23-RFI-002-CS - RA MOD -SUPPORTING TECH SOLUTIONS (FINAL)FINAL2.pdf

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 1 of 16

DEPARTMENT OF ECONOMIC OPPORTUNITY

REQUEST FOR INFORMATION

Information Acknowledgement Form

Page 1 of 16 pages SUBMIT REPLY TO:

Department of Economic Opportunity Purchasing Office 107 East Madison Street, B-047 Tallahassee, Florida 32399-4128 Telephone Number: 850-245-7455

AGENCY RELEASE DATE:

09/23/2022

SOLICITATION TITLE: SOLICITATION NO:

Reemployment Assistance Modernization – Supporting Technology Solutions 23-RFI-002-CS

RESPONSES WILL BE OPENED: 10/04/2022

This is a Request for Information (RFI) as defined by section 287.012(22), Florida Statutes (“F.S.” or Fla. Stat.”). Responses to this RFI are not offers and cannot not be accepted by DEO to form a binding contract. §287.012(22), Fla. Stat. (2022). Information received in response to this RFI, however, may be used to develop future procurements. Respondents to this RFI will not be prohibited from submitting bids to such future procurements based solely on having responded to this RFI.

§287.057(19)(c), Fla. Stat. (2022). Vendors, then, are encouraged to respond with solutions that meet all or part of the specified requirements listed in greater detail in Section B of this RFI.

RESPONDENT NAME:

RESPONDENT MAILING ADDRESS:

CITY – STATE – ZIP:

*Authorized Representative’s Signature

PHONE NUMBER:

TOLL FREE

NUMBER:

FAX NUMBER: *Name and Title of Authorized Representative

EMAIL ADDRESS:

FEID NO.: *This individual must have the authority to provide this Response.

TYPE OF BUSINESS ENTITY (Corporation, LLC, partnership, etc.):

RESPONDENT CONTACTS: Please provide the name, title, address, telephone number and e-mail address of the official contact and an alternate, if available.

PRIMARY CONTACT: SECONDARY CONTACT:

NAME, TITLE: NAME, TITLE:

ADDRESS: ADDRESS:

PHONE NUMBER: PHONE NUMBER:

FAX NUMBER: FAX NUMBER:

EMAIL ADDRESS: EMAIL ADDRESS:

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 2 of 16

SECTION A

SPECIAL INSTRUCTIONS FOR THE PREPARATION AND SUBMISSION OF RESPONSES

The instructions for this RFI have been designed to help ensure all responses are reviewed in a consistent manner, as well as to minimize costs and response time. INFORMATION SUBMITTED IN VARIANCE WITH THESE

INSTRUCTIONS MAY NOT BE REVIEWED.

A.1

A.2

A.3

SOLICITATION NUMBER

SOLICITATION TYPE

PROGRAM OFFICE

23-RFI-002-CS

Request for Information (RFI)

Division of Workforce Services – Reemployment Assistance

A.4 PURCHASING OFFICE Cheryl Sumner/Vincent McKenzie

Purchasing Analyst/Purchasing Manager 107 East Madison Street, B-047 Tallahassee, Florida 32399

(850) 245-7443/(850) 245-7463 (Office Number) Cheryl.Sumner@deo.myflorida.com Vincent.McKenzie@deo.myflorida.com

A.5 CALENDAR OF EVENTS

Listed below is the calendar of important actions and dates/times by which the actions must be taken or completed.

If DEO finds it necessary to change any of these dates/times, it will be accomplished by addendum. All listed times are local in Tallahassee, Florida.

Estimated Calendar of Events Date and

1 Date of Issuance and publication on the Florida Vendor Information Portal (VIP)website at:

https://vendor.myfloridamarketplace.com/search/bids

9/23/2022

2 Responses Due 10/4/2022 By 3:00 pm (Eastern Standard Time

Addenda or clarifications to this RFI Form will be posted on the Florida Vendor Information Portal (VIP). It is the Respondent’s responsibility to monitor the Florida VIP for any updates to this RFI.

A.6 RESERVED.

