1-MWJ2603-Section 5 - 5.1-Interrogatories-FINAL.xlsx
XLSX spreadsheet 39 KB Posted
- Attached to
- Employment Screening Services
- Solicitation number
- MWJ2603
- Issued by
- Cook County, Illinois
About this file
This file contains Section 5.0 - Interrogatories for City Colleges of Chicago's RFP #MWJ2603 for Employment Screening Services, with proposals due March 30, 2026, no later than 12:00 PM (CST). The document is a comprehensive questionnaire designed to evaluate vendor capabilities across employment screening, pre-employment drug testing, and post-employment fitness for duty services. The interrogatories are divided into two primary sections: Functional Interrogatories covering 13 categories including company overview, background check services, social security number handling, drug and health screening, performance measurements, compliance, reporting and analytics, implementation, customer support, and technology; and Technical Interrogatories addressing 26 detailed categories specific to Software-as-a-Service (SaaS) cloud-based solutions, including application reporting, data management, integration capabilities, security protocols, and system architecture. The RFP explicitly requires vendors to provide a SaaS/cloud-based solution, not on-premise implementations.
The interrogatories establish extensive evaluation criteria for vendor qualification without specifying pricing terms within this document. Key requirements include Professional Background Screening Association (PBSA) accreditation, Fair Credit Reporting Act (FCRA) compliance capabilities, integration with Oracle Taleo 21B.0.2, support for QuantiFERON-Gold and Serology testing for nursing department screenings, multiple collection sites within Chicago city-proper with varying shift availability, disaster recovery capabilities, and comprehensive audit and compliance adherence including SOC II Type 1 and 2 certifications. The vendor must demonstrate the ability to consolidate screening and drug testing results into unified reports, provide Medical Review Officer services, support centralized management across multiple locations with configurable policies, and deliver service level agreements with defined response and resolution times. Vendors are required to provide extensive documentation including data security plans, preliminary project plans, sample service level agreements, and detailed information regarding data ownership, transfer protocols, and disposition procedures in the event of contract termination.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 3-MWJ2603-Employment Screening Services-RFP-FINAL-02172026.pdf | ||
| 2-MWJ2603-Section 7 - 7.9-Cost Proposal-FINAL.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Overview
| CITY COLLEGES OF CHICAGO |
| RFP #MWJ2603 - Employment Screening Services |
| Proposals Due: March 30, 2026, no later than 12:00pm (CST) |
| SECTION 5.0 - INTERROGATORIES |
| 1. This document contains the following tabs: |
| Overview Tab |
| Functional Interrogatories |
| Technical Interrogatories |
| 2. Format Alteration |
| DO NOT alter the layout or format of the spreadsheets in any way. Doing so may result in the loss of your company's data and exclusion from further consideration. You may expand the detailed response cell(s) of the spreadsheets only. |
Functional Interrogatories
| CITY COLLEGES OF CHICAGO |
| RFP #MWJ2603 - Employment Screening Services |
| Proposals Due: March 30, 2026, no later than 12:00pm (CST) |
| SECTION 5 - 5.1 - FUNCTIONAL INTERROGATORTIES |
Company's Name:
Provide detailed responses to the categories and questions below accordingly.
