20-01-Specifications for Family Medical Leaeve Assistance.pdf

City of Dallas

Request for Competitive Sealed Proposals (RFCSP) Project Title: Family Medical Leave Assistance Buyer Solicitation Number: BYZ25 - 00028078

I. Introduction, Purpose, and Intent

The City of Dallas is soliciting competitive sealed proposals from qualified vendors to provide full-service leave and wellness benefits administration for approximately 13,000 employees.

Proposals should include detailed pricing for each of the products and/or services offered, as the City may award the contract based on individual quotes for the desired services.

The City will implement Workday (HCM) as its enrollment platform beginning approximately January 1, 2026. The selected vendor should be prepared to administer leave and wellness benefits using a solution that is compatible with Workday. An interim solution may be required prior to full integration.

As part of the City’s continued efforts to support employee well-being and ensure comprehensive coverage of leave and wellness benefits, proposals should include, but not be limited to, the following:

Family and Medical Leave Compassionate Leave (Long-Term Disability) Paid Parental Leave Quarantine Leave (Q-Leave) Mental Health Leave Military Leave for Emergency Declaration ADA Workplace Accommodation Other leave or wellness benefits to be identified

Vendors are encouraged to tailor their proposals to address the administration, tracking, and compliance of these leave types, as well as suggest additional relevant services that align with employee wellness and the City’s needs.

II. Pre‐proposal Meeting Schedule, Questions, and Inquiries

During the solicitation process Proposers are required to limit their communication regarding this project to the Buyer referenced herein. A preproposal meeting will be held by the City whereby the Proposers will have an opportunity to ask the requesting department(s) questions and/or obtain clarification. The preproposal meeting will be the only time when Proposers and requesting department(s) will communicate directly, thereafter, all communication associated with this project shall be address to the assigned Buyer. Proposers may submit their questions electronically through the City solicitation portal, https://dallascityhall.bonfirehub.com/login. All questions shall be submitted electronically, the City will respond to all questions by way of addendum which will be posted as part of the solicitation. The City, its agents, and employees shall not be responsible for any information given by way of verbal communication.

III. Proposal Submittal Requirements Proposals shall be structured and formatted as follows:

1. (Executive Summary of Services):

a. Maximum length of two pages on company letterhead.

b. Include an offer to negotiate indicating the Respondent’s understanding and agreement to comply with the terms of this RFCSP and all related addenda and stipulating that the proposal set forth remains effective for a minimum period of 150 days.

c. Include Firm's name, address and telephone number.

d. Include names, addresses, and telephone numbers of any other person(s) authorized to represent the Firm.

e. Include the name, addresses, and telephone number of a single contact person for all correspondence and notifications and its legal counsel regarding this RFCSP.

f. The original signature of a partner, principal, or officer of the Respondent with a statement that the signatory is authorized to submit the proposal.

2. Table of Contents

a. Proposals shall be submitted a Table of Contents with appropriate page numbers for locating the required information and attachments as specified in the Bid Submittal Requirements.

3. Proposal

a. Each proposal shall be single space. Each section shall be a maximum of 5 pages

b. Responses to the RFCSP Questionnaire. Responses to the RFCSP Questionnaire should be in the order asked and should include as much detail as possible to describe the salient features of the proposal. Responses to the RFCSP shall be made according to the instructions set forth in this section for content and format. Include any cost and service information not otherwise identified in the RFCSP if applicable to the programs at hand.

c. Responses to the RFCSP Questionnaire should be in the order asked and should include as much detail as possible to describe the salient features of the proposal.

Responses to the RFCSP shall be made according to the instructions set forth in this section for content and format. Include any cost and service information not otherwise identified in the RFCSP if applicable to the programs at hand.

d. Proposals shall contain a "Table of Contents" with appropriate page numbers for locating the required information and attachments as specified in the Bid Submittal Requirements.

IV. Scope of Work Comprehensive Leave and Wellness Benefits Administration Services

The selected vendor will be required to manage and administer various leave programs for City of Dallas employees, including Family and Medical Leave (FML), as well as other leave types such as Compassionate Leave (Long-Term Disability), Paid Parental Leave, Quarantine Leave (Q- Leave), Mental Health Leave, Military Leave for Emergency Declaration, ADA Workplace Accommodations, and any additional wellness or leave benefits identified by the City. These services must be compliant with all applicable federal and state regulations, as well as the City’s policies and procedures.

Proposers should include itemized quotes that identify the rates to administer leave benefits for civilian employees only, Police & Fire personnel only, and a third, separate quote for all City of Dallas employees (both civilians and uniformed personnel). The quote should also separately identify the rate for the platform that will be used to administer the full range of leave programs.