Remainder of Page Intentionally Left Blank https://vendor.myfloridamarketplace.com/search/bids

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 3 of 16

SECTION B – INTRODUCTION AND PURPOSE

B.1 INTRODUCTION AND PURPOSE

The State of Florida, Department of Economic Opportunity (DEO), Division of Workforce Services, is requesting information regarding available software solutions that meet the infrastructure, software, data and analytics, and/or security requirements of the Reemployment Assistance Claims and Benefits Information System (System) and the overarching Reemployment Assistance Modernization Program (Program). The software solutions shall support the following projects, which are part of the Program:

• The SOA/API Layer project will establish a solid architectural basis in support of the System’s continuous modernization by defining a new architecture based on .NET Core, Web API framework, and a service-oriented architecture for the modernized System Application;

• The Rules Engine project will establish business rules into a user-visible and user-maintainable business rules engine. This will allow both maintaining business rules and developing new business rules without requiring code changes and subsequent deployments;

• The Master Data Management and Interoperability project will create a data catalog and data dictionary to enable standardization of data elements and interoperability across business units and other Departments per Florida Digital Services (FLDS) and section 282.206, F.S., requirements.

Pursuant to Rule 60A-1.042, F.A.C., an agency may request information by issuing a written RFI. Agencies may use a RFI in circumstances including, but not limited to, determining whether or not to competitively procure particular commodities or contractual services, determining what solicitation process to use for a particular need, or research general, special, and/or technical specifications for a solicitation.

B.2 BACKGROUND

DEO maintains the Reemployment Assistance Claims and Benefits Information System commonly referred to as “CONNECT,” which shall be referred to herein as the “System.” The System serves as the central repository to track, view, and file Reemployment Assistance claims. The System functions as the core benefits administration platform for DEO staff, claimants, employers and TPAs. The System provides online access to apply for benefits, view and track claims, and set up payment information. For employers, the System allows access to respond and protest to inquiries regarding claimants receiving Reemployment Assistance benefits. Additionally, the System allows employers to grant third-party representatives access to perform specific administrative functions.

In response to the impact on the System throughout the COVID-19 pandemic, DEO partnered with a third-party contractor to perform a study to include assessment of the System built in 2013, actions taken to stabilize the performance of the System in 2020, and compare solution options to enable immediate usability improvements and a sustainable continuous modernization path. On February 26, 2021, the Final Report for Improved Delivery of Reemployment Assistance Benefits (“Final Report”) was published and includes a recommended approach and implementation roadmap for future modernization efforts. The Final Report is incorporated herein by reference.

The recommendations divide modernization initiatives into realistic, viable, and achievable projects and include the acquisition of third-party services to support the efforts and initiatives referred to as the Reemployment Assistance Modernization Program.

During the 2021 Legislative Session, the Florida Legislature adopted House Bill 1463, which directed and provided funding for DEO to undertake a sustainable, continuous modernization effort of the System to implement immediate System performance and functional improvement needs while positioning DEO with a secure, scalable, and sustainable System architecture and agile support processes.

http://floridajobs.org/docs/default-source/communicationsfiles/2021-improved-delivery-of-reemployment-assistance-benefits-final-report-and-cost-benefit-analysis.pdf http://floridajobs.org/docs/default-source/communicationsfiles/2021-improved-delivery-of-reemployment-assistance-benefits-final-report-and-cost-benefit-analysis.pdf

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 4 of 16

B.3 SPECIFICATIONS

The list below contains some components necessary for DEO to maintain architectural integrity, information security, and compliance requirements regarding the projects identified in Section B.1 that the required solutions must maintain for successful implementation into the System and deployment of the Program by June 30, 2023.

1. Architectural requirements shall include, but not be limited to, the following:

A. Align to Technical Requirements (see Exhibits 1-3 to Section B. Introduction and Purpose) ;

B. Be COTS/SaaS-based C. Be Cloud Agnostic;

D. Opportunity for minimal customization appropriate for each identified solution;

E. Exportable code products and methods;

F. Leverage API-based solutions;

G. Reusability, product innovation, and scalability;

H. Follows recognized and accepted industry methodology;

I. Compliant with the State’s Enterprise Architecture;

J. Delivers processing accuracy;

K. Support high-speed processing at very large-scale volumes;

L. High Performance module and external system integration and processing;

M. Services versioning, reuse, and rapid deployment;

N. Protect and secure Reemployment Assistance Program data and assets from Information Security threats;

O. Update data across all components of the System simultaneously and provide data flows across the components of the Modernization Projects and the System;

