25-8333_Collier_County_TACS_form_-_cloud.xlsx
XLSX spreadsheet 57 KB Posted
- Attached to
- Air Emission Monitoring System
- Solicitation number
- 25-8333
- Issued by
- Collier County, Florida
About this file
The document is a Technical Architectural, Compatibility and Supportability (TACS) Requirements Document from Collier County's Information Technology Department, version 20, dated 10/29/20. The comprehensive technical specification outlines extensive requirements for software vendors proposing solutions to Collier County, covering web-based applications, browser compatibility, licensing, maintenance agreements, operating system requirements, security protocols, and specific technical compatibility standards. The document mandates compliance with various technical and administrative requirements, including support for Microsoft technologies, adherence to federal and state regulations like the Florida Information Protection Act, and specific security and data protection standards.
The TACS document details critical technical prerequisites for software vendors, including mandatory compatibility with Collier County's existing IT infrastructure, such as Microsoft SQL Server, Active Directory, Windows operating systems, and specific security tools like Cisco AMP and Windows Firewall. Vendors must provide detailed architectural diagrams, demonstrate compliance with security standards, and be prepared to support 24x7 incident response if required. The document emphasizes cost transparency, requiring vendors to disclose licensing models, maintenance agreements, and potential additional support costs. Optional services like extended incident support are allowed but would be funded by the department purchasing the software, with a focus on minimizing long-term support and maintenance expenses for the county.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 25-8333_Collier_County_TACS_form_-_cloud.xlsx | XLSX spreadsheet | |
| Request_for_Proposals_(RFP)_Instructions_Form.docx | DOCX document | |
| 25-8333_Solicitation_R1.pdf | ||
| 25-8333_Attachment_A-Landfill_Cover_Areas.pdf | ||
| PO_Terms_and_Conditions_Rev.3_(1).pdf | ||
| Fixed_Fee_Professional_Service_Agreement_[2025_ver.1].pdf | ||
| 25-8333_Insurance_Requirements.docx | DOCX document | |
| 25-8333_Required_Forms_Revised_042122.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
TACS Doc
Technical Architectural, Compatibility and Supportability Requirements Document (TACS)
| Collier County Information Technology Department |
| Version: 20 |
| 10/29/20 |
| Revised by: Paul Ducca |
| Requesting Div./Dept.: |
| Vendor name: |
| Vendor signature: |
| Application name: |
| Date: |
| Key for C18:C76 C = If internal required, If hosted N/A R= Required O= Optional, but may include additional costs to support | ||||||||
| Key for C18: C76 Place an X in the YES or NO column, add any comments required in column H | ||||||||
| Non-Technical Requirements | Yes | No | Vendor's comments | Collier County Comments | Team responsible | |||
| CMA 5401 compliance | R | Vendors proposing to supply software solutions to Collier County must comply with County-Practices-and-Procedures-(CMA) 5401 INFORMATION SYSTEMS PROCUREMENT AND LIFECYCLE MANAGEMENT | IT Managers | |||||
| Vendors proposing to supply any software solutions to Collier County must fill out this document, sign it, and return it to the Collier County IT Division to review. | R | IT Managers | ||||||
| Req # | Technical Requirements for Applications Hosted on the BCC Network | R/O | Weighted for optional business requirement for depts. fielding RFPS | Yes | No | Vendor's comments | Collier County Comments | Team responsible |
| R1 | Web-based candidate software shall utilize Microsoft's current Internet browser (Chromium Edge), Chrome, and iOS Safari. Others can be supported , but support would be on a case by case would basis and billable. | R1 | R | The department purchasing the software benefits from increased security, efficiency, and lower support costs over the life of the software | Service Desk | |||
| Please list any other browsers in column G, they may or may not be considered as acceptable. Any non-Microsoft browser considered as acceptable may incur dedicated support costs. | R2 | O | Applications | |||||
| R2 | The vendor must submit any applicable license agreements for any proposed elements including a description of the licensing model, and list prices for all license types and whether or not custom licensing arrangements are available. | R3 | R | Allows the department that is purchasing the software to determine the limitations of the licensing and the short and long-term costs | Applications | |||
| R3 | The vendor must submit any applicable maintenance agreements for any proposed elements including a description of the maintenance plan, software upgrade policies and exclusions, and list prices for all maintenance agreement types and whether or not custom maintenance agreements are available. | R4 | R | For the department purchasing the software this information will help them plan when will and how often these events take place and to manage their costs more efficiently. |
| Applications | |
