3515R08 - Appendix N - Enterprise Information Technology Standards.pdf

APPENDIX N

ENTERPRISE INFORMATION TECHNOLOGY

STANDARDS

Commonwealth of Pennsylvania Department of Transportation

Enterprise Information Technology Standards

Guiding Principles Standard Technologies

Enterprise Solutions Reference Architectures

Version 4.6

Effective: April 27, 2016

PennDOT Enterprise IT Standards Page: 1

Revision History

Versio n

Date Revisions Author

1.0 11/28/2012 Initial draft of the document Don Kirschman

1.1 12/10/2012 Added Section for Reference Architectures. Also, minor edits throughout document based on EASM feedback.

Don Kirschman

1.2 12/12/2012 Added section for Enterprise Solutions. Formatting and minor content changes throughout the document.

Don Kirschman

1.3 12/18/2012 Content and formatting edits to all sections of the document. Added section on Changing Standards.

Don Kirschman, Gautam Ray

1.4 1/7/2013 Removed references to Platform Technologies and adopted the term Enterprise Technology for consistency with ITLM. Added content to Reference Architectures.

Made various other changes throughout the document.

Don Kirschman

1.5 1/10/2013 Added content to: Section 1.6 Architecture Evaluation, Section 1.7 Waivers from Standards and Section 2.2 Standard Enterprise Solutions. Changed cover page, headers, footer, etc. Formatted all tables consistently and other minor format and content changes throughout the document.

Don Kirschman

1.6 1/22/2013 Broke Section 2 into Sections 2, 3 and 4. Added content from IT Infrastructure Guidelines and BIO Systems Environment documents as Sections 5 and 6 respectively. Added “Contents of This Document” to Section 1.

Updated EASM logo.

Don Kirschman

1.7 2/11/2013 Added section on COTS and IT Standards. Changed IT Infrastructure Guidelines to Guiding Principles for Technical Architecture. Added Guiding Principles regarding Java/.NET and relational databases. Other minor changes.

Don Kirschman

2.0 3/6/2013 Removed Appendix B and Appendix C the IT Solution Architecture Evaluation form and the IT Standards Waiver Request form, respectively.

Don Kirschman

2.1 3/26/2013 Moved Guiding Principles upfront immediately following General Information. Added new Guiding Principles. Modified some of the existing Guiding Principles.

Don Kirschman

Gautam Ray

2.2 3/27/2013 Renamed Section 1.9 to “Deviations from Standards” and removed all verbiage concerning waivers.

Don Kirschman

2.3 4/22/2013 Incorporated suggestion regarding timing of COTS evaluation and accepted changes on several minor typographical edits throughout the document.

Don Kirschman

2.4 5/10/2013 Incorporated changes to align with ITLM process as well as dozens of minor grammar, spelling and content changes throughout the document.

Don Kirschman

3.0 8/11/2013 Added Section 5.5 reference architecture for mobile applications. Doreen Wallen

3.1 10/9/2013 Added Section 5.6 reference architecture for Domino applications and Section 5.7 reference architecture for SharePoint applications.

Don Kirschman

PennDOT Enterprise IT Standards Page: 2

3.2 6/10/2014 Changed 3.1 to indicate Enterprise Technology Inventory report from ITLM is report ITLM008. Expanded some descriptions of Enterprise Solutions. Various grammar, spelling and format corrections/changes.

Don Kirschman

4.0 7/21/2014 Updated to incorporate external documents and strengthen wording to reflect standards concept.

EASM Team

4.1 12/11/14 Edits made based on Joyce B., comments. See document outlining questions and comments. In addition hosting requirements section has been entirely updated.

EASM Team

4.2 05/11/15 Changed Section 6 to remove versions for technologies listed in Standard Enterprise Technologies section.

Updated Section 3 with newest PennDOT Enterprise Software Inventory.

EASM Team

4.3 6/16/15 Updated Section 3 Standard Enterprise Technologies with current Enterprise Software Inventory

ITLM Process Owner

4.4 8/12/15 Updated Section 3 Standard Enterprise Technologies with current Enterprise Software Inventory

ITLM Process Owner

4.5 9/10/15 Updated Section 3 Standard Enterprise Technologies with a newly renamed PennDOT Enterprise Technology Standard report (ITLM008). Changed references to old report name Enterprise Software Inventory.

ITLM Process Owner

4.6 4/27/16 Updated Section 3 Standard Enterprise Technologies with current PennDOT Enterprise Technology Standard report (ITLM008).

