27033 Attachment A - Specifications.xlsx
XLSX spreadsheet 32 KB Posted
- Attached to
- Mass Communication System RFP
- Solicitation number
- 27033
- Issued by
- Jefferson County, Colorado
About this file
This document is a detailed specifications attachment (Attachment A) for a Mass Communication System Request for Proposal (RFP) issued by Jefferson County School District R-1 in Colorado. The RFP seeks a modern, cloud-based mass communication platform to replace the district's existing SchoolMessenger Communicate system, with the goal of supporting communication across over 140 schools. The proposed solution must meet critical requirements in multiple categories including legal compliance, functional capabilities, technical specifications, data management, information security, support, and training.
The specifications outline extensive technical and functional requirements with specific emphasis on accessibility (WCAG 2.1 Level AA), multi-channel communication, integration capabilities with systems like Infinite Campus and Workday, robust data security protocols, and comprehensive information security measures. Key technical requirements include cloud-based operation, single sign-on support, encryption standards (AES-256), multi-factor authentication, and compliance with various state and federal regulations such as FERPA, COPPA, and Colorado student data privacy laws. The vendor must provide ongoing support, system updates, training materials, and maintain rigorous security practices, with many requirements classified as "Critical" to the district's operational needs.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 27033 Attachment D - Cost Worksheets.xlsx | XLSX spreadsheet | |
| 27033 - Mass Communication System RFP.pdf | ||
| 27033 Attachment C - CAIQ.xlsx | XLSX spreadsheet | |
| 27033 Attachment B - Technical Questionnaire.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
| Response Instructions | ||
| In each workbook tab, offerors will enter response indicators and clarifying comments as follows: | ||
| Indicator | Definition | Instruction |
| S | Standard: Feature/Function is included in the current software release and/or the vendor meets this specification | Offeror is encouraged, but not required, to provide additional information in the Comments column to further demonstrate the system’s ability to meet the requirement. |
| F | Future: Feature/Function will be available in a future software release. | If a response indicator of “F” is entered, the Offeror shall indicate the planned release and planned date the release will be generally available. |
| C | Customization: Feature/Function is not included in the current software release or planned for a future release, but could be provided with custom modifications. | If a response indicator of “C” is given for a requirement that will be met through a custom modification. The Offeror shall indicate all related customization costs in Attachment C – Cost Worksheet. |
| T | Third-Party: Feature/Function is not included in the current software release or planned for a future release, but could be provided via integration with a third-party system. | If a third-party solution "T" is proposed for a requirement, the Offeror shall identify the third-party system and include an associated cost proposal. If the third-party is a part of the proposal, they shall respond to the relevant requirements following the same instructions, with clear notation that the responses are provided by the third-party. |
| N | No: Feature/Function cannot be provided | N/A |
| Response Examples | ||||
| General and Technical | ||||
| Req # | Description of Capability | Criticality | Vendor Response | Vendor Comments |
| Category A | ||||
| A.01 | Requirement description A.01 | Critical | S | |
| A.02 | Requirement description A.02 | Critical | C | A customized function will be added at a cost of … |
| A.03 | Requirement description A.03 | Desirable | S | |
| A.04 | Requirement description A.04 | Desirable | F | Planned for release in release 4.2 in Q4 2025 |
Specifications
| Attachment A - Specifications | |||||
| Req # | Description of Requirement | Criticality | Vendor Response | Comments | |
| Legal | |||||
| 1.01 | The system achieves or exceeds WCAG 2.1 Level AA conformance for both front-end and back-end users, in compliance with Colorado HB21-1110, Section 504, Section 508, and Title II of the ADA. | Critical | |||
| 1.02 | The system shall comply with future versions of WCAG as mandated by applicable state and federal accessibility legislation. | Critical | |||
| 1.03 | The system complies with CRS 22-16-101 to ensure the privacy and protection of student data. | Critical | |||
