1-Attachment F Requirements Matrix.xlsx
XLSX spreadsheet 35 KB Posted
- Attached to
- VAP Case Management and Reporting Software
- Solicitation number
- 549742
- Issued by
- Wayne County, Detroit City, Michigan
About this file
Requirements Matrix Summary
This document is a Requirements Matrix for a case management and reporting software proposal submitted to the Detroit Police Department (DPD) Victim's Assistance Program (VAP) in Detroit, Michigan. The matrix establishes 98 functional and technical requirements organized across six categories: General/Technical (22 requirements), Support and Training (12 requirements), Reporting (12 requirements), Security and Compliance (18 requirements), Backup/Recovery (7 requirements), and Cloud Checklist (27 requirements). The software must support comprehensive case management functions including case intake, assessment, note creation, customizable forms and checklists, duplicate record detection, and document association through drag-and-drop functionality. The system requires integration with DPD's Records Management System (RMS) and must operate as a web-based application without requiring desktop client installation, supporting modern web browsers including Chrome, Edge, and Firefox with API capabilities for third-party integration and Victims of Crime Act (VOCA) grant compliance.
The vendor must provide critical support services including web-based support with searchable problem databases, online documentation, and remote access capabilities during extended hours (7:00 a.m. to 6:00 p.m. Eastern minimum). Training requirements are designated as critical and include onsite initial training, 90-day follow-up training, and post-implementation ad-hoc training options. Security and compliance requirements are stringent, mandating Microsoft Entra ID integration for single sign-on, multi-factor authentication, full data encryption (in transit and at rest), HIPAA and CJIS compliance with Business Associate Agreements, and role-based security at multiple levels including department, division, role, user, screen, menu, report, and field levels. The system must include comprehensive audit logging capabilities, automated user timeouts based on inactivity, and industry-standard security certifications such as ISO 27001. Data center requirements specify geographically diverse Tier III facilities outside the United States without written City consent, with specified recovery time objectives (RTO) and recovery point objectives (RPO) ranging from intra-day to 96-hour availability tiers, and annual disaster recovery testing coordinated with the City.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 3-Attachment D-2 Conditions of Award.pdf | ||
| 6-Attachment A - Respondent Questionnaire.docx | DOCX document | |
| 4-Attachment D-1 Required Forms Affidavits.pdf | ||
| 7-Attachment C Pricing Matrix.xlsx | XLSX spreadsheet | |
| 8-RFP 549742.docx | DOCX document | |
| 5-Attachment B - Respondent Proposal Introduction and Solution Approach.docx | DOCX document | |
| 2-Attachment E- City of Detroit Technology Contract.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Table of Contents
| Table of Contents | |||
| Tab No. | Functional Area | Number of Requirements / Questions | Please note this document contains multiple tabs. |
| 1 | General/Technical | 22 | |
| 2 | Support and Training | 12 | |
| 3 | Reporting | 12 | |
| 4 | Security and Compliance | 18 | |
| 5 | Backup/Recovery | 7 | |
| 6 | Cloud Checklist | 27 | |
| Total Requirements + Questions: | 98 |
General Technical
| ATTACHMENT F - REQUIREMENTS MATRIX | ||||
| Detroit Police Department Victim's Assistance Program Case Management and Reporting Software RFP # _________ | Vendor | Please note this document contains multiple tabs. | ||
| Available Responses | ||||
| C | Requirement Met and Proposed (Standard features available in the product) | 0 | ||
| A | Intent of Requirement Met and Proposed with Alternative | 0 | ||
| N | Requirement Not Met with Proposal | 0 |
TOTAL 0
| Req # | Function | General Technical Requirement | Criticality | Vendor Response | |
| (C, A, N) | Modules Required to Fulfill Requirements | Comments | |||
| 1 | Case Management | The system supports case intake and assigns an unique identifying number to each case. | |||
| 2 | Case Management | The system supports case assessment. | |||
| 3 | Case Management | The system supports the creation of case summaries. | |||
| 4 | Case Management | The system has the ability to allow users to create, add, remove, or edit case notes. | |||
| 5 | Case Management | The system has the ability to create configurable case/report forms. | |||
| 6 | Case Management | The system has the ability to alert a user of a potential duplicate or existing record (e.g. the same individual). | |||
