3-Functional and Technical Req - Flexable Spending Acct.xlsx

XLSX spreadsheet 57 KB Posted Jun 22, 2026

Attached to: Flexible Spending Account
Solicitation number: 547838
Issued by: Wayne County, Detroit City, Michigan

About this file

Written by GovTribe AI · Jun 23, 2026

This is a Functional and Technical Requirements Matrix for a Flexible Spending Account (FSA) and Commuter Benefits RFP issued by the City of Detroit Office of Contracting and Procurement on behalf of the Detroit Human Resources Department. The RFP seeks proposals from qualified vendors to provide end-to-end administration for Health Care Flexible Spending Accounts (HC FSA), Dependent Care Flexible Spending Accounts (DC FSA), and Commuter Benefits programs, including transit and parking benefits. The questionnaire and requirements matrix are designed to evaluate vendor capabilities across 20 functional categories including vendor overview, plan administration and compliance, eligibility and enrollment, contributions and payroll integration, claims and reimbursement, debit card solutions, commuter benefits capabilities, and participant experience.

The requirements matrix assesses vendors across multiple technical dimensions including general technology capabilities, document management, reporting functionality, user interface design, security controls, cloud service provider infrastructure, backup and disaster recovery, mobile accessibility, and support and training services. Vendors must demonstrate compliance with IRS regulations (Sections 125 and 132), HIPAA, ERISA, and nondiscrimination testing requirements. The evaluation framework requires vendors to indicate whether requirements are "Met and Proposed" (C), "Intent Met with Alternative" (A), or "Not Met" (N) across detailed specifications. The City specifies preferences for minimum three-year fee guarantees, integration with existing systems including UKG for HRIS and payroll and WEX for benefits administration, support for City of Detroit-specific services such as transit card fulfillment, and provision of SOC 2 Type 2 reports for cloud environments. References from similar-sized public sector organizations are preferred, and vendors must provide detailed information on implementation timelines, service level agreements with specific performance metrics, and continuous improvement capabilities.

View the file

Other files

File	Type	Posted
2-Attachment A - Respondent Questionnaire (RFP).docx	DOCX document	Jun 22, 2026
8-547838 RFP Flex Spending.pdf	PDF	Jun 22, 2026
7-Attachment D-2 Conditions of Award.pdf	PDF	Jun 22, 2026
1-Attachment B - Respondent Proposal Introduction and Solution Approach.docx	DOCX document	Jun 22, 2026
6-Attachment D-1 Required Forms Affidavits.pdf	PDF	Jun 22, 2026
5-Attachment C - Pricing.docx	DOCX document	Jun 22, 2026
4-3.17.26 UPDATED TECH CONTRACT TEMPLATE (NO AI) (1).docx	DOCX document	Jun 22, 2026

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

FSA Questionnaire

	ATTACHMENT F - REQUIREMENTS MATRIX
RFP Name & RFP # _________		Enter vendor name here

