11-Harris County Universal Services Reference Architecture Questionnaire (Q-38AL).xlsx
XLSX spreadsheet 23 KB Posted
- Solicitation number
- 26/0108
- Issued by
- Harris County, Texas
About this file
This is a Universal Services Reference Architecture Questionnaire (USRA) with AI assessment document for Harris County, Texas, designed to evaluate vendors' proposed solutions for a Financial Reporting System for the Harris County Auditor's Office, with service commencement anticipated on or about October 1, 2026, for an initial term of one year. The questionnaire is comprehensive and structured across multiple technology domains, including solution architecture, digital services, data services, enterprise technology infrastructure, information security, IT service management, and custom application development. Vendors are required to address detailed specifications regarding deployment models (on-premise, cloud, or hybrid), system architecture including AI components, operational transparency, scalability, mobile strategy support, and integration capabilities with existing County systems. The assessment also encompasses critical security and compliance requirements, including vulnerability management, authentication and authorization protocols, data encryption standards, audit trail capabilities, disaster recovery procedures, and adherence to ITIL v4 frameworks with specified service level agreements of 99.95% availability and 5-second average response times.
The questionnaire places significant emphasis on artificial intelligence governance, requiring vendors to detail AI technologies employed, model monitoring and performance tracking in production environments, risk management of third-party AI models and open-source components, human oversight mechanisms for high-impact decisions, training data validation and governance, and incident response protocols specific to AI-related cybersecurity events. Vendors must demonstrate compliance with Harris County's data security and privacy policies, confirm that all County data remains physically stored within the United States, address data repatriation capabilities, and establish clear data ownership and protection frameworks. Additional requirements include documentation of development methodologies, quality assurance processes, data analytics and visualization functions, support for emerging technologies, and provisions for legally required data-subject rights. The document does not specify pricing terms, set-asides, incumbents, or funding amounts, indicating this questionnaire serves as an evaluation instrument for vendor technical capability and solution design rather than a procurement notice containing financial parameters.
View the file
Other files
Show all 16
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
USRA With AI Questions
| No | Subcategories | Questions | Vendor Response | Vendor Additional Comments | Reference Documents/Links |
| (Yes, No, N/A) | |||||
| Solution Architecture | |||||
| 1 | Deployment Model | What type of solution is proposed (On-premise, cloud or hybrid) | |||
| If the proposed solution is on-premise, please elaborate briefly on the hardware, software, and infrastructure requirements for the proposed on-premise solution? | |||||
| If the proposed solution is a hybrid model, please explain how the on-premise and cloud components are integrated and managed? | |||||
| If the proposed solution is cloud-based, please elaborate on the solution architecture briefly, including the service model, provider and any specific cloud services utilized? | |||||
| Does the proposed solution rely upon multitenancy? If "Yes", please elaborate on the architecture implemented and the security protocols used. | |||||
| Where are AI models hosted? Provide names of external model providers and specific model versions. | |||||
| 2 | Architecture | Can the vendor provide an architecture diagram and/or documentation of the proposed solution showing all the applications, microservices, messaging, IAM, presentation, mobile apps, IoT, database and AI components? If yes, please provide it in the response as an attachment to this checklist. If no, please explain. | |||
| Does the proposed solution support multi-tier distributed architecture? If yes, please elaborate briefly. If not, what are the limitations? | |||||
| Does the proposed solution support a thin client strategy (i.e., browser-based)? If yes, please elaborate briefly. If not, what are the limitations? | |||||
| Does the proposed solution provide operational transparency? If "Yes", please elaborate. The discussion should minimally address transparency in the following processes: - Monitoring and operational management - Performance management - Change management - License planning and usage management - Problem management - Service-level management - Service-level data integration | |||||
| How does your organization use AI within the proposed solution — including types of AI technologies employed (e.g., Generative AI, Machine Learning, Agentic AI, Symbolic AI, etc.), key use cases, decision types, and whether outputs are advisory or automated | |||||