| 7 | Case Management | The system has the ability to use "drag and drop" or file upload functionality to associate documents to cases within the system. | |||
| 8 | Case Management | The system supports the creation of customized forms. | |||
| 9 | Case Management | The system supports the creation of customized checklists. | |||
| Quarterly Work Plans | The system supports the development of Quarterly Work Plans. | ||||
| 10 | Integrated modules | The system has the ability to flow all changes made in the system throughout all proposed system features without the need for duplicate data entry. | |||
| 11 | Search functionality | The system has the ability to search any discrete data field within the system. | |||
| 12 | Search functionality | The system has the ability to search by fragment or portion of a word. | |||
| 13 | Search functionality | The system has the ability to search by wild cards. | |||
| 14 | User Interface | The system has an intuitive user interface and simple design which enables users to accomplish tasks with minimal number of clicks and keystrokes. | |||
| 15 | User Interface | The system includes an intuitive user interface that promotes usability and ease of navigation throughout all system components. | |||
| 16 | User Interface | The system has the ability to provide drop down boxes or other pick list function for data selection. | |||
| 17 | Spell check | The system has the ability to spell check on any field with the ability for a user to accept or ignore suggestion. | |||
| 18 | Web browsers | The system has the ability to support modern web browsers (i.e. Chrome, Edge, Firefox). | |||
| 19 | No desktop client installed | The system has the ability to be fully operational without an instance of an installed client on the desktop. | |||
| 20 | RMS Integration | The system has the ability to interface with DPD's RMS System. | Desired | ||
| 21 | API | The system has the ability to support API's (Application Programming Interface) for third-party system integration, imports, and exports of data. | |||
| 22 | Grant Requirements | The system is in compliance with Victims of Crime Act (VOCA) grant requirements |
Support and Training
| ATTACHMENT F - REQUIREMENTS MATRIX | ||||
| Detroit Police Department Victim's Assistance Program Case Management and Reporting Software RFP # _________ | Vendor | Please note this document contains multiple tabs. | ||
| Available Responses | ||||
| C | Requirement Met and Proposed (Standard features available in the product) | 0 | ||
| A | Intent of Requirement Met and Proposed with Alternative | 0 | ||
| N | Requirement Not Met with Proposal | 0 |
TOTAL 0
| Req # | Function | Support and Training Requirement | Criticality | Vendor Response | |
| (C, A, N) | Modules Required to Fulfill Requirements | Comments | |||
| 1 | Support | The vendor will provide access to resolution efforts at a minimum during the hours of 7:00 a.m. to 6:00 p.m. Eastern. | Desired | ||
| 2 | Support | The vendor will provide web-based support, with a searchable database of common problems, to assist end users in researching error messages. | Critical | ||
| 3 | Support | The system has the ability to provide online software documentation for all software application features. | Desired | ||
| 4 | Support | The system has the ability to provide an online tutorial to assist users learning the software. | Desired | ||
| 5 | Support | The system must have the capability to provide support through remote access to the application in accordance with City procedures, if applicable. | Desired | ||
| 6 | Support | The vendor offers software application support during planned upgrades outside of typical operating hours, as requested by the City, if applicable. | Desired | ||
| 7 | Training | Proposal includes vendor provided onsite training, materials and staff for initial training. | Critical | ||
| 8 | Training | Proposal includes 90-day onsite follow up training | Critical | ||
| 9 | Training | Price proposal includes post-implementation ad-hoc training options. | Critical | ||
| 10 | Updates | The system has the ability to allow for outage times to be based on a 24x7 basis instead of working hours. | Desired | ||
| 11 | Updates | Proposed maintenance plan includes all updates, upgrades, IT phone and/or remote support. | Critical | ||
| 12 | Updates | Proposal includes the method by which software is updated and how often the vendor plans to update any proposed software. | Desired |
Reporting
| ATTACHMENT F - REQUIREMENTS MATRIX | ||||
| Detroit Police Department Victim's Assistance Program Case Management and Reporting Software RFP # _________ | Vendor | Please note this document contains multiple tabs. | ||
| Available Responses | ||||