P. Integrate workflow for assigning, managing, monitoring, and approving work;

Q. Integrate and interface with other systems and applications;

R. Automate data population and cascade data between input screens to improve productivity and reduce data entry errors;

S. Improve secure electronic communication within DEO as well as among DEO’s customers and approved third parties;

T. Provide real time access to information necessary for performance measurement and quality management;

U. Provide immediate access to data for accurate reporting and customizable dashboards to support decision-making;

V. Provide a claims processing system with workflow that interfaces with or is integrated with the existing

System, to streamline all Reemployment Assistance claim information and claimant and employer data;

W. Provide a scalable platform with a flexible architecture based on common technical standards to support process improvements and system integration requirements;

X. Meet Florida state and federal requirements and can easily adapt to future changes;

Y. Enable internal and external communications with modern features (e.g., personalized broadcasts and mass mailings);

Z. Leverage one or more industry standard architecture framework(s) (e.g., The Open Group Architecture

Framework (TOGAF), Zachmann, National Institute of Standards and Technology (NIST), etc.);

AA. Be able to be owned, maintained, and enhanced easily by the state;

BB. Maintain a record/audit trail of changes and errors during update processes and accounting for originating source and user;

CC. Be capable of rapidly deploying applications, integrate legacy applications, and share data across multiple enterprise components;

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 5 of 16

DD. Support connections between systems which enable transformed business process orchestrations across Modernization Projects’ components to verify efficiency with limited technical changes;

EE. Provide effective integration of solutions that can be configured quickly to provide faster delivery of new functionality;

FF. Support functionality to interface with multiple entities inside and outside of DEO systems for exchange of information; and

GG. Compliant with the Data Privacy and Cyber Security Requirements outlined in DEO’s security requirements.

2. Solutions must:

A. As applicable, incorporate system development and data security best practices and standards, with leading sources of guidance being:

i. DEO policies and practices;

ii. Chapter 60GG-2, Florida Administrative Code (“F.A.C.”) (Rule Chapter 60GG-2, Florida Administrative Code, “Information Technology Security”);

iii. Chapter 60GG-4 F.A.C. (Rule Chapter 60GG-4, Florida Administrative Code, “Cloud Computing”) ;

iv. Cybersecurity and Infrastructure Security Agency (CISA) Cloud Security Technical Reference

Architecture (TRA);

v. CISA Zero Trust Maturity Model;

vi. NIST Special Publication 800-53;

vii. Center For Internet Security (CIS) Controls Version 8;

viii. Open Web Application Security Project (OWASP) Top 10; and

ix. SANS Securing Web Application Technologies (SWAT) Checklist.

B. Integrate fully with DEO’s chosen Identity and Access Management solution(s) for the centralized, automated management and auditing of users and entitlements.

C. Have the ability to use third-party data validation and verification.

D. Have the ability to request and track system changes and upgrades for audit purposes.

E. Support the ability to limit access to specific internet protocol (IP) address ranges and domains.

F. Generate user activity and system security audit data.

G. Allow accounts to be configured with strong passwords and passphrases, and multi-factor authentication, meeting or exceeding minimum DEO requirements, which will be provided at or near Contract execution.

H. Provide audits and alerts for user activity, including, but not limited to, changes to records, exports, and printing.

I. Provide the ability to manage, change, and disable default settings that pose a security risk. Such settings include but might not be limited to:

i. Infrastructure and application encryption keys.

ii. Accounts.

iii. Passwords.

iv. Simple Network Management Protocol (SNMP) community strings.

J. Use strong, unique encryption keys, where applicable, in both the application and underlying infrastructure, and allow them to be fully managed and controlled by DEO.

K. Support integration with DEO’s preferred central log management tool(s) and security information and event management (SIEM) platform.

3. In addition to standard security requirements, cloud (SaaS, PaaS, IaaS, etc.) providers must:

A. When expected to store or process data categorized as “Moderate” impact or higher, possess FedRAMP provisional Authority to Operate (ATO) at the “moderate” or higher impact level.

B. Allow DEO to own and fully manage encryption keys, logically segregating DEO data from the service provider.

https://www.flrules.org/gateway/ChapterHome.asp?Chapter=60GG-2 https://www.flrules.org/gateway/ChapterHome.asp?Chapter=60GG-2 https://www.flrules.org/gateway/ChapterHome.asp?Chapter=60gg-4

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 6 of 16

C. Produce updated SOC 2 compliance audit reports for DEO review.

D. Be able to meet DEO requirements developed per 60GG-4, F.A.C..

E. Meet any additional compliance requirements relevant to the data being stored.

4. The vendor/solution must meet these guidelines:

A. Any software development processes must follow secure best practices, using the NIST Secure Software Development Framework (SSDF) as a baseline, and include, at a minimum, a process for continual vulnerability assessment (to include static code analysis, dynamic code analysis, and web application scanning), as well as best practices for code versioning and automated release management in the cloud environment.