| 1.04 | The system complies fully with FERPA to safeguard student and family personally identifiable information (PII), and shall not sell or use such data for any purpose beyond fulfilling the tool’s functional requirements. | Critical | |||
| 1.05 | The system complies with COPPA requirements for users under the age of 13, including appropriate data handling and parental consent mechanisms. | Critical | |||
| Functional | |||||
| 2.01 | The system supports multi-channel communication including email, SMS, voice, and push notifications to meet the diverse needs of a large school district with over 140 schools. | Critical | |||
| 2.02 | The system provides emergency notification capabilities with prioritization features to ensure reliable and rapid delivery during high-demand scenarios. | Critical | |||
| 2.03 | The system supports both on-demand and scheduled one-way communications, including email newsletters, SMS, and voice messages. | Critical | |||
| 2.04 | The system provides configurable two-way communication features, allowing system administrators to control message recipients and responders at the school and district levels. | Critical | |||
| 2.05 | The system supports automated communication across multiple channels, with configurable triggers based on user-defined conditions. | Critical | |||
| 2.06 | The system supports multilingual communication through both automated and manual content translation methods. | Critical | |||
| 2.07 | The system includes system-administrator customizable templates for communication scenarios including announcements, reminders, and updates. | Critical | |||
| 2.08 | The system provides a user-friendly interface that supports intuitive navigation for district employees and families. | Critical | |||
| 2.09 | The system supports targeted communication by enabling segmentation of users into relevant groups such as classroom, school, grade level, student group or employee role. | Critical | |||
| 2.10 | The system supports a mobile-first design that scales effectively across desktop, tablet, and mobile devices. | Critical | |||
| 2.11 | The system is compatible with both iOS and Android platforms. | Critical | |||
| 2.12 | The system supports granular control of user roles, permissions, and access levels to ensure users can only perform tasks relevant to their responsibilities. | Critical | |||
| 2.13 | The system enables students to report inappropriate or unwanted messages | ||||
| through the app or web interface. | Desirable | ||||
| 2.14 | The system provides delivery confirmation for messages sent to students, | ||||
| including status indicators for successful, failed, or pending delivery. | Desirable | ||||
| Technical | |||||
| 3.01 | The system operates as a cloud-based solution and provides a documented uptime guarantee to ensure continuous availability. | Critical | |||
| 3.02 | The system supports automated user provisioning via "Just in Time" SSO login or SCIM. If not supported, describe the alternative provisioning method. | Critical | |||
| 3.03 | The system shall support SPF/DKIM configurations to enable DMARC compliance when sending messages using jeffco.k12.co.us email addresses. | Critical | |||
| 3.04 | The system integrates with Infinite Campus to synchronize student, parent, and guardian communication preferences, contact information, student records (including grades and attendance), and inclusive identity categories. | Critical | |||
| 3.05 | The system integrates with Workday and Oracle PeopleSoft to synchronize employee communication preferences, contact information, and employee records including building/location, job code, and job title. | Critical | |||
| 3.06 | The system integrates with industry standard Identity Governance and Administration (IGA) tools to support automaed provisioning and deprovisioning of user access. | Critical | |||
| 3.07 | The system integrates with industry-standard CRM platforms to synchronize user communication preferences. | Critical | |||
| 3.08 | The system integrates with Canto DAM to synchronize digital media assets including photos and graphic files. | Desirable | |||
| Data | |||||
| 4.01 | The system ensures that all data generated or stored remains the sole property of Jeffco. | Critical | |||
| 4.02 | The system establishes and maintains a data management process that addresses sensitivity, ownership, handling, retention, and disposal. The vendor shall review and update documentation annually or upon significant enterprise changes impacting this Safeguard. | Critical | |||
| 4.03 | The system configures data access control lists based on user roles and apply access permissions to all relevant local and remote file systems, databases and applications. | Critical | |||