| C | Requirement Met and Proposed (Standard features available in the product) | 0 | ||
| A | Intent of Requirement Met and Proposed with Alternative | 0 | ||
| N | Requirement Not Met with Proposal | 0 |
TOTAL 0
| Req # | Function | Reporting Requirements | Criticality | Vendor Response | |
| (C, A, N) | Modules Required to Fulfill Requirements | Comments | |||
| 1 | Reporting | Proposed system can provide reports that reflect any period of time or data field requests, such as current week, month, or year to date statistics. | Critical | ||
| 2 | Reporting | The system has the ability to provide an integrated report writer. | Critical | ||
| 3 | Reporting | The system has the ability to provide a library of standard reports (i.e. "canned" reports). | Desired | ||
| 4 | Reporting | The system has the ability to drill down on reports. | Desired | ||
| 5 | Reporting | The system has the ability to allow a user to modify existing reports, with appropriate security permissions. | Desired | ||
| 6 | Reporting | The system has the ability to save a report as a new template after a user copies and modifies an existing report, with appropriate security permissions. | Desired | ||
| 7 | Reporting | The system has the ability to configure and save ad hoc reports by individual user, with the ability to provide access to other users with appropriate security permissions. | Critical | ||
| 8 | Reporting | The system has the ability to save favorite reports in a menu or pick-list by individual user. | Desired | ||
| 9 | Reporting | The system has the ability to allow generated reports to be viewed on screen prior to printing. | Desired | ||
| 10 | Reporting | The system has the ability to schedule reports to run in the future and/or on a recurring basis. | Critical | ||
| 11 | Reporting | The system allows for ad-hoc reporting based and can be exported to excel for further analysis | Desired | ||
| 12 | Reporting | Documentation, training, and procedures provided that will outline: | Desired | ||
| 12a | Reporting | How to access reports | Desired | ||
| 12b | Reporting | How to prepare reports | Desired | ||
| 12c | Reporting | How to utilize the data for the Department's reporting needs | Desired | ||
| 12d | Reporting | How to develop and edit stored procedures | Desired |
Security & Compliance
| ATTACHMENT A - REQUIREMENTS MATRIX | ||||
| Detroit Police Department Victim's Assistance Program Case Management and Reporting Software RFP # _________ | Vendor | Please note this document contains multiple tabs. | ||
| Available Responses | ||||
| C | Requirement Met and Proposed (Standard features available in the product) | 0 | ||
| A | Intent of Requirement Met and Proposed with Alternative | 0 | ||
| N | Requirement Not Met with Proposal | 0 |
TOTAL 0
| Req # | Function | Security Requirement | Criticality | Vendor Response | |
| (C, A, N) | Modules Required to Fulfill Requirements | Comments | |||
| 1 | SSO | The System has the ability to utilize the City's Microsoft Entra ID service for user validation, regardless of deployment method. | Critical | ||
| 2 | Multi Factor Authentication | The system has the ability to support Multi Factor Authentication (MFA) | Critical | ||
| 3 | Encryption | The system has the ability to encrypt data stored in the database. | Critical | ||
| 4 | Encryption | The system has the ability to encrypt data stored in the application. | Critical | ||
| 5 | Encryption | The system has the ability to encrypt data in transit. | Critical | ||
| 6 | Encryption | Please provide information as to what level of encryption/encryption methods are used in transit and at rest. | Critical | ||
| 7 | Role based security | The system has the ability to provide read, write, update, and delete access using role based security. | Critical | ||
| 8 | Role based security | The system has the ability to provide security at the following levels: | |||
| 8a | Role based security | Department or Agency; | Desired | ||
| 8b | Role based security | Division; | Critical | ||
| 8c | Role based security | Role or group; | Critical | ||
| 8d | Role based security | User ID; | Critical | ||
| 8e | Role based security | Screen; | Critical | ||
| 8f | Role based security | Menu; | Desired | ||
| 8g | Role based security | Report; | Desired | ||
| 8h | Role based security | Field; | Desired | ||
| 9 | Role based security | The system allows for departmental administrative self-service (e.g. ability to make changes to roles and workflows) with audit trail capability. | Critical | ||
| 10 | Role based security | The system has the ability to allow a City system administrator to add and change permissions for system access. | |||
| 11 | Compliance | The system is HIPAA compliant and vendor will enter into a BAA with the City. | Critical | ||
| 12 | Compliance | The system is CJIS compliant | Critical | ||