B. DevOps practices must follow NIST DevSecOps guidance.

C. The development supply chain must be managed, including, but not limited to hardware, software, third-party code and code modules, portable code, and cloud environments.

D. Audit information, including, but not limited to, physical access, logical security controls, and system logs, must be available.

5. Services and solutions must follow or facilitate, as appropriate, DEO’s compliance with Florida laws and rules, including, but not limited to:

A. Section 282.318, F.S., Cyberseucrity [specifically (4)(c-i)], requiring comprehensive risk analysis performed at least every three years, established information security policies and procedures, implemented security controls, periodic internal audits, consideration of security during procurement, employee security awareness efforts, and incident detection and response.

B. Section 501.171, F.S., Security of Confidential Personal Information concerning notice and duties of third-party agents and requirements for disposal of customer records.

C. Florida Cybersecurity Standards (Chapter 60GG-2, F.A.C.).

D. Florida Cloud Computing Standards (Chapter 60GG-4, F.A.C.).

E. DEO Security policies derive guidance and ideology from the NIST 800 Series, NIST Cybersecurity

Framework, and the Center for Internet Security (CIS) Controls (https://www.cisecurity.org/controls/).

F. Section 443.1715, F.S., regarding disclosure and confidentiality of Reemployment Assistance information.

6. Additionally, DEO and its contractors must meet information regulatory and compliance requirements where applicable, which may include:

A. IRS Publication 1075, Safeguards for Protecting Federal Tax Information (Internal Revenue Service (IRS)

Publication 1075 (latest version available here);

B. Social Security Administration data sharing agreements;

C. FBI Criminal Justice Information Services Policy (Federal Bureau of Investigation (FBI) Criminal Justice

Information Services (CJIS) Security Policy (latest version available here); and D. Unemployment Insurance Program Internal Security requirements.

B.4 GOALS

The goal of the Program is to implement immediate System performance and functional improvement needs while positioning DEO with a secure, scalable, and sustainable System architecture and agile support processes.

The goal of this RFI is to seek information about solutions for the projects identified in Section B.1. that meet DEO’s requirements and that are available from one or several vendors who may work in partnership with other contractors supporting the modernization Program.

B.5 OBJECTIVES

https://www.cisecurity.org/controls/ https://www.irs.gov/pub/irs-pdf/p1075.pdf https://www.irs.gov/pub/irs-pdf/p1075.pdf https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 7 of 16

To use the results from this RFI to determine which particular commodities or contractual services may be procured and to research general, special, and/or technical specifications for a solicitation, per Rule 60A-1.042, F.A.C.

B.6 PROCESS

Responses to this RFI will be reviewed by DEO for informational purposes only and will not result in the award of a contract. This is an RFI as defined by section 287.012(22), Florida Statutes. Responses to this RFI are not offers and cannot be accepted by DEO to form a binding contract. §287.012(22), Fla. Stat. (2022). Information received in response to this RFI, however, may be used to develop future procurements. Respondents to this RFI will not be prohibited from submitting bids to such future procurements based solely on having responded to this RFI. §287.057(19)(c), Fla. Stat. (2022). DEO will review responses received from this RFI to determine the feasibility of issuing a competitive solicitation for services or commodities. Any request for cost information is for budget purposes only.

B.7 INSTRUCTIONS TO RESPONDENTS

The instructions for this RFI were designed to help ensure all responses are reviewed in a consistent manner.

The response must include:

1. Information Acknowledgement Form

Respondents are required to complete, sign, and return the “Information Acknowledgment Form” with their submittal. This form must be completed and signed by a representative who is authorized to provide information on behalf of the Respondent.

If a Respondent fails to submit a signed Information Acknowledgment Form with their reply, DEO reserves the right to contact the Respondent by telephone to inform the Respondent to submit this document by email, which is then followed by a submission through the mail. This right may be exercised when the Respondent has met all other requirements of the RFI.

In the event more than one Respondent submits a joint response, each Respondent of the joint response must complete and sign a separate Information Acknowledgement Form.