| How do you monitor AI performance in production (drift, anomalies, accuracy degradation), and what triggers intervention? | |||||
| Does your AI system use open-source code, models, datasets, or libraries? If yes, provide inventory including version, license type, and security validation performed. | |||||
| 3 | Maintainability | Is the proposed solution designed for ease of maintenance? If yes, please elaborate briefly and include a discussion of the use of modern digital technologies such as microservices, agile methodology, DevOps Continuous Development/Integration, Single Page Application with two-way data binding, and 12-Factor App methodology. If no, how will the proposed solution address maintenance challenges? | |||
| 4 | Scalability | Can the proposed solution readily accommodate future functional enhancements and scaling requirements? If yes, please elaborate briefly on how the solution supports scalability, including the support for multitudes of digital channels. If no, how will the proposed solution handle scalability? | |||
| 5 | Host Services | Does the cloud or data center hosting the proposed solution meet all the County's compliance standards for data protection? If yes, please elaborate briefly on how compliance is achieved. If not, why not? | |||
| Is the cloud or data center hosting the proposed solution physically located in the U.S.? If not, please elaborate briefly on how the proposed solution ensures that any data processed would not be stored outside the U.S. in any form or fashion. | |||||
| Is the cloud or data center hosting the proposed solution for government tenants only? If not, please elaborate briefly on how security, integrity, confidentiality, and regulatory requirements pertaining to the government sector are achieved in the proposed hosting arrangement. | |||||
| Does the proposed solution host in a facility with adequate and effective "Facility Access Controls" and contingency plans for facility access? | |||||
| How do you evaluate and manage the security, licensing, and compliance risks of third-party AI models, datasets, libraries, and open-source components, including SBOMs, provenance checks, and license compliance? | |||||
| Digital Services | |||||
| 1 | DevOps and CI/CD | Does the proposed solution support an enterprise DevOps Continuous Development/Integration architecture? If yes, please elaborate briefly on the development framework, development tools, and DevOps tools used in the architecture. If no, how will the proposed solution satisfy changes with speed? | |||
| 2 | User Interface | Is the UI of the proposed solution accessibility compliant? If yes, please elaborate briefly on how this is validated periodically. If not, why not? | |||
| Can the UI of the proposed solution be branded in accordance with the County's branding strategy, including the URL to provide a uniform look-and-feel? If yes, please elaborate briefly on how this can be done and updated periodically. If not, why not? | |||||
| How does your organization ensure human oversight for high-impact AI decisions, including the ability to override or challenge outputs? | |||||
| How are users notified when they are interacting with or being evaluated by an AI system? | |||||
| 3 | Emerging Technologies | Does this proposed solution support emerging technology, innovation applications, or is it an innovation application? If yes, please concisely describe how the proposed solution may support the County in its efforts to become an Innovation County. If no, are there any future plans to support emerging technology or become an innovation application? | |||
| 4 | Mobile Strategy | Does the proposed solution support mobile apps? If yes, please elaborate briefly on the mobile strategy, including which mobile platforms are supported. If not, what are the limitations? | |||
| Are the mobile apps downloadable from the respective mobile platform's app store branded as a Harris County app? If yes, please elaborate briefly. If not, what are the limitations? | |||||
| Do the mobile apps support the 7" to 10+" form factors? If yes, please elaborate briefly. If not, what are the limitations? | |||||
| Does the proposed solution utilize mobility management and protection mechanisms to safeguard the confidentiality, integrity, and availability of data elements processed by such solutions? | |||||
| Do the mobile apps support push notifications, automatic version checks, and app updates? If yes, please elaborate briefly. If not, what are the limitations? | |||||
| Can the mobile apps be secured by the County's Citizens Registry if the apps are public-facing apps? If yes, please elaborate briefly. If not, what are the limitations? | |||||
| Can the mobile apps be secured by the County's Active Directory if the apps are for County employees? If yes, please elaborate briefly. If not, what are the limitations? | |||||
