2-RFIDOC 6000003295.pdf
PDF 351 KB Posted
- Solicitation number
- RFI # 6000003295
- Issued by
- Hudson County, New Jersey
About this file
This is a Request for Information (RFI) issued by the Port Authority of New York and New Jersey seeking information on enterprise data governance platforms and related services to support a comprehensive, federated data governance program across the agency's hybrid data environment. The Port Authority is evaluating the market landscape and potential implementation approaches for platforms that can improve data trust, transparency, quality, controlled access, and auditability across operational and analytical use cases. The RFI is issued solely for information-gathering and planning purposes and does not constitute a commitment to procure any product or service. Questions from prospective respondents are due by May 6, 2026 at 2:00 PM ET, with formal responses due by May 22, 2026 at 2:00 PM ET. Responses must be submitted electronically through the Bonfire platform and are limited to twenty-five (25) pages. The Port Authority reserves the right to conduct interviews, issue a subsequent Request for Proposal, or take no further action based on the responses received.
Respondents should address the Port Authority's need to support integrated customer and stakeholder data, supplier information management, regulatory compliance and auditability, analytics and business enablement, data product governance, and cloud migration and system consolidation across a hybrid environment that includes Microsoft Azure, Azure Synapse Analytics, Azure Databricks, SAP, PeopleSoft, Oracle databases, and Power BI. The RFI specifically requests information on data cataloging and discovery, data quality management, data lineage and impact analysis, policy management and workflow, reporting and dashboards, and technical attributes including architecture, scalability, integration capabilities, and data security requirements. Respondents must provide at least three customer references for comparable enterprise deployments, including at least one public-sector or similarly regulated environment. No pricing information, contract term, or funding amounts are specified in this RFI, as it is purely a market research document designed to inform a potential future procurement.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 1-Bid 6000003295 AD.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
PROCUREMENT DEPARTMENT
4 WORLD TRADE CENTER
150 GREENWICH STREET, 21ST FLOOR
NEW YORK, NY 10007
REQUEST FOR INFORMATION
6 0 0 0 0 0 3 2 9 5
ISSUE DATE: 04/21/2026
TITLE: PORT AUTHORITY OF NEW YORK AND NEW JERSEY REQUEST
FOR INFORMATION (RFI) - ENTERPRISE DATA GOVERNANCE PLATFORM
RFI NUMBER: 6000003295
QUESTION DUE DATE: 05/06/2026 TIME: 2:00 PM ET
RESPONSE DUE DATE:
05/22/2026
TIME: 2:00 PM ET
CONTACT NAME: Angelo Arcuti
PHONE #: 201-551-8198
EMAIL: AARCUTI@PANYNJ.GOV
RESPONDENT INFORMATION
(TO BE COMPLETED BY THE
RESPONDENT)
(PLEASE PRINT)
(NAME OF RESPONDENT)
(ADDRESS - CITY, STATE, ZIP
CODE)
(REPRESENTATIVE TO CONTACT - NAME AND TITLE)
(EMAIL ADDRESS, PHONE NO. AND FAX
NO.)
FEDERAL TAX ID NO.:
BUSINESS FORM: CORPORATION PARTNERSHIP
INDIVIDUAL OTHER:
1. GENERAL INFORMATION: THE PORT AUTHORITY OF NEW YORK AND NEW JERSEY
The Port Authority of New York & New Jersey is a municipal corporate instrumentality and political subdivision of the States of New York and New Jersey, created and existing by virtue of the Compact of April 30, 1921, made by and between the two States. The Port Authority’s facilities include two tunnels, and four bridges between the States of New York and New Jersey, the Hudson Tubes facility, including the PATH system, bus terminals, the Trans-Hudson ferry service, five airports, the World Trade Center, six marine terminals, two waterfront development facilities, four industrial development facilities, a resource recovery facility, and certain regional development facilities. The Port Authority is self-sustaining in that it raises the necessary funds for the improvement, construction, or acquisition of its facilities primarily upon the basis of its own credit. The Port Authority has no power to levy taxes or assessments. Its bonds, notes, and other obligations are not obligations of the two States or of either of them and are not guaranteed by the States or by either of them.
