3 - Submittal Form K - DOH IT Contractual Requirements - SaaS Solutions (v241015).xlsx
XLSX spreadsheet 86 KB Posted
- Solicitation number
- 1626-006
- Issued by
- Juneau City and Borough, Anchorage Municipality, Alaska
About this file
This document is a comprehensive technical requirements workbook for Software as a Service (SaaS) solutions issued by the State of Alaska Department of Health (DOH). The document provides detailed IT contractual requirements for vendors seeking to provide SaaS solutions, outlining 32 specific technical requirements across categories including security, integration, architecture, accessibility, and mobile device standards. The workbook is designed to ensure potential vendors understand the state's technical, security, and operational expectations for cloud-based solutions, with a clear emphasis on United States-based hosting, data protection, single sign-on authentication, and compliance with federal and state regulations.
The requirements cover critical areas such as data encryption, accessibility standards, audit logging, system availability (with a goal of 99.999% uptime), database security practices, and mobile application design principles. Vendors must demonstrate alignment with standards like OWASP, NIST, ISO, and CIS controls, and be prepared to undergo a security compliance process that may require 80-120 hours of initial control responses. The document explicitly states that while not meeting all requirements will not automatically disqualify a vendor, the explanations provided will be used during contract negotiations. Vendors must also be prepared to integrate with existing state systems, protect sensitive information, and provide data portability and destruction capabilities.
View the file
Other files
Show all 19
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
This workbook provides the current Department of Health (DOH) Information Technology (IT) technical contractual requirements for Software as a Service (SaaS) solutions and is meant to accompany DOH IT-related solications and contracts.
Failure to complete this workbook will result in a proposal being deemed non-responsive or non-issuance or cancellation of the contract.
| Table of Contents | ||
| Instructions | See below. | |
| Technical Requirements | This tab outlines the technical requirements offerors must answer to be classified as responsive. | |
| Glossary of Acronyms | This tab provides a reference for frequently used acronyms found within the policies, procedures, regulations, and standards referenced throughout this document. | |
| Instructions: | ||
| Each technical requirement must be responded to by the offeror. | ||
| The offeror must choose the appropriate response in the "Response" column. | ||
| Unless the solution or organization already meets or exceeds the requirement, or the requirement is not applicable to the offeror's solution, the offerors must explain how readily they can meet it in the "Explanation" column. |
| Note: | |
| We are aware not all requirements will fit all solutions. Therefore, offerors who do not meet a requirement will not be excluded from consideration. However, the explanations provided in the "Explantions" column may be used as part of contract negotiatons prior to award. | |
| This workbook applies to SaaS solutions only and is not intended to be used for Alaska-hosted solutions. |
&"Arial,Bold"Version 1.3 (2024-03-14)
Technical Requirements
| Req. ID | Category | Subcategory | Solution or Vendor Requirement | Requirement Description | Response | Explanation |
| IT1 | Security | Standard Policy | Vendor | The State of Alaska (and by extension DOH) requires that all business and technical resources utilized under the contract, including system development, testing, implementation, training, and hosting be United States based. |
This includes hosted services, vendor personnel, vendor contracted services, contracted consulting services, and any sub-contracted resources. All elements and services that receive, process, store, or transmit data used by the solution must be hosted within the United States.
IT2 Investment Assurance Asset Management Vendor DOH shall have unlimited rights to use, disclose or duplicate, for any purpose whatsoever, all information and data developed, derived, documented, installed, improved, or furnished by the offeror under this contract.
All files containing any DOH information are the sole and exclusive property of DOH. The offeror agrees not to use information obtained for any purposes not directly related to this contract without prior written permission from DOH. Offeror agrees to abide by all federal and state confidentiality requirements.
| IT3 | Investment Assurance | Asset Management | Vendor | The offeror agrees to provide to DOH, upon request at any time during the contracted period, the data managed by the solution, in whole or in part, in a format agreed upon by both parties. |
| IT4 | Integration | Data Exchange | Solution | The offeror agrees to align their solution with DOH's interoperability standards. Data exchanges between this solution, and other DOH data, will be conducted through DOH's enterprise service bus and enterprise integration services. |
| IT5 | Integration | Data Exchange | Solution | Solutions that create, read, or update client, consumer, or other person demographic data must integrate with DOH's Master Client Index (MCI) to ensure their demographic records are registered in the MCI and appropriately merged with matching client records in the index. |
| IT6 | Integration | Authentication | Solution | The offeror must integrate their solution with the State of Alaska Entra ID (formerly to support single sign-on authentication. |
| IT7 | Integration | Financial and Accounting | Vendor | Offerors whose proposed solution includes finance, accounting, and Human Resources (HR) functions agree to conduct a gap analysis with DOH ITS, DOH Program staff, and Department of Administration Division of Finance Integrated Resource Information System (IRIS) support subject matter experts. |
This analysis will determine how the solution will integrate with the State of Alaska's existing Human Resources and Finance/Accounting systems.
