The file's text, extracted by GovTribe without its formatting.
ATTACHMENT B
PROFESSIONAL SERVICES DATA PRIVACY
ATTACHMENT
PROFESSIONAL SERVICES DATA PRIVACY
Consultant must answer the following questions relating to data privacy.
| 1 |
| Describe how City data created or associated with the project is stored and how access to it is restricted. |
| 2 |
| Describe all ways the City’s data that is created or collected as part of the project will be used for purposes beyond the City’s implementation of this scope. |
| 3 |
| Will third parties have access to this data for purposes other than those related to the project? Please provide details. |
| 4 |
| Have any third-party security or data protection assessments been performed? If yes, please provide the assessments. |
| 5 |
| How will Consultant obtain written approval from the City prior to sharing any City data with a third party? |
ATTACHMENT C
Cloud Technical Capabilities
CLOUD TECHNICAL CAPABILITIES
The terms “System”, “Software”, and “Application” is used throughout this attachment. These terms are meant to represent the Consultant’s proposed software and infrastructure, as applicable.
1. Consultant must respond to each individual capability by entering an ‘X’ in one of the non-grey columns provided. Select the appropriate response using the following guidelines below. If the columns are grey, provide a description in the “Describe” column.
| Standard |
| The capability is satisfied by the System proposed. |
· If the System requires specialized configuration, Consultant must enter required configuration in the “Describe” section provided.
· If the capability is satisfied by third-party software, please indicate the third-party product proposed.
| Customization |
| A modification to the System is required to satisfy the capability. |
· Consultant must provide an explanation of the work required to perform the modification in the “Describe” section provided.
| Not Available |
| The System will not satisfy the capability. |
2. Consultant to provide a brief explanation of how the capability will be satisfied for each capability.
| Describe |
| · If the capability is met by more than one module, Consultant must list which module or modules are required to satisfy the capability. |
· Consultant may also include screen shots, diagrams, samples, and inventories for any capability listed.
· If unable to meet the capability, Consultant must offer a brief explanation or propose an alternative way to meet the capability.
| Ref. No. |
| Capability |
| Standard |
| Customization |
| Not Available |
| Describe |
| 1. |
| The System will not be allowed to use the City’s email system. Describe how the System will send emails. |
| 2. |
| The proposed System must be hosted under a valid and registered domain name (e.g., https://yourcompany.vendor.com) and not solely accessible via an IP address. The System must: |
· Provide a fully qualified domain name (FQDN) for the hosted service.
· Not make use of raw IP addresses for production access, user login, or application endpoints.
| 3. |
| The System must run over a web browser and not require a thick or thin client for both administrative- and end-users. |
| 4. |
| If yes, all functionality is supported over a web browser. |
| 5. |
| If yes, System supports current browser versions, including but not limited to Firefox, Chrome, Edge and implements modern web standards. |
| 6. |
| If the System doesn’t run over a web browser, describe how the software runs (for example, via a thick client). |
| 7. |
| If via a thick or thin client, software must support remote, unattended/silent installation and configuration. |
| 8. |
| If the System provides a native mobile application, describe how the application renders on smart phones and/or tablets, including any hardware or operating system limitations. |
| 9. |
| If a mobile application is available, it continues to be functional during loss of network connectivity, e.g. store locally and automatic sync when network connectivity is available. Describe how this can be achieved. |
| 10. |
| Software is designed to run on a wide variety of form factors using a responsive or native design. |
Application Security
| 11. |
| System does not require users to have local administrator rights to access or use the solution. |
| 12. |
| System design adheres to the principle of least privilege (see, for reference, NIST’s definition: https://csrc.nist.gov/glossary/term/least_privilege). |
| 13. |
| System must allow the City to perform authenticated or non-authenticated scans and penetration tests without impact to production data, or provide the results of such recent scans and tests. |
| 14. |
| Application must comply with OWASP top 10 risks for web applications. |
| 15. |
| System operates with controls applied by mobile device and mobile application management technology services (MDM, MAM). |
| 16. |
| Application must support SAML for modern authentication protocols for single sign-on for City users and provide a mechanism for additional identity provider for constituents. |
| 17. |
| Describe how the System manages PCI-DSS data, should this data be used in the proposed System. |
| 18. |
| The security features provided in the System and by the hosting facility (if applicable) is compliant with the relevant industry recognized security standards. |
Data Security
| 19. |
| System has the ability to classify data elements and unstructured data that are regulated as private or otherwise not public under local, state or federal law. |
| 20. |
| System has the ability to mask and/or redact regulated not-public data from system views, query results, and outputs. |
| 21. |
| System has the ability to classify and prevent changes to structured or unstructured data elements that are considered official (immutable) government records within the System. |
| 22. |
| System has the ability to support input validation to maintain data quality and integrity. |
| 23. |
| System has the ability to prevent unauthorized users from changing or deleting data. |
| 24. |
| System has the ability to secure data transferred between the client (ie. on City devices, client devices, or a web browser) and the application. |
| 25. |
| System has the ability to encrypt data, including backups, at rest and in transmission. |
| 26. |
| System must ensure confidentiality, integrity and availability of the data. |
Secure Maintenance
| 27. |
| Describe how Consultant maintains an active vulnerability and threat-monitoring program that conforms to the following standards: |