Schedule of Work

Vendor shall provide the following:

General Administration and Claims Processing o Provide a year-round platform for tracking applications and administration for various leave services at no cost to the City o Advise of rates for claims processing, including any requirements for minimal number of claims o Outline your application and claims process, including all documented administrative procedures and rules o Collect, review and process all required medical certification documentation and determine eligibility status for qualifying leave events o Provide timely feedback regarding approval or denial of claims o Identify service level for feedback on claims processing (e.g., number of days to respond to claimants with an approval or denial) o Provide case management and communication with the employee to include return to work processes.

o Provide a secure and efficient process that allows employees to report claims o Have the capability to administer workability and/or independent medical evaluations and/or a release to return to work, as appropriate o Have the ability to track leave concurrently with disability claims o Work with the City to review and revise the current leave policies and procedures.

o The review and any revisions to the current leave policies and procedures shall be made prior to the administration of any employee claims.

Reporting and Billing o Describe all administrative reports you will generate as part of the application process;

indicate report frequency o Provide detailed information on fees associated with the requested administration, communication and claims processing o Identify any factors that would cause a change in rates as of the effective date o Provide weekly or bi-weekly reports for tracking that include, but are not limited to:

absences, recertification, continuous, and intermittent leave o Provide the capability to create reports that contain the employee leave data “on demand” that can be accessed by and exported to the Human Resources staff

Communications, Training and Transition o Proposers shall submit a preliminary implementation plan. The plan should consist of a sequential listing of all steps necessary to provide the requested services and who is responsible o Develop and provide informative member communication materials to ensure a successful communications campaign and process transfer o Provide the City with communication tools and other mate rials to promote and advertise the service including posters, business cards and brochures o customized for the City and its employees o Vendor should assign a designated implementation/data transfer leader to manage the transfer of current/open claims to the vendor for continued and process finalization o Provide training to Human Resources staff on FMLA law or other related leave regulations, policies and procedures o Pre-coordinated training sessions should be made available at the request of the City o Provide employee/supervisor communication tools training o Work with the City’s Human Resources department to properly transfer open claims as directed by the City.

o Proposers must confirm that in the event of termination of services, all data and records necessary to administer leaves will be transferred back to the City

Compliance and Regulatory Requirements o Ensure and maintain compliance with federal and state laws, including, but not limited to compliance with HIPAA privacy requirements o Determine best practices in absence management o Vendors must confirm that all claim records and related data, including PHI, will be available to the City upon request

Customer Service, Staffing and Service Levels o Implement a process that includes a customer service or call center o Ensure staffing that includes bilingual support (Spanish speaking) o Identify an assigned client or account manager who is available to coordinate and to meet with City representatives at least three times or more at no cost to the City o Identify the designated support staff that will be assigned per number of employee applications

Metrics Accountability and Performance Measures o Describe your ongoing quality measures o Describe how you would manage the loss of critical resources including work place, work force, your own third-party vendors and system applications o Describe your ongoing quality measures and metrics including your accountability to customer service delivery, accessibility, claims processing (approval/denial rates), account management and other performance guarantees o Vendor must assign a designated Account Manager with responsibility and authority to take all necessary steps to ensure that City expectations are met and to solve all professional performance, invoicing and other conflicts that may arise o Account Manager will meet with City staff regularly or as needed to review and resolve open items and to review all invoices prior to City approval of such invoices for payment o Upon termination of this Agreement, the Vendor must work with the new vendor, carrier or TPA on transferring all open claims via electronic transmission

Please list 3 references that you have worked with in the last 5 years that the City may contact.

Vendor must include direct contact name, email, title and phone number of references.

CONTRACTOR’S RESPONSIBILITY

o In order for a proposal to be considered for funding, Proposers shall comply with the requirements as specified in the Scope of Services, proposal Content as well as the proposal Submittal Requirements, and provide requested information and attachments.

o Contractor will assume complete responsibility for all tasks detailed in the "Scope of Services."

o Any task not specifically detailed in the specified work program as the responsibility of the City will be the responsibility of the contractor.

o Please describe your plan to continue the services outlined in this contract should your company face financial difficulties.

o Awarded vendor will comply with the City’s document retainage schedule.

V. Technical Requirements

The Proposer is requested to provide information on all the below sections, ones not applicable should be stated and a reason for not responding to any section(s) should be stated. For any section which is not applicable the reason for not responding should be stated.

The Technical Requirements are constructed to correlate to the City’s Technology Reference Architecture (TRA) and to determine a Proposer’s ability to provide technical capabilities. When proposing a response to this RFCSP, the Proposer must address all subsections of the Technical

Requirements for the proposed solutions and services supporting the City’s needs. The Technical Requirements are provided as an appendix to this RFCSP. Proposers are expected to respond to each of the statements in the technical appendices and the detailed TRA Checklist.

