10-Appendix F Control Requirements.pdf
PDF 114 KB Posted
- Attached to
- Family Medical Leave Assistance
- Solicitation number
- BYZ25 - 00028078
- Issued by
- Dallas County, Texas
About this file
This document is Appendix F Control Requirements for a contract with the City of Dallas, detailing comprehensive control and compliance specifications for a technology or service provider. The document outlines a detailed set of requirements spanning regulatory/legal compliance, financial controls, business continuity, disaster recovery planning, and policy adherence. Key areas include mandatory compliance with federal, state, and municipal regulations, the ability to retrieve data in a usable format, and alignment with City of Dallas financial controls.
The requirements are extensively focused on disaster recovery and business continuity, mandating that the proposer establish and maintain a robust disaster recovery plan with specific elements such as Recovery Time Objective (RTO), Recovery Point Objective (RPO), identification of critical IT assets, maximum acceptable outage time, and annual disaster recovery testing. Additional requirements include providing key personnel contact information, a communication and escalation plan, insurance coverage, and compliance with the City of Dallas' software systems policies, Information Technology Services security guidelines, and records retention schedules as defined by TSLAC (Texas State Library and Archives Commission).
View the file
Other files
Show all 30
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Appendix F Control Requirements
Req# Requirement Meets?
Y/N Comments
1.0 Regulatory/Legal
1.1 Contracts shall comply with Federal, State, and
Municipal regulations and requirements
1.2 The contract shall provide the capability to retrieve
data in a usable format.
2.0 Financial Control
2.1 Contractor will comply with City of Dallas financial
controls which shall be provided upon request.
3.0 Business Continuity
3.1 The solution shall have an established and maintained
disaster recovery plan for the duration on the engagement that shall include but not be limited to
3.1.1 Identification of the Recovery Time Objective
(RTO), Recovery Point Objective (RPO), and steps in a Disaster Recovery Declaration, implementation and return to production.
3.1.2 Identification of the most serious threats and
vulnerabilities.
3.1.3 Identification of the most critical IT assets and
determine their maximum outage time.
3.1.4 Identification of the Maximum Acceptable Outage
Time (MAOT). The MAOT is the longest period between the onset of a disaster and the resumption of the critical functions.
3.1.5 Identification of how the proposer’s annual disaster
recovery (DR) testing is accomplished.
3.1.6 Identification of how & when the DR Testing will be
reported from the proposer back to the City of Dallas.
3.1.7 Identification of how the inclusion of the DR testing
and validation as a milestone is in the project delivery phase.
3.1.8 Identification of proposer’s description of disaster
response actions immediately following an incident.
3.1.9 Identification of proposer’s assurance of support to
the City of Dallas for the DR transitions (to and from).
3.2 The proposer shall provide the key personnel and DR
team contact information that includes but is not limited to
3.2.1 Contact’s full name, email address and phone
number.
3.2.2 Communication plan and escalation process
3.2.3 Proposer Incident status frequency – every 30m, 45m, 60m.
3.2.4 Proposer support schedule e.g., (24x7
3.2.5 Escalation process controls.
3.3 When applicable a diagram of the City of Dallas
related network and recovery site(s), with instructions on how to reach the recovery site(s).
3.4 The City will establish as part of the contracting
process a set of SLAs to guide and ensure an acceptable and sustainable level of performance by the proposer.
3.5 When applicable the proposer shall provide a list of
software and systems that are used in the recovery process.
3.6 The proposer shall provide insurance coverage per City
of Dallas requirements.
3.7 In the event of an incident, the proposer shall provide
financial and legal processes where issues are encountered.
3.8 The system shall comply with City of Dallas backup
and recovery processes that include but are not limited to
3.8.1 When applicable, the proposer's disaster recovery
system shall ensure the integrity of the data and software.
3.8.2 The proposer must ensure that the computing
infrastructure that supports critical infrastructure business units and operating functions will be restored in accordance with the requirements of the City of Dallas.
3.8.3 When applicable the proposers must ensure against
catastrophic data loss and provide alternative means facility for continuing City essential services and critical business units and operating functions during a disaster.
3.8.4 The proposer shall have failover capability that will
allow for a quick recovery that meets documented RPO, RTO, and MAOT.
3.8.5 When applicable, the proposer shall demonstrate
their capability of a failover to their backup site or the city’s backup location, all shall fall under the accordance of City of Dallas requirements.
4.0 Policy
4.1 The system must comply with City of Dallas software
systems policies and Information Technology Services (ITS) security guidelines.
4.2 The system must manage and comply with records
retention requirements as defined by TSLAC records retention schedules.
File details come from the government source that posted it. Updated .