2. PORT AUTHORITY’S GOALS AND OBJECTIVES
The Port Authority of New York and New Jersey (the “Port Authority” or the “Agency”) is seeking information from qualified firms (“Respondents”) regarding enterprise data governance platforms, services, and related offerings (collectively, “Offerings”) that can support a comprehensive, federated data governance program across the Agency’s hybrid data environment.
The Port Authority is evaluating the market landscape and potential implementation approaches for an enterprise data governance platform that improves data trust, transparency, quality, controlled access, and auditability across operational and analytical use cases, while enabling a federated governance operating model. This Request for Information (“RFI”) is issued solely for information-gathering and planning purposes and does not constitute a Request for Proposal (RFP) or a commitment to procure any product or service.
3. RESPONSES
Responses shall address the following information:
A. Strategic Context and Business Objectives
Respondents should assume the Agency is pursuing a federated data governance model with centralized standards and oversight, and distributed data ownership and stewardship within line departments. The data governance platform should support the following objectives:
• Integrated Customer & Stakeholder Data: enable consolidated, governed views of customer and stakeholder information across systems to support coordinated service delivery and case management.
• Supplier Information Management: enforce consistent supplier records and classifications across procurement and finance processes.
• Regulatory Compliance and Auditability: ensure critical reporting data is complete, current, and traceable with audit trails.
• Analytics and Business Enablement: standardize definitions and authoritative sources for reports, dashboards, and analytical outputs.
• Data Product Governance: apply controls to published datasets (e.g., bronze/silver/gold tiers) used for AI/ML and operational processes.
• Cloud Migration and System Consolidation: establish inventory, ownership, and controls to reduce rework and risk during transformations.
B. Scope of Information Requested
The Port Authority seeks information on platform capabilities and services that may include, but are not limited to:
• Enterprise-wide data cataloging and automated discovery/metadata harvesting.
• Business glossary and domain-driven metadata stewardship.
• Data quality profiling, monitoring, alerting, issue management, and remediation workflows.
• Data lineage (including column-level where available) and impact analysis.
• Policy management, sensitive data classification, access request/approval workflow, and enforcement integration.
• Integration with hybrid data sources (on-premises and cloud), Extract, Transform, Load / Extract, Load, Transform, Business Intelligence (ETL/ELT, BI) tools, and identity providers.
• Role-based dashboards and reporting for executives, technical administrators, and non-technical operations data stewards.
• AI tools used in or as part of the solution for data discovery and compliance
• Options to implement data governance enforcement including reporting and rectifying data overlap or non-compliance at all levels in the organization.
• Ability to track data at different levels as appropriate for the catalog/owner in a cascading or waterfall approach.
NOTE: Responses that the Port Authority, in its sole discretion, determines to be outside of, or not responsive to, the scope of this RFI shall be rejected without further review.
C. Current State – Technical Environment (Summary)
The Port Authority operates a hybrid data environment spanning on-premises infrastructure and cloud platforms. Respondents should describe how their offering connects to, governs, and scales across environments like the following (representative, non-exhaustive) components:
Cloud data platform components (representative):
• Microsoft Azure (primary cloud platform).
• Azure Synapse Analytics (enterprise data warehousing and big data analytics).
• Azure Databricks (data engineering and data science workloads; Unity Catalog enabled).
• Azure Data Factory / orchestration tools (ETL/ELT and pipeline scheduling).
• Azure Data Lake Storage Gen2 (data lake; medallion architecture – bronze/silver/gold).
• Azure SQL databases (line department application data).
Enterprise resource / line-of-business systems (representative):
• SAP (enterprise applications for multiple business functions running on Oracle database).
• PeopleSoft (HR, payroll, and related processes running on Oracle database).
• Oracle HFM / Hyperion (financial consolidation and reporting).
• On-premises SQL Server and Oracle databases (line department application data).
• BI and reporting tools (e.g., Power BI; other tools may exist across departments).
