26939 Attachment B - IT Technical Questionnaire (1).xlsx
XLSX spreadsheet 59 KB Posted
- Attached to
- Postsecondary Workforce Readiness System RFP
- Solicitation number
- 26939
- Issued by
- Jefferson County, Colorado
About this file
This document is an IT Technical Questionnaire from Jefferson County Public School District (Jeffco) related to a Postsecondary Workforce Readiness System procurement in Colorado. The questionnaire comprehensively covers cybersecurity, data management, authentication, accessibility, and technical requirements for a potential software solution. The document seeks detailed vendor responses across multiple sections, including hosting models, data privacy, security controls, browser compatibility, user authentication, rostering capabilities, reporting functions, and service level management.
The technical questionnaire emphasizes critical vendor evaluation criteria such as cybersecurity insurance, data encryption practices, incident response protocols, and compliance with accessibility standards like WCAG 2.1 Level AA. Key technical requirements include support for Single Sign-On (SSO) methods, compatibility with platforms like Clever and ADFS, role-based access controls, multilingual support, and robust data governance. The district is seeking a solution that can securely manage personally identifiable information (PII), provide comprehensive reporting tools, support various user roles and scenarios, and maintain high availability with clearly defined service level agreements and disaster recovery procedures.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 26939 - Postsecondary Workforce Readiness System RFP.pdf | ||
| Q&A Document 1.pdf | ||
| 26939 Addendum 1.pdf | ||
| 26939 Attachment A - Specifications (1).xlsx | XLSX spreadsheet | |
| 26939 Attachment C - CAIQ (2).xlsx | XLSX spreadsheet | |
| 26939 Attachment D - Cost Worksheet (2).xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Cyber Security Questionnaire
| Requirements | Vendor response. |
| Have you experienced any security breaches? If yes, explain. | |
| Is all sensitive data encrypted at rest and in transit? | |
| Are there any add-ons or marketplace extensions integrated? Any 3rd party vendors you work with in relation to this product? | |
| Explain your data recovery process. In your explanation include the scope of data recovery activities, recovery prioritization, and the security of backup data. Explain how the district would be informed of any changes to this backup process. | |
| Do you carry cybersecurity insurance? If yes, provide an overview of the coverage. | |
| Do you have a chief information security officer or equivalent position? | |
| What Personally Identifiable Information is collected upon login and in action within the software | |
| Does the offeror absorb ownership of any Personal Identifiable Information (PII) data collected from the District or users of the tool? | |
| What type of system technology is used to house/store collected information? | |
| At the time of contract termination, what is your retention policy / requirement for collected PII data? | |
| Describe how content is shared and/or permissions will be managed for users and administrators throughout the solution. | |
| What type of Jeffco staff or student PII data is collected for the proposed solution? | |
| Who would be Jeffcos contact for any breaches or incidents - should something happen? | |
| How would we be made aware of any changes to Incident Response contacts? |
Accessibility and Equity
| Yes | No | Describe | |
| Confirm that the proposed solution provides for the support of multiple languages, including but not limited to both English and Spanish (Jeffco supported languages: English, Spanish, Russian, Vietnamese, Aribic, Chinese, French, Hmong, Korean, Nepali, Swahili, Kurdi) | |||
| Confirm the proposed solution meets or exceeds Web Accessibility Content Guidelines (WCAG) 2.1 Level AA. | |||
| Describe how the proposed solution meets or exceeds Web Accessibility Content Guidelines (WCAG) 2.1 Level AA. | |||
| Submit a Voluntary Product Accessibility Template (VPAT) or documentation of web accessibility conformance testing. |
Technical Requirements
| Requirements | Description | Vendor Response |
| Section One | ||
| Hosting model: | SaaS/Remote Application Hosting or Self-hosted/On Premise | |
| Terms of Service | Please attach your Terms of Service | |
| Personally Identifiable Information | Please explain how you collect and share student data | |
| Personally Identifiable Information | List of data fields collected at time of account creation (i.e., username, location, age, etc.): | |
| Data | Location of Data Centers where equipement is located (Also list if 3rd party) | |
| Data | List of additional data field collected during application usage | |
| Pen Testing | Please explain your current Pen Testing method | |
| Security Controls | Do you have a security control framework that you follow? Please explain | |
| Scanning | Do you conduct monthly vulnerability scans? Please attach any information regarding this | |
| Network | Please provide network requirements (IPs, Ports, URLs) of the provided solution. Include anything a host or other server might need to access to, with the assumption that these must be implemented in host-based firewalls and network firewalls. | |
| Environment | What does your development and test processes look like especially when it comes to integrations with your solution? | |
| Configuration/Installation | Provide documentation regarding any and all hardware that District Information Technology department will need to configure/install. | |