FSA & Commuter Benefits RFP Questionnaire
1. Vendor Overview	Response
Provide a company overview, including ownership structure and years in business.
Describe your experience administering:
Healthcare FSAs
Dependent Care FSAs
Commuter benefits (parking/transit)
Provide the number of clients served by product type.	Healthcare FSAs	Dependent Care FSAs	Commuter
Please enter a number.
Provide the number of participants served by product type.	Healthcare FSAs	Dependent Care FSAs	Commuter
Please enter a number.
2. Plan Administration & Compliance	Response
Describe your administrative model for FSA and commuter programs.
How do you ensure IRS compliance for:
IRS Sections 125 and 132
Healthcare FSAs (including carryover/grace period rules)
Dependent Care FSAs
Qualified Transportation Fringe (Section 132)
COBRA (for healthcare FSA where applicable)
How do you support nondiscrimination testing?
Do you include nondiscrimination testing for the Section 125 cafeteria plan, FSA and commuter plans within your fee?
Do you provide annual IRS reporting support (Form 2441 data)?
Do you assist with plan document creation and updates?
Describe audit processes and internal compliance controls.
Describe how you maintain HIPAA-compliance processes for PHI.
Please describe any data breaches over the past five years.
How do you ensure compliance with ERISA (as a best practice)?
Do you provide year-end services for:
IRS forms, if necessary
Participant tax documentation
3. Eligibility & Enrollment	Response
How are employee eligibility and status changes managed?
Describe your approach to:
New hires
Qualifying Life Events (QLEs)
Terminations and COBRA eligibility (FSA only)
Do you support:
Online enrollment
Mobile enrollment
Integration with HRIS/payroll systems (list supported systems)
List supported HRIS/payroll systems
Describe file formats and data exchange frequency.
Do you provide enrollment confirmations to participants?
4. Contributions & Payroll Integration	Response
Describe payroll deduction handling for each benefit:
Healthcare FSA (uniform coverage rule)
Dependent Care FSA
Commuter benefits (monthly election changes)
Can commuter elections be changed monthly per IRS rules?
Describe funding methods (prefunding vs pay-as-you-go).
What reconciliation reporting is provided?
5. Claims & Reimbursement (FSA Only)	Response
Describe claims adjudication processes for healthcare FSA.
What claims substantiation methods are used?
Average turnaround time for:
Manual claims
Auto-adjudicated claims
Describe health care FSA reimbursement methods:
Direct deposit
Check
Explain your substantiation approach for debit card transactions.
Describe claims adjudication processes for dependent care FSA.
Describe dependent care FSA reimbursement methods:
Direct deposit
Check
Pay my provider
Is there any provider validation for dependent care FSA reimbursements?
If so, please describe.
6. Debit Card & Payment Solutions	Response
Describe your FSA debit card program:
Network (e.g., Visa, Mastercard)
Inventory Information Approval System (IIAS) compliance
Can cards be used for:
Healthcare FSA expenses
Dependent Care FSA expenses
Describe commuter benefit access:
Transit cards
Mobile ticketing integration
Parking reimbursement vs direct pay
Lost/stolen card process and turnaround time.
7. Commuter Benefits Capabilities	Response
Describe your transit and parking solutions:
Pre-tax payroll deductions
Direct transit authority integrations
Smartcard fulfillment
Is the City of Detroit supported?
Can employees:
Order passes online/mobile?
Make real-time election changes?
Describe employer vs employee funding flexibility.
How are unused balances handled?
8. Participant Experience	Response
Provide details on your:
Member portal
Mobile app functionality
Features available:
Claims submission
Receipt upload
Balance tracking
Push notifications
Customer service:
Hours of operation
Contact channels (phone, chat, email)
Average call response time
Provide languages supported.
9. Reporting & Analytics	Response
Provide list of standard reporting available.
Can reports be customized?
Provide examples of:
Utilization reports
Forfeiture analysis
Liability reporting
Contributions vs. claims
Provide frequency and delivery methods of reports.
Do you provide employer dashboards?
If so, what information is included in those dashboards.
10. Funding & Financial Management	Response
Describe fund flow for:
Healthcare FSA claims funding
Dependent Care reimbursements
Who holds participant funds?
Interest/earnings handling (if applicable).
Describe run-out period administration.
What happens to forfeitures?
Describe how you reconcile payroll deductions and funding files.
Will you support the City's accounting processes, if needed?
11. Fees & Pricing	Response
Provide detailed pricing structure:
Per participant per month (PEPM)
Debit card fees
Set-up/Implementation fees
Claims processing fees
Compliance/nondiscrimination testing fees
Any additional fees?
If so, please describe.
How many years are these fees guaranteed for? The City's preference is a minimum of three years.
Volume discounts available? Please describe.
12. Implementation & Transition	Response
Describe your implementation timelines and capacity.
Provide a detailed implementation timeline and project plan.
Describe your onboarding process:
Data migration
Plan setup
Employee communications
Dedicated implementation manager?
Describe your experience handling vendor transitions.
13. Technology & Security	Response
Describe your technology platform architecture.
What is your frequency of security audits?
What is the frequency of system upgrades?
14. Integration & Data Exchange	Response
List available integrations:
HRIS (COD uses UKG)
Payroll systems (COD uses UKG)
Benefits administration platforms (COD uses WEX)
Describe data validation/error handling processes.
15. Customer Support (Employer)	Response
Is a dedicated account manager provided?
What is the frequency of business reviews?
Describe your escalation process.
Describe your support for (both onsite and offsite):
Open enrollment
Employee education
Describe training materials available.
16. Communications & Education	Response
What employee communication materials are provided (e.g, enrollment guides, welcome packets, FAQs, educational campaigns)?
Open enrollment support:
Onsite meetings/benefit fairs
Emails
Text messages
Webinars
Decision tools
Describe ongoing education regarding IRS rules and deadlines.
Describe custom branding capabilities.
Will you provide plan documents, amendments and SPDs?
17. Innovation & Differentiators	Response
What differentiates your platform from competitors?
Describe recent product enhancements (past 2 years).
Describe roadmap for future development.
Any AI, automation, or advanced analytics capabilities available or planned? Please describe.
18. Guarantees & SLAs	Response
Service level agreements (SLAs) provided:
Claims processing times: 2-5 business days
Claims accuracy rate: 99%
Call center performance: ASA< 30 seconds
Issue Resolution: 3-5 business days
System uptime: >=99.5%
File processing accuracy: >=99%
Account management responsiveness: 1 business day
Customer satisfaction: Satisfied or above
Provide financial guarantees for performance standards.
Provide penalties for missed SLAs.
Will you conduct semi-annual/annual business reviews?
Will you identify continuous improvement opportunities?
19. References & Case Studies	Response
Provide client case studies demonstrating:
Improved utilization
Reduced forfeitures
Enhanced participant experience
Provide 3–5 client references of similar in size (Name, Title, Email, Employee Count). Public sector is preferred.
Reference 1
Reference 2
Reference 3
Reference 4
Reference 5
20. Additional Considerations	Response
Can you support:
Limited Purpose FSA (LPFSA)
Post-Deductible FSA (PDFSA)
HSA compatibility?
How do you handle plan design flexibility?
Describe your approach to regulatory changes.
Please describe other services you may provide (HSA, LSA, etc.)