IT8 Security Code Security Vendor The offeror must complete software development in compliance with DOH Secure Systems Development Lifecycle, including:
• Secure Coding – The offeror shall disclose what tools are used in the software development environment to encourage secure coding.
• Disclosure – The offeror shall document in writing to the purchaser all third-party software used in the solution, including all libraries, frameworks, components, and other products, whether commercial, free, open-source, or proprietary.
• Evaluation – The offeror shall make reasonable efforts to ensure third-party software meets all the terms of this agreement and is as secure as the custom code developed under this agreement.
• Source Code Scanning – The offeror shall work with DOH staff to facilitate static code scanning for all product and third-party files using a DOH provided scanning solution.
• Hosting Environment Hardening – The offeror shall work with DOH staff to ensure that any hosting environment utilized complies with DOH's adopted standards for security hardening.
IT9 Security Environment Vendor The offeror shall work with DOH staff to ensure that any hosting environment utilized complies with DOH adopted standards for security hardening.
The offeror acknowledges that all DOH Information Security Compliance and Privacy Services and Standards apply to DOH managed off-site hosting scenarios.
| IT10 | Security | Environment | Vendor | Offeror shall facilitate requests for third-party vulnerability and/or penetration testing of DOH solutions. |
| IT11 | Security | Policy | Vendor | The offeror agrees to notify, in writing, the DOH contract administrator of any personnel transfers or termination of their personnel, including sub-contractors, who possess DOH credentials and/or badges or who have DOH information system privileges, within fifteen (15) calendar days. |
| IT12 | Security | Retention/Destruction | Vendor | The offeror agrees to dispose of all protected printed media in a manner consistent with the guidance provided by the National Institute of Technologies (NIST) Special Publication 800-88 Revision 1. This includes any Development, Test, and Production data. |
| IT13 | Security | Retention/Destruction | Vendor | The offeror must ensure that all protected electronic media (electronic protected health information [PHI], personally identifiable information [PII], protected information [PI], protected client information [PCI], criminal justice information [CJI], etc.) must be disposed of in a manner consistent with the guidance provided by the Department of the Army’s brief, Cybersecurity: Sanitization of Media and NIST Special Publication 800-88 Revision 1. Disposed of electronic media must receive a Certificate of Media Disposal or agreed upon proof of disposal for each device disposed. |
| IT14 | Security | Retention/Destruction | Vendor | The offeror ensures that the solution will comply with DOH's policies for record retention. The offeror must provide procedures and agree to all data (including test data) destruction when contract ends if continuing operations and maintenance is not provided by the contractor. |
The offeror must provide an information system with an audit reduction and report generation capability that:
a. Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents;
b. Does not alter the original content or time ordering of audit records;
c. Retains audit records for at least ninety (90) days and archives old records for six (6) years to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements IT15 Security Authorization Package Vendor Solutions must be granted Authority to Operate before they can be used to support DOH activities.
Actual workload varies greatly in proportion to the size of the solution and offeror's experience demonstrating security compliance. We have found that most small to medium size solutions require 80–120 hours to complete the initial security control responses.
The offeror agrees to work towards security compliance requirements and accommodate an appropriate number of remediation cycles to address any identified defects.
| IT16 | Security | Authorization Package | Vendor | The offeror agrees to submit one Interface Risk Assessment Worksheet, per interface, outlining its specifications and security components |
| IT17 | Security | Encryption | Vendor | The offeror confirms their solution ensures all sensitive, confidential, and/or restricted data are encrypted in-transit and at-rest. |
Criminal Justice Information Systems (CJIS) and those systems requiring Minimum Acceptable Risk Safeguards for Exchanges (MARS-E) compliance must meet these encryption requirements using a Federal Information Processing Standards (FIPS) 140-2 certified product.