D. Business Challenges
The Port Authority has identified business issues and opportunities that a data governance platform should help address, including:
• Data is distributed across departments and systems; presenting an opportunity to further align definitions and strengthen authoritative sources.
• Business and technical metadata varies in completeness and consistency, creating an opportunity to improve the discoverability and understanding of data assets.
• Data quality monitoring and remediation are performed in multiple ways today, creating an opportunity for a more centralized, consistent approach across domains.
• Data lineage visibility exists, in some areas, presenting an opportunity to expand end-to-end lineage to support root-cause analysis and compliance or audit readiness.
• Governance activities (e.g. stewardship, policy exceptions, approvals) are supported through a mix of tools and processes, creating an opportunity to streamline and standardize workflows.
• Ownership and stewardship roles are defined across many areas, creating an opportunity to clarify responsibilities and decision rights across a decentralized environment.
• Some governance tooling and workflows are optimized for technical users, creating an opportunity to better support non-technical operations staff serving as data stewards.
E. Target-State Capabilities and Outcomes
The Port Authority is interested in Offerings that can enable the following outcomes under a federated governance model:
• Clear assignment of data ownership and stewardship, supported by workflow-driven accountability.
• Improved data integrity, completeness, and consistency with measurable KPIs and quality scorecards.
• Controlled and auditable access to data assets aligned to roles, sensitivity, and policy.
• End-to-end traceability (lineage) to support impact analysis, incident response, and compliance audits.
• Self-service discovery and stewardship tools for non-technical operations staff, including no-code/low-code rule definition and human-in-the-loop exception handling.
• Robust reporting environment for data governance review, discrepancy discovery and resolution, and audit reporting.
F. Example Use Cases
Illustrative (non-exhaustive) use cases include:
• Non-technical data stewards monitor data integrity and quality KPIs for critical operational datasets (e.g., asset inventories, work orders, service events) and manage remediation workflows for issues identified.
• Business users discover trusted datasets via catalog search, understand definitions via business glossary, and view lineage to confirm fitness for use.
• Data stewards review and approve data access requests, with policy-based routing, time-bound grants, and complete audit trails.
• Governance teams identify and classify sensitive data (PII/PHI/financial) and validate masking/tokenization controls.
• Technical teams perform impact analysis before schema or pipeline changes using interactive lineage and downstream dependency views.
• Executive stakeholders monitor governance health metrics, stewardship activity, and compliance evidence through dashboards.
G. Key Themes
Respondents should address the following topics in their Response:
• Support for a federated governance operating model, including role definitions (data owners, data stewards, custodians) and delegation/approval workflows.
• Support for yearly audit reporting to external and internal auditors.
• User-friendly interfaces and guided workflows for non-technical operations staff designated as data stewards (e.g., plain-language interfaces, guided workflows, role-specific dashboards).
• No-code/low-code configuration for data quality rules, thresholds, and stewardship workflows; and human-in-the-loop exception handling.
• Capabilities to monitor data integrity, quality, and access, including alerts, scorecards, audit trails, and remediation tracking.
• Data source coverage and pre-built connectors for hybrid environments, including on-premises databases, cloud data platforms, ETL/ELT tools, and BI tools.
• Implementation approach, typical timeline, staffing assumptions, and change management/training approach for both technical and non-technical users.
• High-level licensing/pricing model and key cost drivers (e.g., users, assets, connectors, compute/consumption).
• At least three (3) customer references for comparable enterprise deployments, including at least one (1) public-sector or similarly regulated environment, where available.
Further, Respondents should describe how the offering supports non-technical stewards in day-to-day stewardship activities without requiring coding or advanced technical skills, including:
• Role-based, plain-language dashboards for data quality, integrity checks, and access activity
(who accessed what, when, and why).
• Alerting and guided remediation workflows (assignment, SLA tracking, evidence capture, resolution verification).
• Human-in-the-loop exception handling for outliers, policy exceptions, and temporary access grants.
• In-application help, training modes, and audit-friendly activity logs tailored to steward responsibilities.