| Category | Item # | Description | Detailed responses |
| A. Company Overview | 1 | Provide your company name and contact information. | |
| 2 | Provide a brief overview of your company history and years providing services. | ||
| 3 | What are your hours of operations? | ||
| 4 | Outline your proposed account management team. | ||
| 5 | What is your client retention rate during the past 5 years? | ||
| 6 | List your lines of business and % dedicated to background screening. | ||
| 7 | Provide three higher education client references. | ||
| 8 | What makes your firm unique from competitors? | ||
| 9 | Are you accredited by PBSA? Professional Background Screening Association | ||
| 10 | Describe your dedication to a safe workplace. | ||
| 11 | List any lawsuits related to background check non-compliance. | ||
| 12 | Describe problem identification and resolution. | ||
| 13 | Describe tools provided for client questions. | ||
| 14 | Provide addresses for drug testing facilities. | ||
| 15 | Provide turnaround times for background and drug screening. | ||
| 16 | Can results be provided within five business days? | ||
| B. Background Check Services | 1 | Which databases, registries, and exclusion lists are included in the searches you conduct? | |
| 2 | Describe each service you provide and how you go about obtaining that information, (including the frequency of downloading information from sources / frequency) in as much detail as possible. | ||
| 3 | Do you provide any industry-specific services that would benefit us? | ||
| 4 | For verifications (i.e., education, employment), how many attempts do you make to retrieve the information? | ||
| 5 | Do you offer electronic I-9 verification services? | ||
| 6 | What is the average time to complete criminal background checks? | ||
| 7 | What is the average time to complete health screenings, court searches, verifications, and reference checks? | ||
| 8 | What percentage of background checks do you complete on the first attempt? | ||
| 9 | How many attempts do you make when conducting employment and educational verifications? | ||
| 10 | Are individuals who are making verifications trained to understand the nuances of requesting verification information from US employers and educational institutions? | ||
| 11 | County Criminal history courthouse searches – How far back do the Country Criminal searches go? Do you charge more for a search that goes back farther than seven years? Are the county searches conducted physically at the county courthouse or through an electronic database? | ||
| C. Social Security Number | 1 | How do you handle additional names or aliases? Is there an additional charge for researching that information? | |
| 2 | Driving Records (Motor Vehicle Records) (National DMV searches = 0-12 / year). List states that are available and any special access restrictions. | ||
| 3 | Education verification (Frequency = 0-12 / year) - How many attempts are made in order to verify education? | ||
| 4 | Reference Checks - Indicate if both Employment Reference Checks and Personal Reference checks are available. How many attempts are made in order to obtain references? | ||
| 5 | International Screening (Frequency = 0-12 / year) - Does your company provide employment screening on an international basis? If yes, please describe in detail. If so, is your company Safe Harbor Certified? Does your company provide for international dispute handling? If so, describe. | ||
| 6 | What is your “Unable to Verify” rate? | ||
| 7 | Do you offer services we can use to screen our extended workforce (i.e., vendors, third party contractors, volunteers, etc.)? | ||
| 8 | Do you work with any vendor partners to deliver your services? How do you ensure the quality of work done by these partners? | ||
| 9 | Will you reach out to the candidate to obtain additional information if required? If so, what is your process for doing this? | ||
| 10 | Describe the candidate experience when working with your organization. In what ways do you interact with our candidates? | ||
| 11 | How often do candidates dispute information reported in their background check? | ||
| 12 | Do you provide services to screen candidates who have education and work history outside of the United States? How much additional data collection time and cost are these screenings? | ||
| 13 | Background screening: In order to verify candidate work history, CCC requests that candidates cannot select the option “No” to contact their previous employers; unless it’s the current employer. Can your company meet this requirement? | ||
| D. Drug and Health Screening | 1 | List the major steps in processing a drug test result (both Department of Transportation [DOT] and non-DOT) for both a NON-NIDA 5 and 9-Panel Pre-Employment Drug Screen. Include tesing via hair samples | |
| 2 | Are Collection Services Personnel certified as a Breath Alcohol Technician (BAT)? | ||
| 3 | Are Collection Services Personnel trained to be proficient in the following areas: | ||
| Steps to prepare and secure the collection site. | |||
| Transmission of the Chain of Custody Form (COC). | |||
| Use of the collection kit and shipping materials. | |||
| Preliminary steps in collections. | |||
| Role in checking specimens. | |||
| Role in directly observed collections. | |||
| Role in monitored collections. | |||
| Role in split specimen collections. | |||