| 13 | Compliance | The system meets compliance rules / regulations in order to ensure the sensitive digital assets are guarded against loss, theft and misuse | Critical | ||
| 14 | Security Certifications | Please list any industry standard security certifications the solution / vendor has. (Ex: ISO 27001). | |||
| Please note annual SOC 2 type reports will be required via the City’s contract. | Critical | ||||
| 15 | Audit Capabilities | The system has the ability to track and audit changes throughout the system that creates a log of all records maintained and includes: | Critical | ||
| 15a | Audit Capabilities | Date; | Critical | ||
| 15b | Audit Capabilities | Time; | Critical | ||
| 15c | Audit Capabilities | User; | Critical | ||
| 15d | Audit Capabilities | Information prior to change; | Critical | ||
| 15e | Audit Capabilities | Changed information | Critical | ||
| 16 | Access Time Out | The system has the ability to log users off the system after an administrator-defined period of inactivity, based on user-defined roles. | Critical | ||
| 17 | Access Time Out | The system has the ability to allow a system administrator to log out users. | Critical | ||
| 18 | Security | The system has the ability to allow authorized users to have access to a log of security activity to determine users that have signed on and off the system, as well as unsuccessful attempts to sign on to the system. | Desired |
Backup and Recovery
| ATTACHMENT F - REQUIREMENTS MATRIX | |||
| RFP Name & RFP # _________ | Please note this document contains multiple tabs. | ||
| Backups / Business Continuity and Recovery RFP Questions | |||
| Please provide an answer or statement to all issues listed | |||
| Enter vendor name here | |||
| Prompt # | Topic | Vendor Response | |
| 1 | Proposers shall have a backup and recovery capability for the system and application, including incremental and full backup capabilities. Additionally, system backups shall be accomplished without taking the application out of service and without degradation of performance or disruption to City operations. | ||
| 2 | Proposers shall be able to provide the service from at least two geographically diverse data centers that do not share common threats (e.g., the data centers cannot be in the same earthquake zone, likely hurricane path, same flood zone, etc.). The data centers shall at a minimum meet Tier III standards for redundancy of power, telecommunications, HVAC, security, fire suppression and building integrity. |
• Where are the data center and storage facilities?
• The Proposer shall not store or transfer non-public City of Detroit data outside of the United States without the written consent of the City. This includes backup data and Disaster Recovery locations.
| 3 | Proposers shall specify whether, in the event of a technology or other failure at the primary processing center, the alternate system will meet the following tiers, for which the City’s use should be identical regardless of which location is processing the City’s work: |
| 3a | • High Availability – Continuous operation without interruption or degradation in service |
| 3b | • Standard availability – Available for City use within 48 hours with no degradation in service |
| 3c | • Non-Critical Availability – Available for City use within 96 hours with no degradation in service |
| 4 | Proposers shall implement crisis management, business continuity and disaster recovery plans, subject to City approval, which the City will not reasonably withhold. These plans shall outline how the Proposer will support the City’s recovery at the alternate site, including backup staff required to implement the plan in an emergency if the Proposer’s primary staff is unavailable. Such plans may also include annual testing in coordination with the City. |
| 5 | Proposers shall specify the System’s proven, maximum tolerable length of time that a computer, system, network, or application can be down after a failure or disaster occurs or its recovery time objective (“RTO”) and the amount of data at risk, as determined by the amount of time between data protection events, and as it reflects the amount of data that potentially could be lost during a disaster recovery point objective, (“RPO”) in case the primary site becomes unavailable. The selection of the RTO and RPO will be agreed upon objectives between the Proposer and the City. |
| 6 | Proposers shall specify whether the System will meet the following availability tiers, which tier, and shall specifically describe how the System meets such tier: |
| 6a | • High Availability, 99.982% |
RTO Characteristics and RPO: Intra-day, Typically involves data replication, to a hot-site for each transaction, or at short intervals, like 15 minutes.