4. HOW TO RESPOND TO THIS RFI
The Port Authority has transitioned to an entirely digital submissions process for the receipt of Responses to this RFI using the Bonfire platform, located at the link below.
Respondents must register and create a free Bonfire account at the provided link in order to log in and download the referenced solicitation and associated information, and in order to upload proposal submissions. Registration on the Bonfire platform requires a registration that is separate from all other Port Authority software platforms.
The Port Authority shall accept only those submissions in electronic format for which the submission or modification is completed at the time of the due date. Responses will be accepted by upload only via the Bonfire platform at https://panynj.bonfirehub.com/portal/?tab=login and must be uploaded and received by the Port Authority no later than 2 PM Eastern Time (ET) on . Emailed submissions, hand deliveries and mailed deliveries (e.g., UPS, USPS) will not be accepted.
Submissions must be uploaded, submitted and finalized prior to the due date. Respondents are strongly urged to allow sufficient time of at least one (1) day prior to the due date to begin the uploading process and finalizing the submission. Respondents will receive an email confirmation receipt with a unique confirmation number once a submission is finalized.
The Respondent’s Response to this RFI should take the form of a proposal of no more than a total of twenty-five (25) pages, addressing the following:
1. A brief description of the Respondent, its lines of business, organization, mission, affiliates, objectives, location, and years in business providing this product/service.
2. Contact information (name, title, telephone number, email) of the individual who will act as the Respondent’s contact for communications with the Port Authority. In addition, at any time after the opening of the Responses to this RFI, the Port Authority may request additional information relating to the Respondent’s qualifications and will use this individual as the point of contact for these queries.
3. Information about Respondent’s product as set forth above in Section I. This may also include a description of the Respondent’s experience relevant to its applications and responses, including:
a. A list of Respondent’s projects currently in place or secured for the future which are relevant to this RFI.
b. Any other experiences, insights, ideas, and approaches to implementing data governance systems that addresses the needs of technical users and non-technical users.
c. Please describe any obstacles you or clients may have encountered in the implementation of your solution.
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpanynj.bonfirehub.com%2Fportal%2F%3Ftab%3Dlogin&data=05%7C01%7Ckgokhale%40panynj.gov%7Cb1fb418f226a46f31abf08da3cc94376%7Cc4484a25d0d84ad0916aa889b6aa7a02%7C0%7C0%7C637889132359179992%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=szx6ZwnZLUj0j0Jw7J%2BLMvOUwgTyBqEy2uFZxSFc810%3D&reserved=0
5. QUESTIONS AND COMMUNICATIONS REGARDING THIS RFI
Questions concerning Bonfire may be addressed to the contact provided on the Bonfire platform.
Questions concerning this solicitation shall be addressed only to the Procurement’s Contact Person as below:
Angelo Arcuti Procurement The Port Authority of New York & New Jersey Four World Trade Center | 21st Floor 150 Greenwich Street New York, NY 10007 Email: aarcuti@panynj.gov
Questions from prospective Respondents concerning this RFI must be addressed by email to the Contact Person listed above. Please include in your email’s subject line the following:
“ENTERPRISE DATA GOVERNANCE PLATFORM – RFI 6000003295”.
Questions must be submitted on or before 05/06/2026
6. MEETINGS WITH RESPONDENTS
At any time after the receipt of Responses, we may ask a Respondent to attend an informal informational meeting with Port Authority staff to discuss the Respondent’s Response.
7. GENERAL
A. The Port Authority reserves the right to conduct interviews, issue a solicitation for a proposal, take any other action it is permitted to take, or to perform none of the above.
B. The Port Authority reserves the unqualified right in its sole and absolute discretion to choose to accept or reject any and all firms responding to this RFI on the basis of an evaluation of the responses to the RFI. The Port Authority also reserves the unqualified right to request further information from any Respondent.
C. Neither the information submitted from your firm, nor the submission of your Response to the RFI and any documents or other information supplied by you, nor any correspondence, discussions, meetings or other communications between your organization and the Port Authority, will impose any obligation on the Port Authority and should not be deemed confidential information. The Port Authority shall have no obligation to any Respondent.