| R4 | SAP is Collier's financial application and as such: |
• Applications cannot directly interface with SAP
• Applications that have a point of sales component must be able to produce a batch file daily containing all financial transactions for that day
• The batch file will use the format supplied by the Collier County Clerk of Courts
| R5 | R | Applications | |||||
| R5 | All desktop software applications must utilize Microsoft Operating System, current Collier Production Version release with current patches and service packs, Windows 10 (64-bit). | R6 | R | Operations | |||
| R6 | Applications may not use Exchange Event Sinks or Exchange Public Folders. | R7 | R | Operations | |||
| R7 | If US-CERT posts vulnerabilities associated with an application then the application must be mitigated within a 30 day timeframe by the software vendor. | R8 | R | Operations | |||
| R8 | Software must comply with all Federal, State and Local regulation. Especially the Florida Information Protection Act (FIPA Fla. Stat. 501.171). Vendors and consultants must be able to show that their applications either a) do not store the type of sensitive data mentioned in FIPA in their application's database or b) be prepared to demonstrate how they secure the type of sensitive data mentioned in FIPA in their application's database. | R9 | R | Link to Sensitive Data questions | Administrative | ||
| HIPAA compliance is required for any applications that contain an individuals’ electronic personal information if it is created, received, used, or maintained in the software. | R10 | R | |||||
| All applications that include point of sales systems or accept any type of payments using credit cards must be PCI (Payment Card Industry Data Security Standard) compliant and recertify every year. All credit card processing must be done outside of the BCC network unless the credit card device encrypts all information directly on the device. | R11 | R | Vendors are required to meet banking industries PCI compliance requirements | ||||
| All vendors requiring access to Collier County facilities and the computer network must comply with current published County ordinances and policies. Those ordinances and policies are same requirements that all county employees must agree to, which include finger printing ,a background check, and signing any user agreements required access the BCC computer network. | R12 | R | |||||
| R9 | Any software which stores personally identifying information, including but not limited to passwords, SSN, driver’s license numbers, etc.... or any financial information, such as credit card numbers, bank routing information, etc... must fully protect the information and disclose the methods of protection used, access protection methods, and life cycle handling of this data. Industry standard encryption methods utilizing at least 256 bit encryption techniques are required. | R13 | R | All IT teams | |||
| R10 | Software vendors will acknowledge in writing prior to selection, that Collier County Government will own any and all data and the databases. | R14 | R | Applications | |||
| C1 | The candidate software application proposal must include a complete hardware topology diagram and recommended hardware configurations. |
Vendor Deliverables:
- Topology Diagram
- Recommended hardware requirements (workstation and server)
| - Network bandwidth requirements | C1 | R | Technical specifications, hardware requirements, and visual representations of the candidate’s recommended software solution will enable the selection committee to understand the complexity of the application and costs to support it. | Applications | |||||
| C2 | Web-based software must utilize IIS 10 or newer with current patches and service packs. | C2 | R | The department purchasing the software benefits from increased security, efficiency, and lower support costs over the life of the software | Operations | ||||
| Applications that utilize a web browser for an internal or external access will utilize TLS1.2 instead of SSL | C3 | R | Operations | ||||||
| C3 | Software applications should support and run on current shipping release of virtual servers, including: |
- VMware ESX ( most current version )
| C4 | R | Operations | |||||
| C4 | All software upgrades or changes required by the selected vendor must be fully tested before being moved into the production environment. Therefore vendors must include in their proposal the costs for licensing, professional services, and annual maintenance to set up and maintain test and development environments. | C5 | R | Applications | |||
| C5 | System must support the current the use of NetBackup in the Collier Production environment with NetBackup most current version. | C6 | R | Operations | |||
| C6 | All server software applications must utilize Microsoft Operating System, current Collier Production Version release with current patches and service packs, current version is Server 2019 | C7 | R | Standardizing the desktop operating system to a few specific versions decreases the management overhead for support and lowers the cost to the agency. | Operations | ||