| Chain of custody completion and finishing the collection process. | |||
| Actions to be taken in case of refusals to take a test. | |||
| Actions to be taken in case of shy bladder or shy lung. | |||
| Familiar with collector errors in tests, their effects, and means of correction, e.g. fatal flaws, correctable flaws. | |||
| Collection procedures if an employee refuses to cooperate with the collection process. | |||
| 4 | Do you offer QuantiFERON-Gold testing? (Nursing department test) | ||
| 5 | Do you offer Serology testing for: (Nursing department test): | ||
| Measles | |||
| Mumps | |||
| Rubella | |||
| Varicella | |||
| Hepatitis B surface Antigen | |||
| Hepatitis B Surface Antibody | |||
| 6 | Do you offer 10 Panel Drug Screening (Nursing department test)? | ||
| 7 | What is the time frame for receiving drug screen results for negative and positive results? | ||
| 8 | Will drug screening and background screening results be consolidated into one report? | ||
| 9 | Will collection site fees and standard drug screening fees be consolidated into one bill? Do you offer Medical Review Officer (MRO) services? Do you have an in-house MRO? | ||
| 10 | Is the MRO a member of the National Registry of Certified Medical Examiners? | ||
| 11 | How will collection site identification be handled? Describe your process for managing your collection site network. Include how you monitor collection site performance. | ||
| 12 | How do you handle onsite collection needs? Does your company have the ability to provide support for onsite testing and reporting? | ||
| 13 | Will you provide Chain of Custody (COC) forms? | ||
| 14 | How do we order additional COC forms? Who pays for these supplies? | ||
| 15 | Do you have an electronic COC solution? If so, please describe. | ||
| 16 | From which laboratories do you have result downloads established? List your lab partners and their certifications. | ||
| 17 | How frequently are downloads received from each laboratory? | ||
| 18 | What are your emergency collection services for post accident and reasonable cause tests? | ||
| 19 | Do you offer random program management services? What is your process for random selection? Is it a computer-based random generation program? Describe the process and how the monthly lists are generated. | ||
| 20 | What random program information is viewable on your website? | ||
| 21 | Are you able to provide the necessary and appropriate services, materials and equipment to perform breath alcohol testing? Who administers the breath alcohol tests? What is the minimum and maximum time frames for receiving results? | ||
| 22 | Please provide a list of locations in the Chicago city-proper area, working hours of each site, parking availability, 2nd or 3rd shift testing availability. | ||
| 23 | Do you have mobile test vans available and if so, what are the hours of availability and can they service all of our locations within the Chicago city-proper area? | ||
| 24 | Do you offer testing for Tuberculosis? | ||
| E. Performance Measurements / Quality | 1 | What is your average turnaround time for reports? | |
| 2 | How do you calculate turnaround time? Is there an order entry cutoff time? | ||
| 3 | What services can you provide to improve our overall time to hire? | ||
| 4 | Describe your quality assurance program. | ||
| 5 | How many background checks receive a quality audit? | ||
| 6 | Does your company use Six Sigma for ongoing process improvement? | ||
| 7 | Does your company conduct client satisfaction surveys? How often? How do you score your surveys? | ||
| 8 | What other metrics do you use to measure customer satisfaction? | ||
| 9 | Do you conduct customer service surveys? Customer service surveys would refer to CCC user community. If so, how frequently? | ||
| 10 | Do you conduct candidate surveys? Candidate survey would refer to the candidates- ease of using the system. If so, how frequently? | ||
| 11 | Describe your employee qualifications and employee training program. | ||
| 12 | How do you measure success? | ||
| F. Compliance | 1 | How do you comply with the FCRA? What tools do you offer to ensure that we are in compliance with FCRA regulations? Fair Credit Reporting Act | |
| 2 | What methods do you use to keep customers updated about regulatory changes for any applicable laws or applicable court rulings? | ||
| 3 | Describe the process for handling candidate disputes on a background report. Would we receive a copy of this dispute? Describe the details of your appeal process. | ||
| 4 | Do you offer automated tools to assist us in the pre-adverse and adverse action process, if required? | ||
| 5 | How do you help customers review and update an existing program for compliance and efficiency? | ||
| G. Reporting / Analytics | 1 | How is the status of a background check reported and how often are status reports done? | |
| 2 | Provide a list of the standard management reports that you provide. Describe the purpose, frequency and timing of each report. Provide samples of each of these reports. | ||
| 3 | What makes your reports different than others available in the market? | ||
| 4 | Would we have the ability to access any information in the database, subject to security limitations, for ad-hoc reporting? | ||
| 5 | Can report queries be saved, copied, modified and reused? | ||
| 6 | Can reports be filtered based on specified criteria, including any custom client fields? | ||