ITLM Process Owner

Document Approvals

Enterprise Architecture Service Management Date Project Governance Committee

PennDOT Enterprise IT Standards Page: 3

PennDOT Enterprise IT Standards Contents

Revision History

Document Approvals

1. General Information

1.1 Contents of This Document

1.2 Background

1.3 Intended Audience

1.4 Intended Use

1.5 Scope

1.6 Types of Standards

1.6.1 Guiding Principles for Technical Architecture

1.6.2 Enterprise Technologies

1.6.3 Enterprise Solutions

1.6.4 Reference Architectures

1.7 Architecture Evaluation

1.8 COTS and IT Standards

1.9 RFP/RFQ’s and IT Standards

1.10 Deviation from Standards

1.11 Information Technology Lifecycle Management

1.12 Technology Lifecycle Classification

2. Guiding Principles for Technical Architecture

3. Standard Enterprise Technologies

3.1 List of Standard Enterprise Technologies

3.2 Technologies Specifically Not Supported

4. Standard Enterprise Solutions

PennDOT Enterprise IT Standards Page: 4

5. Standard Reference Architectures

5.1 .NET Applications Reference Architecture

5.2 Highway Applications Reference Architecture

5.3 Driver and Vehicle Services Applications Reference Architecture

5.4 DW/BI Reference Architecture

5.5 Mobile Applications Reference Architecture

5.6 Domino Applications Reference Architecture

5.7 SharePoint Applications Reference Architecture

6. PennDOT Information Technology Platforms

7. Hosting Requirements

PennDOT Enterprise IT Standards Page: 5

1. General Information

1.1 Contents of This Document

This document lists the IT standards for PennDOT and is divided into six sections. Section 1 General Information provides a background and context for the IT standards.

Sections 2, 3, 4 and 5 are PennDOT’s IT standards. Section 2 Guiding Principles for Technical Architecture defines the high-level technical guidelines for consideration when designing and evaluating the technical architecture for new IT solutions. Section 3 Standard Enterprise Technologies lists the actual standard technologies, including name, vendor and current version. PennDOT employees may also obtain current versions of this document from the IT Asset Management (ITAM) web site. Section 3 also defines certain technologies that are specifically not supported at PennDOT. Section 4 Standard Enterprise Solutions describes the reusable enterprise IT assets to be leveraged in lieu of developing similar functionality into new IT solutions. Section 5 Standard Reference Architectures defines high-level technical architectures for new IT solutions.

Section 6 PennDOT Information Technology Systems describes, at a high level, the current infrastructure, network and server environment at PennDOT.

Section 7 Hosting Requirements describes the requirements of vendors hosting PennDOT applications and data.

1.2 Background

PennDOT uses a large number of technologies, solutions and infrastructure to support our critical enterprise applications and our business community at large. Costs and time-to-market for IT solution delivery and maintenance rise, and the quality of service is threatened if these IT assets are not properly managed. Adding new technologies without consideration, having many development teams build similar solutions and designing disparate architectures for each IT solution are the most prevalent and preventable inefficiencies to be addressed by sound IT asset management.

Enterprise IT standards promote increased reuse and will result in more efficient and effective delivery of IT solutions and services. Enterprise Architecture and Service Management (EASM) has developed this document to communicate enterprise standards to PennDOT’s IT solution stakeholders. The standards expressed in this document have been reviewed and approved by PennDOT IT leadership.

PennDOT Enterprise IT Standards Page: 6

1.3 Intended Audience

This document is to be used by infrastructure and application architects, server engineers, administrators, business analysts, technicians and application developers who participate in the design, development, maintenance and support of IT solutions for PennDOT. IT managers, project managers, business analysts and others in the broader IT community will also find this document useful for a wide range of activities, including: portfolio and project planning, requirements analysis, etc.

This document is made available to PennDOT and other Commonwealth employees, contractors, business partners and prospective contractors.

1.4 Intended Use

PennDOT’s EASM program will facilitate the use of this document in promoting technology, solution and architecture standardization and rationalization. The intended uses for this document include but are not limited to the following:

• Communicating enterprise standard technologies, solutions and architectures to IT stakeholders

• Evaluating proposed technical architectures

• Providing guidance for the technical architecture of new and significantly updated IT solutions

• Provide guidance to potential vendors regarding requirements and standards when creating responses to requests for proposals and quotations (RFPs and RFQs).

• Providing guidance to PennDOT staff when evaluating RFPs and RFQs and other procurement related documents

1.5 Scope

This document defines IT standards for PennDOT-hosted and supported solutions only. These standards apply to new IT solutions and to those existing IT solutions that are being modernized or otherwise significantly updated. For IT solutions hosted in an external service provider’s data center, please refer to Section 7: PennDOT Hosting Requirements.

1.6 Types of Standards

To ensure well-architected solutions, it is not sufficient to merely identify a list of standard technologies; rather, care must also be taken in how these technologies are combined to deliver

PennDOT Enterprise IT Standards Page: 7 complete IT solutions. In fact, this document defines four different types of standards: Guiding Principles for Technical Architecture, Enterprise Technologies, Enterprise Solutions and Reference Architectures.

These four types of standards are defined below.