| C7 | Solutions requiring a back-end database must utilize Microsoft SQL Server Standard or Enterprise edition. The solution must use and support Microsoft SQL Server 2016 (64-bit) SP2 or newer. Compatibility mode must match the version of Microsoft SQL Server. | C8 | R | Development | |||
| For SQL Server based solutions, the use of the default SQL SA account is prohibited. The use of the SA role for daily functions is also prohibited. The solution will adhere to the least privilege principle. | C9 | R | Development | ||||
| Is the proposed application compatible with VSS? Service Display Name: Volume Shadow Copy |
Service Name: VSS
| Path: C:\WINDOWS\system32\vssvc.exe | C10 | R | ||||||||
| C8 | Hard coding account access shall not be permitted. | C11 | R | Provides enhanced application security by removing the issue of being unable to change user account names and passwords if that information is compromised. | Operations/Development | |||||
| C9 | If a geographic information systems (GIS) is included in the solution, the solution must leverage ESRI ARGIS Online. Loosely couple architecture using the REST endpoints is the preferred architecture solution. The County strives to keep its ESRI GIS current with the latest released version. | C12 | R | If the solution must use On-Premise ArcGIS Enterprise this should be talked over with IT Managers and discussed to make sure that this can be kept up to date and that the Dedicated GIS servers can accommodate. | ||||||
| Development | ||||||||||
| All optional items listed below may incur additional costs for support and maintenance for the application that is proposed. All additional costs, for implementation and ongoing maintenance would be borne by the department purchasing the application. | R/O | Weighted for optional business requirement for depts. fielding RFPS | Yes | No | Vendor's comments | Collier County Comments | ||||
| O1 | Incident Support providing 24x7/365 coverage shall be offered. Incident response service levels shall be specified. | O1 | O - 10 | This service is appropriate when a department’s critical business is run outside of the normal 8 to 5 Monday to Friday work week ( example: evenings, weekends, holidays) and the software systems are proprietary or complex enough that the BCC IT department cannot always resolve the issue without assistance from the vendor. There is however, a premium associated with the cost of this type of vendor support, which the department purchasing the software would bare. | Applications | |||||
| O2 | Client software applications should support and the vendor should provide package definition files with silent install without user interaction, using Microsoft SCCM current version. Supported installation packages include: | |||||||||
| MSI, Microsoft Windows installer MSI compatible | O2 | O - 10 | Results in lower support and maintenance costs for the department that owns the software. | Applications | ||||||
| O3 | All software application vendors are required to notify Collier County when new releases become available and when current releases and related systems are no longer supported. | O3 | O - 10 | Allows the department that owns the software to get the latest functionality that the vendor is offering along with patches that keep software security and compatibility current. | Applications | |||||
| O4 | Preferred solutions should take advantage of the County's Active Directory environment and utilize Windows Authentication at the application, database and server tier, run fully in the user context, and not require elevated permissions or administrative permissions. Elevated permissions require adherence to all relevant policies, such as the Elevated Privileges and Elevated Database Permissions policies. | O4 | O - 10 | Provides enhanced security by eliminating the possibility of a disgruntled former employee or vendor getting access to a department's application since their network account with be disabled. | All IT teams | |||||
| Does the application require anti-virus exclusions Anti-Virus? If so please provide paths & or processes | O5 | |||||||||
| Credit Card Payment Processing | ||||||||||
| All credit card processing devices are prohibited from being connected to any BCC computer or directly to the BCC network unless the device is P2PE compliant and encrypts the data directly on the device. | R-15 | R | Credit Card payment devices must use a separate phone or cable connection to the Internet or is P2PE compliant | Applications | ||||||
| Security Software required by the Information Technology Division that ALL Proposer's software must compatible with. | Vendor's comments | Collier County Comments | ||||||||
| NNT | R-16 | If for some reason the proposing vendor's software is not compliant with CMA5401, then it is possibly to mitigate the issues . However mitigation would be a dedicated service and the purchasing division would be responsible to bare all of the costs of the mitigation. | Security | |||||||
| Change Auditor | R-17 | Security | ||||||||
| Cisco AMP (Antivirus) | R-18 | Security | ||||||||
| Windows Firewall | R-19 | Security | ||||||||
| Flexera | R-20 | Security | ||||||||
| SCCM | R-21 | Security | ||||||||
| System Center Endpoint Security | R-22 | Security | ||||||||
