4-RFP 26-011 Technical Requirements.xlsx
XLSX spreadsheet 37 KB Posted
- Attached to
- RFP# 26-011 Syllabus Software
- Solicitation number
- RFP# 26-011
- Issued by
- Tarrant County, Texas
About this file
This is a Technical Requirements document for RFP 26-011 issued by Tarrant County College District in Texas for a Syllabus Software solution. The RFP seeks a single integrated platform to consolidate the College's current three separate solutions (Instructor Class Requirements, District Master Syllabi, and Canvas LMS) into one comprehensive system. The solution must provide students with consistent class information across the student information system and learning management system, enable faculty to input and update course section information through a single tool, support academic leaders in ensuring compliance with division, department, campus, college, state, and federal requirements, allow the College to manage required content, and provide public access to syllabus and faculty curriculum vitae information.
The technical requirements document specifies 132 detailed functional and technical requirements organized into categories including backup and recovery continuity, compliance standards, payment processing, data center and hosting specifications, data management and security, identity and access management, interfaces and integrations, system performance monitoring, audit trails, and accessibility standards. Key requirements include 24-hour recovery time objectives with 60-minute recovery point objectives for disaster recovery, compliance with SSAE 18 SOC 1 and SOC 2 Type 2, multiple ISO/IEC standards (27001, 27002, 27017, 27018), FIPS 140-2/140-3 cryptographic standards, GDPR processor requirements, 99.9% uptime service level agreements, and comprehensive API capabilities for integrations with federal and state agencies including the U.S. Department of Education, IPEDS, Texas Higher Education Coordinating Board, and Texas retirement systems. The document utilizes a drop-down response format requiring vendors to indicate whether requirements are met as standard functionality, partially met, on future roadmap, provided through third-party integrations at no additional cost, or not applicable.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Technical RFP Requirements
| RFP Audience | RFP Sequence # | Category | Sub-Category | Requirement | Functionality Support | Comments |
| Internal Use Only | The RFP Sequence number may have intentional gaps in numbering. |
If Respondent has specific questions regarding items listed on this sheet, please provide the RFP Sequence Number and specifically which part of requirement they are referring to. Respondent represents that responses to these requirements are addressed as represented in this response by the software solution offered and costed in its response.
Respondent represents that to meet the requirements as represented in this response, the College will not be required to acquire additional software nor incur additional cost. Respondent should use drop-down to provide response and see available options. Respondent should elaborate to help College understand functionality, configurability, use-cases, and/or limitations.
If Respondent does not believe a requirement is applicable to their system/software/etc, please elaborate as to the why for evaluation purposes.
| The software solution offered by the Respondent offers the functionality and/or capability to: | ||||
| SaaS / Hosted | ITS.1 | Technical | Back up Recovery Continuity | Provide a solution that is architected to allow it to be fully recoverable/replicated, with an entire recovery time objective (RTO) not to exceed 24 hours. |
| SaaS / Hosted | ITS.2 | Technical | Back up Recovery Continuity | System provides a Business Continuity/Disaster Recovery capability enabling full and complete system recovery to a recovery point objective (RPO) within 60 minutes of system failure with zero data loss. |
| SaaS / Hosted | ITS.3 | Technical | Back up Recovery Continuity | Maintain primary and disaster recovery hosting sites which, if located within hurricane evacuation zones and/or flood zones, are rated to withstand Category 5 hurricanes, including alternative power generation provisions. |
| SaaS / Hosted | ITS.4 | Technical | Back up Recovery Continuity | Provide the ability to restore back-up or archived data by various optional parameters including the date range of the back-up/archiving processes and other user defined business rules. |
| SaaS / Hosted | ITS.5 | Technical | Back up Recovery Continuity | Sync transactions to a Network Time Protocol (NTP) Server, as a component of back-up and recovery procedures. |
| SaaS / Hosted | ITS.6 | Technical | Back up Recovery Continuity | Provide procedures, support and documentation which enable the Institution to independently test and assess recovery and continuity capabilities. |
| Standard | ITS.7 | Technical | Compliance | Comply with and provide independent audit attestation of compliance with SSAE 18 SOC 1 and SOC 2 Type 2 reports. Provide name of independent auditor and make reports available to the Institution. Or, document alternative standards-based methodology for achieving equivalent, independently verifiable results. |