1.6.1 Guiding Principles for Technical Architecture

Guiding Principles for Technical Architecture embody the broadest technical requirements for all PennDOT enterprise IT. They capture the essence of what the enterprise holds as most valuable in defining a high-quality technical solution. These guiding principles are to be considered when defining the technical architecture for all new solutions, and they will be incorporated into Architecture Evaluations. Section 2 of this document identifies PennDOT’s enterprise standard Guiding Principles for Technical Architecture.

1.6.2 Enterprise Technologies

Enterprise Technologies are those commercially available hardware and/or software products that are used as the most basic building blocks for IT solutions. Not all technologies used by PennDOT are standardized, as many of them are used in narrow ways and are not of critical importance.

Only those most critical technologies that have a significant impact on the IT landscape of the organization are subject to standardization and are thus identified as Enterprise Technologies. Section

3.1 of this document identifies PennDOT’s standard Enterprise Technologies.

1.6.3 Enterprise Solutions

Enterprise Solutions are enterprise IT assets (e.g. applications, services, frameworks, infrastructure, etc.) which provide a common set of functionality that is made available to be leveraged by other PennDOT IT solutions. Enterprise Solutions benefit the organization in that resources are not wasted developing more than a single solution with the same or nearly identical functionality. A classic example of an Enterprise Solution is electronic document management, for which PennDOT has our FileNet-based EDMS system. Section 4 of this document identifies PennDOT’s standard Enterprise Solutions.

1.6.4 Reference Architectures

A Reference Architecture combines Enterprise Technologies and Enterprise Solutions in order to define the highest-level logical architecture for the operating environment for an IT solution. Physical infrastructure environments exist for each Reference Architecture. New IT solutions will be directed towards existing Reference Architectures to the extent possible during the very early phases of the project. This reduces design effort and ensures that existing physical infrastructure is rationalized and standardized.

Section 5: Reference Architectures lists the highest-level technical requirements for an IT solution and

PennDOT Enterprise IT Standards Page: 8 identify the Enterprise Technologies and/or Enterprise Solutions that are utilized to support each requirement.

1.7 Architecture Evaluation

Very early in the design or requirements phase of an IT project, an architecture evaluation must take place. During the architecture evaluation process, the EASM team will work with solution architects to review the proposed architecture against the standards in this document.

1.8 COTS and IT Standards

Commercial Off-The-Shelf (COTS) solutions can offer a significant cost savings and a reduced time-to-market when compared with a custom-developed IT solution. COTS solutions are also bound by our IT standards.

COTS solutions are developed with a very specific set of technologies and with a target platform.

COTS may not align with our IT standards. Implications of COTS solutions that don’t align with PennDOT standards and the potential for additional support costs must be weighed against any potential cost savings offered by the COTS.

The time to evaluate a COTS solution for alignment with enterprise IT standards is before the COTS is selected and certainly before a purchase contract or some other type of binding commitment has been established.

Caution must be taken if a COTS solution is to be modified in order to align with enterprise IT standards. These efforts are often very risky and may leave PennDOT with a solution that is orphaned and difficult to upgrade or maintain.

1.9 RFP/RFQ’s and IT Standards

Any IT solution being proposed as part of a procurement (RFP, RFQ, etc.) is also bound by our IT standards. Any proposed deviations from these standards must be included in the technical proposal of a prospective vendor. As part of the RFP/RFQ process, vendors must also complete a PennDOT Offeror Technology List showing all required technologies for their proposed solution.

A careful architecture evaluation of the proposed IT solution shall be conducted and any non-alignment with enterprise IT standards shall be carefully documented and presented to key selection team in advance of vendor selection.

When evaluating potential vendor’s proposed IT solutions, those that align with PennDOT IT standards are preferable to those that do not.

PennDOT Enterprise IT Standards Page: 9

1.10 Deviation from Standards

PennDOT recognizes that there may be strong business cases for IT solutions that deviate from our IT standards. If a decision is made to proceed with an IT solution that does not align with our IT standards, a waiver request must be submitted and approved by PennDOT senior IT leadership. In some cases, in addition to approving the waiver, PennDOT’s IT standards may be updated so future IT solutions can incorporate similar architectures.

The following four situations illustrate a deviation from these enterprise IT standards:

• Violation of Guiding Principles: This is a proposed architecture for an IT solution that is not in alignment with the Guiding Principles for Technical Architecture as identified in Section 2 of this document. Waiver required.

• Non-Standard Technology: This is the use of any technology that is either not identified as an Enterprise Technology or that is prohibited for use in Section 3 of this document. Waiver required.

• Non-Use of Enterprise Solution: This is developing or acquiring new solution functionality that is the same or very similar to that which is already provided by a standard Enterprise Solution identified in Section 4 of this document. Waiver required.

• Non-Standard Architecture: This is the use of an architecture that is inconsistent with the standard Reference Architectures identified in Section 5 of this document. Waiver required.

1.11 Information Technology Lifecycle Management

The process used to track Technologies in use at PennDOT is called Information Technology Lifecycle Management (ITLM). ITLM is reviewed and kept up-to-date in order to help the organization identify and respond to change brought about by the interaction of dependent technologies and the movement of technologies through their natural lifecycle from release and early adoption through obsolescence and retirement.