2. Details

Interested Respondents submitting a response for consideration by DEO should use the information below during development:

A. The submission should be limited to no more than three (3) pages for each solution proposed by the

Respondent.

B. Respondents must submit a response for at least one (1) solution for one of the projects listed in

Section B.1; responses that reflect a vendor’s ability to provide solutions for more than one project listed in B.1. will be accepted.

C. Responses must describe the solution(s) and explain how the solution(s) meets the specifications listed in Section B.3. and the requirements listed in the applicable Requirements Traceability Matrix.

The submission needs to reflect how the Respondent’s solution(s) clearly and completely meets the requirements as identified in Section B.3..

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 8 of 16

D. The submission must reflect Respondent’s experience with applying and implementing identified solutions in a large-scale, multi-component environment; and

E. Any other information that Respondent wishes to supply in response to this RFI.

B.8 RESPONSE

RFI responses are to be submitted electronically via email to the address(s) specified in Section A.4, Purchasing Office. Responses should be prepared in accordance with the instructions provided in this RFI. DEO is not responsible for and will not reimburse any costs incurred in the preparation or submission of information in response to this RFI.

This is strictly a RFI, and in no way does this request bind DEO to solicit bids or proposals in the future. However, in no way does submittal of information pursuant to this RFI give any Respondent any advantage in any solicitation if DEO elects to solicit bids/proposals in the future.

B.9 RESERVED.

B.10 RESPONSE DATE

RFI responses are due, via email, at the time and date specified in Section A.5, “Calendar of Events” in the Purchasing Office, 107 East Madison Street, Room B-047, Caldwell Building, Tallahassee, Florida 32399.

RFI responses received by DEO are subject to production, disclosure, inspection, and copying, in accordance with Chapter 119, Florida Statutes.

B.11 DISCLOSURE AND OWNERSHIP OF RESPONSES BY DEO

A Respondent’s response shall be a public record and subject to production, disclosure, inspection, and copying consistent with the requirements of Chapter 119, Florida Statutes.

B.12 RESPONDENT’S DUTIES TO ASSERT EXEMPTION FROM DISCLOSURE AS A PUBLIC RECORD

Any response content submitted to DEO which is asserted to be exempted by law from disclosure as a public record shall be set forth on a page or pages separate from the rest of the response, and clearly marked “exempt,” “confidential,” or “trade secret” (as applicable), with the statutory basis for such claim of exemption specifically identified in writing on each and every such page. Failure to segregate and so identify any such content shall constitute a waiver of any claimed exemption as applied to the portion of the response or other document in which the content is set forth.

Any claim of exemption from public disclosure is waived upon submission, unless addressed as set forth above.

DEO will attempt to afford protection from disclosure of any trade secret as defined in section 812.081(1)(c), F.S., or section 688.002, F.S., where identified as such in the response, to the extent permitted under section 815.045, F.S., or section 288.075, F.S., and Chapter 119, F.S. Each Respondent acknowledges that the protection afforded by section 815.045, F.S., is incomplete, and hereby agrees that no remedy for damages may arise from any disclosure by DEO.

DEO takes its public records responsibilities under Chapter 119, F.S., and Article I, Section 24 of the Florida Constitution, very seriously. If a Respondent considers any portion of the documents, data, or record submitted in response to this RFI to be exempted by law from disclosure as a public record, the Respondent must also provide DEO with a separate Redacted Copy of its response at the time of reply submission.

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 9 of 16

This Redacted Copy shall contain DEO’s RFI name, number, and the name of the Respondent on the cover, and shall be clearly titled “Redacted Copy.” The Redacted Copy shall be provided to DEO at the same time the Respondent submits its response to the RFI and must only exclude or redact those exact portions which are exempted by law from public disclosure. Each individual portion of the Redacted Copy that Respondent asserts is confidential must contain a citation to the specific law making the content of the redacted portion confidential.

If it is determined the response does not contain any information which is exempted by law from public disclosure, Respondent shall provide as part of the response, a written statement to that effect which is executed by an authorized representative of the Respondent’s company with legal authority to make this determination on behalf of the Respondent.

