12-13. CCSD Technology Requirements and Questions - Attachment B.xlsx
XLSX spreadsheet 27 KB Posted
- Attached to
- Assessment Platform
- Solicitation number
- AP-2026 RFP
- Issued by
- Cherokee County, Georgia
About this file
This is a Technology Requirements and Questions document prepared for the Cherokee County School District (CCSD) in Georgia as part of their Assessment Platform RFP solicitation. The document outlines comprehensive technical specifications that qualified proposers must meet to provide a K-12 assessment platform supporting assessment development, administration, scoring, reporting, and instructional decision-making. The platform must include a Georgia standards-aligned item bank, robust item creation and management tools, flexible assessment-building capabilities, and seamless data interoperability. The solution should enable the District to design both district-wide and school-level customized assessments while maintaining secure ownership and management of all assessment content and data. The document specifies that all RFP questions must be submitted through the Euna Procurement Message Center.
The technology requirements document establishes detailed specifications across seven primary functional categories: Access, Security, and Infrastructure; Data Management; Document Management; System Interfaces; User Interfaces; Workflow; and Data Recovery, supplemented by General and Security technical requirements. Key requirements include SAML 2.0 authentication with SSO session persistence, AES 256-bit encryption for data in motion and rest, role-based security with field-level data access controls, comprehensive audit logging, and 99.99% system uptime availability. The platform must support mobile access on iOS and Android platforms, integrate with productivity tools including Microsoft Office 365, comply with 1EdTech Interoperability Standards (LTI, ThinCC, CASE, OneRoster, and QTI), and operate on Windows 10 or higher, macOS 15 or higher, and current versions of Edge, Chrome, and Safari browsers. The solution must store all data in the Continental United States, provide daily backup and recovery capabilities with defined MTTR parameters, maintain compliance with HIPAA and FERPA regulations, and support flexible deployment models including cloud, on-premise, or hybrid configurations with single and multi-tenant offerings.
View the file
Other files
Show all 12
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1 Vendor:
| 1 | Technology Functional Features | ||
| 1.1 | Access, Security, and Infrastructure | ||
| Item | Requirement | Y / N | Comment |
| 1.1.1 | Support audits of the hosting environment or to have an acceptable independent third party audit the hosting environment. | ||
| 1.1.2 | Secure and encrypt APIs and open interfaces with different keys for different tenants/instances/environments. | ||
| 1.1.3 | Once authenticated via SAML 2.0, the proposed solution must maintain a session for the user until they log out or the session expires. The solution should support SSO session persistence, where the user can seamlessly transition between systems integrated with SSO without re-authenticating. | ||
| 1.1.4 | Encrypt all data at rest (DAR) in different levels (e.g., physical disk, field level). | ||
| 1.1.5 | Allow administration to delegate administration capabilities and to grant particular administrative privileges to another user. | ||
| 1.1.6 | Secure data by field (e.g., only select users can see PII fields) and by group (e.g., managers in a particular department can see only their department's data or hierarchical groups, directors can see data for all their managers' departments) that makes it obvious to users that there is data they cannot see (e.g., blank rows, fields). | ||
| 1.1.7 | Comprehensive, tamper-proof logging of all user activities and system events (e.g., logins, data access, system modifications). Detailed records of who accessed or modified data, when, and what changes were made. | ||
| 1.1.8 | All backup data, including system configurations and business data, must be encrypted to prevent unauthorized access. Well defined policies for the retention, archiving, and secure deletion of backup data, ensuring compliance with data retention regulations. | ||