IT18 Desktop/Device Standards Vendor Offeror confirms their solution is device independent and/or fully functional operating on a Microsoft Windows desktop/laptop with standard Microsoft productivity suite software. Offeror's proposed solutions must operate on standard OIT-specified equipment (subject to annual review)
Any solution specific requirements such as drivers, software versions, etc. should be described in Comments.
IT19 Mobile Device Standards Vendor If solution includes mobile devices, offeror confirms their solution will be fully functional with the standard DOH mobile devices:
• Dell Windows based Tablets o Configured with the latest version of Microsoft Standard browsers o Web applications are to be Browser version independent which means they support current versions of Internet browsers for Microsoft, Firefox, and Google Chrome.
o Software should not be dependent on a specific version of MS Office Suite.
• Apple iOS based Tablets and Smart Phones o Configured with the latest version of Safari and Google Chrome.
o Software should not be dependent on a specific version of MS Office Suite
The offeror confirms their solution:
a. Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices;
b. Authorizes the connection of mobile devices to organizational information systems.
c. Establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to access the information system from external information systems; and process, store, or transmit organization-controlled information using external information systems.
IT20 WAN General Vendor Bandwidth varies greatly in areas outside Juneau, Anchorage, Wasilla, and Fairbanks. In some rural communities bandwidth can be as low as 56k.
The Offeror agrees to denote any performance degradation that could be encountered by their solution along with suggested mitigations.
IT21 Accessibility Standards Vendor The offeror attests their solution is compliant with accessibility standards and assistive/adaptable technology accommodations for users with disabilities under the latest or most current Federal and State regulations, including but not limited to:
a. ADA (section508.gov)
b. W3C (w3.org).
Accessibility issues are categorized in four distinct groups under Web Content Accessibility Guidelines (WCAG).
• Perceivable issues are those that affect a user’s ability to find and process information on a website
• Operable issues are those that impact a visitor’s ability to navigate and use a website
• Understandable issues concern a user’s ability to discern and comprehend all information and navigation on a website
• Robust issues involve a website’s ability to adapt and evolve to meet the changing needs of users with disabilities
ADA areas of concern include:
• Structure
• Readability
• Descriptive Link Text
• Accessible Files
• Videos
• Images
• Color
• Fonts
• Keyboard Navigation
• Form and Table Labels
• Call-to-Action (CTA) Buttons
| IT22 | Architecture and Performance | Architecture | Vendor | The offeror attests their solution was developed using modern design principles, applying principles of modularity, interface abstraction, and loose coupling to support ease of maintenance and readily allow future functional enhancements. |
| IT23 | Architecture and Performance | Architecture | Vendor | The offeror ensures that functionality added for other customers will not negatively impact DOH's solution instance. |
| IT24 | Hosting and Support | Standards | Vendor | The offeror will work with DOH to determine content and schedule of system upgrades. |
| IT25 | Security | Architecture | Vendor | The offeror attests their solution will be hosted in a federally-compliant cloud-based model (public, private, or government cloud). |
| IT26 | Investment Assurance | Standards | Solution | The offeror's solution will offer continuous backup with geographically separated redundancy. |
| IT27 | Security | Auditing and Logging | Solution | The offeror ensures their solution maintains an audit log as outlined below. |
The offeror's solution will log the following events, per record:
a. Record was created/modified
b. Record was deleted
c. Record was viewed
d. Record was printed
e. Record was searched
f. System login (both successful and unsuccessful)
g. System logout
Their log entries will include, at minimum:
a. The user ID of the person who accessed the record
b. The date and time of the event
c. Network location
d. The information that was accessed
e. The record's data state before and after any edits
These Audit records will be maintained for investigative purposes and should be readily searchable by user ID or client ID.
In addition, for solutions hosted by DOH, the offeror confirms their solution can submit logged events to DOH's industry standard Security Information and Event Management (SIEM) solution.
The offeror must provide an information system with an audit reduction and report generation capability that:
a. Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents;
b. Does not alter the original content or time ordering of audit records;
c. Retains audit records for at least ninety (90) days and archives old records for six (6) years to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements.
IT28 Availability Vendor The offeror attests to the level of availability that they will deliver.
The highest availability standard for systems is 99.999% or “five nines”–or about 5 minutes and 15 seconds of downtime per year (see table below). To achieve five nines, all components of the system must work seamlessly together. Software applications, compute resources, networking functionality, and physical data center services must be highly available to achieve five nines.