| Hybrid Applications | Any hybrid applications, where some components are in the SAAS/Cloud and others are on premise, must use secure protocols, e.g., SSL/TLS, for inter-data transfer. Explain how you will meet the District's secure protocols for a hybrid application. | |
| Modern Desktop Browsers | Does the application have the ability for users and administers to use a supported modern desktop browser, iOS and Android? Please explain. | |
| Modern Desktop Browsers | Does the application have the ability to administer from a supported modern desktop browser, iOS and Android? Please explain. | |
| Modern Desktop Browsers | Does your application require additional applications, plugins, or extension to be installed by either system administratos or system users? Please explain. | |
| Provisioning | Does the application provision by device or user? Explain how the application will monitor device or user access rights and privacy. | |
| Bandwidth | Does the application provide reporting or a live dashboard to monitor transaction bandwidth. Explain what information is available. | |
| Ports & Protocals | What ports and protocols would the application require for use and administration? | |
| Data Governance | Does the application have the ability to provide a system glossary of terms that identify functions in the application? Please provide an example, if available. | |
| Print Stats | Can the application monitor stats from the phone, tablet, or Chromebook? Please explain. | |
| Section Two | ||
| Authentication | Explain how the application will authenticate users and any Single Sign-On (SSO) methods used such as Clever, OIDC, SAML, WS-Fed, OAuth2, etc. Is the SSO login initiated by Relying Party (RP), Identify Provider (IDP), or both? Confirm the solution supports a Single Logout (SLO) that is compatible with ADFS 2019 or Azure AD/Entra ID. (Vendors should enhance/add this support if missing, as this is a MUST have district requirement.) | |
| SSO Certificates | Explain how certificates are updated, such as does the application support both providing and consuming published metadata? If not, please explain on the lifetime of the certificates and the process to update. | |
| SAAS/Cloud | If application is a SAAS/Cloud based, your application would need to be SSAE18 compliant. Please explain how your application complies. | |
| Rostering | Does this application support user rostering for administrators, teachers, students, classes, etc? If so, please describe the processes by which this happens, and the protocols used to ensure information security. | |
| Rostering | Does the application support rostering via Clever? |
If yes, are all user types rosterable through Clever or are additional integrations required?
| OneRoster Compliance | Is the application OneRoster 1.1 or 1.2 complant? If yes, please describe. |
| Authorization | Does the application provide differentiated access to data and functionality to different user groups (role-based security)? If so, can a single user have multiple roles and/or belong to multiple groups? Please describe. |
| Authorization | If the application supports classroom rostering, describe if and how it is able to support the following scenarios: |
- multiple teacher classroom/team-teaching models
- intervention access to discreet students/groups of students
- student enrolled concurrently at multiple schools Authorization Does the application support rostering via Clever?
If yes, are all user types automatically assigned to the appropriate role, or is additional in-app role assignment required?
| Ed-Fi Compliance | Is the application Ed-Fi compliant? If yes, please describe. |
| Reporting | Does the application have a native reporting tool or function? If yes, please describe. |
| Data | Does the application retain history in database tables? Is there a data dictionary available? Does the application provider include a database diagram? |
| Data Extraction | Does the application allow for scheduled and/or automated extraction of all data via webhooks, modern web APIs, or scheduled batch extracts? If yes, please describe the data that is available and the protocols available for its extraction |
| SaaS/PaaS additional requirements | For SaaS/PaaS solutions explain if there are any missing components, services, features that are expected that District or some other Cloud Solution will be required at additional expense to the District. For example SMTP, SFTP, monitoring, alerting, provisioning/rostering, automation/orchestration, etc. |
Service Level Mgmt
| Requirements | Vendor response. |
| What is the support process for critical situations? | |
| What is your guaranteed response time? | |
| What are your system availability/up time guarantees? | |
| Describe your enumeration when the SLA needs are not met. | |
| Describe Service Level Targets, defined and reported with differing time windows for service provision (e.g., 07.00 - 16.00 Monday - Friday for one service / department, 07.00 - 22.00 for another, 24 x 7 for others etc.). | |
| Describe your service level monitoring and reporting capabilities. | |
| When is your service desk open? What is the availability? | |
| Any SAAS/Cloud applications must present their Service Level Agreement (SLA) to Jeffco for evaluation and to set expectations for any potential outages. Also, the SAAS provider Disaster Recovery (DR) and procedures need to be presented, including disaster recovery time, and how often DR procedures are tested. Have you included an SLA document and information on DR in your response? |
Jefferson County Public School District
Business Requirements for ITSM Tools &A Page &P of
File details come from the government source that posted it. Updated .