| 1.1.9 | Provide a Web interface or API in which an administrator can create, manage, and delete user accounts (e.g., account list methods) and a batch interface or API that can import user management (create, change, delete) via text, CSV, or XML file. | ||
| 1.1.10 | Automated user onboarding and offboarding processes that assign and revoke access rights as employees join, move within, or leave the organization. Integration with identity management systems for streamlined user provisioning. | ||
| Item | Question | Response | |
| 1.1.11 | Describe hardware refresh cycles of hosting environment. | ||
| 1.2 | Data Management | ||
| Item | Requirement | Y / N | Comment |
| 1.2.1 | Support robust data search functionality that honors a users role and data access permissions | ||
| Item | Question | Response | |
| 1.2.2 | Describe Post data in real-time fashion, flow all changes made in the solution throughout all solution systems without the need for duplicate data entry, accommodate mass updates, provide user-defined fields and be Payment Card Industry (PCI) compliant. | ||
| 1.2.3 | Which tools monitor networks to notify customers of any issues that impact availability or cause latency issues, monitoring on a 24/7 basis, and taking proactive measures in the data center to ensure optimal performance? | ||
| 1.3 | Document Management | ||
| Item | Requirement | Y / N | Comment |
| 1.3.1 | All documents (e.g., invoices, receipts, tax forms, contracts) should be stored in a central, secure repository for easy access and management. | ||
| 1.3.2 | Ability to categorize and tag documents based on type (e.g., invoices, financial statements, contracts) and metadata (e.g., date, client, department). | ||
| 1.3.3 | Track and store different versions of documents, allowing users to view and revert to previous versions when needed. | ||
| 1.3.4 | Automatically index documents with metadata (e.g., document type, date, amount) to enable quick search and retrieval. | ||
| 1.3.5 | Define user roles and permissions to control who can view, edit, and delete specific financial documents. | ||
| 1.3.6 | Encrypt documents at rest and in transit to ensure that sensitive financial data is protected from unauthorized access. | ||
| 1.3.7 | Support digital signatures to authenticate and verify the integrity of documents (e.g., contracts, approvals). | ||
| 1.3.8 | Define and automate document retention periods based on document type (e.g., invoices retained for 7 years), ensuring compliance with regulatory and legal requirements. | ||
| 1.3.9 | Implement secure and auditable document deletion processes once the retention period expires, ensuring data privacy and compliance. | ||
| 1.4 | System Interfaces | ||
| Item | Requirement | Y / N | Comment |
| 1.4.1 | Support the use of web services and APIs to push and pull data (e.g., RESTful, HTTP, SOAP). | ||
| 1.4.2 | Support integrations through flexible file formats and application integration tools that can invoke standards-based web services (e.g., Informatica, Dell Boomi, MuleSoft, Snaplogic, Jitterbit). | ||
| 1.4.3 | Provide secure integration processes (e.g., provider-hosted SFTP server, subscriber-hosted SFTP server, PGP encryption, integration gateway). | ||
| 1.4.4 | Integrate with productivity tools/desktop applications (e.g., Microsoft Office 365) including both web-based and desktop versions of these applications. | ||
| 1.4.5 | Provides digital instructional and assessment resources to fully conform with the latest 1EdTech Interoperability Standards specification [specifically, Learning Tools Interoperability (LTl), Thin Common Cartridge (ThinCC), Competencies and Academic Standards Exchange (CASE), OneRoster, and Question and Test Interoperability ("QTI") specifications]. |
The Instructional Resources shall be interfaced, utilizing such standards, and integrated or ingested in the District's LMS and/or learning object repository (LOR) where the instructional resources can be searched based on metadata tagging. Examples of such tagging include: title, description (or resource summary), subject, grade, audience (teacher, student, parent, administrator, etc.), resource type (video, worksheet, etc.), resource URL, length (number of seconds), year, duration, etc.
