2-SN2503 - Applicant Tracking System Technical Interrogatories.docx

RFP #SN2503 – APPLICANT TRACKING SYSTEM - EXHIBIT A

Technical Interrogatories

Please respond to the groups and questions below by indicating Y-Yes or N-No (for each bullet point) and providing appropriate details in the table. The table needs to be completed in the format provided. You can expand the space for details and additionally reference attachments if you need more space.

Please note that CCC is only interested in SAAS (Software-as-a-Service/Cloud-based) solutions.

· Please differentiate between transactional versus analytical reports

· How do you manage reporting access?

· Do you provide real-time reporting?

· Is a separate reporting environment available for high-volume analytics? Is this required?

· What online and offline file formats are supported (pdf, MS-Word/Excel, XML, etc…)

· If so, what formats are supported (pdf, MS-Word/Excel, XML, etc…)

· Are there any system constraints or limits to the amount of information that can be imported/extracted?

· Is there information that cannot be imported/extracted?

· What options are available for CCC to access your system data? Do you allow backend database or system updates or is it view-only?

· Do you provide delivered APIs to access information? Please describe their functionality.

· Do you provide tools to allow CCC to “mass update” high volume information as appropriate?

· What information do you need CCC to provide to your application (required versus optional)? How frequently? What formats are acceptable?

· Describe any delivered integrations available with 3rd parties (e.g., PeopleSoft)?

· What forms of secure transmission do you support: sftp? ssl? ftp with pgp? Other?

· What integration options are available (real-time services, batch, near real-time, etc…)?

· Do you utilize the following technologies: SOAP, REST, SAML

· Give an example of a common customization or a situation where a customization is required (i.e., something that cannot be configured as delivered)

· Provide two examples of “complex” customizations.

· To what extent can CCC “brand” the application (differentiate between customization and configuration)?

· What skill sets are required to configure the application (how much training is required and what training/support materials are delivered)?

· Who performs the customizations (CCC and/or Vendor)? If CCC is allowed to customize, what is allowable to avoid violating the licensing agreement/warranty?

· What programming expertise is required to customize the application?

· Describe all the areas that can be “configured” (e.g., setup, transaction processes, security, workflow, online validations, etc…)

· Does your application allow workflow approvals (multi-levels)?

· How does your application handle workflow proxy?

· How does your application handle escalations?

· Do the delivered transaction audits affect system performance?

· Is the audit data readily available for access? To whom?

· At what point do you purge the audit information?

· For situations where there is not an “edit” to maintain data quality/integrity, what other safeguards are available as delivered (e.g., reports, periodic batch validation programs, etc…)

· Differentiate between CCC and Vendor responsibilities and access.

· Provide network bandwidth requirements for the various functions within this application

· Does this application work with caching servers? Is there a specific configuration needed?

· Is a dedicated circuit required?

· If yes, is the connection encrypted, provide detail?

· Explain your load balancing capabilities (address appropriate tiers)

· Describe each environment

· Discuss how the environments are maintained (i.e., upgraded, cloned, refreshed, etc…)

· Explain the process to migrate data between various environments (e.g., setup data from Dev to QA). Do you provide delivered scripts and/or processes?

· Can CCC request additional environments as needed for the build-out as well as future needs (e.g., Development, Testing, Production, Training, etc…)? What database platform do you utilize?

· How do you determine the initial database size? How do you adjust for actual and planned growth?

· How much space is included in the standard offering for each environment?

· What is the incremental cost for additional environments and/or space requirements?

· Discuss your backup, restore, and recovery strategy as it relates to various tiers.

· What is provided as part of your standard offering?

· Will our business be subject to mandatory purging and/or archival?

· Complete Appendix A and B

· Do you have a business continuity template or initial plan?

· How often do you test Disaster Recovery with each client?

· What is the maximum data loss in the event of catastrophic system failure?

· How long will the system be down (i.e., timing for switching over to secondary system/application and bringing it online)?

· What are your SLA’s related to DR?

· Is the data center owned or leased?

· If leased, please provide details around agreement with 3rd party (including major terms and expiration dates).

· Who manages and maintains the data center?

· Is the data center secure? How do you maintain security? Please detail and address following areas at a minimum:

· Network Security

· Server Security

· Application Security

· Physical Security

· Database Security

· Data/Information Security (Personal Identifying Information - PII)

· Operating System Security

· Shared versus Dedicated Environments

· How do you backup your guarantee? What are the consequences of not meeting the guarantee?

· Define how the guarantee applies to all hosted applications, systems, and/or tiers

· Do you currently offer High Availability (HA)? If so, please provide separately the options and costs-related

· If no, do you have any plans to offer HA within the next two years? If yes, please provide as much details as possible.

· Please provide the dates and types of your most recent audits (if more than one type) and who they were conducted by.

· Detail any major deficiencies that were identified and how they were remedied.

· Please describe your audit schedule and when your next audits will be conducted?