| H. Implementation | 1 | Describe the timeline services proposed can be delivered in. | |
| 2 | Define your implementation methodology. | ||
| 3 | Do you have a dedicated implementation team? If so, what are their qualifications? | ||
| 4 | Do you have a dedicated technical implementation team? If so, what services do they provide? | ||
| 5 | What training is provided to the customer (e.g., administrator training, end-user)? | ||
| 6 | Describe the project management services and tools that your firm will provide during implementation (i.e., routine project management calls, issues log tracking, timelines, meeting notes, budget tracking, etc.). | ||
| I. Ongoing Customer Support | 1 | Describe the structure of your service team. | |
| 2 | What methods are available for contact? | ||
| 3 | State your support team’s availability. | ||
| 4 | What is your problem resolution process? | ||
| 5 | Describe your approach to ensure a successful handoff if the implementation team and ongoing administration teams are different. | ||
| 6 | Describe your ongoing communication services and the target audiences your services support. Describe any workshops or training sessions, printed materials and tools, targeted emails and online access to information and education that you provide. | ||
| 7 | How does your service team gain visibility to our account to ensure consistency in response and service? | ||
| 8 | What opportunity will we have to engage with your other clients for best practices purposes? | ||
| J. Technology | 1 | Do you offer technology to automate background check requests and report delivery? | |
| 2 | Describe your back-end systems. | ||
| 3 | Describe your system’s ability to scale. | ||
| 4 | Is your technology HR-XML standard compliant? | ||
| 5 | Have you integrated with any Applicant Tracking System (ATS) or Human Resource Information System (HRIS) providers? If so, which vendors? How many active integrations do you have? | ||
| 6 | What is the timeline and cost for integration with Oracle Taleo 21B.0.2? | ||
| 7 | Are your integrations pre-built and easily and quickly configurable, or are they custom? | ||
| 8 | How do you support your integrated accounts? | ||
| 9 | What features are available through your integrations? | ||
| 10 | Do you have the ability to integrate with any data form or representation and a variety of transport protocols? | ||
| 11 | What processes are in place to ensure the quality of the information submitted and received? Can the system detect when data is invalid? | ||
| 12 | Does the system automate additional criminal searches based on available information? | ||
| 13 | Please state your company’s ability to integrate with the current Taleo Enterprise 21B.0.2 system. | ||
| K. System Capabilities | 1 | Describe your user interface. | |
| 2 | Describe any technical features that you have created to provide greater efficiency for your clients. | ||
| 3 | What methods are available for entering information into your system? | ||
| L. Data Security | 1 | What are your data security protocols? | |
| 2 | Provide a copy of your data security plan. | ||
| 3 | How many years of data history will you support? | ||
| 4 | Do you have a formal disaster recovery plan that facilitates restoration of services in the wake of an unexpected disruptive event? If yes, please describe in detail. | ||
| 5 | Does the data center have a back-up location? | ||
| 6 | How soon can you recover lost data? | ||
| 7 | What system and network resources are monitored to ensure application uptime? | ||
| 8 | Has your organization ever experienced a data breach or a loss of sensitive personal information? If so, please describe. (Made change) | ||
| 9 | What safeguards are in place to ensure the safety of sensitive personal information? | ||
| 10 | Detail the controls your organization has in place to maintain the confidentiality of all information obtained from your clients and surrounding your client’s customer’s information. | ||
| 11 | How frequently are your employees required to change passwords? How frequently are your customers required to change passwords? | ||
| 12 | Do you have the ability to maintain and set up a security list and allow users visibility to only certain functions? | ||
| 13 | What system tools are in place to monitor system performance? | ||
| 14 | What are the gaps in your current ability to proactively monitor network, system, and application performance? | ||
| 15 | What specific browser settings are necessary for your product to work? | ||
| 16 | Do you allow your customers to conduct audits of your operations? | ||
| 17 | Describe your ability to support centralized management of orders submitted from many locations. Does your capability allow for separate policies among multiple locations, and if so can these policies be managed by our key managers? | ||
| M. Summary | 1 | Describe any additional value-added services you provide. | |
| 2 | Include any additional information that might be useful in evaluating your proposal. |
Technical Interrogatories
| CITY COLLEGES OF CHICAGO |
| RFP #MWJ2603 - Employment Screening Services |
| Proposals Due: March 30, 2026, no later than 12:00pm (CST) |
| Section 5 - 5.1 - Technical Interrogatories |
| Company's name: |
Provide detailed responses to the categories and questions below accordingly.