| If the proposed solution supports a mobile strategy (i.e., use of mobile apps), are the mobile apps designed not to cache data locally in the apps or have measures in place to encrypt any County data stored locally in the mobile device? If yes, please elaborate briefly on how this is handled. If not, why not? | |||||
| Data Services | |||||
| 1 | Data Analytics | Does the proposed solution offer Data Analytics functions (generate business intelligence and insights for predictions & prescriptions, etc.) for both structured and unstructured data? If supported, please elaborate briefly. | |||
| 2 | Data Integration | Does the proposed solution need to be integrated with any other County apps or data sources to function properly? If yes, please elaborate briefly on what kind of data is being exchanged between the proposed solution and other County apps and how is the data processed. If no, please explain. | |||
| 3 | Data Architecture | Does the proposed solution offer Data Architecture Management functions? If supported, please elaborate briefly on how the data model is developed/maintained, how it is aligned with the County's other business data models, and how the meta-data architecture is defined/maintained. | |||
| Does the proposed solution offer Data Visualization functions (canned and ad-hoc dashboards and scorecards in a variety of ways graphically, etc.) for both structured and unstructured data? If supported, please elaborate briefly. | |||||
| Can the vendor provide the data dictionary or the data model used in the proposed solution? If yes, please provide it in the response as an attachment to this checklist. If no, please explain. | |||||
| Does the proposed solution offer Data Quality Management functions (how data quality is profiled, analyzed, monitored, and cleansed continuously)? If supported, please elaborate briefly. | |||||
| Does the proposed solution offer Reporting Services functions (canned and ad-hoc reports, etc.) for both structured and unstructured data? If supported, please elaborate briefly. If not supported, why not? | |||||
| Will County data be used for training, fine-tuning, or model improvement? If so, how is data isolated and opt-out supported? | |||||
| How do you ensure ongoing review of training-data accuracy, relevance, and suitability? | |||||
| 4 | Data Development | Does the proposed solution offer Data Development functions (data modeling/analysis, how conceptual, logical, and physical data models are constructed, etc.)? If supported, please elaborate briefly. | |||
| How do you document and validate AI training-data sources, lineage, quality, representativeness, and intended use? | |||||
| 5 | Data Repatriation | If the proposed solution stores data outside of the County’s data centers (i.e., IaaS, PaaS, or SaaS apps), does the vendor provide a way to repatriate the data in its entirety to a location designated by the County when needed? If supported, please elaborate briefly. If not supported, why not? | |||
| Where is all County data and AI-related metadata hosted? Describe residency, segregation, and sovereign hosting requirements. | |||||
| 6 | Data Polices and Standards | Does the proposed solution offer data policies and data standards functions? If supported, please include how data policies and data standards are developed and approved for use by the proposed solution? | |||
| How does the solution validate its training data (sources, lineage, quality, representativeness, intended use) and support data-governance policies and standards, including how those policies are developed and approved? | |||||
| Enterprise Technology Infrastructure Services | |||||
| 1 | Connectivity and Implementation | Does the proposed Hosted Only/Cloud implementation provide a dedicated connection(s) to the County (appropriately sized and scalable)? If yes, please explain in detail. | |||
| Does the proposed solution have the ability to provide for a Hybrid (On-prem/Cloud) implementation? If yes, please explain in detail (state if it is included in the proposed solution). | |||||
| Does the proposed Hybrid implementation provide a dedicated connection(s) to the County (appropriately sized and scalable)? If yes, please explain in detail. If no, please provide a roadmap and timeline when it will be incorporated if applicable. | |||||
| 2 | Cloud Deployment | Does the proposed cloud solution provide support for defined Cloud Deployment Models? If yes, please explain in more detail (state if it is included in the proposed solution and how). If no, please provide a roadmap and timeline when it will be incorporated if applicable. | |||
| Does the proposed solution (cloud, hybrid & on-prem) provide support for Portability and Interoperability? If yes, please explain in more | |||||
| 3 | Virtualization | Does the proposed solution have the ability to utilize Server Virtualization Technology for the infrastructure [to include machine (host-based), OS, TPM & Session-based]? If yes, please explain in detail (state if it is included in the proposed solution and how). If no, please provide a roadmap and timeline when it will be incorporated if applicable. | |||