Respondent shall protect, defend, and indemnify, save and hold harmless, DEO from any and all claims, demands, liabilities, and suits of any nature arising out of, because of, or due to the failure of, DEO releasing information redacted by the Respondent, and to further indemnify DEO for any other loss DEO incurs due to any claim being made against DEO regarding portions of its Redacted Copy being confidential, proprietary, trade secret, or otherwise not subject to disclosure. DEO expressly retains all rights, benefits, and immunities of sovereign immunity in accordance with Section 768.28 Florida Statutes, and nothing in this RFI shall be deemed a waiver of sovereign immunity or limits of liability beyond any statutory waiver.

B.13 RIGHTS TO DATA AND COPYRIGHT

Writings, publications, films, videos, technical reports, equipment, computer hardware and software, recordings, computer programs, computerized data bases, data processing programs, pictorial reproductions, maps, drawings, specifications, graphical representations, and works of similar nature (whether copyrighted or not copyrighted), which are submitted with a response or specified to be delivered under a project contract shall be maintained by DEO and may be released as public records. Additionally any writings, publications, films, videos, technical reports, equipment, computer hardware and software, recordings, computer programs, computerized data bases, data processing programs, pictorial reproductions, maps, drawings, specifications, graphical representations, and works of similar nature (whether copyrighted or not copyrighted), which are developed or produced and paid for in whole or in part by contract funds become the property of DEO except as may otherwise be provided in the contract.

The remainder of this document is intentionally left blank.

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 10 of 16

ATTACHMENT 1 TO SECTION B.

Requirements Traceability Matrix – SOA and API Layer

Description

Be able to search for PDF files on website through search criteria (Project Name, Local Government, Document Type.)

Search and find upload DRI PDF files with categories: Project Name, Document Type, Local Government, Project Number.

Ability to go into application to add different types of documents to existing projects.

Search existing projects through search criteria (Project Name, Local Government, Document Type).

Project files are in Axiom Pro and Share Drive in PDF format. Need to migrate files into new application. About 260 gbs from Axiom Pro.

Be able to download PDF files from search results. Hyperlinks with document file names.

Must be cloud-based.

Ability to gather Performance metrics Ability to integrate with enterprise application performance monitoring tools (AppDynamics and Splunk) Provide range of concurrent transactions supported by each product Provide scalability model(s) Disaster recovery and High availability support for each deployment options The technology selected must be agnostic to any specific vendor and minimize vendor dependency and promote and enable DEO to have independence in using, maintaining, modernizing, and enhancing the System The technology selected must leverage exportable code products and methods where appropriate to reduce risks and lower both short-term and long-term costs The technology selected must leverage API-based solutions to promote efficient integration and to reduce risk and lower both short- and long-term costs The technology selected must promote reusability, product innovation, and scalability by using innovative concepts and that are suitable to a state government setting with funding constraints The technology selected must follow an industry accepted software engineering methodology, or a hybrid methodology based on industry accepted methodologies and proven best practices, from requirements gathering through deployment to production and during warranty periods

The technology selected must simplify configuration, policy, process, maintenance, and testing The technology selected must Integrate and interface with other systems and applications including but not limited to: SSA, NDNH, EmployFlorida Marketplace, Reemployment Assistance Help Center, IVR, ICON, SUNTAX, and SIDES The technology selected must automate data population and cascade data between input screens to improve productivity and reduce data entry errors, according to the Reemployment Assistance Program and coordinated System changes

The technology selected must provide timely access to information necessary for performance measurement and quality management The technology selected must meet Florida state and Federal requirements and can easily adapt to future changes

The technology selected must support connections between systems which enable transformed business process orchestrations across Modernization Projects’ components to verify efficiency with limited technical changes

The technology selected must ensure information in transit between entities is secure as required by Federal and State laws The Integration Platform must incorporate current industry standards tools or technology.

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 11 of 16

Required ongoing support and maintenance skill sets must be readily available in industry.

The Integration Platform must support a fully scalable architecture designed to allow incremental increases in every capacity to meet expansion in usage demand.

The Integration Platform must allow for a System-wide view that supports enabling technologies that align with DEO’s goals and nationally recognized Reemployment Assistance business processes and technologies.

Integration Platform services must enable component integrations based on the standards and requirements outlined in the SOA/API vendor's SOW.

This Integration Platform must enable the seamless integration of the RA System, multiple modular components including Commercial-off-the-Shelf (COTS) software, Software-as-a-Service (SaaS) solutions, and additional projects, as identified by the DEO.

The Integration Platform must be an ESB (Enterprise Services Bus) to serve as the primary API gateway.