General Tech

	ATTACHMENT F - REQUIREMENTS MATRIX
RFP Name & RFP # _________			Enter vendor name here
	Available Responses
	C	Requirement Met and Proposed (Standard features available in the product)		0
	A	Intent of Requirement Met and Proposed with Alternative		0
	N	Requirement Not Met with Proposal		0

. TOTAL 0

	Req #	Function	General Technical Requirement	Criticality	Vendor Response
(C, A, N)	Modules Required to Fulfill Requirements	Comments
	1	Integrated modules	The system has the ability to flow all changes made in the system throughout all proposed system features without the need for duplicate data entry.
	2	Data Export	The system has the ability to import and export data from (or to) standard file formats including but not limited to: (Please specify import/export or both in the Comments column)
	3	Data Export	.txt;
	4	Data Export	.csv;
	5	Data Export	MS Excel
	6	Data Export	MS Word
	7	Data Export	MS SQL
	8	Data Export	Use the comments column to specify other file formats that apply.
	9	File Import	The system has the ability to accommodate and manage large file sizes for import. Please indicate max file size allowed.
	10	API	The system has the ability to support API's (Application Programming Interface) for third-party system integration, imports, and exports of data.
	11	Data Dictionary	The system has the ability to provide a centralized data dictionary, that fully describes table structure and appropriate levels of metadata.
	12	Web browsers	The system has the ability to support modern web browsers (i.e. Chrome, Edge, Firefox).
	13	No desktop client installed	The system has the ability to be fully operational without an instance of an installed client on the desktop.
	14	Retention schedules	The system has the ability to support management of records' and associated files' retention schedules.
	15	OCR	The system has the ability to electronically capture and store files, with Optical Character Recognition (OCR) capabilities.
	16	Search functionality	The system has the ability to search by fragment or portion of a word.
	17	Search functionality	The system has the ability to search by wild cards.
	18	System navigation	The system has the ability to provide links to associated modules from any display screen to minimize backing out of one screen to access another.
	19	System navigation	The system has the ability for multiple windows to be open at the same time, allowing City staff to view and edit multiple projects or application simultaneously.
	20	System navigation	The system has the ability to warn a user that they are about to execute a process and ask if they want to proceed.
	21	Field Label Control	The system has the ability to allow the City system administrator to rename field labels.
	22	Field Label Control	The system has the ability to view history of field label changes made by a City system administrator.
	23	Mobile screen optimization	The system has the ability to recognize the device that is being used to view the software to make the necessary window adjustments (screen optimization).
	24	System updates	The system has the ability to allow properly authorized users to configure and maintain all system settings from any workstation on the local/wide area network.
	25	System updates	The system has the ability to allow remote deployment of system updates and system maintenance.
	26	System Administration	The vendor must proactively notify the System Administrator regarding which releases of third-party software (JAVA virtual machine, Internet Explorer, Mozilla, Safari, etc.) are known to create problems with the current version of the vendor software.