· When was the most recent 3rd party audit performed and can you provide the results to CCC?

· Discuss unplanned maintenance:

· Process

· Communication to CCC

· Alerts

· RCA – Root Cause Analysis

· Which tiers/areas are monitored?

· Hardware System Availability

· System Connectivity Availability

· Communication Protocol Delivery

· Network Reliability and Performance

· Operating System Availability

· Database Access Availability

· OLTP Performance

· Batch Processing Performance

· Other

· Please describe the alert process and timing

· What is the demarcation point (vendor/CCC)?

· Does your monitoring extend to CCC? Are there additional costs for the end-to-end monitoring?

· What access will you provide to CCC (dashboard, reports, etc…) and what is the frequency of updates?

· Discuss what tools and/or applications do you utilize to ensure maximum system availability?

· How do you proactively identify potential issues?

· Please clearly differentiate which resources/tiers are dedicated for CCC versus what will be shared with other organizations

· Do you utilize virtualization? Please explain.

· What capital upgrades are you undertaking or plan to make within the next two years? How will this impact the agreement and costs?

· How do you maintain a current system (latest patches, releases, hardware/software, etc…) – Please discuss CCC versus Vendor roles, responsibilities, and costs.

· Do you have the capability to import user access roles from other systems?

· Discuss examples of single sign-on (SSO) capabilities to provide seamless user access as they transition between multiple systems and/or applications

· Discuss physical security to limit unauthorized access to that data center

· Do you have automated logging for all application activity?

· How do ensure that your system is current to prevent all malware?

· How does your application prevent threats such as SQL injection?

· Upon request, vendor needs to provide CCC access to security logs

· What security standards and methods are utilized (SSL/VPN Tunnel, Antivirus, Encryption, etc…)

· The vendor shall provide applicable Service Organization Reports (SOC II type 1 and 2) or complete the CCC Audit Checklist if it does not perform SOC testing

· How do you insure security?

· How do you insure stability (i.e., adjust for 3rd party changes)

· How do you use open data sources?

· Discuss your post-implementation activities and support as part of the standard offering

· Is communication included in your standard offering? Discuss your communication strategy, responsibilities, dependencies, and tasks

· Is training included in your standard offering? Discuss your training strategy, responsibilities, dependencies, and tasks

· What post-implementation training do you provide and to what audience? How often are the classes? Where are they located? What training options are available? Who conducts the training?

· What major functionality or bug/fixes are you currently planning to implement in the future?

· Describe the process for customers to provide input into your future releases

· Discuss your patch, upgrade, and release strategy and address the following: Frequency, Time to Apply, Roles and Responsibilities, Dependencies, Testing, Contingency/Rollback, etc…

· Describe your process for providing release notes (timing, formats, content)?

· Discuss how a change (configuration or customization) moves from request, development, testing, and production.

· Describe your change control and version control process.

· Describe what is included in your maintenance agreement as it relates to application/system bug/fixes.

· Complete Appendix C

· How do you adjust your employee resources for peak times?

· Describe your help desk support activities and process. How would you coordinate with CCC’S centralized Service Desk?

· Are there penalties if SLAs are not met, describe?

· Describe the support team (work location, offshore/offsite, working hours, etc…)

· Discuss your planned outages (address all tiers)

· How flexible is your maintenance windows and can it be integrated and/or coordinated with CCC?

· Provide your performance SLA’s and describe the process, impact, and timing to scale (planned and unplanned)

· How do you ensure adequate network bandwidth?

· Clearly delineate between Vendor and CCC responsibility as it relates to compliance with government law, regulations, contracts, etc…

· Provide a listing of all Vendor value-added offerings.

Example of offerings:

· Account Management

· Advisory Services

· Database and Server administration, Tuning, Monitoring, Capacity Planning, or Performance

· Third Party Integration Support

· Programming and Customization Services

· Extra environments

· Extra storage

· Licenses

· Additional Tools

· Training

· Other

· Please describe in detail the policies and procedures for termination of services, including any fees, charges or penalties.

· Please discussion ownership of data and transfer of data back to CCC in the event of termination

· Please provide a high-level plan that details tasks, responsibilities, and time/duration guarantees

· What is your policy on maintaining, securing, and distribution (internal/external) of CCC data

· In addition, describe your policies and procedures for the disposition of CCC data on devices not returned to CCC.

· Build Out/Migration

· Implementation

· Setup, Circuit, etc…

· One-Time Costs

· Ongoing Fixed Monthly

· Ongoing Variable (Monthly/Per Unit)

· Optional (new accounts, services, licenses, storage, etc…)

· Growth/Increases (storage, metrics - # students, employees, budget, etc…)

· Exit/Termination costs (included, not included)

· Ability to reduce costs

· Purge/Archive

· Other

Attachments

Appendix A: Backup

Appendix B: Retention

Baseline

Daily

Weekly

Monthly

Annual

Key Calendar Dates

Appendix C: Support