D. At any time, in its sole discretion, the Port Authority may, by written addenda to this
RFI, modify, amend, cancel, and/or reissue this RFI. If an addendum is issued prior to the date a response is due, it will be made available on the following website:
https://www.panynj.gov/port-authority/en/business-opportunities/solicitations-advertisements.html. If an addendum is issued after Responses have been received, it mailto:aarcuti@panynj.gov https://www.panynj.gov/port-authority/en/business-opportunities/solicitations-advertisements.html https://www.panynj.gov/port-authority/en/business-opportunities/solicitations-advertisements.html https://www.panynj.gov/port-authority/en/business-opportunities/solicitations-advertisements.html may, at the Port Authority’s discretion, be provided only to those Respondents whose submittals may be impacted by such change/addendum.
E. The Port Authority reserves all its rights at law and equity with respect to this RFI including, but not limited to, the unqualified right, at any time and in its sole discretion, to change or modify this RFI, to reject any and all Responses, to waive defects or irregularities in Responses received, to seek clarification of Responses, to request additional information, to request any or all respondents to make a presentation, to undertake discussions and modifications with one or more Respondents, which, at any time, subsequent to the deadline for submissions to this RFI, may express an interest in the subject matter hereof.
F. No respondent shall have any rights against the Port Authority arising from contents of this RFI, the receipt of information, or the incorporation in or rejection of information contained in any response or in any other document. The Port Authority makes no representation, warranties, or guarantees that the information contained herein, or in any addenda hereto, is accurate, complete, or timely or that such information accurately represents the conditions that would be encountered during the performance of a subsequent contract, if any. The furnishing of such information by the Port Authority shall not create or be deemed to create any obligation or liability upon if for any reason whatsoever and each Respondent, by submitting its information, expressly agrees that it has not relied upon the foregoing information, and that it shall not hold the Port Authority liable or responsible therefore in any manner whatsoever.
G. Neither the Commissioners of the Port Authority, nor any of them, nor any officer, agent or employee thereof shall be charged personally with any liability by a Respondent or another or held liable to a Respondent or another under any term or provision of this RFI or any statements made herein or because of the submission or attempted submission of information or other response hereto or otherwise.
H. There are no guarantees made or implied by the Port Authority that this RFI will result in a public procurement process. The Port Authority will not preclude firms or organizations that do not respond to this RFI from participating in any possible future procurement.
Functional & Technical Capability Survey & Associated Questions
Your Response shall include the chart below as well as responses to the corresponding questions with respect to the capabilities of your Offerings. Respondents should indicate the extent to which their Offering reflects the capabilities described below (e.g., Yes / No / Partial) and provide explanatory comments.
Data Cataloging & Discovery
ID Capability Response (Y/N/P) Comments / Notes DC-01 Automated discovery and scanning of data assets across databases, data lakes, file systems, and APIs
DC-02 Support for technical metadata extraction (schemas, data types, relationships)
DC-03 Business metadata management including descriptions, tags, and classifications
DC-04 AI/ML-powered automated tagging and classification suggestions
DC-05 Business glossary with term definitions, synonyms, and relationships.
Taxonomy/ontology modeling (hierarchies, concept types, semantic relationships, governed relationship types).
DC-06 Crowdsourcing capabilities for metadata enrichment by business users
DC-07 Search functionality with natural language query support
DC-08 Data asset versioning and change history tracking
DC-09 Data product marketplace experience, publishing, certification, and lifecycle management, schema expectations, quality thresholds, access terms and SLA.