| 1.4.6 | The instructional resources should be interfaced utilizing the 1EdTech standards referenced above and integrated or ingested in the District's learning management system and/or learning object respository where the resources can accessed based on metadata tagging. Examples of such tagging include: title, description (or resource summary), subject, grade, audience (teacher, student, parent, administrator, etc.), resource type (video, worksheet, etc.), resource URL, length (number of seconds), year, duration, etc. | |||||
| 1.4.7 | Support 3rd party unified communication tools (e.g., Skype for Business, Microsoft Teams, Zoom, Jabber, Google Meetings). | |||||
| 1.4.8 | Provide file-based loaders for large imports of data, spreadsheet loaders (e.g., Excel) and reporting tools that support exports through different file formats. | |||||
| 1.4.9 | Support workflow interaction with interface processes (e.g., system workflow engine initiating outbound interface). | |||||
| 1.5 | User Interfaces | |||||
| Item | Requirement | Y / N | Comment | |||
| 1.5.1 | Provide access through a GUI application interface that facilitates users performing operations without prior training or exposure to the application. | |||||
| 1.5.2 | Provide a GUI application interface with readable text such that a user with 20/20 eyesight or corrected vision can read the text in ambient lighting from a distance of 6 inches to 24 inches. | |||||
| 1.5.3 | Provide flexibility to operate on the current smartphone platforms (e.g., iOS, Android) without interrupting the system's normal operation while safeguarding the storage of any sensitive data locally on the device. | |||||
| 1.5.4 | Distribute and manage mobile applications through a mobile device management (MDM) solution and require users to perform at least a one-time device registration with the system. | |||||
| 1.5.5 | Configure mobile access by group, role, and system modules. | |||||
| 1.5.6 | Securely display forms for viewing and printing, provide data validation on entry, provide spell check on any editable field, provide drill-down access on all screens to source transactions, records, and attachments based on security permissions. | |||||
| 1.5.7 | Provide links to associated modules from any display screen to minimize backing out of one screen to access another, with appropriate security. | |||||
| 1.5.8 | Provide system templates that are easily definable and customizable by users, are able to sort any field, can hide fields, add calculations, and use/adjust colors for emphasis. | |||||
| 1.5.9 | Provide help support to a general user, including any context-sensitive help or capability to include custom content or outside links. | |||||
| 1.5.10 | Imbed School Board Policies and Procedures within the system that can be accessed by end users. | |||||
| 1.5.11 | Audit mobile application user access including device identification and automate the download of audit logs for mobile use including the auditing of individual users. | |||||
| 1.5.12 | Configure various elements of the base solution (e.g., addition of data elements to screens and reports, masking of data fields, apply business rules and logic to screens and data fields), save partially-completed screens or documents, support customizable/context sensitive help, and provide views in a printer friendly PDF format. | |||||
| 1.5.13 | Attach files to records in the solution and export system data with appropriate security. | |||||
| 1.6 | Workflow | |||||
| Item | Requirement | Y / N | Comment | |||
| 1.6.1 | Re-route workflow assignments based on availability, provide escalation paths based on user-defined criteria (e.g., minimum period of no Response), provide event-driven notifications by email, provide event-driven notifications in a user's view of the solution, allow configurable notifications, and attach relevant documents to the workflow process. | |||||
| 1.6.2 | Provide multiple methods for end users to approve a workflow (e.g., system, email, mobile application, website) and automatically send email notices to the initiator of a request to let him/her know it has been approved. | |||||
| 1.6.3 | Allow a workflow administrator to cancel or reroute pending/in-flight workflows (e.g., employee leave the company and the position is not filled). | |||||
| 1.6.4 | Provide workflow notifications that can include information such as the vendor/customer's name, brief description, and the amount associated with the account. | |||||
| 1.7 | Data Recovery | |||||
| Item | Question | Response | ||||
| 1.7.1 | Describe backup and recovery options, MTTR, retention times, archival of data, and regional location of stored data. | |||||
| 1.74.2 | What captures all modifications to date through the use of audit trails and to set up audit subsets of data rather than all data? | |||||
| 2 | Technical Requirements | |||||
| 2.1 | General | |||||
| Item | Requirements | Y / N | Comment | |||
| 2.1.1 | Provide flexibility to operate on the current smartphone platforms (e.g.; iOS, Android) without interrupting the system's normal operation while safeguarding the storage of any sensitive data locally on the device. | |||||