| 4.04 | The system retains data according to enterprise-defined minimum and maximum retention timelines. | Critical | |||
| 4.05 | The system collects audit logs across enterprise assets, and enable Jeffco IT staff to access and download logs for incident response and investigations. | Critical | |||
| 4.06 | The system retains audit logs for a minimum of 90 days across all enterprise assets. | Critical | |||
| 4.07 | The system collects service provider logs where supported, including authentication, authorization, data creation, and disposal events. | Critical | |||
| 4.08 | The system establishes and maintains a data recovery process that includes scope, prioritization, and security of backup data. Best practice is the vendor reviews documentation annually or upon significant changes impacting this Safeguard. | Critical | |||
| 4.09 | The system performs automated weekly backups of in-scope enterprise assets, with frequency based on data sensitivity. | Critical | |||
| 4.10 | The system protects recovery data using controls equivalent to those applied to original data, including encryption or separation as required. | Critical | |||
| 4.11 | The system tests backup recovery quarterly for a representative sample of in-scope enterprise assets. | Critical | |||
| 4.12 | The vendor provides documentation for data retention, archival, and deletion policies to demonstrate compliance with applicable standards. | Critical | |||
| 4.13 | The system archives secure data transfer protocols and ensures compatibility with the district’s existing data formats and frameworks. The vendor shall provide technical documentation. | Critical | |||
| Information Security | |||||
| 5.01 | The system employs AES-256 encryption or stronger for all data at rest to ensure data integrity. | Critical | |||
| 5.02 | The system aligns with recognized security standards including NIST Cybersecurity Framework, ISO 27001, SOC 2, and CAIQ to ensure robust information security practices. | Critical | |||
| 5.03 | The system uses technical controls such as application allow listing to restrict execution to authorized software. The vendor shall reassess controls at least bi-annually. | Critical | |||
| 5.04 | The vendor establishes and maintains a detailed inventory of all licensed software installed on enterprise assets, including metadata and business purpose. The software inventory must document the title, publisher, initial install or use date, and business purpose for each entry. Where appropriate, it must include the URL, app store(s), version(s) deployment mechanism, and decommission date. | Critical | |||
| 5.05 | The system supports SSL/TLS 1.2 or higher for all data in transit across applications and domains. | Critical | |||
| 5.06 | The system requires multi-factor authentication (MFA) for all administrative access accounts across enterprise assets, whether managed internally or by third-party providers. | Critical | |||
| 5.07 | The system defines and maintains role-based access control, document access rights per role, and performs annual access control reviews to validate authorized privileges. | Critical | |||
| 5.08 | The vendor establishes and maintains an inventory of all service providers like 3rd party representatives used or subcontractors, including classifications and designated enterprise contacts. Best practice would be for the vendor to review inventory annually or upon significant changes impacting this Safeguard. | Critical | |||
| 5.09 | The vendor classifies service providers (3rd party representatives used or subcontractors) based on characteristics such as data sensitivity, volume, availability, regulations, and risk. Best practice would be for the vendor to review classifications annually or upon significant changes impacting this Safeguard. | Critical | |||
| 5.10 | The vendor ensures all contracts with service providers (3rd party representatives used or subcontractors) include security requirements consistent with Jeffco’s service provider management policy. Requirements may include minimum security program, security incident, data breach notification and response, data encryption requirements and data disposal commitments. Best practice would be that the vendor reviews contracts annually for completeness. | Critical | |||
| 5.11 | The vendor assesses service providers (3rd party representatives used or subcontractors) per Jeffco’s management policy using SOC 2 reports, questionnaires, or other rigorous methods. Best practice would be that vendors assess providers annually or upon contract changes. | Critical | |||
| 5.12 | The vendor monitors service providers for compliance, including reassessments, release note reviews, and dark web monitoring, per Jeffco’s management policy. | Critical | |||
