11-I. City Application Package Requirements Compliance Form.pdf

City Application Package Requirements Compliance Form

Category Requirement Compliant?

(Y/N)

Proposer Response Notes

General Architectural Requirements:

Application must be n-tier architecture, separating data, business logic, and presentation layers (at a minimum)

Application modules that are part of the proposed product suite shall be extensions of a core product and not an aggregation of acquired products.

This requirement applies to all application modules available, not just the ones proposed.

Functionality shall be grouped around business processes and accessed via interoperable services

Services shall be engineered to improve agility and to be generic and reusable

Data Layer Requirements:

Any disparate system components shall share related data to ensure consistency

Application components shall share a single, common data model.

Application components shall share a single, common database.

Application shall have the ability to archive and purge data that has reached aging limits defined by the City

Reporting

Data dictionary with table and field descriptions shall be available that can be used for internal custom report development

A single, common data repository shall be available that internal reports can be developed against.

Packaged reporting capabilities shall include imbedded report distribution management capabilities.

In addition to built-in, packaged reporting, the application shall provide an ad-hoc reporting capability that is end-user friendly and can produce data exports for additional analysis within external tools such as Microsoft Excel.

Integration

Application shall provide the ability to interact with other systems via flat files, staging tables, functionally oriented web services, and/or application programming interfaces (API’s)

All available integration channels shall be itemized and described in program documentation

Application shall support external flat file import of historical data to accommodate migration of existing information into the system.

Application Configuration Requirements

The City shall have the option to adjust the behavior of application components to meet future business needs through direct manipulation of an explicit business process model, making design manageable by business users without the need for substantial IT support.

Vendor modifications / updates to the application shall be delivered via a consistent, pre-defined process that includes complete instructions on how modifications shall be applied to the City of Charlotte code environment.

Security Requirements Overview:

The City of Charlotte is committed to protecting its information resources from accidental or intentional intrusion. To accomplish this, the City will require Information Security features be included with software/hardware purchases, etc. (e.g. access permissions, encryption for restricted data and data that passes from trusted to untrusted networks, common authentication (Active Directory)). Please describe the security capabilities of the proposed technology, and your company’s security procedures to include handling of electronic data, hard copy information, and employee security.

Security Requirements Detail:

Security-related patches to supported operating systems shall be supported by the application within two weeks of operating system patch release. If OS patch cannot be supported, mitigation steps must be provided.

Application shall use windows login credentials for authentication Access levels shall be definable to restrict use of system level functions (such as user authorization), and to provide data access levels to restrict the use of data entry, data approval, data retrieval, data modification, database structure creation or modification functions.

The server-side components of any Citizen-facing capability shall be able to be isolated and segregated from the rest of the server environment so additional security measures can be applied to it.

If the software/hardware will process credit cards, please include Payment Card Industry Data Security Standard (PCI-DSS) or Payment Application Data Security Standard (PA-DSS) compliance documentation. The software/hardware must maintain compliance with the most current PCI- DSS/PA-DSS during the entire contract period.

If company is a service provider whose services shall be within a PCI DSS compliant environment, the vendor shall have to follow and maintain procedures and guidelines set in the most current PCI DSS standards.

Vendor shall provide annually and by request, a signed copy of their most recent PCI Self-Assessment Questionnaire (SAQ), Report on Compliance (ROC), Attestation of Compliance (AOC), or equivalent supporting documentation.

Vendor shall agree to submit any additional PCI DSS documentation requested by the City of Charlotte or 3rd party assessors within 14 business days of request.

Operational

Procedures and mechanisms for performing both online and offline application backups shall be available

If the application requires any batch job processing, native scheduling and schedule management capabilities shall be provided

Application monitoring and logging capabilities shall be available to report / alert on things like performance bottlenecks, failed/hung processes, communication failure, etc. Monitoring shall include all aspects of the solution environment, such as application server, database, and operating system.

Application shall respond to any end-user requests within 4 seconds.

Server mail notifications shall support SMTP according to specification

FRC 2821.

Disaster Recovery Requirements:

The Service Provider must indicate the capability to recover from natural, human-caused, and electronic disasters (including security compromises) that could interrupt service to the City and the City's customers. The Service Provider will detail their solution to include:

Procedures for off-site storage of information;

Capabilities and availability of alternate processing, communications, and operations facilities;

Plans for maintaining business processes, including communications with the City, the City’s customers, and suppliers of goods and services.

Estimated time to recover from disaster events, and service level expectations for business continuity following a disaster;

Cost to the City, if any, for disaster recovery services; and A documented disaster recovery and business continuity plan, including dates of disaster recovery tests and schedule for future tests.

Procedures for off-site storage of information.

Additional Information:

Itemization of all software required to run this application (server & client) shall be included within the proposal. Example: database server, application server, java, .net, compilers, runtime engines, etc. If there is a separate cost associated with supporting software, this fact shall be clearly noted in the proposal, and estimates of those costs shall be provided if possible.

In addition to the above information submit a complete system architecture diagram showing all hardware recommended for the system. For each server or other hardware shown in the architecture diagram, provide complete recommended specifications.