Document Mgt

	ATTACHMENT F - REQUIREMENTS MATRIX
RFP Name & RFP # _________			Enter vendor name here
	Available Responses
	C	Requirement Met and Proposed (Standard features available in the product)		0
	A	Intent of Requirement Met and Proposed with Alternative		0	..
	N	Requirement Not Met with Proposal		0

. TOTAL 0

	Req #	Function	General Technical Requirement	Criticality	Vendor Response
(C, A, N)	Modules Required to Fulfill Requirements	Comments
	1	Document Management	The system has the ability to provide Document Management functionality to track electronic files associated with specific system records.
	2	Document Management	The system has the ability to hyperlink to different system document record(s)
	3	Document Management	The system has the ability to detect duplicate documents or files and store a single instance.
	4	Document Management	The system has the ability to use "drag and drop" or file upload functionality to associate documents to transactions within the system.
	5	Document Management	The system has the ability to link imported documents to specific records.
	6	Document Management	The system has the ability to allow a user to scan documents directly into the system.
	7	Document Management	The system has the ability to export a file directly for document storage.
	8	Document Management	The system has the ability to allow users to select exported file type.
	9	Document Management	The system has the ability to email a linked image file to another party (internally or externally).
	10	Document Management	The system has the ability to email a linked case file to another party (internally or externally).

Reporting

	ATTACHMENT F - REQUIREMENTS MATRIX
RFP Name & RFP # _________			Enter vendor name here
	Available Responses
	C	Requirement Met and Proposed (Standard features available in the product)		0
	A	Intent of Requirement Met and Proposed with Alternative		0
	N	Requirement Not Met with Proposal		0

TOTAL 0

	Req #	Function	Reporting Requirements	Criticality	Vendor Response
(C, A, N)	Modules Required to Fulfill Requirements	Comments
	1	Report writer	The system has the ability to provide an integrated report writer.
	2	Report writer	The system has the ability to provide an integrated report writer that has a consistent look and feel across all proposed system features.
	3	Report writer	The system has the ability to provide an integrated report writer that allows the creation of reports comprised of any discrete data field throughout the system.
	4	Report writer	Describe any output limitations of the system's native report writer.
	5	Reporting	The system has the ability to drill down on reports.
	6	Reporting	The system has the ability to provide a library of standard reports (i.e. "canned" reports).
	7	Reporting	The system provides authorized users with a canned Report Wizard that will let the user select filtering data such as (specify as appliable to the software)
	8	Reporting	The system has the ability to save a report as a new template after a user copies and modifies an existing report, with appropriate security permissions.
	9	Reporting	The system has the ability to allow a user to modify existing reports, with appropriate security permissions.
	10	Reporting	The system has the ability to configure and save ad hoc reports by individual user, with the ability to provide access to other users with appropriate security permissions.
	11	Data export	The system allows for ad-hoc reporting based and can be exported to excel for further analysis
	12	Reporting	The system has the ability to save favorite reports in a menu or pick-list by individual user.
	13	Reporting	The system has the ability to allow one or more users to query information and run reports at the same time.
	14	Reporting	The system has the ability to allow generated reports to be viewed on screen prior to printing.
	15	Reporting	The system has the ability to allow reports to be generated that are searchable.
	16	Dashboards	The system has the ability to provide interactive dashboards for consumption by City staff.
	17	Dashboards	The system has the ability to drill down on dashboard results.
	18	Dashboards	The system has the ability to display data on dashboards in real-time.
	19	Dashboards	The system has the ability to allow a user to manually refresh dashboards.
	20	Scheduled reports	The system has the ability to schedule reports to run in the future.
	21	Report distribution	The system has the ability to configure automatic distribution paths for generated reports (i.e. automatically send a report to a particular user).
	22	Report distribution	The system has the ability to schedule and to distribute reports via email.
	23	Reporting	The system has the ability to display when a report is being run, or in process, so that a user does not run the report again.
	24	GIS integration	The system provides reports by location through an integration with GIS (e.g. street, or other spatially-related).
	25	Compatibility	The system's reporting features are compatible with MS SQL environment.
	26	Compatibility	The system has the ability to integrate with Tableau.
	27	Compatibility	The system has the ability to support the creation of reports using SSRS.
	28	Reporting	The system has stored procedures that prepare data for output to a crystal Report (or equivalent) that is executed by a report shell
	29	Data schema documentation	The system has the ability to provide the City full access to all data within the system and data and includes clear, up-to-date schema documentation
	30	Reporting documentation	Documentation, training, and procedures provided that will outline:
	31	Reporting documentation	How to access reports
	32	Reporting documentation	How to prepare reports
	33	Reporting documentation	How to utilize the data for the Department's reporting needs
	34	Reporting documentation	How to develop and edit stored procedures
	35	Reporting documentation	How bad data is identified and scrubbed

