13-Appendix 6 - Electronic and Information Resources Environment Specifications.pdf

REQUEST FOR PROPOSAL

APPENDIX SIX

ELECTRONIC AND INFORMATION RESOURCES ENVIRONMENT SPECIFICATIONS

The specifications, representations, warranties and agreements set forth in Proposer’s responses to this APPENDIX SIX will be incorporated into the Agreement.

University is primarily a Microsoft products environment.

Basic Specifications

1. If the EIR will be hosted by University, please describe the overall environment requirements for the EIR (size the requirements to support the number of concurrent users, the number of licenses and the input/output generated by the application as requested in the application requirements).

A. Hardware: If Proposer will provide hardware, does the hardware have multiple hard drives utilizing a redundant RAID configuration for fault tolerance? Are redundant servers included as well?

B. Operating System and Version:

C. Web Server: Is a web server required? If so, what web application is required (Apache or IIS)? What version? Are add-ins required?

D. Application Server:

E. Database:

F. Other Requirements: Are any other hardware or software components required?

G. Assumptions: List any assumptions made as part of the identification of these environment requirements.

H. Storage: What are the space/storage requirements of this implementation?

I. Users: What is the maximum number of users this configuration will support?

J. Clustering: How does the EIR handle clustering over multiple servers?

K. Virtual Server Environment: Can the EIR be run in a virtual server environment?

2. If the EIR will be hosted by Proposer, describe in detail what the hosted solution includes, and address, specifically, the following issues:

A. Describe the audit standards of the physical security of the facility; and B. Indicate whether Proposer is willing to allow an audit by University or its representative.

3. If the user and administrative interfaces for the EIR are web-based, do the interfaces support Firefox on Mac as well as Windows and Safari on the Macintosh?

4. If the EIR requires special client software, what are the environment requirements for that client software?

5. Manpower Requirements: Who will operate and maintain the EIR? Will additional University full time employees (FTEs) be required?

Will special training on the EIR be required by Proposer’s technical staff? What is the estimated cost of required training.

6. Upgrades and Patches: Describe Proposer’s strategy regarding EIR upgrades and patches for both the server and, if applicable, the client software. Included Proposer’s typical release schedule, recommended processes, estimated outage and plans for next version/major upgrade.

Security

1. Has the EIR been tested for application security vulnerabilities? For example, has the EIR been evaluated against the Open Web

Application Security Project (OWASP) Top 10 list that includes flaws like cross site scripting and SQL injection? If so, please provide the scan results and specify the tool used. University will not take final delivery of the EIR if University determines there are serious vulnerabilities within the EIR.

2. Which party, Proposer or University, will be responsible for maintaining critical EIR application security updates?

3. If the EIR is hosted, indicate whether Proposer’s will permit University to conduct a penetration test on University’s instance of the

EIR.

4. If confidential data, including HIPAA or FERPA data, is stored in the EIR, will the data be encrypted at rest and in transmittal?

REQUEST FOR PROPOSAL

Integration

1. Is the EIR authentication Security Assertion Markup Language (SAML) compliant? Has Proposer ever implemented the EIR with Shibboleth authentication? If not, does the EIR integrate with Active Directory? Does the EIR support TLS connections to this directory service?

2. Does the EIR rely on Active Directory for group management and authorization or does the EIR maintain a local authorization/group database?

3. What logging capabilities does the EIR have? If this is a hosted EIR solution, will University have access to implement logging with University’s standard logging and monitoring tools, RSA’s Envision?

4. Does the EIR have an application programming interface (API) that enables us to incorporate it with other applications run by the University? If so, is the API .Net based? Web Services-based? Other?

5. Will University have access to the EIR source code? If so, will the EIR license permit University to make modifications to the source code? Will University’s modifications be protected in future upgrades?

6. Will Proposer place the EIR source code in escrow with an escrow agent so that if Proposer is no longer in business or Proposer has discontinued support, the EIR source code will be available to University.

Accessibility Information

Proposer must provide the following, as required by 1 TAC §213.38(b):

1. Accessibility information for the electronic and information resources (EIR)1 products or services proposed by Proposer, where applicable, through one of the following methods:

(A) URL to completed Voluntary Product Accessibility Templates (VPATs)2 or equivalent reporting templates;

(B) accessible electronic document that addresses the same accessibility criteria in substantially the same format as VPATs or equivalent reporting templates; or

(C) URL to a web page which explains how to request completed VPATs, or equivalent reporting templates, for any product under contract; and

2. Credible evidence of Proposer’s capability or ability to produce accessible EIR products and services. Such evidence may include, but is not limited to, Proposer’s internal accessibility policy documents, contractual warranties for accessibility, accessibility testing documents, and examples of prior work results.

1 Electronic and information resources are defined in §2054.451, Government Code and 1 TAC §213.1 (6).

2 Voluntary Product Accessibility Templates are defined in 1 TAC §213.1 (19). For further information, see this VPAT document provided by the Information Technology Industry Council.