1. Describe your automated discovery mechanism and supported data source types.
2. How does your solution handle schema changes and metadata drift over time?
3. What Artificial Intelligence/Machine Learning capabilities are included for automated classification and tagging?
4. Describe the user experience for business users searching and browsing the catalog.
Data Quality Management
DQ-01 Data profiling capabilities to assess completeness, accuracy, consistency, and validity
DQ-02 Rule-based data quality validation with customizable business rules
DQ-03 Data quality scorecards and dashboards with drill-down capabilities
DQ-04 Automated anomaly detection and alerting for quality degradation
DQ-05 Issue tracking and remediation workflow management
DQ-06 Historical trending of data quality metrics over time
DQ-07 Integration with data pipelines for inline quality checks
5. Describe the types of data quality dimensions your solution measures out-of-the-box.
6. How are data quality rules defined, and what level of technical expertise is required?
7. Explain your approach to root cause analysis when quality issues are detected.
8. How does your solution handle data quality at scale (billions of records)?
Data Lineage & Impact Analysis
Req ID Requirement Response (Y/N/P) Comments / Notes
DL-01 Automated lineage capture from ETL/ELT tools, databases, and BI platforms
DL-02 Column-level lineage tracking (not just table/dataset level)
DL-03 Visual lineage representation with interactive exploration
DL-04 Forward and backward lineage tracing (upstream and downstream)
DL-05 Impact analysis for proposed schema or source changes
DL-06 Support for manual lineage documentation where automated capture is not possible
DL-07 Lineage integration with data quality to trace quality issues to source
9. What ETL/ELT tools and BI platforms does your solution capture lineage from natively?
10. How does your solution handle lineage across complex transformations (e.g., PySpark, custom SQL)?
11. Describe the user experience for performing impact analysis before making changes.
12. How frequently is lineage information refreshed, and can it be triggered on-demand?
Policy Management & Workflow
PM-01 Centralized policy definition and management repository
PM-02 Role-based access control (RBAC) with fine-grained permissions
PM-03 Automated policy enforcement and compliance monitoring
PM-04 Data stewardship workflow with approval and review processes
PM-05 Sensitive data identification and classification (PII, PHI, etc.)
PM-06 Data access request and approval workflow
PM-07 Policy versioning with audit trail of changes
PM-08 Integration with external access control systems (e.g., Azure AD, LDAP)
PM-08 Role-based task queues, reassignment, SLAs, exception queues, dashboards.
PM-09 Business-readable policy modeling (information policy representation) with traceability to implementing rules and enforcement integrations.
PM-10 Policies and controls can be authored/managed as code (API, Git, promotion Dev Test Prod, approvals, audit).
13. Describe your approach to defining and enforcing data access policies.
14. How does your solution handle policy exceptions and temporary access grants?
15. What sensitive data detection capabilities are included (patterns, ML-based, etc.)?
16. How does your solution integrate with existing identity providers and access management systems?
17. Where does meta data and data live in the solution (on prem, cloud) and what protections are in place to protect and safeguard Port Authority data.
Reporting & Dashboards
RD-01 Executive dashboards with governance health scores and KPIs
RD-02 Compliance reporting with evidence collection for audits
RD-03 Data usage and consumption analytics
RD-04 Custom report builder with export capabilities (PDF, Excel, etc.)
RD-05 Scheduled report generation and distribution
RD-06 Role-specific views and dashboards for different stakeholders
RD-07 Trust score model for datasets and data products, with explainability (why the score is what it is).
Master Data Management (Optional)
MD-01 Match and merge entity resolution
MD-02 Golden record creation with survivorship rules
MD-03 Hierarchy management for organizational structures
MD-04 Stewardship interface for data curation and validation
Technical Attributes Describe architecture, scalability, integration, and security capabilities in alignment with the capabilities below.
Architecture & Scalability
TA-01 Support for SaaS, on-premises, and hybrid deployment models
TA-02 Horizontal scalability to handle growing data volumes
TA-03 High availability architecture with disaster recovery capabilities
TA-04 Multi-tenant architecture with data isolation guarantees
TA-05 Support for containerized deployment (Kubernetes, Docker)
Integration Capabilities Req ID Requirement Response (Y/N/P) Comments / Notes IC-01 REST APIs for programmatic access and automation
IC-02 Pre-built connectors for common databases (SQL Server, Oracle, PostgreSQL)
IC-03 Native integration with Azure Synapse Analytics
IC-04 Native integration with Azure Databricks (Unity Catalog compatible)
IC-05 Integration with
Azure Data Factory for pipeline lineage
IC-06 Integration with Azure Data Lake Storage Gen2
IC-07 Connectors for PeopleSoft, SAP, and Oracle databases (on-prem and cloud)
IC-08 Integration with BI tools (Power BI, Tableau)
IC-09 Webhook and event-driven integration support
IC-10 SDK availability for custom integrations (Python, Java, .NET)