VI. City Technology Reference Architecture (TRA)

The TRA is a compact, comprehensive, abstract illustration of the technology components and business processes supporting City operations. The TRA has been developed to provide guidance on how solutions should deploy and operate within the City’s Information Technology (IT) environment. The TRA serves as a reference for the specific architectures that Proposers may implement to solve City business objectives.

The TRA is composed of six interrelated domains and provides the foundation for the delivery of service to the City. For more information pertaining to the TRA, Proposers are encouraged to visit the Department of Information & Technology Services (ITS) webpage at www.dallascityhall.com.

The TRA is shown in Appendix B.

VII. Technology Reference Architecture (TRA) Checklist

Proposers are required to complete the City’s Technology Reference Architecture (TRA) Checklist as part of their proposal. The TRA Checklist assists the City in understanding the scope, capabilities, technical implementation, and deployment features of the proposed solution.

The TRA Checklist is located on the City’s website at:

https://dallascityhall.com/departments/ciservices/Pages/enterprise-architecture.aspx

VIII. Technical Requirements Domain

Proposers are required to provide explanation of their fulfillment of the technical requirements pertaining to the domains of:

Data Management.

Application Management Infrastructure Management (including Server and Network Services) Security Management Service Management Program Management Disaster Recovery and Business Continuity Management Proposers are encouraged to reference the diagram for the City’s “Technical Reference Architecture” displayed in Appendix B of this document.

The City’s security framework and standards are provided in Appendix C. The City’s stated data management strategy is provided in Appendix D of this document.

IX. Method of Delivery

The Proposer is expected to provide the City information on a SaaS (Software as a Service) method of delivery:

With SaaS, the Proposer licenses the software application that is hosted at a remote location(s) (i.e., Network Operations Center) to customers through a subscription model, generally a monthly or yearly fee. This approach can also take into consideration a “cloud computing” model where all the technology is in the “cloud” and accessed over the Internet as a service.

X. Platform Administration / Professional Service

The Proposer is expected to provide the City with platform administration (maintain & run).

System administration and maintenance of implemented platform, as well as the addition of new software components if needed, is expected to be provided by the Proposer.

XI. Data Management

The Proposer is expected to provide the City with details on their approach to the following data management areas:

Data Governance Data Architecture Data Quality Data Security Data Operations Meta Data Management Master Data Management

Please refer to Appendix D for the City’s Data Management Strategy.

XII. Communication

It is essential that the awarded Proposer responds clearly after receiving a telephone call or email from the City. Written correspondence from the City shall be answered within twenty-four (24) hours. The awarded Proposer shall respond to phone calls and emails from the City within four

(4) hours of receipt.

The City’s Procurement Specialist will be the primary point of contact until a contract is executed then the City’s Business Relationship Manager shall serve as the central point of contact.

During implementation, the Assistant City Secretary, and the Records Management Officer (RMO) will serve as the primary contacts for this implementation endeavor. Throughout the implementation, the City expects full availability of the Proposer’s timely attendance at all required meetings, trainings, and development sessions. For routine communication, the City expects a 4-hour response time from the Proposer. For urgent or critical issues, the City expects a 1-hour response time from the Proposer.

XIII. Commencement Date

Services will commence on a reasonable, mutually agreed-upon date after the contract award (valid insurance and appropriate bonding) and upon full execution of the contract. The term of the agreement is expected to last once the milestones are completed and approved by the City to include 8 weeks of support after final approval and acceptance.

XIV. Award Method

The City’s intent is to award this solicitation in its entirety, but the City reserves the right to award in the method that is most advantageous to the City.

The City reserves the sole discretion to determine whether a solicitation response is responsive.

City reserves the right to reject any or all bids and to waive minor irregularities or discrepancies in any solicitation response as may be in the best interest of City. Late bids will not be considered for award.

XV. Location and Invoicing

The City shall pay invoices in 30 days. For the City to pay invoices in 30 days, the Proposer’s invoice must be correct, and reflect the work or goods delivered to the City. Proposers must submit invoices electronically to HRfinance@dallas.gov. The 30 days begin when the City has received a correct invoice reflecting the work or goods delivered. If the City receives an invoice that is not correct and/or reflective of work or goods that have been delivered, the City will request a corrected invoice and the 30-day period will begin once the correct invoice has been received. The 30-day period repeats until a correct invoice has been received. All work described in the Proposer’s invoice must have been delivered in compliance with the terms of any contract.