| Does the proposed solution have the ability to provide support for Storage Virtualization (Block Based and/or File Based)? If yes, please explain in detail (state if it is included as part of the proposed solution and how). | |||||
| Does the proposed solution have the ability to provide for Application Virtualization (Client Application Streaming and/or Server Application Streaming)? If yes, please explain in more detail (state if it is included as part of the proposed solution and how). If no, please provide a roadmap and timeline when it will be incorporated if applicable. | |||||
| 4 | Network Management | Does the proposed solution have the ability to provide support for Network Segmentation? If yes, please explain in detail (state if it is included as part of the proposed solution and how). If no, please provide a roadmap and timeline when it will be incorporated if applicable. | |||
| Does the proposed solution have the ability to provide support for Network Availability? If yes, please explain in detail (state if it is included as part of the proposed solution and how). If no, please provide a roadmap and timeline when it will be incorporated if applicable. | |||||
| For each proposed configuration (cloud, hybrid & on-premise), does the solution infrastructure support or interface with SDN Networks? If yes, please explain in more detail and how it is incorporated. If no, please provide a roadmap and timeline when it will be incorporated if applicable. | |||||
| How do you secure AI APIs and data pathways (authentication, authorization, TLS/security standards, rate limiting)? | |||||
| Information Security Services | |||||
| 1 | Vulnerability Management | Is the proposed solution scanned periodically for vulnerabilities such as cross-site forgery, SQL injection vulnerabilities, etc., and fixed accordingly? If yes, please elaborate briefly on how this is done and validated periodically. If not, why not? | |||
| Is the proposed solution able to prevent the effects of a denial of service attack? If "Yes", please elaborate. Please ensure you describe the basics of your strategy. | |||||
| Are independent internal and external penetration tests performed on the solution periodically and remediation completed on test findings? Please elaborate on process. | |||||
| Does the proposed solution provide intrusion detection and prevention services? If "Yes", please elaborate. | |||||
| How do you test and protect your AI models against data leakage, inference attacks, overfitting, adversarial inputs, tampering, unauthorized retraining, and data-poisoning attempts, including any monitoring or anomaly-detection methods used during training and inference? | |||||
| What processes evaluate security/integrity of open-source dependencies (vulnerability scanning, SBOMs, provenance checks)? | |||||
| 2 | Authentication | Does the proposed solution implement and use Identity, Authentication and Access Management methods? If "Yes", please elaborate. When elaborating, please minimally consider the method of implementation; multi-factor authentication; single sign-on; reliance on third-party identity management and access tools; group assignment; supervisor rights management; unsuccessful login attempts; isolation of internal and external users; etc. | |||
| Can the proposed solution be integrated with the County's Active Directory to authenticate the County's employee users? If yes, please elaborate briefly. If not, why not? | |||||
| If the proposed solution has a public-facing component, can it be integrated with the County's Citizen Registry to authenticate the Citizen users? If yes, please elaborate briefly. If not, why not? | |||||
| Does the proposed solution implement a periodic continued business use policy by periodically re-validating if an employee has a continued business need to access a specific system? If yes, please elaborate. If no, why not? | |||||
| Does the solution allow for Dual Authentication (SSO and ID/Pswd)? | |||||
| 3 | Authorization | Does the proposed solution support Attribute Based Access Control (ABAC) for Data Service applications? If "Yes", please identify which standard(s) or framework(s) are used and elaborate on how its implementation benefits the County. | |||
| Is the proposed solution capable of roles creation that strictly limits access to specified data? If "Yes", please elaborate. Some examples of role-based access include: - Rows and columns that are editable, viewable, or neither - Reports and fields that can be viewed and accessed - Screens and fields on the screens that can be viewed or edited - System features that can be accessed - Types of notices the user receives | |||||
| Does the proposed solution support role-based activities? If "Yes", please elaborate on the roles available in the solution and how it supports the operational principles of Segregation of Duties and Least Privilege. | |||||
| How do you prevent AI model tampering, extraction, or theft (access controls, encryption, monitoring, isolation)? | |||||
| 4 | Compliance | Does the vendor follow a documented Security Standards Policy that will be used for this solution? Note, if selected, the vendor may be required to provide the policy documentation. | |||