User Interface

	ATTACHMENT F - REQUIREMENTS MATRIX
RFP Name & RFP # _________			Enter vendor name here
	Available Responses
	C	Requirement Met and Proposed (Standard features available in the product)		0
	A	Intent of Requirement Met and Proposed with Alternative		0
	N	Requirement Not Met with Proposal		0

TOTAL 0

	Req #	Function	User Interface Requirement	Criticality	Vendor Response
(C, A, N)	Modules Required to Fulfill Requirements	Comments
	1	ADA Compliance	The system has the ability to provide American Disability Act (ADA)-compliant online help documentation.
	2	ADA Compliance	The system has the ability to comply with the American Disability Act (ADA):
	3	ADA Compliance	The system has the ability to allow users to access using a screen reader with a text-to-speech (TTS) system.
	4	ADA Compliance	The system has the ability to accept data entry through the use of constituent's or user's voice recognition software (i.e. speech to text functionality).
	5	ADA Compliance	The system has the ability to provide text alternatives on all visuals
	6	ADA Compliance	The system has the ability to accommodate keyboard support (i.e. anchor links to allow disabled users to access content using a keyboard).
	7	ADA Compliance	The system has the ability to include and support Accessible Rich Internet Applications (ARIA) landmarks.
	8	ADA Compliance	The system has the ability to provide functionality or integrate with third-party products to enlarge the print on computer screens (i.e. screen magnification).
	9	Hyperlinks	The system has the ability to provide hyperlink capability.
	10	Required Fields	The system has the ability to allow the City to determine which fields are required, beyond standard system keys.
	11	Spell check	The system has the ability to spell check on any field with the ability for a user to accept or ignore suggestion.
	12	User Interface	The system includes an intuitive user interface that promotes usability and ease of navigation throughout all system components.
	13	User Interface	The system has the ability to provide drop down boxes or other pick list function for data selection.
	14	User Interface	The system has the ability to provide integration with the Microsoft clipboard.
	15	User Interface	The system has the ability to store field-level metadata and display it in the user interface when appropriate.
	16	User Interface	The system has the ability to provide data validation on entry.
	17	User Interface	The system has the ability to provide drill down capability on all screens where applicable.
	18	User Interface	The system has the ability to provide the user with standard field editing capabilities including but not limited to: navigation forward and backward to complete data entry and the ability to correct spelling mistakes.
	19	User Interface	The system has the ability to provide predictive text capability with the ability to turn this functionality on or off, by field .
	20	User Interface	The system has the ability to support pre-filled fields in appropriately pre-formatted screens eliminating redundant data entry.
	21	User Interface	The system has an intuitive user interface and simple design which enables users to accomplish tasks with minimal number of clicks and keystrokes.
	22	User Interface	The system has the ability to provide links to associated features from any display screen to minimize backing out of one screen to access another, with appropriate security.
	23	User Interface	The system has the ability to provide the user with integrated application features that offer a consistent user interface to minimize user training and administration of the system.