Invoices shall be submitted monthly to the City for payment, unless both parties agree to alternative arrangement based on project milestones. Each invoice submitted for payment shall include, at a minimum, the following information:

Name and address of the department for which services were provided Contact information of City staff who placed order (name, phone number, department) Date of order of Service Detailed description of each service Price good or services (charges for all services covered by this contract are to be separately stated and explained) Total cost of goods/services Number of individuals covered for each invoice amounts by service

Submitting invoices without the above information may cause delays in payment processing.

Incorrect invoices or invoices sent to the wrong address will delay payment. A contracted Proposer(s) who fails to follow this procedure may risk having the contract with the City cancelled.

XVI. Ownership

The City will retain full ownership of all project and work artifacts created by the natural progression through this project’s life cycle. This is to include, but not limited to, all electronic and paper documentation relating to the conceptualization, design, configuration, testing and implementation of the system. The electronic documentation subject to the City’s ownership will also include relevant project documentation located on externally shared or hosted locations.

At the conclusion of this contract, all project artifacts will be delivered to the City’s project team for storage within the City’s systems. The delivery method of City owned artifacts will be jointly agreed upon by the City project team and the Proposer.

XVII. Total Cost of Goods and/or Services

The total fee for all goods and services shall be all inclusive and shall be valid for 180 days after proposal opening. All necessary expenses shall be included in the proposal and in the total pricing.

Per City policy, total billable amounts may not exceed the executed contract amounts. Costs not included or calculated in the applicable unit prices as proposed will not be paid by the City, regardless of the intentions of the proposers when the proposal was submitted and regardless of the fact that those costs were actually incurred.

XVIII. Evaluation Criteria

The contract will be awarded to the proposer(s) who is determined to be the most advantageous to the City. Upon award of a contract, the terms of the specifications, the RFCSP, the award instrument for the comprehensive web-based repository management solution system shall serve as the terms of the contract, unless the City chooses, in its sole discretion, to prepare a formal contract document incorporating the above referenced documents as a part thereof.

The Selection Committee will consist of City technical, management, and end-user personnel and others designated by the City. This committee will evaluate the proposals based on criteria listed as part of the evaluation process, the City may interview Proposers regarding specific areas of their proposals as well as their references.

It is each proposer’s responsibility to effectively communicate their qualifications, services and products to the City of Dallas by thoroughly responding to each requirement contained in this

RFCSP.

The evaluation is based upon the following criteria:

Evaluation Criterion Points A. Cost to the City 25 B. Expertise 30 C. Capability Match to Requirements 25 D. Technical Match to Requirements 15 E. Local Preference 5 Total Points 100

1. Related to Criteria A – Cost to the City: 25 points

Actual cost of various elements of the system as identified in the Proposal Pricing document.

2. Related to Criteria B - Expertise of the Proposer: 30 points Expertise in pay equity analysis and delivering pay equity solutions.

3. Related to Criteria C – Capability Match to City Requirements: 25 points

The proposed system’s ease of use regarding user interaction to provide for the utmost in an officer’s safety, and integration of modules.

Proposer presentation prove that the Proposer’s answers to Functional Requirements are accurate.

Clear and complete responses to the functional requirements contained in the RFCSP.

Ability to meet the long-term functional needs of the City of Dallas.

Proposer’s provision of long term supported interfaces and/or compatible systems.

4. Related to Criteria D - Technical Match to City Requirements: 15 points

Clear and complete responses to the technical requirements contained in the RFCSP.

Ability to meet the long-term technical needs of the City of Dallas.

True packaged software demonstrated by:

Successful history of releases and bug fixes Support and maintenance Ease of upgrading to a new release Future plans for the proposed software Security Architecture

5. Related to Criteria E - Local Preference Program: 5 Points

a) The City of Dallas aims to maximize economic return in the procurement of goods and service with the Local Preference Program. The City’s Local Preference Program values the participation of companies who have their principal place of business in the City of Dallas and who hire City of Dallas residents. 5 points will be awarded to those Suppliers that qualify for the local Preference points on a pass/fail basis.

b) The information shall be submitted in the proposal. To receive the points a supplier must satisfy one of the following:

Proof of principal place of business located in the City of Dallas, OR Proof of local workforce composition including:

At least 100 full time employees who are Dallas residents: OR At least 20% of its total full-time employees who are Dallas residents; OR If available, participation in Workforce Development Program

XIX. Performance Measures and Contract Management

a. Performance will be measured by determining if the project milestones and project tasks are being achieved. The project team will have at minimum a weekly status report meeting to monitor project progression. The project team will require adequate representation by Proposer personnel. Proposer will also be responsible for documented follow-up on open items at all project-related meetings.

b. Unexplained or unreasonable failures to achieve project milestones or project related tasks required will be escalated to contracted Proposer’s management and potentially documented as a “Default.”

c. Monthly contract status meetings between City Human Resources leadership and

Proposer will be held to discuss progress, identify opportunities for improvement and any open issues.

d. Proposer may be required to present or consult to Executive leadership and Council as a subject matter expert.

e. Key customer service indicators will also be developed by the proposer on collaboration with the City Human Resources department and other key users.