1.12 Technology Lifecycle Classification

The following are the Commonwealth of Pennsylvania OA/OIT and PennDOT standard definitions for technology life cycle classifications.

Lifecycle Status Definition

Emerging Emerging technologies or products that have the potential to become current standards. At the present time, they are to be used only in pilot

PennDOT Enterprise IT Standards Page: 10 or test environments where they can be evaluated. Use of these technologies is restricted to a limited production mode, and requires approval of a waiver request. Research technologies are less widely accepted and time will determine if they will become a standard.

Current These technologies or products meet the requirements of the current architecture and are recommended for use.

Contain These technologies or products no longer meet the requirements of the current architecture and are not recommended for use. They are to be phased out over time. No date has been set for their discontinuance.

Retire These technologies or products are being phased out. Plans are to be developed for their replacement, especially if there is risk involved, such as lack of vendor support. A date for retirement has been set.

Note: These definitions are maintained by the Commonwealth of Pennsylvania, Office of Administration, Office of Information Technology Product Life Cycle Management Product Standard (STD-APP026A) http://www.portal.state.pa.us/portal/server.pt/gateway/PTARGS_0_2_785_416_0_43/http%3B/pubcontent.state.pa.us/publishedcontent/publish/global/files/itbs/application_itbs/app026/std_app026a.doc http://www.portal.state.pa.us/portal/server.pt/gateway/PTARGS_0_2_785_416_0_43/http%3B/pubcontent.state.pa.us/publishedcontent/publish/global/files/itbs/application_itbs/app026/std_app026a.doc

PennDOT Enterprise IT Standards Page: 11

2. Guiding Principles for Technical Architecture The following are the Guiding Principles for Technical Architecture. These are enterprise standards, and they embody the broadest technical requirements for all PennDOT IT solutions.

1. The system shall adhere to Commonwealth standards defined by the Office of Administration/Office for Information Technology (OA/OIT) in Information Technology Policies (ITP’s) and PennDOT IT standards as defined in this document.

2. The system shall be built using “Current” and “Emerging” technologies as defined by the Office of Administration/Office for Information Technology (OA/OIT) in Information Technology Policies (ITP’s) and PennDOT IT standards as defined in this document.

Technologies that are classified as “Contain” or “Retire” must not be used for new development. If the applicable policy does not include a desired emerging technology, a waiver should be submitted.

3. The system shall use Guiding Principles, Reference Architectures, Enterprise Solutions, and Enterprise Technologies defined in this document.

4. The system will introduce new Reference Architecture, Enterprise Solution, or Enterprise Technologies only if the ones existing do not meet the functional and technical requirements.

5. The system shall meet the documented business needs for responsiveness, throughput, capacity and resource utilization.

6. The system shall meet documented business needs for availability.

7. The system shall be scalable, with respect to infrastructure, technology and software architecture, to accommodate increases in system capacity and required throughput without resulting in performance degradation.

8. The system shall store and manage all structured data in a relational database management system (RDBMS).

9. The system shall encrypt sensitive data in motion and at rest as required in Commonwealth and PennDOT standards.

10. The system shall, to the greatest extent possible, be developed using either the Java/J2EE or Microsoft .NET development platforms.

http://www.portal.state.pa.us/portal/server.pt/community/policies___procedures/10048 http://www.portal.state.pa.us/portal/server.pt/community/policies___procedures/10048 http://www.portal.state.pa.us/portal/server.pt/community/policies___procedures/10048 http://www.portal.state.pa.us/portal/server.pt/community/policies___procedures/10048

PennDOT Enterprise IT Standards Page: 12

11. The system shall be server-based to the greatest extent possible and accessible via industry-leading web browsers on a variety of devices, including desktop computers, tablets, smartphones, etc.

12. The system shall be designed to be accessible via the internet unless there is a specific requirement to the contrary.

13. The system shall have easily configurable parameters that do not require code modifications for such items as: communication, infrastructure and component names and locations, database names and connections, environment-specific settings, etc.

14. The system shall support multiple environments, including production and multiple pre-production environments.

15. The system shall implement an information lifecycle management strategy, including record retention and archiving/purge strategies, for all structured and unstructured data.

16. The system shall include sufficient technical documentation, and implementation plans must incorporate specific tasks and activities to facilitate knowledge transfer and transition to designated PennDOT technical resources.

17. The system shall incorporate documented and standards-based interfaces with other PennDOT systems as required.

18. The system shall utilize TCP/IP for network communications.

19. The system shall incorporate role-based authorization.

20. The system shall use existing Commonwealth or PennDOT directories for authentication, authorization.

21. The system shall use existing Commonwealth or PennDOT solutions for identity management and provisioning. Or the solution shall provide this capability.