Security

	ATTACHMENT F - REQUIREMENTS MATRIX
RFP Name & RFP # _________			Enter vendor name here
	Available Responses
	C	Requirement Met and Proposed (Standard features available in the product)		0
	A	Intent of Requirement Met and Proposed with Alternative		0
	N	Requirement Not Met with Proposal		0

TOTAL 0

	Req #	Function	Security Requirement	Criticality	Vendor Response
(C, A, N)	Modules Required to Fulfill Requirements	Comments
	1	SSO	The System has the ability to utilize the City's Microsoft Entra ID service for user validation, regardless of deployment method.
	2	AD integration	The system has the ability to inherit groups from Active Directory for application authentication.
	3	Multi Factor Authentication	The system has the ability to support Multi Factor Authentication (MFA)
	4	SAML	The system has the ability to utilize the City's SAML Authentication (Azure Active Directory) for user validation to achieve single-sign-on, regardless of deployment method.
	5	SAML	The system has the ability to map SAML groups or App roles from Azure Active Directory for application permissions .
	6	Password Encryption	The system has the ability to store passwords in encrypted form, if applicable.
	7	Encryption	The system has the ability to encrypt data stored in the database.
	8	Encryption	The system has the ability to encrypt data stored in the application.
	9	Encryption	The system has the ability to encrypt data in transit.
	10	Encryption	Please provide information as to what level of encryption/encryption methods are used in transit and at rest.
	11	Role based security	The system has the ability to provide read, write, update, and delete access using role based security.
	12	Role based security	The system has the ability to provide security at the following levels:
	13	Role based security	Department or Agency;
	14	Role based security	Division;
	15	Role based security	Role or group;
	16	Role based security	User ID;
	17	Role based security	Screen;
	18	Role based security	Menu;
	19	Role based security	Report;
	20	Role based security	Field;
	21	Role based security	The system allows for departmental administrative self-service (e.g. ability to make changes to roles and workflows) with audit trail capability.
	22	Role based security	The system has the ability to update all user profiles automatically (user discretion) when a change in their role (s) is/are made.
	23	Role based security	The system has the ability to allow a City system administrator to add and change permissions for system access.
	24	User Groups	The system has the ability to establish, deactivate, and archive user groups.
	25	User Groups	The system has the ability to delete user groups that do not have historical data, with an audit trail.
	26	Compliance	The system is HIPAA compliant and vendor will enter into a BAA with the City.
	27	Compliance	The system is CJIS compliant
	28	Compliance	The system is IRS Publication 1075 compliant
	29	Compliance	The system meets compliance rules / regulations in order to ensure the sensitive digital assets are guarded against loss, theft and misuse
	30	Compliance	The system is compliant with applicable compliance regulations.
	31	Security Certifications	Please list any industry standard security certifications the solution / vendor has. (Ex: ISO 27001).

Please note annual SOC 2 type reports will be required via the City’s contract.

32	Audit Capabilities	The system has the ability to track and audit changes throughout the system that creates a log of all records maintained and includes:
33	Audit Capabilities	Date;
34	Audit Capabilities	Time;
35	Audit Capabilities	User;
36	Audit Capabilities	Information prior to change;
37	Audit Capabilities	Changed information
38	Audit Capabilities	The system has the ability to allow the audit trail to have a date/time stamp to the nearest second.
39	Audit Capabilities	The system has the ability to allow a City system administrator to configure the duration that time audit logs are retained (e.g. 90 days). Proposer to describe how this feature works.
40	Audit Capabilities	The system has the ability to provide customizable audit reports.
41	Access Time Out	The system has the ability to log users off the system after an administrator-defined period of inactivity, based on user-defined roles.
42	Access Time Out	The system has the ability to allow a system administrator to log out users.
43	Security	The system has the ability to allow authorized users to have access to a log of security activity to determine users that have signed on and off the system, as well as unsuccessful attempts to sign on to the system.
44	Security	The system has the ability to scan attached files for viruses, malware, or other cybersecurity threats (vendor to specify capability for using City preferred anti-virus solutions).
45	Applicable to submissions from the public	The system has the ability to capture IP addresses from a requestor.