| Standard | ITS.8 | Technical | Compliance | Comply with ISO/IEC 27001 and provide independent certification of compliance. Provide name of independent auditor and make reports available to the Institution. Or, document alternative standards-based methodology for achieving equivalent, independently verifiable results. |
| Standard | ITS.9 | Technical | Compliance | Comply with ISO/IEC 27002 and provide independent certification of compliance. Provide name of independent auditor and make reports available to the Institution. Or, document alternative standards-based methodology for achieving equivalent, independently verifiable results. |
| Standard | ITS.10 | Technical | Compliance | Comply with ISO/IEC 27017 and provide independent certification of compliance. Provide name of independent auditor and make reports available to the Institution. Or, document alternative standards-based methodology for achieving equivalent, independently verifiable results. |
| Standard | ITS.11 | Technical | Compliance | Comply with ISO/IEC 27018 and provide independent certification of compliance. Provide name of independent auditor and make reports available to the Institution. Or, document alternative standards-based methodology for achieving equivalent, independently verifiable results. |
| Standard | ITS.12 | Technical | Compliance | Comply with Federal Information Processing Standard (FIPS) 140-2 or 140-3 for cryptographic modules for Data in Motion. (Note: if claiming FIPS 140-2 only, comment on transition plans to FIPS 140-3.) |
| Standard | ITS.13 | Technical | Compliance | Comply with ISO/IEC 15408 (Common Criteria for Information Technology Security Evaluation) or document alternative standards-based methodology for achieving equivalent of the 'Common Criteria'. |
| Payments / Payment Processing | ITS.14 | Technical | Compliance | Provide payment processing capabilities which are compliant and compatible with the Electronic Payments Association NACHA Automated Clearing House (ACH) Standards. |
| Payments / Payment Processing | ITS.15 | Technical | Compliance | Comply with Payment Card Industry Data Security Standard (PCI DSS) and provide evidence of compliance. |
| Payments / Payment Processing | ITS.16 | Technical | Compliance | Provide payment processing capabilities which are compliant and compatible with ISO 20022 for payments messaging, or document future plans to provide the capability for ISO 20022 compliant messaging. |
| Standard | ITS.17 | Technical | Compliance | Support a continuous program to sustain compliance over time with all standards requirements in this document as well as new and revised equivalent industry standards, and for reporting to the Institution on ongoing compliance and any periodic additions or changes to overall compliance program. |
| Standard | ITS.18 | Technical | Compliance | Support the Institution's full and timely compliance with the General Data Protection Regulation (GDPR) by fulfilling all requirements of a GDPR 'processor' which processes personal data on behalf of the Institution. State any GDPR certifications maintained and any requirements unable to be achieved. |
| Standard | ITS.19 | Technical | Compliance | In the role of 'processor', provide necessary data, support and assistance conducting any GDPR required Data Protection Impact Assessments (DPIA). |
| Standard | ITS.20 | Technical | Compliance | In the role of 'processor', provide any and all GDPR-required notifications (e.g., of data breaches) within the timeframes required by the regulation and with reasonable and sufficient time for IES to meet its GDPR responsibilities. |
| Standard | ITS.21 | Technical | Compliance | In the role of 'processor', provide immediate and effective investigation support in case of any breach or compromise of institutional data or users. |
| Standard | ITS.22 | Technical | Compliance | In the role of 'processor', support management of all aspects of the Institution's GDPR compliance, including without limitation, modifying records and tracking changes across all systems when an individual withholds or withdraws consent or exercises one of their rights including the right of access, the right of rectification, the right to erasure, the right to restrict processing, the right to data portability and the right to object. |
| Standard | ITS.23 | Technical | Compliance | Provide commitment, methodology and practices to implement system updates as needed to comply with changes in the GDPR as well as future data and privacy regulations. |
| SaaS / Hosted | ITS.24 | Technical | Data Center and Hosting | Provide a comprehensive system environment which is highly available and fully redundant, including geo-redundancy. |
| SaaS / Hosted | ITS.25 | Technical | Data Center and Hosting | Provide hosting through a data center that complies with, at minimum, Tier Three (3) data center standards. |
| SaaS / Hosted | ITS.26 | Technical | Data Center and Hosting | Ensure hosting data center is located within the continental United States. |
| SaaS / Hosted | ITS.27 | Technical | Data Center and Hosting | System utilizes geo-dispersed Tier III or higher data centers in the United States for hosting and backup. |