| Cisco AnyConnect | R-23 | Security | ||||||||
| Vendor Required Software for their applications to run | Yes | No | Vendor's comments | Collier County Comments | ||||||
| Does the application require Flash? | Software listed in this section will require additional dedicated costs for support. | Applications | ||||||||
| Does the application require Java? | Applications | |||||||||
| Does the application require Silverlight? | Applications | |||||||||
| Does the application require any type of PDF software? | Applications | |||||||||
| Cloud or SAS Specific Applications and Services | Yes | No | Vendor's comments | Collier County Comments | ||||||
| ADFS for single sign on | O | |||||||||
| Does the application require the installation of software, including browser plug-ins on a end user's computer, list all the software and version number required in cell H70. | R | |||||||||
| Provide a detailed architectural diagram of the application that includes links to all servers, services, and IP addresses. | If a vendor cannot provide a detailed architectural diagram of their application that includes links to all servers, services, and IP addresses this will not necessarily preclude a vendor from selling their application to a Collier County division. However, the Collier County Information Technology Division will not be able to troubleshoot any problems beyond the edge of the BCC network and it will be the vendors responsibility to resolve any issues that occur. | |||||||||
| Collier County uses a web filtering service. Does the proposing vendor's solution work with a web filtering service. If it does, please provide all IP Addresses and the services being delivered in cell H70. | Variances are possible if a vendor does not want or cannot supply the requested information. However, if problems with the application occur and the BCC network is functioning as designed, it is the responsibility of the vendor to troubleshoot and resolve the issues. | |||||||||
| If your application requires whitelisting, please provide a list of URL's to be bypassed in the web filtering service. | ||||||||||
| List the web browsers and versions that your application is compatible with in cell H74 | ||||||||||
| Describe your data backup and recovery process. Will a copy of the database be available if requested and what format will it be in? | ||||||||||
| Is any type of sensitive data stored in the application database and if so what steps are taken to protect that data? | Link to Sensitive Data questions |
What colocation data center is the proposing vendor's application housed at ?
| Minimum bandwidth required? |
| Web applications must support HTTPS, TLS 1.1 or higher |
CMA5401
| CMA 5401 |
| INFORMATION SYSTEMS PROCUREMENT AND LIFECYCLE MANAGEMENT |
| Page 1 of 3 |
| § 5401-1. Purpose. |
| § 5401-2. Procurement and Deployment. |
| § 5401-3. Ongoing Support and Maintenance. |
| § 5401-4. Application Retirement. |
| § 5401-5. Waivers, Mitigation and Remediation. |
| § 5401-6. Currency. |
| [Effective Date: April 18, 1997 (Revised: October 1, 2001; Revised: October 1, 2003; Revised: January 21, 2016)] |
| ___________________________________________________________________ |
| § 5401-1. Purpose. |
| The purpose of this Instruction is to define a standard, efficient, and effective method for procurement and lifecycle management of information systems and services that are compatible with the agency’s information architecture, supportable, interoperable, secure and comply with the County Information Technology Division (IT) standards and practices. All purchases must comply with the requirements of the County procurement ordinance and policy. |
| § 5401-2. Procurement and Deployment. |
| A. A completed Technical Architectural Compatibility Standards (TACS) signed by the IT Director and the procuring Operating Division Director is required prior to procurement. The current TACS form is available on the IT Division’s Intranet website. All requirements must be met. Exceptions may be granted with sufficient mitigation or a waiver see § 5401-5. Waivers, Mitigation and Remediation. |
| B. Operating Division Director must determine permissible service levels including the maximum number of failures on an annual basis, the maximum downtime per incident and the acceptable data loss per incident in minutes. |
| C. Information systems must comply with all local, state and federal laws. Health Insurance Portability and Accountability Act (HIPAA), Personally Identifiable Information (PII) and Payment Card Industry Data Security Standard (PCI DSS) requirements must be identified and addressed if applicable. PCI DSS certifications must submitted on an annual basis by the Operating Division Director. |
| D. An architectural diagram must be prepared and review conducted in compliance with IT policy. Approval by the IT Division Director is required prior to procurement and deployment. |
| § 5401-3. Ongoing Support and Maintenance. |
| A. Systems must have an active vendor maintenance agreement that includes patches and upgrades. |