Please note that CCC is only interested in SAAS (Software-as-a-Service/Cloud-based solution)
| Item # | Category | Sub-Category | SAAS (Software as a Service) | Detailed responses |
| 1 | Application | Reporting | List and describe all reports included in the base application. | |
| Please differentiate between transactional versus analytical reports | ||||
| How do you manage reporting access? | ||||
| 2 | Application | Reporting Tools | Do you provide an ad-hoc reporting tool? Is access to this tool limited by user groups or other method? | |
| Do you provide real-time reporting? | ||||
| Is a separate reporting environment available for high-volume analytics? Is this required? | ||||
| What online and offline file formats are supported (pdf, MS-Word/Excel, XML, etc…) | ||||
| 3 | Application | Data Extract / Import | Do you provide a tool to extract or import information from/to your system? | |
| If so, what formats are supported (pdf, MS-Word/Excel, XML, etc…) | ||||
| Are there any system constraints or limits to the amount of information that can be imported/extracted? | ||||
| Is there information that cannot be imported/extracted? | ||||
| 4 | Application | Access to Data Model | Do you provide a data model (diagram) and/or data dictionary for your application? | |
| What options are available for CCC to access your system data? Do you allow backend database or system updates or is it view-only? | ||||
| Do you provide delivered APIs to access information? Please describe their functionality. | ||||
| Do you provide tools to allow CCC to “mass update” high volume information as appropriate? | ||||
| 5 | Application | Integration / Interface | List integration and/or interfaces delivered with the standard system. | |
| What information do you need CCC to provide to your application (required versus optional)? How frequently? What formats are acceptable? | ||||
| Describe any delivered integrations available with 3rd parties (e.g., PeopleSoft)? | ||||
| What forms of secure transmission do you support: sftp? ssl? ftp with pgp? Other? | ||||
| What integration options are available (real-time services, batch, near real-time, etc…)? | ||||
| Do you utilize the following technologies: SOAP, REST, SAML | ||||
| 6 | Application | Configuration / Customization / Branding | For an average client, what is the percentage of customizations versus configuration? | |
| Give an example of a common customization or a situation where a customization is required (i.e., something that cannot be configured as delivered) | ||||
| Provide two examples of “complex” customizations. | ||||
| To what extent can CCC “brand” the application (differentiate between customization and configuration)? | ||||
| What skill sets are required to configure the application (how much training is required and what training/support materials are delivered)? | ||||
| Who performs the customizations (CCC and/or Vendor)? If CCC is allowed to customize, what is allowable to avoid violating the licensing agreement/warranty? | ||||
| Describe all the areas that can be “configured” (e.g., setup, transaction processes, security, workflow, online validations, etc…) | ||||
| 7 | Application | Workflow / Approvals /Proxy | Does your application allow configurable workflow? | |
| Does your application allow workflow approvals (multi-levels)? | ||||
| How does your application handle workflow proxy? | ||||
| How does your application handle escalations? | ||||
| 8 | Application | Transaction Audits | What types of transaction audits are available with the standard system? What information is not audited? | |
| Do the delivered transaction audits affect system performance? | ||||
| Is the audit data readily available for access? To whom? | ||||
| At what point do you purge the audit information? | ||||
| 9 | Application | Data Integrity / Validations | Explain in detail how the application maintains data quality and integrity (address online, batch, etc…) | |
| For situations where there is not an “edit” to maintain data quality/integrity, what other safeguards are available as delivered (e.g., reports, periodic batch validation programs, etc.…) | ||||
| 10 | Application | Operations / Scheduling | How are interfaces, reports, and other batch processes scheduled and the results distributed? | |
| Differentiate between CCC and Vendor responsibilities and access. | ||||
| 11 | Application | Communications (Email) | Provide network bandwidth requirements for the various functions within this application | |
| Does this application work with caching servers? Is there a specific configuration needed? | ||||
| Is a dedicated circuit required? | ||||
| If yes, is the connection encrypted, provide detail? | ||||
| 13 | Network | Firewall Rules | Describe the ports needed to communicate with this application. | |
| 14 | Network | Redundancy / Failover / Load Balancing | Explain what safeguards are in place to minimize the risks of failure (address appropriate tiers) | |