Cloud Checklist

ATTACHMENT F - REQUIREMENTS MATRIX

RFP Name & RFP # _________

Cloud Service Provider Security Checklist
Please provide an answer or statement to all issues listed
Enter vendor name here
Prompt #	Topic	Vendor Response
1	Describe who is responsible uptime, maintenance, patching and administration of the server.
2	The provider must show diagram (and possible past examples) of their governance and notification processes for their services.
3	Describe how the provider will guarantee legal and regulatory compliance with government and sectorial (industry specific) laws and regulations.
4	Does the solution follow one of the following sets of security and privacy control best practices? Indicate which.
4a	NIST Series
4b	ISO/IEC Series
4c	COBIT
4d	ITIL
5	The vendor will provide to the City, at no additional cost, the most recent SOC 2 Type 2 report from its cloud hosting provider covering the environments used by the City.
6	Describe process for Account Management
7	Define who is responsible for security monitoring. If the City will be responsible for securing the environment, describe how the City will obtain logs to ingest into its SIEM.
8	Describe how a data inventory of City of Detroit Data Assets will be kept.
9	Will subcontractors be used? If yes, will all security controls be inherited by subcontractors?
10	Describe Public Key Infrastructure
11	Process for separation of data belonging to different consumers in a multi‐tenant environment.
12	Does the solution use a private, shared or hybrid cloud?
13	Process used to separation of network traffic in a shared multi‐tenant provider environment
14	Statement guaranteeing adherence to all privacy laws governing the physical areas of data storage.
15	Willing to participate in a Risk Assessment and Privacy Impact Assessment covering the storage of PII.
16	Network traffic must be screened and firewall protected network must have intrusion detection & prevention in place.
17	Network must have detailed logging and documented alerting capabilities.
18	Dedicate VLANs with dedicated virtual firewall.
19	Describe how the City of Detroit network access separated from provider network access.
20	Are the City of Detroit VMs are on a dedicated hypervisor?
21	Will provider's servers only communicate with the City of Detroit logical disk units?
22	Will online storage and backup media be scrubbed when retired or replaced?
23	Identify system environments that will be available to the City (e.g. production, development, test)
24	Identify shared components of the system (e.g., network segments, backup tapes, etc.)
25	Identify Data storage and transfer limits
26	Identify normal and peak bandwidth requirements

Backup-Recovery

ATTACHMENT F - REQUIREMENTS MATRIX

RFP Name & RFP # _________

Backups / Business Continuity and Recovery RFP Questions
Please provide an answer or statement to all issues listed
Enter vendor name here
Prompt #	Topic	Vendor Response
1	Proposers shall have a backup and recovery capability for the system and application, including incremental and full backup capabilities. Additionally, system backups shall be accomplished without taking the application out of service and without degradation of performance or disruption to City operations.
2	Proposers shall be able to provide the service from at least two geographically diverse data centers that do not share common threats (e.g., the data centers cannot be in the same earthquake zone, likely hurricane path, same flood zone, etc.). The data centers shall at a minimum meet Tier III standards for redundancy of power, telecommunications, HVAC, security, fire suppression and building integrity.

• Where are the data center and storage facilities?

• The Proposer shall not store or transfer non-public City of Detroit data outside of the United States without the written consent of the City. This includes backup data and Disaster Recovery locations.

3	Proposers shall specify whether, in the event of a technology or other failure at the primary processing center, the alternate system will meet the following tiers, for which the City’s use should be identical regardless of which location is processing the City’s work:
3a	• High Availability – Continuous operation without interruption or degradation in service
3b	• Standard availability – Available for City use within 48 hours with no degradation in service
3c	• Non-Critical Availability – Available for City use within 96 hours with no degradation in service
4	Proposers shall implement crisis management, business continuity and disaster recovery plans, subject to City approval, which the City will not reasonably withhold. These plans shall outline how the Proposer will support the City’s recovery at the alternate site, including backup staff required to implement the plan in an emergency if the Proposer’s primary staff is unavailable. Such plans may also include annual testing in coordination with the City.
5	Proposers shall specify the System’s proven, maximum tolerable length of time that a computer, system, network, or application can be down after a failure or disaster occurs or its recovery time objective (“RTO”) and the amount of data at risk, as determined by the amount of time between data protection events, and as it reflects the amount of data that potentially could be lost during a disaster recovery point objective, (“RPO”) in case the primary site becomes unavailable. The selection of the RTO and RPO will be agreed upon objectives between the Proposer and the City.
6	Proposers shall specify whether the System will meet the following availability tiers, which tier, and shall specifically describe how the System meets such tier:
6a	• High Availability, 99.982%

RTO Characteristics and RPO: Intra-day, Typically involves data replication, to a hot-site for each transaction, or at short intervals, like 15 minutes.

6b • Standard Availability, 99.741% RTO Characteristics and RPO: 24 to 48 hours Nightly imaging to cloud / data center. System reestablished at time of disaster from cloud / data center. May lose up to one day of data.

6c • Non-Critical Availability, 99.671% RTO Characteristics and RPO: 48 to 56 hours, Nightly imaging to cloud / data center. System reestablished at time of disaster from cloud / data center. May lose up to one day of data.