The API gateway will provide real-time access to services and data for both internal and external systems.

The ESB solution must act as the communication broker and web services orchestrator for the RA Moderization System’s projects and components.

The ESB solution must clearly define service end points that add functionality without requiring pervasive or broad changes to the ESB.

The ESB solution must orchestrate a stateless flow of information and request/reply conversations across services and between applications in the SOA.

The ESB solution must enable message-oriented middleware, transformation, and routing intelligence for System components.

The ESB solution must be flexible and allow the integration of a variety of industry standard technologies.

The ESB solution must provide data management and secure sharing of data across System components and external systems.

The ESB solution must deliver asynchronous communications, timely alerts, and notifications to support broad availability of data to users in a timely manner.

The ESB solution must be able to receive documents, images, and any other file types identified by DEO from external systems to be stored in the System.

The ESB solution must be able to receive data via one protocol and translate it to another protocol prior to further routing.

The ESB solution must support at a minimum the following web service, specifications, and adaptors, including but not limited to: ODBC, JDBC, POP3, SMTP, SSH, Web Service (WSDL, WS-*, SOAP, REST, UDDI, ODATA), XML, JSON- WDP, FTPS, SFTP, HTTP, and HTTPS.

The ESB solution must include an automated system availability solution which routinely checks to see if each System integration point is operating as expected.

The frequency of each System integration point verification will be defined by DEO.

The ESB solution must provide secure sharing of data across the Integration Platform and System components.

The ESB solution must provide the capacity to execute business rules from a variety of systems using ESB orchestrations.

Documentation of other architectural requirements: API Gateway usage

The ESB must support manageable interactions among the solutions and projects included in the RA Modernization Program to intelligently route data flowing through System components, adapting and transforming that data as required by the System’s various solutions.

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 12 of 16

The interaction styles may include synchronous or asynchronous request/response, messaging, publish/subscribe, alerts, security, and quality of service.

Documentation of API architectural specifications for CX/UX enforcement/development The ESB must provide a service-oriented architecture and standards approach, which promotes data sharing, service routing, and message processing.

Federal Risk and Authorization Management Program (FedRAMP) Moderate Baseline – must be “FedRAMP-authorized” for Moderate impact systems (i.e., meet the moderate baseline)

Social Security Administration (SSA) Technical System Security Requirements (TSSR) v10.5 (attached)

Payment Card Industry (PCI) Data Security Standard (DSS) v4.0 (available here)

The SOA/API Layer will be configured to allow APIs to be managed and maintained in one location. The product will allow the centralized maintenance and management of all APIs and functionality across multiple RA systems

All Remployment Assistance (RA) systems will call APIs from the API gateway/ESB (e.g CONNECT, CX/UX)

APIs within the ESB shall be able to be quickly modified by approved roles Role based access control shall be set up for maintenance of API interface tables, with at least 3 levels of roles.

Interface tables associated with APIs shall have real time or near real time reporting capabilities

APIs shall have an event log and change log, to allow authorized roles to view and download tracking information https://www.fedramp.gov/documents-templates/ https://www.fedramp.gov/documents-templates/ https://www.pcisecuritystandards.org/document_library?category=pcidss&document=pci_dss

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 13 of 16

ATTACHMENT 2 TO SECTION B.

Requirements Traceability Matrix – Rules Engine

The Business Rules Engine (BRE) Solution shall be configurable, so that it integrates with other RA Program Systems/Applications as identified by DEO (even though some of the systems and platforms may already have built-in rules engines).

All RA Systems/applications shall call rules from the BRE Solution (e.g CONNECT, CX/UX, etc.)

The BRE Solution shall be available 24 hours per day, 7 days per week, 365 days per year.

The BRE Solution shall allow for rollback to previous versions of rules without impacting RA Program system/application availability.

The BRE Solution shall have role-based access control, and have at least 3 levels of roles.

The BRE Solution shall have functionality that allows users and permissions, for multiple elevated user levels and business rule approvals, to be managed in accordance with the Identity and Access Management project.

The BRE Solution shall allow for stored rules to be quickly enabled/disabled by authorized users.

The BRE Solution shall allow for the maintenance of rules without requiring additional code changes to any downstream RA Program systems/applications.

The BRE Solution shall support authorized users to create business rules in a natural language in a user-friendly interface.

The BRE Solution shall provide functionality to bulk update large sets of similar rules.