6b • Standard Availability, 99.741% RTO Characteristics and RPO: 24 to 48 hours Nightly imaging to cloud / data center. System reestablished at time of disaster from cloud / data center. May lose up to one day of data.
6c • Non-Critical Availability, 99.671% RTO Characteristics and RPO: 48 to 56 hours, Nightly imaging to cloud / data center. System reestablished at time of disaster from cloud / data center. May lose up to one day of data.
7 Identify shared components of the system (e.g., network segments, backup tapes, etc.)
Cloud Checklist
| ATTACHMENT F - REQUIREMENTS MATRIX | |||
| RFP Name & RFP # _________ | Please note this document contains multiple tabs. | ||
| Cloud Service Provider Security Checklist | |||
| Please provide an answer or statement to all issues listed | |||
| Enter vendor name here | |||
| Prompt # | Topic | Vendor Response | |
| 1 | Identify what type of cloud storage the system uses. | ||
| 2 | Describe who is responsible uptime, maintenance, patching and administration of the server. | ||
| 3 | The provider must show diagram (and possible past examples) of their governance and notification processes for their services. | ||
| 4 | Describe how the provider will guarantee legal and regulatory compliance with government and sectorial (industry specific) laws and regulations. | ||
| 5 | Does the solution follow one of the following sets of security and privacy control best practices? Indicate which. | ||
| 5a | NIST Series | ||
| 5b | ISO/IEC Series | ||
| 5c | COBIT | ||
| 5d | ITIL | ||
| 6 | The vendor will provide to the City, at no additional cost, the most recent SOC 2 Type 2 report from its cloud hosting provider covering the environments used by the City. | ||
| 7 | Describe process for Account Management | ||
| 8 | Define who is responsible for security monitoring. If the City will be responsible for securing the environment, describe how the City will obtain logs to ingest into its SIEM. | ||
| 9 | Describe how a data inventory of City of Detroit Data Assets will be kept. | ||
| 10 | Will subcontractors be used? If yes, will all security controls be inherited by subcontractors? | ||
| 11 | Describe Public Key Infrastructure | ||
| 12 | Process for separation of data belonging to different consumers in a multi‐tenant environment. | ||
| 13 | Does the solution use a private, shared or hybrid cloud? | ||
| 14 | Process used to separation of network traffic in a shared multi‐tenant provider environment | ||
| 15 | Statement guaranteeing adherence to all privacy laws governing the physical areas of data storage. | ||
| 16 | Willing to participate in a Risk Assessment and Privacy Impact Assessment covering the storage of PII. | ||
| 17 | Network traffic must be screened and firewall protected network must have intrusion detection & prevention in place. | ||
| 18 | Network must have detailed logging and documented alerting capabilities. | ||
| 19 | Dedicate VLANs with dedicated virtual firewall. | ||
| 20 | Describe how the City of Detroit network access separated from provider network access. | ||
| 21 | Are the City of Detroit VMs are on a dedicated hypervisor? | ||
| 22 | Will provider's servers only communicate with the City of Detroit logical disk units? | ||
| 23 | Will online storage and backup media be scrubbed when retired or replaced? | ||
| 24 | Identify system environments that will be available to the City (e.g. production, development, test) | ||
| 25 | Identify shared components of the system (e.g., network segments, backup tapes, etc.) | ||
| 26 | Identify Data storage and transfer limits | ||
| 27 | Identify normal and peak bandwidth requirements |
File details come from the government source that posted it. Updated .