7 Identify shared components of the system (e.g., network segments, backup tapes, etc.)

Mobile Access

	ATTACHMENT F - REQUIREMENTS MATRIX
RFP Name & RFP # _________			Enter vendor name here
	Available Responses
	C	Requirement Met and Proposed (Standard features available in the product)		0
	A	Intent of Requirement Met and Proposed with Alternative		0	..
	N	Requirement Not Met with Proposal		0

. TOTAL 0

	Req #	Function	Mobile Access Requirement	Criticality	Vendor Response
(C, A, N)	Modules Required to Fulfill Requirements	Comments
	1	Mobile responsiveness	The system is accessible from mobile devices.
	2	Mobile responsiveness	The system has the ability to recognize the device that is being used to view the software to make the necessary window adjustments (screen optimization).
	3	Mobile Accessibility	The system has the ability to monitor the connection status of mobile units and display this information in the administrative portal
	4	Mobile Accessibility	The system supports the following platforms: iOS, Android, Windows, Google Chrome devices.
	5	Mobile Accessibility	The system has the ability to support all popular browsers (i.e. Safari, Chrome, Edge, FireFox, etc.) and provide browser and device agnostic capability.
	6	Data encryption	The system encrypts all data that is transmitted to and from the mobile devices with a minimum of 256-bit encryption.
	7	Mobile Accessibility	The system has the ability to synchronize data from the field to ensure data is viewable in real-time, if applicable.
	8	Mobile Accessibility	The system has the ability to allow field users to access all data and documents from a remote location, with ability to later upload or synchronize data at a later date due to no or low connectivity in the field.
	9	Mobile Accessibility	The system has the ability to perform pre-defined queries from the field against the system database for those needing to view historical data.

10	Mobile Messaging	The system has the ability for mobile messaging functionality to allow users to send/receive text messages to/from appropriate personnel within the system or to any valid email address.
11	Mobile Accessibility	The system has the ability to allow multiple users to use a single device, with different security access based on user logon.

Support & Training

	ATTACHMENT F - REQUIREMENTS MATRIX
RFP Name & RFP # _________			Enter vendor name here
	Available Responses
	C	Requirement Met and Proposed (Standard features available in the product)		0
	A	Intent of Requirement Met and Proposed with Alternative		0
	N	Requirement Not Met with Proposal		0

					TOTAL	0
							.
	Req #	Function	Support and Training Requirement	Criticality	Vendor Response
(C, A, N)	Modules Required to Fulfill Requirements	Comments
	1	Vendor Support / Upgrades	The system has the ability to allow for outage times to be outside of standard business hours.
	2	Vendor Support / Upgrades	The vendor offers software application support during planned upgrades outside of typical operating hours, as requested by the City, if applicable.
	3	Vendor Support / Upgrades	The system has the ability to provide an administrative messaging system (e.g. a message to alert users of system maintenance activity).
	4	Vendor Support / Upgrades	The vendor has the ability to provide web-based support, with a searchable database of common problems.
	5	Vendor Support / Upgrades	The system has the ability to adhere to the City's security policy, which requires vendors to request for access to the on premise application for troubleshooting.
	6	Vendor Support / Upgrades	Vendor has the ablity to provide support through remote access to the application in accordance with City procedures, if applicable.
	7	Vendor Support / Upgrades	The system has the ability to create error logs with detail associated with the error.
	8	Vendor Support / Upgrades	The system has the ability to provide error messages that appear in a consistent format across all system features.
	9	Training / Help	The system includes a suite of online training features.
	10	Training / Help	The system includes access to an online user group community for City staff.
	11	Training / Help	The system includes online software documentation for all software application features.
	12	Training / Help	The system includes access to periodic live webinar training sessions to City staff at no additional cost.
	13	Training / Help	The system includes recorded training sessions that may be viewed by City staff at no additional cost.
	14	Training / Help	The system includes functional online help documentation for system end users of all types.
	15	Training / Help	The system includes technical online help documentation for City system administrators.
	16	Training / Help	The system has the ability to provide error messages that are integrated with online help functionality.
	17	Training / Help	The system has the ability to provide contextual help (i.e. field descriptions that are displayed based on the location of the mouse or cursor).

File details come from the government source that posted it. Updated Jun 23, 2026.