| Does the solution Process, Store, or Transmit data that is sensitive or that falls under a Government or Industry regulation? If yes, please select data type(s) and elaborate briefly how compliance is achieved. If no, why not? | |||||
| Will the application transmit or house sensitive data, including but not limited to HIPAA, PII, PCI, SPI? | |||||
| Is the data captured in the proposed solution physically stored in the United States? | |||||
| For multitenant environments how do you separate customer data from other customers? | |||||
| Does the County own the data created, managed, and used within the proposed solution regardless of processing architecture including AI? Please elaborate on who owns the data collected in the proposed solution and how the data would be protected and used in accordance with the County's data security and privacy policies. | |||||
| Will the solution be sharing sensitive data with third parties? | |||||
| How do you control your remote access to the cloud for support of the solution? | |||||
| Does the proposed solution offer Data Security Management functions (how data access permissions are managed, monitored, and audited)? If supported, please elaborate briefly. If not supported, why not? | |||||
| Does the proposed solution employ security standards? If "Yes", please state which security standards are implemented and how they add value and benefit to the solution and the County. | |||||
| Does the proposed solution use encryption methods for the protection of data? If "Yes", please elaborate. The County is interested in methods to protect data at rest, data in flight, and data during processing. | |||||
| Does the proposed solution require any local caching of unencrypted data? If "Yes", please elaborate. | |||||
| Does the proposed solution implement and/or use Media Sanitizing technology and/or procedures? If "Yes", please elaborate. | |||||
| How does your organization identify and classify high-risk AI systems based on potential impacts to individuals, rights, safety, or critical services? | |||||
| Describe your AI governance framework, including policies, prohibited uses, accountability structures, training and oversight requirements. | |||||
| How do you maintain strict separation between training, testing, staging, and production environments? | |||||
| 5 | Audit and Monitoring | Is the proposed solution capable of maintaining a full audit trail for all changes to any system data, screen, AI activities, etc., and does the trail include information like the user who made the change, the date/time of the change, the original value, the modified value, and the IP address of where the change was initiated? If "Yes", please elaborate. | |||
| Is the proposed solution capable of allowing designated super users to log in to the system and mimic another user for the purpose of seeing how the system looks to that user? If "Yes", please elaborate. | |||||
| Is the proposed solution capable of enforcing and supporting strong passwords as defined by company policy, including the use of a specific number of special characters, digits, mixed case letters, frequency of change, and minimum password lengths? If "Yes", please elaborate. | |||||
| Does the vendor have an incident response plan that covers cybersecurity and AI-related incidents (e.g., model misuse, data leakage, or harmful outputs), and how are detection, escalation, and notification handled? | |||||
| 6 | Availability and Recovery | Does the proposed solution back up data periodically for system restore/recovery purposes if corrupted for any reason? If yes, please elaborate briefly. If not, why not? | |||
| Does the proposed solution replicate data to a different geographical location periodically for disaster recovery scenarios? If yes, please elaborate briefly. If not, why not? | |||||
| Is there a disaster recovery or business continuity plan for the proposed solution? If yes, please elaborate briefly on the plan, what the RTO and RPO parameters are, and how the plan is verified periodically. If not, why not? | |||||
| How do you ensure AI service continuity including backups, redundancy, failover, and recovery of models and data? | |||||
| IT Service Management | |||||
| 1 | ITIL Support | The County has adopted ITIL v4 Edition for its IT Service Management framework. Does the proposed solution support ITIL processes and objectives? If "Yes", please elaborate. Identify the domains and processes supported by the solution. | |||
| 2 | Service Level Agreements (SLA) | Is the availability SLA of the proposed solution 99.95% or higher? If yes, please elaborate briefly on what the committed availability SLA is, how it is monitored continuously, and what the County's recourse is if it is not met. If not, why not? | |||
| Is the performance SLA of each click in the proposed solution a 5-second response time on average 80% of the time? If yes, please elaborate briefly on how the performance SLA is monitored continuously and what the County's recourse is if it is not met. If not, why not? | |||||