PennDOT Enterprise IT Standards Page: 13

3. Standard Enterprise Technologies

3.1 List of Standard Enterprise Technologies

PennDOT maintains a listing of standard Enterprise Technologies in the IT Asset Management (ITAM) portal http://itam.pdot.state.pa.us/. PennDOT staff can generate a current version of the PennDOT Enterprise Technology Standard (ITLM008) report. This report is the list of PennDOT’s standard enterprise technologies. This report includes the name, version, category, manufacturer, platform, description and lifecycle status of the Enterprise Technologies.

The PennDOT Enterprise Technology Standard as of 4/27/2016 is included below:

http://itam.pdot.state.pa.us/

PennDOT Enterprise IT Standards Page: 14

PennDOT Enterprise IT Standards Page: 15

PennDOT Enterprise IT Standards Page: 16

PennDOT Enterprise IT Standards Page: 17

PennDOT Enterprise IS Standards Page: 18

3.2 Technologies Specifically Not Supported

The following technologies are specifically not supported for use in new and/or significantly modified IT solutions, either because they present operational and support challenges or because they are prohibited by Commonwealth OA/OIT enterprise standards.

1. Any technologies that are not standards as identified by PennDOT or the Commonwealth OA/OIT. See Section 3: Standard Enterprise Technologies.

2. Any technologies with an IT Lifecycle Classification of “Retire” or “Contain” by either PennDOT or the Commonwealth OA/OIT

3. Any technologies with an IT Lifecycle Classification of “Emerging” by the Commonwealth

OA/OIT.

4. Any open source, shareware, freeware, public domain or other non-commercial technologies (excluding application frameworks, such as Spring, Hibernate, etc.) unless they are identified as PennDOT or Commonwealth OA/OIT standard

5. Client Side Java J2SE unless it is packaged and deployed with an IT solution and isolated from any other Java J2SE clients

PennDOT Enterprise IS Standards Page: 19

4. Standard Enterprise Solutions The following is a list of the Enterprise Solutions to be leveraged for new IT solutions.

Enterprise Solution Description

EDMS Electronic Document Management System (EDMS) is PennDOT’s enterprise standard solution for long-term electronic document management, image capture, OCR, storage, searching and retrieval. It is based on EMC Captiva and IBM FileNet technologies.

PDSF for .NET PennDOT Solution Framework (PDSF) is a custom application framework for rapid development and delivery of high-quality solutions for the Microsoft .NET platform.

PD Framework for Java PD Framework is a custom application framework for rapid development and delivery of high-quality solutions in Java/J2EE.

PDIF BI Portal The PennDOT Data Integration Facility (PDIF) BI Portal is a web-based portal and a development platform for BI and end-user reporting solutions. It is a .NET application and integrates with reporting content (e.g. Crystal Reports, Excelcius and WEBI) published to Business Objects Enterprise Server.

PDIF Enterprise Data Warehouse

The PennDOT Data Integration Facility (PDIF) Enterprise Data Warehouse is PennDOT’s enterprise data warehouse in Oracle that integrates data from many disparate source systems for end-user reporting and analysis.

PDIF BOBJ Gateway PennDOT Data integration Facility (PDIF) BOBJ Gateway is a RESTful web-service API that enables secure, tight integration of Crystal Reports published on the Business Objects Enterprise server within the consuming application.

PennDOT Enterprise IS Standards Page: 20

5. Standard Reference Architectures The following are the enterprise standard Reference Architectures. These architectures represent the base logical architecture for new IT solutions at PennDOT. Separate architectures are defined for the specific type of solution (e.g. .NET, Highway, Driver and Vehicle Services, DW/BI, etc.).

Refer to Section 3.1 for the specific version numbers for the technologies referenced in this section.

5.1 .NET Applications Reference Architecture

The following Reference Architecture is intended for PennDOT’s Microsoft .NET solutions which can support any business community in the Department.

Technical Requirement Enterprise Technologies or Solutions

Relational Database Microsoft SQL Server on Windows

Application Server Internet Information Services on Windows

Software Development Microsoft Visual Studio

Microsoft .NET Framework

C#.NET

Visual Basic.NET

PennDOT Solution Framework for .NET (PDSF)

End-User Reporting Business Objects Enterprise on Windows

PDIF BOBJ Gateway

Identity and Access Management

PDSF Security

Document Management EDMS

Application Integration IBM WebSphere MQ on Windows

IBM WebSphere Message Broker on zLinux

Data integration Informatica PowerCenter on Windows

SQL Server Integration Services Windows

PennDOT Enterprise IS Standards Page: 21

5.2 Highway Applications Reference Architecture

The following reference architecture is intended for Java/J2EE solutions which support the Highway Administration.