| SaaS / Hosted | ITS.28 | Technical | Data Center and Hosting | Maintains relevant certifications and attestations for Hosting Services, as specified in this document's Compliance Requirements, including - but not limited to: SSAE 18 SOC 1 Type 2 and SOC 2 Type 2 reports; ISO 27001, ISO 27017 and ISO 27018. |
| SaaS / Hosted | ITS.29 | Technical | Data Center and Hosting | Keep institution fully informed of the vendor's complete set and statuses of all certifications and attestations related to its hosting services. |
| Standard | ITS.30 | Technical | Data Management & Security | Operate, maintain and provide the Institution documentation of a comprehensive data security program which addresses all five functions of the NIST Cybersecurity Framework: Identify, Protect, Detect, Respond, and Recover. The comprehensive data security program should comply with, but not be limited to, the other data security requirements in this document and specify on which industry standard(s) the framework is based. |
| Standard | ITS.31 | Technical | Data Management & Security | Operate, maintain and provide the Institution documentation of a comprehensive data security and integrity monitoring program which ensures active, continuous measures to detect, report on and investigate intrusions, attacks, breaches, security policy violations and any other anomalies or misuse of data or applications and systems integrity. |
| Standard | ITS.32 | Technical | Data Management & Security | Operate, maintain and provide the Institution documentation of a comprehensive incident management and response program which ensures timely and effective response to all types of security and operational incidents and includes pre-existing, established processes for known types of incidents and complies with relevant industry standards. |
| Standard | ITS.33 | Technical | Data Management & Security | Operate, maintain and provide the Institution documentation of a comprehensive security risk management program which actively identifies, detects, ranks and mitigates emerging and potential threats to data security and application services. |
| Standard | ITS.34 | Technical | Data Management & Security | Ensure appropriate protection and masking of any fields designated for protection by TCC, including those displayed in queries and reporting, designated as personally identifiable information with access restricted to authorized users by department and role and responsibility. Note: Please use the comments to elaborate on functionality, configuration, and use-cases. |
| Standard | ITS.35 | Technical | Data Management & Security | Support public key infrastructure (PKI) including use of SSL and X.509 digital certificates as appropriate to the functionality. |
| Standard | ITS.36 | Technical | Data Management & Security | Support latest versions of both Transport Layer Security (TLS) and Secure Sockets Layer (SSL) cryptographic protocols for secure data transmission. |
| Standard | ITS.37 | Technical | Data Management & Security | Support industry standard digital certificates beyond PKI applications, where appropriate and which enable encryption at the Transport Layer and create secure channels. |
| Standard | ITS.38 | Technical | Data Management & Security | Provide bulk data import and export services, including physical transport, for moving large amounts of data from the vendor’s solution to other platforms and services. Vendor enables export of all institutional data in standard format(s) the institution can readily consume and use for transition to another system. Note: If not applicable, please use the comments to desribe why. |
| Standard | ITS.39 | Technical | Data Management & Security | Ensure that all copies of data retained by the vendor for back-up and recovery purposes will be encrypted to industry standards. |
| Standard | ITS.40 | Technical | Data Management & Security | Support secure hypertext transfer protocol (HTTPS), to the exclusion of HTTP, for all inbound and outbound transmissions. |
| Standard | ITS.41 | Technical | IAM & Users Accounts | Support the ability to integrate and interoperate with Identity Management Solution/MS Azure Active Directory to automate and drive user account management including authorization provisioning and de-provisioning across other external, standards-based applications. Note: if additional/add-on products are required to achieve this capability, state in Comments. |
| Standard | ITS.42 | Technical | IAM & Users Accounts | For IAM, support options for both: 1) the capability for the ERP to function as the identity system of record and 2) integration with standards-based external IAM products to perform authentication and authorization functions, including - but not limited to - SAML 2.0, NTLM, ADFS and other standards-based external applications. NOTE: Please provide exact capabilities in comments. |
| Standard | ITS.43 | Technical | IAM & Users Accounts | Support the ability to interoperate in real-time with MS Azure AD, and other trusted identity providers, during original authorization to detect and prevent fraudulent identities and accounts. |
| Standard | ITS.44 | Technical | IAM & Users Accounts | Support seamless single sign-on across all functional modules and components of the system, if applicable. |