Indicators will be reviewed on an annual basis, at minimum, or upon request of the City. Failure to perform in accordance with the agreed upon indicators may result in recommendation for termination of agreement. Recommendation for termination will follow the process as outlined in the fully executed contract.

XX. Exhibits

1. Business Associate Agreement (BAA) – Successful Proposer will be required to sign and submit a City-generated and/or other HIPAA compliant BAA.

2. Data Protection Requirements: - Successful candidate will comply with the City’s security and data protection requirements.

3. City Data and Intellectual Property. All right, title, and interest in City Data (as defined herein) will remain the property of the City. Proposer has no intellectual property rights or other claim to City data that is hosted, stored, or transferred to and from the hosted site or the cloud services platform provided by contracted Proposer, or to City’s confidential information. Contracted Proposer will cooperate with City to protect City’s intellectual property rights and City data. Contracted Proposer will promptly notify City if they become aware of any potential infringement of those rights in accordance with the provisions of this Exhibit.

XXI. Security and Data Protection

1. City Data and Security. All City data handled by Proposer must be securely maintained and located by Proposer or City’s computing infrastructure data center(s). For purposes of this RFCSP and related exhibits “City data” shall include any City confidential and / or regulated information, and any personally identifiable information (PII) relating to any City’s end users or employees of City, its suppliers or contractors (“Personal Data”), to which Proposer has or may have access in connection with the operation or administration of Proposer’s platform, or in connection with the performance of professional services by Proposer for City under terms of any related contract or any applicable statement(s) of work. All City data stored or at rest encrypted in the Data center(s), or in transport, will be encrypted in transport and will not be transferred to any other hosting entity or location without the prior written consent of the City.

(i) Proposer will provide the following available services and functions as part of the software without additional cost to the City:

(a) the use of encryption technology to protect City data from unauthorized access; and

(b) routine back‐up and archiving of City data. Proposer will comply with the requirements for Data security set forth below and implement any pertinent data safeguards including those established herein, and Proposer will further implement reasonable security standards that it determines are necessary, but in no event less than industry standards, to protect

• the physical security of the Data centers used to maintain City data;

and (b) Proposer’s network, all operating systems and software applications, and all data storage systems and media provided by Proposer or its licensors or contractors or operated or provided by City that connect or interface with Proposer’s products, software, or platform, from being subject to any disabling devices.

2. Data Safeguards Proposer has represented to City that Proposer will not be permitted to access City data stored or contained in the products or Proposer’s platform, and Proposer will have no ability to manipulate, modify or control such City data. If any support services or professional services provided by Proposer may involve Proposer or its personnel having or requiring access to City servers, City applications, and / or City data, Proposer shall comply with the provisions of this section and the data security requirements set forth below and, at City’s request, Proposer shall enter into an appropriate separate agreement with City to govern such access and protect any City data that may be subject to such access. To the extent City grants Proposer access to City data, or Proposer has access to or stores or holds any City data, Proposer agrees to:

(i) access and use the City data solely for the purpose of providing City with access to the products, software and Proposer’s platform, and to provide professional services to City in accordance with the terms and conditions of any related contract and any applicable statement(s) of work;

(ii) maintain physical, technical, and administrative safeguards (including but not limited to those set forth in the data security requirements set forth below, and in any event no less than industry standards in the cloud computing/online services industry) to protect the City data against unauthorized access, use, or disclosure while it is accessible to or held by Proposer (“Data Safeguards”); and

(iii) not disclose the City data to any third party, except: (1) to its employees, consultants or contractors who need to have access to such information and solely for purposes of providing professional services to City, provided that such recipients are bound by confidentiality provisions no less restrictive than those set out in any contract; and (2) to the extent required by a judicial order or other legal obligation, provided that, to the fullest extent permitted by law, Proposer will promptly notify City of such a required disclosure to allow intervention by City (and will cooperate with City) to contest or minimize the scope of the disclosure.