Technical Requirement Enterprise Technologies or Solutions

Relational Database IBM DB/2 on zOS

Application Server WebSphere Application Server on Windows

Software Development Rational System Architect

Java/J2EE

PDFramework

Spring and Hibernate

End-User Reporting Business Objects Enterprise on Windows

PDIF BOBJ Gateway

Identity and Access Management

Engineering Construction Management System (ECMS) Security

Document Management EDMS

Application Integration IBM WebSphere MQ on Windows

IBM WebSphere Message Broker on zLinux

Data Integration Informatica PowerCenter on Windows

5.3 Driver and Vehicle Services Applications Reference Architecture

The following reference architecture is intended for Java/J2EE solutions which support the Driver and Vehicle Services.

Technical Requirement Enterprise Technologies or Solutions

Relational Database Oracle on zLinux

PennDOT Enterprise IS Standards Page: 22

DB/2 on zOS

Application Server WebSphere Application Server on zLinux

Software Development Rational System Architect

Java/J2EE

End-User Reporting Business Objects Enterprise on Windows

Identity and Access Management

Driver and Vehicle Services Security

Document Management EDMS

Application Integration IBM WebSphere MQ on zLinux

IBM WebSphere Message Broker on zLinux

Data Integration Informatica PowerCenter on Windows

5.4 DW/BI Reference Architecture

The following reference architecture is intended for PennDOT’s Data Warehouse and Business Intelligence (DW/BI) solutions.

Technical Requirement Enterprise Technologies or Solutions

Relational Database Oracle on zLinux

Application Server Internet Information Services on Windows

Software Development Microsoft Visual Studio

Microsoft .NET Framework

C#.NET

Visual Basic.NET

End-User Reporting Business Objects Enterprise on Windows

PennDOT Enterprise IS Standards Page: 23

Identity and Access Management

Role Based Security System (RBSS)

Document Management EDMS

Data integration Informatica PowerCenter on Windows

5.5 Mobile Applications Reference Architecture

The following reference architecture is intended for PennDOT’s mobile applications for iOS/iPad with Java/J2EE backend services.

Technical Requirement Enterprise Technologies or Solutions

Relational Database Refer to reference architecture for target audience

Application Server WebSphere Application Server on Windows

Software Development Apple iOS / XCode

Rational System Architect

Java/J2EE

PDFramework

Spring and Hibernate

End-User Reporting Business Objects Enterprise on Windows

PDIF BOBJ Gateway

Identity and Access Management

Engineering Construction Management System (ECMS) Security

Document Management EDMS

Application Integration IBM WebSphere MQ on Windows

IBM WebSphere Message Broker on zLinux

Data Integration Informatica PowerCenter on Windows

PennDOT Enterprise IS Standards Page: 24

5.6 Domino Applications Reference Architecture

The following reference architecture is intended for PennDOT’s internally-developed RAD applications developed using IBM Lotus Domino.

Technical Requirement Enterprise Technologies or Solutions

Data Store Lotus Notes

Application Server Lotus Domino

Software Development Lotus Domino Developer

End-User Reporting Business Objects Enterprise on Windows

PDIF BOBJ Gateway

Identity and Access Management

Domino Security

Engineering Construction Management System (ECMS) Security

Microsoft Active Directory

Document Management EDMS

Data integration Lotus Enterprise Integrator (LEI)

5.7 SharePoint Applications Reference Architecture

The following reference architecture is intended for PennDOT’s web collaboration applications developed with Microsoft SharePoint.

Technical Requirement Enterprise Technologies or Solutions

Relational Database Microsoft SQL Server on Windows

Application Server Internet Information Services on Windows

Microsoft SharePoint on Windows

Software Development Microsoft SharePoint on Windows

PennDOT Enterprise IS Standards Page: 25

Microsoft Visual Studio

Microsoft .NET Framework

C#.NET

Visual Basic.NET

End-User Reporting Business Objects Enterprise on Windows

PDIF BOBJ Gateway

Identity and Access Management

SharePoint Security

Engineering Construction Management System (ECMS) Security

Microsoft Active Directory

Document Management SharePoint

EDMS

Data integration Informatica PowerCenter on Windows

SQL Server Integration Services Windows

PennDOT Enterprise IS Standards Page: 26

6. PennDOT Information Technology Platforms Last Reviewed: 04/30/2015

Servers PennDOT hosts applications and data at the RagingWire Data Center in Ashburn, Virginia under the Pennsylvania Compute Services (PACS) contract owned by Unisys Corporation.

Hardware o IBM zEC12 Enterprise server model 2827-504 o System Configuration z/OS and z/VM Operating Systems z/OS 3 Logical Partitions: Production Applications, Development & Test, Sandbox z/VM 3 Logical Partitions: Production z/Linux guests, Pre-prod z/Linux guests, Tivoli Monitoring

PennDOT hosts applications and data in the Commonwealth Enterprise Data Center on the former Harrisburg State Hospital grounds in Harrisburg, PA.

Server Farm - Windows-based Application and Database servers

• Hardware o VMWare ESXi used for all environments o System Configuration

Microsoft Windows server operating system Network Components

PennDOT’s network infrastructure connects thousands of client devices in hundreds of locations throughout the Commonwealth.