IT29 Database Vendor The offeror attests they maintain database design and maintenance best practices, including provisions for:
• Deploying Firewalls for Database Servers
• Ensuring database software is patched to include all current security patches
• Maintaining application code that is reviewed for SQL injection vulnerabilities
• Monitoring the delivery of protected data to user workstations
• Passwords for all database administrator (DBA), operating system accounts, and database accounts are required to be strong passwords
• Secure authentication to the database is used
• Tracking all logins to operating system and database servers, successful or unsuccessful
• Protected data is encrypted at rest, as well as during transmission over the network IT30 Reporting Solution The Offeror attests that any reporting capability contained within the solution will employ Embedded Data Analytics, features including:
• Application Programming Interface (API) Integration
• Extract, Transform, and Load (ETL) integration
• Data Variety Support
• Data Modeling Capability
• Data Quality Monitoring and Remediation
• Real-Time Performance Optimization
• Scalability
• Robust Security Controls
• Data Privacy and Governance Controls IT31 Security Vendor The offeror must acknowledge, and commit to implementing the following application security standards:
• Open Web Application Security Project (OWASP) Protocols
• NIST Special Publication (SP) 800–218 Guidelines
• International Organization for Standardization (ISO) 27034 Measures
• Center for Internet Security (CIS) Control 16: Application Software Security Controls
• Payment Card Industry (PCI) Payment Application Data Security Standard (PA-DSS) (whenever any payment controls are included in an application) IT32 Mobile Device Vendor The Offeror acknowledges that if their solution includes a mobile app companion to any system, or a purely mobile solution, they ensure their solution:
• Integrates Push Notifications into App Functions
• Provides High-Quality Image Resolution
• Includes an Integrated Search Feature
• Incorporates Social Media Integration Capability
• Uses Responsive App Design
• Follows the Principle of Simplicity-in-Design, with Uncluttered Elements (https://www.cerdonis.tech/blogs/the-process-of-mobile-app-designing/)
• Provides Extensive Cross-Platform Coverage and Usability
• Incorporates Robust Security Controls
• Leverages Mobile Screen Touch Features
• Integrates Provisions for User Feedback
• Provides the Ability for Apps to Work Offline
&"Arial,Bold"&14State of Alaska Department of Health &"Arial,Bold"&14Information Technology Contractual Requirements for Software as a Service (SaaS) Solutions
Version 1.5 (2025.01.22) Page &P of &N
Glossary of Acronyms
| Description: The glossary of acronyms provides a reference for frequently used acronyms found within the policies, procedures, regulations, and standards referenced throughout this document. | |
| Acronyms | Description |
| ADFS | Active Directory Federated Services |
| API | Application Programming Interface |
| ASP | Active Server Pages |
| CIS | Center for Internet Security |
| CJI | Criminal Justice Information |
| CJIS | Criminal Justice Information Systems |
| CTA | Call-to-Action |
| DBA | Database Administrator |
| DOH | Department of Health |
| ETL | Extract Transform and Load |
| FIPS | Federal Information Processing Standards |
| GDPR | General Data Protection Regulations |
| HR | Human Resources |
| IRIS | Integrated Resource Information System |
| ISO | International Organization for Standardization |
| IT | Information Technology |
| ITS | Information Technology Services |
| MCI | Master Client Index |
| MS | Microsoft |
| NIST | National Institute of Technologies |
| OIT | Office of Information Technology |
| OWASP | Open Web Applicatoin Security Projects |
| PA-DSS | Payment Application Data Security Standard |
| PCI | Protected Client Information |
| PCI | Payment Card Industry |
| PHI | Protected Health Information |
| PHP | PHP: Hypertext Preprocessor |
| PI | Personal Information |
| PII | Personally Indentifiable Information |
| SaaS | Software-as-a-Service |
| SIEM | Security Information and Event Management |
| SOC | System and Organization Control |
| SQL | Structured Query Language |
| SSAE | Statement on Standards for Attestation Engagements |
| XaaS | Everything-as-a-Service |
DropDownValues
| Preparedness Selection Values | |||
| Solution | Vendor | ||
| Yes or No | Must Have | Out of the Box/Included in this Solution | Yes, we meet this requirement without reservation |
| Yes | Nice-to-Have | Configuration Required (Explain) | Maybe, please see our comments for explanation (Explain) |
| No | Do Not Include | Modification Required (Explain) | No, we cannot meet this requirement (Explain) |
| Future Release (Explain) | N/A, this does not apply to our proposed solution | ||
| Not Available/Not Applicable (Explain) |
image1.jpeg
File details come from the government source that posted it. Updated .