18. Provide a complete list of pre-built connectors included with your solution.
19. Describe the process for building custom connectors for systems not natively supported.
20. What is the typical integration timeline for connecting to enterprise systems?
21. How does your solution handle API rate limiting and throttling for source systems?
Data Security Requirements
DS-01 Encryption at rest using AES-256 or equivalent
DS-02 Encryption in transit using TLS 1.2 or higher
DS-03 Support for customer-managed encryption keys (BYOK)
DS-04 Data masking and tokenization sensitive data
DS-05 Complete audit logging of all data access and administrative actions
DS-06 Data residency controls (US-based data centers)
DS-07 Regular penetration testing and vulnerability assessments
22. Provide copies of current SOC 2 Type II and ISO 27001 certifications.
23. Describe your incident response process and notification timelines.
24. What data does your solution store, and where is it physically located?
25. Describe your approach to secure software development (SDLC).
26. How do you handle data deletion and retention upon contract termination?
After reviewing Responses, the Port Authority may invite one, several, or no Respondents to participate in informational discussions and/or product demonstrations to further understand Offerings and implementation approaches. Any such discussions or demonstrations, if conducted, are for information-gathering purposes only.
EXHIBIT A
AGREEMENT ON TERMS OF DISCUSSION
The Port Authority’s receipt or discussion of any information (including information contained in any proposal, vendor qualification(s), ideas, models, drawings, or other material communicated or exhibited by us or on our behalf) shall not impose any obligations whatsoever on the Port Authority or entitle us to any compensation therefor (except to the extent specifically provided in such written agreement, if any, as may be entered into between the Port Authority and us). Any such information given to the Port Authority before, with or after this Agreement on Terms of Discussion (“Agreement”), either orally or in writing, is not given in confidence. Such information may be used, or disclosed to others, for any purpose at any time without obligation or compensation and without liability of any kind whatsoever. Any statement which is inconsistent with this Agreement, whether made as part of or in connection with this Agreement, shall be void and of no effect. This Agreement is not intended, however, to grant to the Port Authority rights to any matter, which is the subject of valid existing or potential letters patent.
Any information (including information contained in any proposal, vendor qualification(s), ideas, models, drawings, or other material communicated or exhibited by us or on our behalf) provided in connection with this procurement is subject to the provisions of the Port Authority Public Records Access Policy adopted by the Port Authority’s Board of Commissioners, which may be found on the Port Authority website at: http://corpinfo.panynj.gov/documents/Access-to-Port-Authority-Public- Records/. The foregoing applies to any information, whether or not given at the invitation of the Authority.
(Company)
(Signature)
(Title)
(Date)
ORIGINAL AND PHOTOCOPIES OF THIS PAGE ONLY.
DO NOT RETYPE.
http://corpinfo.panynj.gov/documents/Access-to-Port-Authority-Public-Records/ http://corpinfo.panynj.gov/documents/Access-to-Port-Authority-Public-Records/
| A. Strategic Context and Business Objectives |
| C. Current State – Technical Environment (Summary) |
| D. Business Challenges |
| E. Target-State Capabilities and Outcomes |
| F. Example Use Cases |
| G. Key Themes |
| 6. MEETINGS WITH RESPONDENTS |
| 7. GENERAL |
| Functional & Technical Capability Survey & Associated Questions |
| Data Cataloging & Discovery |
| Data Quality Management |
| Data Lineage & Impact Analysis |
| Policy Management & Workflow |
| Reporting & Dashboards |
| Master Data Management (Optional) |
| Technical Attributes |
| Architecture & Scalability |
| Integration Capabilities |
| Data Security Requirements |
File details come from the government source that posted it. Updated .