LAN

• Ethernet, TCP/IP, 100MB-1GB to desktop

WLAN

• PennDOT provides 802.11n connectivity for PennDOT issued wireless devices.

WAN

• Core MPLS and CopaNET

• Remote Sites MPLS ranging from 1.5Mbps to 1Gbps and site to site VPN connections.

• Business Partner Connections range from 1 Mbps to 1 Gbps and includes some site to site VPN connections.

• Cellular Private IP Network based on Verizon Wireless MPLS.

Standard Workstation Configuration

PennDOT Enterprise IS Standards Page: 27

PennDOT provisions employees with Windows-based desktop PC’s and/or laptops.

Hardware

• Desktop PC – Intel Core i7-3770 3.4GHz, 128 GB HDD, 8GB DDR3 RAM

• Laptops – Intel Core i7-3720QM 2.6GHz, 256GB HDD, 8GB DDR3 RAM

Software

• Operating System – Microsoft Windows

• Office Productivity – Microsoft Office

• Internet Browser - Microsoft Internet Explorer

• Microsoft .Net 4.0

• Java Runtime 1.6.0_35

• Panagon Viewer (IDM Viewer) 4.0.2 Hot Fix 8

• Corel GIS Active-X Viewer 7.1

• Adobe Acrobat Reader XI Patch 3

• McAfee VirusScan Enterprise 8.8 Patch 4

• WinZip 18.5 Licensed

• SAP GUI 7.30 Patch 9

• Adobe Flash Player 13

• Adobe SVG Viewer

• Cisco AnyConnect (Laptops only)

PennDOT Enterprise IS Standards Page: 28

7. Hosting Requirements

The following requirements must be met when Commonwealth of Pennsylvania data and/or IT services are implemented on hardware and/or software that is not owned and managed by Pennsylvania Department of Transportation staff. These requirements apply to any external hosting arrangements and Software as a Service (SaaS) Information technology solutions.

A. Hosting Requirements

1. The selected Offeror shall supply all hosting equipment (hardware and software) required for performance of the Contract.

2. The selected Offeror shall provide secure access to all levels of users via the internet.

3. The selected Offeror shall use commercially reasonable resources and efforts to maintain adequate internet connection bandwidth and server capacity.

4. The selected Offeror shall maintain all hosting equipment (hardware and software) and replace as necessary to maintain compliance with the Service Level Agreements as described in the service level agreement (SLA) appendix of the RFP\RFQ.

5. The selected Offeror shall monitor, prevent and deter unauthorized system access. Any and all known attempts must be reported to the Commonwealth within the timeframe set out by the RFP. In the event of any impermissible disclosure, loss or destruction of Confidential Information, the receiving Party must immediately notify the disclosing Party and take all reasonable steps to mitigate any potential harm or further disclosure, loss or destruction of such Confidential Information. In addition, pertaining to the unauthorized access, use, release, or disclosure of data, the selected Offeror shall comply with state and federal data breach notifications regulations and is to report security incidents to the Commonwealth within one (1) hour of when the selected Offeror knew of such unauthorized access, use, release, or disclosure of data.

6. The selected Offeror shall allow the Commonwealth or its delegate, at times chosen by the

Commonwealth, to review the hosted system’s location and security architecture.

PennDOT Enterprise IS Standards Page: 29

7. The selected Offeror staff, directly responsible for day-to-day monitoring and maintenance, shall have industry standard certifications applicable to the environment and system architecture used.

8. The selected Offeror shall locate servers in a climate-controlled environment. Offeror shall house all servers and equipment in an operational environment that meets industry standards including climate control, fire and security hazard detection, electrical needs, and physical security.

9. The selected Offeror shall examine system and error logs daily to minimize and predict system problems and initiate appropriate action.

10. The selected Offeror shall completely test and apply patches for all third-party software products before release.

11. Offerors shall provide a successfully passed SSAE- 16 SOC2 audit report, conducted by an independent certified public accounting firm, subject to the approval of the Department, as part of its proposal, and the selected Offeror shall provide a SSAE-16 audit reports annually.

B. System Availability

1. The selected offeror shall make available the system and any custom software as established in the requirements section of the request for proposal\request for quotation.

2. The selected offeror shall perform routine maintenance during the planned weekly maintenance period as described in the requirements section of the RFP\RFQ. Routine maintenance shall include, but is not limited to, server upgrades/patching, software upgrades/patching and hardware maintenance. If defined as a requirement in the RFP\RFQ, In order to maintain system availability, the Offeror is expected to rollover to a backup site during maintenance periods.

3. The selected Offeror shall perform non-routine maintenance at a mutually agreeable time as defined in the RFP\RFQ..

4. From time to time, emergency maintenance may be required to bring down the system. In such situations, if possible, the selected Offeror shall give advance notice, before the system

PennDOT Enterprise IS Standards Page: 30 goes down for maintenance, to the Commonwealth. The selected Offeror will limit the emergency maintenance to those situations which require immediate action of bringing down the system that cannot wait for the next scheduled maintenance period. If defined as a requirement in the RFP\RFQ, It is expected that the Offeror will rollover to a backup site during any such emergency maintenance.