· Zero day vulnerabilities are remediated within two business days Critical and high vulnerabilities are remediated within 30 business days
Cybersecurity
| 28. |
| System must protect City data and services with a firewall or other City-approved solution that excludes all network traffic to environments hosting City data and services, except that which is explicitly allowed. Examples of untrusted networks includes: |
· Internet
· Other customer networks
· Consultant management network
· Consultant corporate network
| 29. |
| System employs and monitors network and host-based intrusion detection and prevention solutions to protect City data and services. This includes anti-malware capabilities. |
| 30. |
| System employs a continuous security monitoring solution including the ability to manage and protect log files from tampering and retain logs for up to 12 months. |
| 31. |
| The System must ensure full separation of the City’s data from that of other customers, tenants, or clients on the same platform, and guarantee that no other customer can access the City’s data. |
| 32. |
| System must restrict access to City data and services by Consultant’s personnel to only those who have an approved business need. |
| 33. |
| System has the ability to log and report on physical access to infrastructure hosting City data and services. |
| 34. |
| System must ensure all City data, including backups, resides within the continental United States. |
| 35. |
| Describe how the System uses artificial intelligence to fulfill any of the functionality provided by the System. |
| 36. |
| System will not transmit city data over API to general purpose AI models such as ChatGPT. |
| D. |
| Auditability/Security Monitoring |
| 37. |
| System must include documented procedures to audit at least annually all user access accounts to City data. |
| 38. |
| System preserves and protects logs against tampering or deletion by privileged users. |
| 39. |
| System must have the capability to enforce auditing and log basic information about user access activity, administration activities, system events and errors, and access violation reports. Activity logs must capture at least the following: |
· User authentication
· Type of event
· Date and time
· Success or failure indication
· Origination of event Identity or name of affected data, system component or resource
| 40. |
| System logs and reports on security events including, but not exclusive to: |
· Log on
· Log off
· Failed Log on
· Account Locked
· Account Unlocked Password Reset
| 41. |
| System logs and reports on access/authentication changes including, but not exclusive to: |
· New account created
· Accounts disabled / enabled
· Account deleted
· Authorization changes such as adding user (or removing from) a new role or other evidence of an authorization change.
Privilege escalation (ie. escalation from any user role to system administrator role)
| 42. |
| System has the ability to implement ‘separation of duties’ (fraud prevention) controls around critical workflow and transaction changes and approvals. |
| 43. |
| System logs and reports on changes to configuration settings. |
| 44. |
| System logs and reports on application and data management events such as: |
· Data Element Changes
· System Error messages
· Files opened and closed
· Files modified
| 45. |
| System provides mechanism to consume secure SOAP-based and/or REST-based web services from external and internal systems. |
| 46. |
| System provides mechanism that can be automated to export data via batch process(es). |
| 47. |
| System provides capability for automated near real-time export of data out of the system. |
| 48. |
| System integration layer is kept on same upgrade schedule as the core system. |
| 49. |
| System provides a repeatable and automated mechanism to access to data required by the City to perform all reporting and ETL functions necessary to support business processes. |
| F. |
| Storage, Reporting, and Retrieval |
| 50. |
| System allows for the configuration of data retention rules within the System. |
| 51. |
| The System must include robust reporting functionality that meets both operational and strategic business needs. Specifically, the System must: |
· Provide a comprehensive set of standard out-of-the-box reports relevant to the solution’s core functions.
· Support the ability to generate custom reports based on business-specific criteria, including filtering, grouping, date ranges, and user-defined fields.
| 52. |
| All data collected within the System (whether it be out-of-the-box or customized) must be accessible via the System’s robust reporting functionality. |
Disaster Recovery
| 53. |
| System has the ability to back-up and restore data to support the following: |
· Recovery Point Objective: [24-hours – no more than 24-hours data loss.]
· Recovery Time Objective (Incidental Restore Requests): 4 hours
| 54. |
| System supports 99.99% uptime. |
| 55. |
| System supports testing or other verification of the disaster recovery process on an annual basis. |
| 56. |
| If available, describe how each release of the System is compliant with Section 508 and/ or WCAG2.1 AA specifications. |
| 57. |
| If available, describe how all interfaces (both for administrators and end-users) are compliant with Section 508 and/or WCAG2.1 AA specifications throughout the System’s lifecycle. |
ATTACHMENT D
Costs Worksheet
Pricing Tables – Recurring Fees for Service
| Service |
| Interval |
| Price Per Interval |
| Annual Price |
| (Example: Software) |
| (Monthly) |
| ($100.00/month) |
| ($1,200.00) |
Total Annual Cost: $____________
ATTACHMENT E
Prior Experience and Reference Form
Prior Experience and Reference Form
Company Name: ______________________________________________ Date: _______________________________________________________ List two (2) references able to attest to safety record and performance related to service requirements listed to provide services for shared mobility operations support. Please include City name, affiliation, work address and contact information. 1.____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________ 2.____________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________________
Provide list of municipalities within the past five (5) years related to service requirements listed in this solicitation. Provide Customer, Location and Date.
| Customer |
| Location |
| Dates of Service Provided |