| B. Systems must support platform patches within 30 days of release. If patches cannot be installed appropriate mitigations must be identified and deployed within that time frame by the Operating Division Director (see § 5401-5. Waivers, Mitigation and Remediation). |
| C. Vulnerabilities identified and published by the Department of Homeland Security’s United States Computer Emergency Readiness Team (US-CERT) must be mitigated by the Operating Division Director within 30 days of notice by IT (see § 5401-5. Waivers, Mitigation and Remediation). |
| D. The Operating Division Director is responsible for submitting a completed Technical Architectural Compatibility Standards (TACS) to IT on an annual basis. All requirements must be met Exceptions may be granted with sufficient mitigation or a waiver see § 5401-5. Waivers, Mitigation and Remediation. |
| § 5401-4. Application Retirement. |
| A. All system components must be shut down and decommissioned when systems are |
| retired. This includes servers, databases, storage and uninstalling associated applications |
| on PCs. |
| B. Budget inventory changes must be made at system retirement. |
| C. The Operating Division Director is responsible for public records compliance for all |
| retired system data and contacting the agency’s Records Manager to determine the |
| appropriate retention period. The operating Division Director is responsible for |
| maintaining the systems to read the backup media including any required hardware and |
| software and all associated costs. |
| D. Operating Division Director will review retirement plan with IT to ensure compliance |
| with this CMA. |
| § 5401-5. Waivers, Mitigation and Remediation. |
| A. Mitigation is required for systems that are not TACS compliant or require the use of older |
| version of/or insecure components. Viable mitigation options include the use of technical |
| controls, replacement or upgrade of the system and retiring the system. |
| a. The Operating Division Director is responsible for working with IT to develop an |
| acceptable mitigation strategy. Scenarios involving technical controls are subject |
| to the same review process as new systems. |
| b. The Operating Division Director is responsible for all costs, including support |
| staff, associated with mitigation. These costs may include, but are not limited to: |
| i. Support for |
| 1. Non-standard databases |
| 2. Operating Systems |
| 3. System components |
| 4. Web servers |
| ii. Creation and maintaining development environments |
| iii. Initial and ongoing support for Firewalls and Intrusion |
| Detection/Prevention systems and monitoring |
| B. Waivers may be granted under extenuating circumstances. |
| a. All waivers must be reviewed by the IT Director. |
| b. The Operating Division Director may grant a waiver where the impact is limited |
| to their division. |
| c. Department Heads may grant waivers where the impact is limited to their |
| department. |
| d. The Information Technology Executive Committee (ITEC) will make a |
| recommendation to grant a waiver where the impact is at the agency level with |
| final approval by the County Manager or his designee. |
| C. Remediation costs associated with a breach or system failure as the result of a waiver |
| must be fully funded by the Operating Division Director. |
| § 5401-6. Currency. |
| The Information Technology Division is responsible for maintaining the currency of this Instruction |
| Return to TACS Doc |
Sensitive Data Collection
| Does your department collect social security numbers for any reason? | |
| No, our department does not collect social security numbers for any reason. | |
| Our department collects social security numbers in compliance with FS 119.071(5) and provides the required form when doing so. |
| If yes, to question above: | |
| Our department does not store or save social security numbers (on paper or electronically). | |
| Social security numbers are stored as follows: |
| Does your department accept credit cards for any transactions? | |
| No, our department does not accept credit card payments directly or via 3rd parties. | |
| Yes, our department accepts credit card payments for the following: |
| Does your department retain and store HIPAA protected health information (see definition below)? | |
| No, our department does not store HIPAA protected health information. | |
| Yes, our department retains HIPAA protected health information in the following manner: | |
| HIPAA regulations define health information as "any information, whether oral or recorded in any form or medium" that |
"is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse"; and
"relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual."
| It is worth emphasizing that while HIPAA's primary privacy concern is health information exchanged or stored electronically, the Privacy Rule* also reaches to data "[t]ransmitted or maintained in any other form or medium." That includes paper records, fax documents and oral communications ∲. |
| * http://privacy.med.miami.edu/glossary/xd_privacy_stds.htm |
| ∲ http://privacy.med.miami.edu/glossary/xd_oral_communication.htm |
http://privacy.med.miami.edu/glossary/xd_hipaa.htm
File details come from the government source that posted it. Updated .