C. Security Requirements

1. The selected Offeror shall conduct a third party independent security/vulnerability assessment at its own expense on an annual basis and submit the results of such assessment to the Commonwealth within three (3) business days.

2. The selected Offeror shall comply with Commonwealth directions/resolutions to remediate the results of the security/vulnerability assessment to align with the standards of the Commonwealth.

3. The selected Offeror shall use industry best practices to protect access to the system with a firewall and firewall rules to prevent access by non-authorized users and block all improper and unauthorized access attempts.

4. The selected Offeror shall use industry best practices to provide system intrusion detection and prevention in order to detect intrusions in a timely manner.

5. The selected Offeror shall use industry best practices to provide virus protection on all servers and network components.

6. The selected Offeror shall limit access to the system and servers and provide access only to those staff that must have access to provide services proposed.

7. The Selected Offeror will provide all Services, using security technologies and techniques in accordance with industry best practices and the Commonwealth’s security policies, procedures, and requirements, including those relating to the prevention and detection of fraud and any other inappropriate use or access of systems and networks.

D. Data Storage

1. The selected Offeror shall use industry best practices to update all systems and third party software security patches to reduce security risk. The Selected Offeror shall protect their

PennDOT Enterprise IS Standards Page: 31 systems with anti-virus, host intrusion protection, incident response monitoring and reporting, network firewalls, application firewalls, and employ system and application patch management to protect its network and customer data from unauthorized disclosure.

2. The selected Offeror shall be solely responsible for all data storage required.

3. The selected Offeror shall take all necessary measures to protect the data including, but not limited to, the backup of the servers on a daily basis in accordance with industry best practices and encryption techniques.

4. The Selected Offeror agrees to have appropriate controls in place to protect critical or sensitive data and shall employ stringent policies, procedures, and best practices to protect that data particularly in instances where sensitive data may be stored on a Selected Offeror controlled or owned electronic device.

5. The selected Offeror shall utilize a secured backup solution to prevent loss of data, back up all data every day and store backup media. Storage of backup media offsite is required. Stored media must be kept in an all-hazards protective storage safe at the worksite and when taken offsite. All back up data and media shall be encrypted.

E. Disaster Recovery

1. The selected Offeror shall employ reasonable disaster recovery procedures to assist in preventing interruption in the use of the system.

F. Data Exchange/Interface Requirements

1. Payment Card Industry (PCI) Compliance

Note: This section only applies if the RFP\RFQ applies to Payment Card Industry (PCI) data.

The Selected Offeror is obliged to adhere to the Payment Card Industry Data Security Standard (PCI DSS) if it processes payment card data. Moreover, The Selected Offeror certifies that their Information Technology practices conform to and meet current PCI DSS standards as defined by The PCI Security Standards Council at https://www.pcisecuritystandards.org/security_standards/index.php.

https://www.pcisecuritystandards.org/security_standards/index.php

PennDOT Enterprise IS Standards Page: 32

The Selected Offeror will monitor these PCI DSS standards and its Information Technology practices and the Selected Offeror will notify the Commonwealth within one (1) week, if its practices should not conform to such standards. The SELECTED OFFEROR will provide a letter of certification to attest to meeting this requirement and agrees to the Commonwealth's right-to-audit either by Commonwealth or external 3rd party auditors.

Selected Offeror agrees that it may (1) create, (2) receive from or on behalf of Commonwealth, or (3) have access to, payment card records or record systems containing cardholder data including credit card numbers (collectively, the "Cardholder Data"). Selected Offeror shall comply with the Payment Card Industry Data Security Standard ("PCI-DSS") requirements for Cardholder Data that are prescribed by the payment brands (as appropriate including Visa, MasterCard, American Express, Discover), as they may be amended from time to time (collectively, the "PCIDSS Requirements"). Selected Offeror acknowledges and agrees that Cardholder Data may only be used for assisting in completing a card transaction, for fraud control services, for loyalty programs, or as specifically agreed to by the payment brands, for purposes of this Agreement or as required by applicable law.

G. Adherence to Policy

1. The selected Offeror support and problem resolution solution shall provide a means to classify problems as to criticality and impact and with appropriate resolution procedures and escalation process for each classification of problem.

2. The selected Offeror shall abide by all the Commonwealth’s policies (Information

Technology Policies (ITPs)).

3. The Selected Offeror shall comply with all pertinent federal and state privacy regulations.

H. Closeout

1. When the contract term expires or terminates, and at any other time at the written request of the Commonwealth; the selected Offeror must promptly return to the Commonwealth all its data (and all copies of this information), in a format agreed to by the Commonwealth, that is in the selected Offeror’s possession or control.