| 2.1.2 | Provides production and training/test environments. | |||||
| 2.1.3 | Provides for upgrades to accommodate changes in laws, regulations, best practices, and new technology. | |||||
| 2.1.4 | Includes complete installation, operating, and system maintenance documentation. | |||||
| 2.1.5 | System must be run natively with the common platforms and browsers below: | |||||
| Source | Product | Supported Version | ||||
| Microsoft* | Windows OS | 10 or higher | ||||
| Apple | Mac OSX (Monterey) | MacOS 15 or higher | ||||
| Microsoft* | Edge | 132 or higher | ||||
| Google* | Chrome | 132 or higher | ||||
| Apple | Safari | 17.4 or higher | ||||
| *Preferred platforms and browsers. | ||||||
| 2.1.6 | System complies fully with all federal and state laws including, but not limited to HIPPA or FERPA. | |||||
| 2.1.7 | Provides system availability 24 hours a day, 365 days a year (not including Force Majeure Events or scheduled downtime). | |||||
| 2.1.8 | Ensures scheduled downtime is pre-approved one week in advance. | |||||
| 2.1.9 | Provides system uptime of 99.99%. | |||||
| 2.1.10 | Stores data in the Continental U. S. | |||||
| 2.1.11 | Upon discovery or reasonable belief of any data breach, notifies by the fastest means available, and also in writing within 24 hours. Notification should include: | |||||
| • The nature of the breach | ||||||
| • The data accessed, used, or disclosed | ||||||
| • The person(s) who accessed, used, disclosed, and/or received data (if known) | ||||||
| • What has been done to quarantine and mitigate the breach | ||||||
| • What corrective actions has been taken to prevent future breaches | ||||||
| 2.1.12 | Provides daily updates regarding findings and actions performed until the breach has been effectively resolved. | |||||
| 2.1.13 | Provides a report containing the results of the investigation of the breach. | |||||
| 2.1.14 | In the event of a disaster or catastrophic failure, provide notice: | |||||
| • Within one (1) hour | ||||||
| • The scale and quantity of the data loss | ||||||
| • What proposer has done to recover the data and mitigate any effect of the data loss | ||||||
| • What corrective action proposer has taken to prevent future data loss | ||||||
| Item | Question | Response | ||||
| 2.1.15 | Do you maintain any underpinning contracts with hosting providers and other strategic partnerships that would impact the proposed solution? If yes, please provide appropriate details around the solutions functionality and operation. | |||||
| 2.1.16 | Describe the deployment flexibility with support for cloud, on-premise, or hybrid models of the proposed solution and include a description around single and multi-tenant offerings. | |||||
| 2.1.17 | Describe backup and recovery options, MTTR, retention times, archival of data, and regional location of stored data. | |||||
| 2.2 | Security | |||||
| Item | Requirements | Y / N | Comment | |||
| 2.2.1 | The ERP system must support integration with external Identity Providers (IdPs) that use SAML 2.0 for authentication (e.g., Active Directory Federation Services (ADFS), Azure AD, Rapid Identity, etc.). | |||||
| 2.2.2 | Once authenticated via SAML 2.0, the proposed solution must maintain a session for the user until they log out or the session expires. The solution should support SSO session persistence, where the user can seamlessly transition between systems integrated with SSO without re-authenticating. | |||||
| 2.2.3 | Encrypt all data in motion (DIM) between the hosting environment and end users with minimum AES 256-bit encryption (HTTPs or SSL). | |||||
| 2.2.4 | Maintains audit logging to record access activity: | |||||
| • Login/logout attempts by user and workstation | ||||||
| • Initiated processes | ||||||
| • System overrides | ||||||
| • Additions, changes, or deletes to application maintained data | ||||||
| 2.2.5 | Allows the system administrator to: | |||||
| • Configure control access to the application, modules, transactions, data, and reports | ||||||
| • Define access rights (e.g.; create, read, update, delete) by user ID or functional role | ||||||
| • Define functional access rights (e.g.; processes, screens, fields, and reports) by user Id or functional role | ||||||
| • Restrict access to sensitive data elements by user ID, user groups, or functional role | ||||||
| 2.2.6 | Role-based security must be customizable to individual employees, positions, and roles, and allow varied levels of permissions for query, view, edit, save, and download data. | |||||
| Item | Question | Response | ||||
| 2.2.7 | What security standards do you implement to ensure participant privacy? | |||||
| 2.2.8 | Describe your security procedures to ensure the District and employee data is protected in full. | |||||
| 2.2.9 | Provide a detailed description of any firewall and network access rules needed for all client access. |
Cherokee County School District Assessment Platform AP-2026 RFP Technology Requirements and Questions - Attachment B
File details come from the government source that posted it. Updated .