| Explain your load balancing capabilities (address appropriate tiers) | ||||
| 15 | Network | Data Flow | Provide a diagram of data flows through the various tiers and systems in the environment. Include ports and protocols of those data flows. | |
| 16 | Servers | Hardware Requirements | Provide high-level documentation of your hardware architecture – Address the following categories: Servers, Memory, CPU, Virtualization, Operating System, Storage, etc.…) | |
| 17 | Servers | VPN | Does your application encrypt the session between the server and the end user? | |
| 18 | Storage / Environments | Environments Required (Dev, QA, Prod, Training, Production Mirror, etc.…) | What environments are standard? | |
| Describe each environment | ||||
| Discuss how the environments are maintained (i.e., upgraded, cloned, refreshed, etc.…) | ||||
| Explain the process to migrate data between various environments (e.g., setup data from Dev to QA). Do you provide delivered scripts and/or processes? | ||||
| Can CCC request additional environments as needed for the build-out as well as future needs (e.g., Development, Testing, Production, Training, etc.…)? What database platform do you utilize? | ||||
| How do you determine the initial database size? How do you adjust for actual and planned growth? | ||||
| How much space is included in the standard offering for each environment? | ||||
| What is the incremental cost for additional environments and/or space requirements? | ||||
| 19 | Storage / Database | Data Purge, Retention, Backup, Restore, and Recovery | Discuss your data archive, purge, and retention strategy as it relates to various tiers. | |
| Discuss your backup, restore, and recovery strategy as it relates to various tiers. | ||||
| What is provided as part of your standard offering? | ||||
| Will our business be subject to mandatory purging and/or archival? | ||||
| 20 | Remote Hosting | Disaster / Recovery, Business Continuity | Discuss your Disaster/Recovery (DR) capabilities and architecture. | |
| Do you have a business continuity template or initial plan? | ||||
| How often do you test Disaster Recovery with each client? | ||||
| What is the maximum data loss in the event of catastrophic system failure? | ||||
| How long will the system be down (i.e., timing for switching over to secondary system/application and bringing it online)? | ||||
| What are your SLA’s related to DR? | ||||
| 21 | Remote Hosting | Data Center Capabilities | Where is the data center located? If there are multiple, please specify primary, alternate(s) | |
| Is the data center owned or leased? | ||||
| If leased, please provide details around agreement with 3rd party (including major terms and expiration dates). | ||||
| Who manages and maintains the data center? | ||||
| Is the data center secure? How do you maintain security? Please detail and address following areas at a minimum: | ||||
| Network Security | ||||
| Server Security | ||||
| Application Security | ||||
| Physical Security | ||||
| Database Security | ||||
| Data/Information Security (Personal Identifying Information - PII) | ||||
| Operating System Security | ||||
| Shared versus Dedicated Environments | ||||
| 22 | Remote Hosting | System/Application Availability | Describe what system availability guarantees you offer and the costs associated | |
| How do you backup your guarantee? What are the consequences of not meeting the guarantee? | ||||
| Define how the guarantee applies to all hosted applications, systems, and/or tiers | ||||
| Do you currently offer High Availability (HA)? If so, please provide separately the options and costs-related | ||||
| If no, do you have any plans to offer HA within the next two years? If yes, please provide as much details as possible. | ||||
| 23 | Remote Hosting | Audit and Compliance | Please describe in detail what type of auditing (SAS 70, SSAE 16, SOC 1, 2, or 3, etc.…) you adhere to. | |
| Please provide the dates and types of your most recent audits (if more than one type) and who they were conducted by. | ||||
| Detail any major deficiencies that were identified and how they were remedied. | ||||
| Please describe your audit schedule and when your next audits will be conducted? | ||||
| When was the most recent 3rd party audit performed and can you provide the results to CCC? | ||||
| 24 | Remote Hosting | Maintenance | Provide a schedule of your data center maintenance schedule for the upcoming calendar year and include planned system downtime/durations | |
| Discuss unplanned maintenance: | ||||
| Process | ||||
| Communication to CCC | ||||
| Alerts | ||||
| RCA – Root Cause Analysis | ||||
| 25 | Remote Hosting | Monitoring | What monitoring tools do you offer? | |
| Which tiers/areas are monitored? | ||||
| Hardware System Availability | ||||
| System Connectivity Availability | ||||
| Communication Protocol Delivery | ||||