The BRE Solution shall provide the ability to quickly sort rules by category (i.e. functional area, downstream System, etc).

The BRE Solution shall have real time or near real time reporting capabilities.

The BRE Solution shall provide an User Access Report.

The BRE Solution shall provide an Event Log/Audit Log Report.

The BRE Solution shall provide a Transaction Log Report containing details of passed/failed communications/transactions.

a. The BRE Solution shall have the ability to gather and display performance metrics.

b. The BRE Solution shall provide a dashboard view of the BRE to monitor the rules execution and its performance and statistics.

The BRE Solution shall be scalable and able to meet the high transaction volumes for all downstream Systems.

The BRE Solution shall include a scheduler for the maintenance and implementation of rules without impacting RA Program systems/applications availability.

The BRE Solution shall be able to determine priority when multiple rules are included in a scenario.

The BRE Solution shall have the ability to create new pages, rules, issues and rationales.

The BRE Solution shall be accessible through the SOA/API Layer.

The BRE Solution shall be compatible with automated batch jobs.

The BRE Solution shall provide the User with a side-by-side view (UI) of the current version of business rules and the rules being edited

The BRE Solution shall have the ability to integrate with enterprise application performance monitoring tools (AppDynamics and Splunk)

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 14 of 16

The BRE Solution shall provide a centralized location to implement and manage all RA Program system/application rules. These rules will consist of the following:

a. Business Logic

b. Screen Verbiage

c. Screen Functionality

d. Rationales (Correspondence Verbiage)

The BRE Solution shall be implemented (and testable) in the cloud environment established by DEO.

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 15 of 16

ATTACHMENT 3 TO SECTION B.

Requirements Traceability Matrix – Master Data Management and Interoperability

Master Data Management and Interoperability (MDM) Solution shall be scalable across all Program Systems/Applications MDM Solution shall handle the connections with all the systems/applications deemed relevant MDM Solution shall handle the amount of data from systems/applications, with regards to amount of data, and bandwidth for communication with other systems/applications MDM Solution must be able to handle the amount of Master Records established for DEO Identified Domains and any other User Type determined from Working sessions.

MDM Solution shall be configurable, incorporating business policies including source system, data provider, data collection method, data collection date/time, data quality, data format, data values, and other data characteristics.

MDM Solution shall use Data Vault 2.0 as a potential architecture design principle and pattern MDM Solution shall access/be accessible to the rest of the RA Mod Program via the SOA/API Layer

MDM Solution shall have ability to configure workflows for Master Record Conflict Resolution by Data Stewards

MDM Solution shall identify and provide notification on identity records that are potentially duplicated or have other errors MDM Solution shall be available 24/7/365.

MDM shall have the ability to enrich data using external or internal connectors Shall have MDM Tool licensed implementations for development environments deemed necessary MDM Solution shall maintain linkages between identity records MDM Solution shall provide the ability to link, de-link, and relink data within identity records MDM Solution shall provide search functionality to search and navigate the Master Data Model and the established Master Data Records MDM Solution shall be able to push/receive changes to/from connected RA Mod Program systems/applications

MDM Solution shall be able to accept records in real time, batch, or asynchronously MDM Solution shall provide reporting functionality, including a User Report for listing users with access to the tool and an event Log for changes made, who made a change, to what, when, etc.

MDM Solution shall allow/establish a single Master Record for each person/organization both internal and external to DEO to identify, manage, and share the linkages to existing System records from systems identified by DEO (i.e.

EmployFlorida) MDM Solution shall provide functionality to notify MDM users of issues that require actions MDM Solution shall provide a User Interface to display the Master Records MDM Solution shall identify the source of the Master Record MDM Solution shall provide edit functionalities to fix errors or update a record MDM Solution shall provide a visual representation of the Master Data Model and relationships MDM Solution shall have ability to maintain Data Dictionary and/or Data Catalogue to implement Data Governance MDM Soltuion shall have ability to maintain Reference Data Models (i.e., glossaries, unemployment insurance (UI) definitions) MDM Solution shall provide edit functionality to alter the Master Data Model

An equal opportunity employer/program. Auxiliary aids and services are available upon request to individuals with disabilities. All voice telephone numbers on this document may be reached by persons using TTY/TDD equipment via the Florida Relay Service at 711.

DEO Solicitation No.: 23-RFI-002-CS Page 16 of 16