3. Data Breach Proposer further agrees that it will monitor and test its data safeguards from time to time, and further agrees to adjust its data safeguards from time to time considering relevant circumstance or the results of any relevant testing or monitoring. If Proposer suspects or becomes aware of any unauthorized access to any City data or personal data by any unauthorized person or third party, or becomes aware of any other security breach relating to personal data held or stored by Proposer under any related contract or in connection with the performance of the professional services or other services performed under a related contract or any statement(s) of work (re: “Data Breach”), Proposer shall immediately notify City in writing and shall fully cooperate with City at Proposer’s expense to prevent or stop such Data Breach. In the event of such Data Breach, Proposer shall fully and immediately comply with applicable laws, and shall take the appropriate steps to remedy such Data

Breach. Proposer will defend, indemnify and hold City, its affiliates, and their respective officers, directors, employees and agents, harmless from and against any and all claims, suits, causes of action, liability, loss, costs and damages, including reasonable attorney fees, arising out of or relating to any third-party claim arising from breach by Proposer of its obligations contained in this section, except to the extent resulting from the actors omissions of City.

All personal data to which Proposer has access, as between Proposer and City, will remain the property of City. City hereby consents to the use, processing and / or disclosure of personal data only for the purposes described herein and to the extent such use or processing is necessary for Proposer to carry out its duties and responsibilities, any applicable statement(s) of work, or as required by law. Proposer will not transfer personal data to third parties other than through its underlying network provider to perform its obligations. All personal data delivered to Proposer shall be stored in the United States or other jurisdictions approved by City in writing and shall not be transferred to any other countries or jurisdictions without the prior written consent of City.

XXII. Data Security Requirements (Are you a member of HISAR?? – Health information resource in the event of breach, all members are notified)

Note: Reference Appendix C for additional discussion

1. General Security Procedures

1.1 Without limiting Proposer’s obligation of confidentiality as further described in the contract and herein, Proposer will be responsible for establishing and maintaining an information security program that is designed to:

a. Ensure the security and confidentiality of City data; (ii) protect against any anticipated threats or hazards to the security or integrity of the City data; (iii) protect against unauthorized access to or use of the City data; (iv) ensure the proper disposal of City data, as further defined herein; and

b. Ensure that all sub-contractors of contracted Proposer, if any, comply with all the foregoing. Contracted Proposer will designate an individual to be responsible for the information security program. Such individual will respond to City inquiries regarding computer security and be responsible for notifying City‐designated contact(s) if a breach or an incident occurs, as further described herein.

1.2 Proposer must conduct formal security awareness training, with a testing component, for all personnel as soon as reasonably practicable after the time of hiring or prior to being appointed to work on City data and annually recertified thereafter. Documentation of security awareness training must be retained by Proposer, confirming that this training and subsequent annual recertification process have been completed, and certification of completion provided to the City upon request.

1.3 City will have the right to review Proposer’s information security program prior to the commencement of City’s entry of data into the products or delivery to City of any professional services and from time to time during the term of any related contract. During the term of any related contract, from time to time with proper notice and contracted Proposer approval, which will not be unreasonably withheld, City, at its own expense, will be entitled to perform, or to have performed, an on‐ site audit of Proposer’s information security program and facilities. In lieu of an on‐site audit, upon request by City, Proposer will use reasonable efforts to complete, within forty‐five (45 days) of receipt, an information security and privacy assessment questionnaire provided by City regarding Proposer’s information security and privacy program.

1.4 In the event of any actual or apparent theft, unauthorized use or disclosure of any City data, Proposer will immediately commence all reasonable efforts to investigate and correct the causes and remediate the results thereof, and within two

(2) business days following discovery of any such event, provide City notice thereof, and such further information and assistance as may be reasonably requested.

1.5 City data, including but not limited to sales data, hosted, stored, or held by

Proposer in the Product(s) or in the platform operated by Proposer, or on any device owned or in the custody of Proposer, its employees, agents, or contractors, will be encrypted. Proposer will not transmit any unencrypted City data over the internet or a wireless network and will not store any City data on any mobile computing device, such as a laptop computer, USB drive or portable data device, except where there is a business necessity and then only if the mobile computing device is protected by industry‐standard encryption software approved by City.

1.6 The parties acknowledge and agree that any disclosure of City data will in no way be construed to be an assignment, transfer, or conveyance of title to or ownership rights in such City data.

2. Network and Communications Security

2.1 All Proposer connectivity to City computing systems and all attempts at same will be only through City’s security gateways/firewalls and only through City‐ approved security procedures in compliance with City AD 2-24 and the City’s information security standards.

2.2 Proposer will not access and will not permit unauthorized persons or entities to access, City computing systems and/or networks without City’s express written authorization, and any such actual or attempted access will be consistent with any such authorization.