| Network Reliability and Performance | ||||
| Operating System Availability | ||||
| Database Access Availability | ||||
| OLTP Performance | ||||
| Batch Processing Performance | ||||
| Other | ||||
| Please describe the alert process and timing | ||||
| What is the demarcation point (vendor/CCC)? | ||||
| Does your monitoring extend to CCC? Are there additional costs for the end-to-end monitoring? | ||||
| What access will you provide to CCC (dashboard, reports, etc.…) and what is the frequency of updates? | ||||
| Discuss what tools and/or applications do you utilize to ensure maximum system availability? | ||||
| How do you proactively identify potential issues? | ||||
| 26 | Remote Hosting | Infrastructure Architecture | Describe the physical hardware environment and architecture, including servers, storage and software you will utilize and/or provide as part of the agreement. Please diagram initial state, as well as what it might look like based on the 5 year growth projections. | |
| Please clearly differentiate which resources/tiers are dedicated for CCC versus what will be shared with other organizations | ||||
| Do you utilize virtualization? Please explain. | ||||
| What capital upgrades are you undertaking or plan to make within the next two years? How will this impact the agreement and costs? | ||||
| How do you maintain a current system (latest patches, releases, hardware/software, etc.…) – Please discuss CCC versus Vendor roles, responsibilities, and costs. | ||||
| 27 | Security | Various tiers - Access, Roles | Explain how you provision users and restrict access for various tiers by roles and responsibility (authorization)? | |
| Do you have the capability to import user access roles from other systems? | ||||
| 28 | Security | LDAP / AD, Single Sign-on (SSO) | Discuss your system’s ability to utilize LDAP or AD to authenticate and/or authorize? Is this delivered or does it have to be built? | |
| Discuss examples of single sign-on (SSO) capabilities to provide seamless user access as they transition between multiple systems and/or applications | ||||
| 29 | Security | Database security | Explain how highly confidential data is maintained and encrypted during storage | |
| 30 | Security | Data Center / Physical Security | Provide an overview of your data center and its operations and controls | |
| Discuss physical security to limit unauthorized access to that data center | ||||
| 31 | Security | Intrusion Detection / Virus | What safeguards are in place to prevent malicious 3rd party attacks and intrusion? | |
| Do you have automated logging for all application activity? | ||||
| How do ensure that your system is current to prevent all malware? | ||||
| How does your application prevent threats such as SQL injection? | ||||
| 32 | Security | General | What security logs does the host provider maintain and which tiers? | |
| Upon request, vendor needs to provide CCC access to security logs | ||||
| What security standards and methods are utilized (SSL/VPN Tunnel, Antivirus, Encryption, etc.…) | ||||
| The vendor shall provide applicable Service Organization Reports (SOC II type 1 and 2) or complete the CCC Audit Checklist if it does not perform SOC testing | ||||
| 33 | Data Security/Risk | Open Data Source | Do you use open data sources in our application? | |
| How do you insure security? | ||||
| How do you insure stability (i.e., adjust for 3rd party changes) | ||||
| How do you use open data sources? | ||||
| 34 | Implementation | SDLC – Methodology | Discuss your implementation methodology – What are the phases, tasks, responsibilities, and deliverables | |
| Discuss your post-implementation activities and support as part of the standard offering | ||||
| 35 | Implementation | Preliminary Project Plan | Provide a preliminary project plan for CCC taking into consideration our requirements (with assumptions). Include major milestones and key deliverables | |
| 36 | Implementation | Project Charter and other deliverables | As appropriate, provide a sample charter and some representative project deliverables | |
| 37 | Implementation | Vendor Tasks / Responsibilities | What are high-level tasks required of CCC and the vendor? | |
| 38 | Implementation | Change Management, Training, Communications | Is change management included in your standard offering? Discuss your change management strategy, responsibilities, dependencies, and tasks | |
| Is communication included in your standard offering? Discuss your communication strategy, responsibilities, dependencies, and tasks | ||||
| Is training included in your standard offering? Discuss your training strategy, responsibilities, dependencies, and tasks | ||||
| What post-implementation training do you provide and to what audience? How often are the classes? Where are they located? What training options are available? Who conducts the training? | ||||
