilities.

System employs a continuous security monitoring solution including the ability to manage and protect log files from tampering and retain logs for up to 12 months.

The System must ensure full separation of the City’s data from that of other customers, tenants, or clients on the same platform, and guarantee that no other customer can access the City’s data.

System must restrict access to City data and services by Consultant’s personnel to only those who have an approved business need.

System has the ability to log and report on physical access to infrastructure hosting City data and services.

System must ensure all City data, including backups, resides within the continental United States.

Describe how the System uses artificial intelligence to fulfill any of the functionality provided by the System.

System will not transmit City data to general purpose AI models such as ChatGPT.

System must include documented procedures to audit at least annually all user access accounts to City data.

System preserves and protects logs against tampering or deletion by privileged users.

System must have the capability to enforce auditing and log basic information about user access activity, administration activities, system events and errors, and access violation reports. Activity logs must capture at least the following:

· User authentication

· Type of event

· Date and time

· Success or failure indication

· Origination of event

· Identity or name of affected data, system component or resource

System logs and reports on security events including, but not exclusive to:

· Log on

· Log off

· Failed Log on

· Account Locked

· Account Unlocked

· Password Reset

System logs and reports on access/authentication changes including, but not exclusive to:

· New account created

· Accounts disabled / enabled

· Account deleted

· Authorization changes such as adding user (or removing from) a new role or other evidence of an authorization change.

· Privilege escalation (i.e. escalation from any user role to system administrator role)

System has the ability to implement ‘separation of duties’ (fraud prevention) controls around critical workflow and transaction changes and approvals.

System logs and reports on changes to configuration settings.

System logs and reports on application and data management events such as:

· Data Element Changes

· System Error messages

· Files opened and closed

· Files modified

System provides mechanism to consume secure SOAP-based and/or REST-based web services from external and internal systems.

System provides mechanism that can be automated to export data via batch process(es).

System provides capability for automated near real-time export of data out of the system.

System integration layer is kept on same upgrade schedule as the core system.

System provides a repeatable and automated mechanism to access data required by the City to perform all reporting and ETL functions necessary to support business processes.

System allows for the configuration of data retention rules within the System.

The System must include robust reporting functionality that meets both operational and strategic business needs. Specifically, the System must:

· Provide a comprehensive set of standard out-of-the-box reports relevant to the solution’s core functions.

· Support the ability to generate custom reports based on business-specific criteria, including filtering, grouping, date ranges, and user-defined fields.

All data collected within the System (whether it be out-of-the-box or customized) must be accessible via the System’s robust reporting functionality.

System has the ability to back-up and restore data to support the following:

· Recovery Point Objective: 24-hours – no more than 24-hours data loss.

· Recovery Time Objective (Incidental Restore Requests): 4 hours

System supports 99.99% uptime.

System supports testing or other verification of the disaster recovery process on an annual basis.

ATTACHMENT E

SOLUTION CATEGORY IDENTIFICATION

1. The Definitions Table below provides information on how the City defines on-premise, cloud, and SaaS solutions. Consultant must respond by entering an ‘X’ in the column that best matches its proposed solution in the Consultant’s Response Table.

2. Consultant must provide a brief explanation of how its solution deviates from the definition, if at all.

Definitions Table:

· Network services, such as connectivity

· Infrastructure services, such as virtual servers (web servers, database servers)

· Desktop services, such as computers and client installs The Consultant provides the following, if applicable:

· Software solution, including support

· Hardware device, such as an appliance or a hand-held device

Consultant’s Response Table

Solution Dependencies

· Consultant must specify, in the Solution Dependency Table below, if the proposed solution has any dependencies on City network or infrastructure, such as:

1. Network connectivity or communication that requires a site-to-site VPN tunnel

2. Data transfer to or from the Consultant doesn’t go over the public internet

3. Connects to local Active Directory for authentication

Solution Dependency Table The proposed solution has the following dependencies on City network or infrastructure:

ATTACHMENT F

COST/FEE TEMPLATE

(include in RFP release as an Excel spreadsheet)

Attachment Cost_Fee Template.xlsx

ATTACHMENT G

DATA PRIVACY

Consultant must answer the following questions relating to data privacy.

ATTACHMENT H

REFERENCES

Consultant is requested to provide three references of current customers, and three references of former customers. For each numbered row, Consultant should provide the requested reference information in writing, using the soft copy of this template. All customer references provided should be in regard to customer accounts where Consultant’s services are/were similar to the City’s project in terms of size, scope and geographic footprint.

Relationship with Customer

CURRENT CUSTOMERS

1.

2.

3.

FORMER CUSTOMERS

4.

5.

6.

ATTACHMENT I

Q&A SUBMITTAL FORM