2.3 Proposer will take appropriate measures to ensure that Proposer’s systems connecting to City’s systems, and anything provided to City through such systems do not contain any disabling device. For purposes of this RFCSP, “disabling device” means any programs, mechanisms, programming devices, malware or other computer code (i) designed to disrupt, disable, harm, or otherwise impede in any manner the operation of any software program or code, or any computer system or network (commonly referred to as “ransomware”, “malware”, “spyware”, “viruses” or “worms”); (ii) that would disable or impair the operation thereof or of any software, computer system or network in any way based on the elapsing of a period of time or the advancement to a particular date or other numeral (referred to as “time bombs”, “time locks”, or “drop dead” devices); (iii) is designed to or could reasonably be used to permit a party or any third party to access any computer system or network (referred to as “trojans”, “traps”, “access codes” or “trap door” devices); or (iv) is designed to or could reasonably be used to permit a party or any third party to track, monitor or otherwise report the operation and use of any software program or any computer system or network by the other party or any of its customers.

3. City Data Handling Procedures

Erasure of Information and Destruction of Electronic Storage Media. If City data is required to be permanently deleted from any storage media owned or operated by Proposer, all electronic storage media containing City data must be wiped or degaussed for physical destruction or disposal, in a manner meeting forensic industry standards such as the NIST SP800‐88 Guidelines for Media Sanitization. Proposer must maintain documented evidence of data erasure and destruction. This evidence must be available for review at the request of City.

Data Protection. Proposer acknowledges that it may have access to certain of City’s computer and communications systems and networks for the purposes set forth in this RFCSP or related contract. If any data is made available or accessible to Proposer, its employees, agents, or contractors, pertaining to City’s business or financial affairs, or to City’s projects, transactions, clients or customers, Proposer will not store, copy, analyze, monitor, or otherwise use that data except for the purposes set forth in the License Contract for the benefit of City.

Proposer will comply fully with all applicable laws, regulations, and government orders relating to Personally Identifiable Information (“PII”), Sensitive Personal Information (SPI), Health Insurance Portability Accountability Act (HIPAA), and data privacy with respect to any such data that Proposer receives or has access to under the License Contract or in connection with the performance of any services for City. Proposer will otherwise protect PII and will not use, disclose, or transfer across borders such PII except as necessary to perform under contract or as authorized by the data subject or in accordance with applicable law. To the extent that Proposer receives PII related to the performance of the License Contract, Proposer will protect the privacy and legal rights of City’s personnel, clients, customers, and contractors.

4. Physical Security

All backup and archival media containing City data must be contained in secure, environmentally controlled storage areas owned, operated, or contracted for by Proposer and all backup and archival media containing City data must be encrypted.

5. Penetration Testing

If any City data is stored with the Proposer, the Proposer shall provide City with an annual, third-party penetration test report. Proposer will engage, at its own expense and at least one time per year, a third-party contractor reasonably acceptable to City to perform penetration and vulnerability testing (“Penetration Tests”) with respect to Proposer’s systems for the duration of any related contract terms. The objective of such penetration testing is to identify design and / or functionality issues in infrastructure of Proposer’s systems that could expose City data and its computer and network equipment and systems to risks from malicious activities. Penetration tests will probe for weaknesses in network perimeters or other infrastructure elements as well as weaknesses in process or technical countermeasures relating to Proposer’s systems that could be exploited by a malicious party. Penetration tests will identify, at a minimum, the following security vulnerabilities: invalidated or un-sanitized input; broken access control; broken authentication and session management; cross‐site scripting (XSS) flaws; buffer overflows;

injection flaws; improper error handling; insecure storage; denial of service; insecure configuration management; proper use of SSL/TLS; proper use of encryption; and anti‐virus reliability and testing. Within a reasonable period after the annual penetration test has been performed, City may request from Proposer a report of any high level and medium level security issues that were revealed during such penetration test and subsequent certification in writing to City that such high level and medium level security issues have been fully remediated. To the extent that high level and / or medium level security issues were revealed during a penetration test, Proposer will subsequently engage, at its own expense, the testing City to perform an additional penetration test within a reasonable period thereafter to ensure continued resolution of identified security issues and will notify City with the results thereof.

All install paths MUST be communicated to City’s ITS Engineering for inclusion of install path.

Ensure system is on supported versions and platforms (please provide this information in response), e.g., minimum server version of 2016, browser types and versions (e.g., “Edge,” “Chrome”).

6. Cybersecurity Liability and Insurance is required

Solution/Application Assurance – The proposed solution must adhere to secure coding practices managed through a secure solution development lifecycle. Use of and adherence to an authoritative software development framework is both encouraged and expected.

Preference will be given to solutions applying Open Web Application Security Project (OWASP) security standards, frameworks, guides, and models. Proposed solutions should be able to demonstrate adherence to the most current versions of the OWASP Secure Coding Practices (or similar), the OWASP Software Assurance Maturity Model (or similar), the OWASP Development Guide (or similar), the OWASP Testing Guide (or similar), the OWASP Code Review Guide (or similar), and the OWASP Application Security Verification Standard (ASVS) (or similar).