| Does the proposed solution provide metrics and other information to support Service Level Agreement management? If "Yes", please elaborate. | |||||
| 3 | Lifecycle Mgt | What is the expected Lifecycle Mgt of the product? |
1) 1-5 Years
2) 5-10 Years
3) Indefinite
| What is the Roadmap for the product/solution can you share this with Customers? | ||
| How do you manage AI model updates and retraining (testing, approvals, rollback, deployment, versioning)? | ||
| 4 | Solution Documentation | Does the proposed solution include documentation to build, install, turn up, validate and operate the solution? If "Yes", please elaborate. The information provided will be assessed to determine if run and recovery books can be constructed to adequately operate, maintain and support the solution. |
| Does the proposed solution provide solution documentation? If "Yes", please elaborate. In your response, please individually address each item noted below. Please provide additional information that you believe will assist the County in understanding how the proposed solution is documented. | ||
| Procedural definitions of system user identity and access management (both internal and external users). | ||
| Planning and installation documentation for product upgrades. | ||
| A detailed system configuration design. | ||
| A detailed description of system installation, configuration and integration documentation. | ||
| Installation instructions for all software components, including client computers, network servers, peripheral devices, instrumentation, databases, and any other vendor-supplied utilities or existing customer assets which are required for the software to be implemented and supported by the County systems administrator. | ||
| Record layouts for all files and database tables used in the system. | ||
| Any special backup, restore, and/or recovery procedures. | ||
| At least one thoroughly documented application example, if the provided application supports API (application-programming interface). | ||
| Interactive, computer-based training or online tutorial. | ||
| Access to a vendor-supported website containing documentation enhancements, bug reports, patches, etc. | ||
| Online documentation, field level or otherwise, preferably in an industry-standard, searchable help format such as a Microsoft Help or PDF or HTML file, or minimally as an ASCII text file. | ||
| Custom Application/Software Development And user Experience/User Interface (UX/UI) | ||
| 1 | Development Methodology | What development methodologies are used (e.g., Agile, DevOps)? |
| How is version control managed in the proposed solution? | ||
| Does the proposed solution support an enterprise DevOps Continuous Development/Integration architecture? If yes, please elaborate briefly on the development framework, development tools, and DevOps tools used in the architecture. If no, how will the proposed solution satisfy changes with speed? | ||
| How do you ensure compliance with open-source licensing (e.g., Apache, MIT, GPL) for all AI-related components? | ||
| 2 | Quality Assurance | What are the QA processes implemented in the proposed solution? |
| How is testing automated within the solution? | ||
| 3 | Integration And Interoperability | Does the proposed solution need to interface/integrate with other County apps to function properly? If yes, what are these other County apps, and in what form would they be integrated with the proposed solution (i.e., APIs or file-based integration)? |
| Does the proposed solution have the capability to be easily integrated with other County apps in the future? If yes, please elaborate briefly on how this can be achieved (i.e., APIs or file-based integration). If not, what are the limitations? | ||
| 4 | Data Management | Does the proposed solution have a bulk data import capability to upload/migrate selected data in bulk into the proposed solution? If supported, please elaborate briefly. If not supported, why not? |
| Does the proposed solution have the capability to, periodically or on demand, exchange data or export data in microservices/batch files with/to other County apps? If supported, please elaborate briefly. If not supported, why not? | ||
| How do you support legally required data-subject rights (access, correction, deletion, transparency, explanation)? | ||
| How do you ensure fairness and ethical AI practices, including how you detect, measure, and mitigate bias in training data and model outputs, and the methods, metrics, and safeguards you use to support transparency, safety, and accountability? | ||
| 5 | Emerging Technologies | Does the proposed solution support emerging technology, innovation applications, or is it an innovation application? If yes, please concisely describe how the proposed solution may support the County in its efforts to become an Innovation County. If no, are there any future plans to support emerging technology or become an innovation application? |
File details come from the government source that posted it. Updated .