| 39 | Ongoing Maintenance | Project / Application Documentation | What documentation do you provide for the project implementation and ongoing use? | |
| 40 | Ongoing Maintenance | Upgrades, Releases, Patches | What is the most current release? When was it first available? When is the next release scheduled? What is currently included in the next release? | |
| What major functionality or bug/fixes are you currently planning to implement in the future? | ||||
| Describe the process for customers to provide input into your future releases | ||||
| Discuss your patch, upgrade, and release strategy and address the following: Frequency, Time to Apply, Roles and Responsibilities, Dependencies, Testing, Contingency/Rollback, etc.… | ||||
| Describe your process for providing release notes (timing, formats, content)? | ||||
| Discuss how a change (configuration or customization) moves from request, development, testing, and production. | ||||
| Describe your change control and version control process. | ||||
| Describe what is included in your maintenance agreement as it relates to application/system bug/fixes. | ||||
| 41 | Ongoing Maintenance | Support/Call Center - Response, Resolution, Escalations, Hand-off (CCC and Vendor) - SLAs | Provide a sample Service Level Agreement document specifying response and resolution times for Production/Non-Production (based on various severities/priorities/tiered support) | |
| How do you adjust your employee resources for peak times? | ||||
| Describe your help desk support activities and process. How would you coordinate with CCC’S centralized Service Desk? | ||||
| Are there penalties if SLAs are not met, describe? | ||||
| Describe the support team (work location, offshore/offsite, working hours, etc.…) | ||||
| 42 | Ongoing Maintenance | Warranties | What do you warranty as part of your standard offering? | |
| 43 | Ongoing Maintenance | Availability: System, Application, Network, Servers, etc.… | Discuss your guaranteed application and system availability (percentage) | |
| Discuss your planned outages (address all tiers) | ||||
| How flexible is your maintenance windows and can it be integrated and/or coordinated with CCC? | ||||
| 44 | Other | Web 3.0 capabilities | List and describe your Web 3.0 capabilities? Provide examples. | |
| 45 | Other | Scalability - Various Tiers | Describe how your architecture (system resources) supports peak times and considers various concurrent activities (online, batch, services, reporting, etc.…) | |
| Provide your performance SLA’s and describe the process, impact, and timing to scale (planned and unplanned) | ||||
| 46 | Other | Smart / Mobile Device Capabilities | Does your application support smart and/or mobile devices? Can you provide examples? | |
| 47 | Other | Stress / Performance assurances / peak times | Discuss your strategies for performance/stress testing to ensure maximum system efficiency during normal and peak times | |
| How do you ensure adequate network bandwidth? | ||||
| 48 | Other | Additional software licenses | Is there specific 3rd party software required for your application? | |
| 49 | Other | Client hardware / software / version requirements | Detail specific client workstation and/or software versions and requirements (e.g., web browsers, desktop memory, display resolution, etc.…) | |
| 50 | Government Regulations | HIPPA, SOX, FERPA, GDPR, Security, Data Retention | With which government requirements/mandates do you comply (HIPPA, ADA Section 508, FERPA, GDPR, etc.…)? | |
| Clearly delineate between Vendor and CCC responsibility as it relates to compliance with government law, regulations, contracts, etc.… | ||||
| 51 | Legal | Electronic Signatures | Discuss if and/or how your application utilizes and facilitates electronic signatures. Provide an example. | |
| 52 | Value-added | Provide a listing of all Vendor value-added offerings. | ||
| Example of offerings: | ||||
| Account Management | ||||
| Advisory Services | ||||
| Database and Server administration, Tuning, Monitoring, Capacity Planning, or Performance | ||||
| Third Party Integration Support | ||||
| Programming and Customization Services | ||||
| Extra environments | ||||
| Extra storage | ||||
| Licenses | ||||
| Additional Tools | ||||
| Training | ||||
| Other | ||||
| Please describe in detail the policies and procedures for termination of services, including any fees, charges or penalties. | ||||
| 53 | Legal | Exit agreements (tasks / responsibilities) / Data agreements | Please discuss ownership of data and transfer of data back to CCC in the event of termination | |
| Please provide a high-level plan that details tasks, responsibilities, and time/duration guarantees | ||||
| What is your policy on maintaining, securing, and distribution (internal/external) of CCC data | ||||
| In addition, describe your policies and procedures for the disposition of CCC data on devices not returned to CCC. |
File details come from the government source that posted it. Updated .