Solution/Application Testing and Acceptance – The proposed solution must be able to demonstrate adequate success at defeating test threats to the solution by City test teams.

The solution must be able to competently survive application, application component, and end-to-end solution testing.

Secure Supply Chain Management - The proposed solution must be able to demonstrate secure acquisition and management of solution components. Components acquired or included within the proposed application/solution must substantiate claims of secure management upon City request. Preference will be given to organizations and solutions demonstrating use and adherence to current Supply Chain Risk Management frameworks such as NIST Special Publication 800-161 (Revision 1) or similar.

Payment Card Industry (PCI) Security Standards Council (SSC) Security Standards - The

City requires the proposed solution to be compliant with all relevant PCI security standards including the most current version of the PCI Data Security Standard (DSS). As The City is ultimately accountable for PCI compliance for the solution, the Proposer will provide all appropriate evidentiary artifacts to assure the City that the deployed and operated solution is appropriately compliant with all relevant and current PCI standards.

If the solution is operated by the Proposer on behalf of the City, the Proposer will provide evidentiary artifacts on no less than an annual basis or upon significant change to the solution indicating continued solution compliance with PCI standards. If the Proposer fails to maintain compliance, the City may take steps at the Proposer’s cost to bring the solution into compliance with current PCI standards or terminate the contract for cause

XXIII. Data and information shall be divided into the following classifications:

Public: Data or information classified as Public, (not explicitly and authoritatively classified as confidential) may be made generally available without specific Data Owner approval.

Sensitive: Data or information subject to public release under an open records request, but the information should be vetted and verified before release. These types of data include items such as employee records and gross salary information. Information that is still considered “public” but afforded a higher level of protection to ensure confidential data (e.g., net salary information) is not comingled.

Confidential: Data or information classified as Confidential shall be protected in a more secure manner than data or information classified as Public. That is typically excepted from public disclosure, whether specified in law or through a decision by the Open Records division of the Texas Attorney General’s office. The loss, corruption, or unauthorized disclosure of such data may be a violation of Texas Statues and/or Federal mandates, laws, and regulations.

Regulated: Data or information focused on the types of data typically regulated by state federal statute or third-party agreements. The loss, corruption, or unauthorized disclosure of such data may be a violation of Texas Statutes, Federal mandates, laws, and/or third-party agreements.

1. General. Acceptance of any equipment, software, or services shall be effective when the designated City representative has accepted such equipment, software, or service pursuant to the City’s information and technology services protocol which shall be agreed upon in more detail with the contracted Proposer. Reference the “Change Management Framework 1.0” in the appendix for additional general detail.

2. Acceptance Testing. Upon receipt of the forgoing notification, the City has the right to conduct testing of the deliverable. Proposer shall provide the City with such assistance as the City may reasonably require to perform acceptance-testing of applicable deliverables.

Pursuant to such testing, the City shall determine whether such equipment, software or service meets in all material respects the specifications, functionality, and performance for the delivered equipment, software, or service.

3. Errors. Within a reasonable time of Proposer’s written or e-mail notification to the designated City representative of completion of delivery, the City shall complete its testing of the deliverable and either provide Contractor with: (i) an acceptance in accordance with City’s protocol, or (ii) if the City determines that the deliverable contains defects or fails to conform to the applicable specifications for such deliverable, the City shall provide Proposer notice of all such defects and failures (collectively, “errors”). Refer to the hosted services software license agreement (“SLA”), if applicable.

4. Failure to Correct Errors. Refer to the contractor hosted services SLA, if applicable and the service level agreement, if applicable.

5. Final Delivery. Upon acceptance by the designated City representative of the completeness and accuracy of testing on the deliverable(s), the contracted Proposer is responsible for delivering the final equipment, software, or service within the agreed upon time defined in the change order and associated procedure(s) developed between City and contractor at the beginning of the change process as deemed acceptable by the City.

XXV. Audit Requirements

1. The repository management solution project will follow the City’s project management methodology (ref. Appendix J). This will provide adequate audit information for the City to store within its records.

2. Proposer is required to assist with all tasks necessary to achieve each gate of the SDLC process.

The contracted Proposer shall keep accurate records of all components of invoices to the City, including but not limited to times and payroll receipts for hourly personnel utilized by this Contract. These records shall be retained for a minimum of two years after the conclusion of the Contract. The City reserves the right to audit any records it deems necessary.

1. Service Completion Schedule

High Level Timeline

a. It is desired that the City “goes live” with the…