| 5.13 | The vendor securely decommissions service providers by deactivating accounts, terminating data flows, and securely disposing of enterprise data. | Critical | |||
| 5.14 | The system ensures secure authentication for parents and older students when accessing or responding to messages such as attendance or grades. | Critical | |||
| 5.15 | The vendor provides comprehensive documentation for incident response procedures, including breach notification timelines and resolution protocols. | Critical | |||
| 5.16 | The system allows guardians to view student-teacher communication threads, | ||||
| with access controls defined by district policy. | Desirable | ||||
| Support & Training | |||||
| 6.01 | The vendor delivers regular system updates and maintenance at no additional cost to ensure continued system performance. | Critical | |||
| 6.02 | The vendor provides comprehensive training and customer support, including instructional videos, written tutorials, and other training materials. | Critical | |||
| 6.03 | The vendor notifies the district in advance of any upcoming changes, upgrades, or releases that may impact service delivery. | Critical | |||
| 6.04 | The vendor provides a single point of contact (SPOC) for all technical and support-related issues. | Critical | |||
| 6.05 | The vendor provides comprehensive documentation outlining the escalation path for issues reported, contact methods for all SPOCs, and service hours including after-hours support. | Critical | |||
| 6.06 | The vendor's SLA defines severity levels for customer service response, including response times and escalation procedures. | Critical | |||
| 6.07 | The vendor provides student-accessible troubleshooting tools and | ||||
| knowledge base articles for common communication issues. | Desirable |
CherryRoad Technologies Inc. &"Arial,Bold"&14Jefferson County School District, CO &8Enterprise Resource Planning (ERP) Readiness Project Functional and Technical Requirements
&"Arial,Regular"&10Attachment B &"Arial,Regular"&9&KFF0000Oracle Confidential Disclosure - Exempt from Disclosure under C.R.S. § 24-72-204(3)(a)(IV)
Reporting & Notifications
| Req # | Description of Requirement | Criticality | Vendor Response | Comments | ||
| Reporting | ||||||
| Standard Reports (Out of the Box) | ||||||
| Summary (List) Reports | Must Have | Must Have | ||||
| Detailed (List) Reports | Must Have | Must Have | ||||
| Form Reports | Must Have | Nice to Have | ||||
| Imbeded Hyperlinks | Must Have | Nice to Have | ||||
| Imbeded Images | Must Have | Nice to Have | ||||
| Client Logos | Not Needed | |||||
| Program Level Reporting | Must Have | Nice to Have | ||||
| Custom Reports | ||||||
| Ad-Hoc data reports | Must Have | Nice to Have | ||||
| Custom Reports by end User | Must Have | Nice to Have | ||||
| Report Writer | Must Have | |||||
| Custom Formatting and Logos | Must Have | |||||
| Dashboards | ||||||
| Dynamic Dashboard | ||||||
| Program Level Dashboards | Must Have | Nice to Have | May be a separate tool from PMIS | |||
| Project Level Dashboards | Must Have | Must Have | Browser based options | |||
| Custom Dashboard Landing Pages | Must Have | Nice to Have | ||||
| Role Based Dashboard Landing Pages | Must Have | Nice to Have | ||||
| Static Dashboards | ||||||
| Printable Dashboarding | Nice to Have | Nice to Have | ||||
| Notifications and Distribution | ||||||
| Standard Notifications - Email notifications | ||||||
| System Generated Notifications | Must Have | Must Have | ||||
| Manually Generated Notifications | Must Have | Must Have | ||||
| Accommodate Nomenclature | Must Have | |||||
| Hyperlinks | Must Have | Nice to Have | ||||
| Email response will update system without logging in | Email response will update system without logging in | Must Have | ||||
| Imbeded photos | Nice to Have | Nice to Have | ||||
| Custom Notifications | ||||||
| Customizable Notifications | Must Have | Nice to Have | ||||
| Distribution | ||||||
| Program Distribution Lists | Must Have | Nice to Have | ||||
| Project Distribution Lists | Must Have | Nice to Have | ||||
| Scheduled Reporting | Must Have | Nice to Have | ||||
| Personal Scheduled Reports | Must Have | Nice to Have | ||||
| Views | ||||||
| Standard Views | ||||||
| All Records Views per function | Must Have | |||||
| Open / Closed views per function | Must Have | |||||
| Group level views | Must Have | |||||
| Record Previews | Must Have | |||||
| Exportable | Must Have | |||||
| Custom Views | ||||||
| New View creation | Must Have | |||||
| All fields available | Must Have | |||||
| Formulas | Must Have | |||||
| Filters | Must Have |
File details come from the government source that posted it. Updated .