| Standard | ITS.45 | Technical | IAM & Users Accounts | Allow the system administrator or Identity Management System to grant user groups and/or categories the ability to delegate access privileges for designated functionality for all environments used, including but not limited to Production and/or Dev/Test. |
| Standard | ITS.46 | Technical | IAM & Users Accounts | For specified local user accounts or those not using SSO, provide user access and security using two factor authentication, including at the page level where required, and/or integrate with commonly-used, standards-based external two factor authentication systems (e.g., Microsoft Authenticator). |
| Standard | ITS.47 | Technical | IAM & Users Accounts | Allow the system administrator, other authorized users or Identity Management System to define roles/user access groups based on job responsibilities to ensure separation of duties. |
| Standard | ITS.48 | Technical | IAM & Users Accounts | Allow the system administrator or Identity Management system to grant roles/user groups access to each system function and to maintain (assign/remove) individually or in bulk roles and privileges, including the types of access to be allowed (add, change, inquire, retire, delete) and an effective start and end date for this access. Note: Please clarify in the comments whether this can be done only by a system administrator manually or can be automated - and if automation is possible, please clarify how (e.g., Azure AD Security Groups) |
| Standard | ITS.49 | Technical | IAM & Users Accounts | Provide an online process with work flow to allow authorized managers to request access for employees to specific system functions and subsystems and obtain management approval based on enterprise business rules for this access; based on management approvals, request will then be forwarded to system administrator or authorized user for review and potential action. May not apply to all systems. Note: Please clarify in comments if applicable, for things such as delegates, proxy approvals (individuals are on leave and need to assign to others temporarily), etc. |
| Standard | ITS.50 | Technical | IAM & Users Accounts | Allow the system administrator, authorized users, or Identity Management system to grant individual users access to a system function that their role/user group is not entitled to access and to establish the type of access to be allowed (add, change, inquire, retire, delete) and the effective start and end date for this access. Provide an audit trail and exception report for any additional security access granted. |
| Standard | ITS.51 | Technical | IAM & Users Accounts | Allow the system administrator, authorized users, or Identity Management system to remove users from one or more roles/user groups including recording of an effective date for end of inclusion in each role/user group. Note: Please clarify in comments if this is manual by the System Administrator or if can be automated through methods such as Azure AD Security Groups. |
| Standard | ITS.52 | Technical | IAM & Users Accounts | Restrict the display of system functions and subsystems on sign-in to the System to only the options and icon selections for which the user has authorized access. For example, a user's logon would define the functionality required and present only that capability. This has the added benefit of simplifying the choice of available system functions and individual screens for the user. |
| Standard | ITS.53 | Technical | IAM & Users Accounts | Provide system administrator, authorized users, or Identity Management system the ability to define or reset a user's password with the system generating a unique, random temporary password. Temporary password must be capable of being emailed or provided verbally based on a user successfully answering challenge questions. This may only be applicable for local accounts. Note: Please clarify in comments if this is revelant and the extent of functionality. |
| Standard | ITS.54 | Technical | IAM & Users Accounts | Require local passwords to be changed at an interval defined by the Institution system administrator or other authorized users. This may only be applicable for local accounts. Note: Please clarify in comments if this is revelant and the extent of functionality. |
| Standard | ITS.55 | Technical | IAM & Users Accounts | Suspend access for a period of time configurable by the system administrator, following a user-defined number of invalid sign-on attempts with the specific maximum number of invalid sign-on attempts configurable to fit local policy. This may only be applicable for local accounts. Note: Please clarify in comments if this is revelant and the extent of functionality. |
| Standard | ITS.56 | Technical | IAM & Users Accounts | Log incidents of invalid password attempts which exceed the maximum allowable number of attempts capturing user Identification entered, type of violation (invalid user ID, invalid password or invalid ID and password) and date and time of the violation. Place the incident log in the audit trail log. At a minimum, the log data should include: IP address, User Name, user agent, date/time stamp, location, function being accessed. This may only be applicable for local accounts. Note: Please clarify in comments if this is revelant and the extent of functionality. |
| Standard | ITS.57 | Technical | IAM & Users Accounts | Log incidents of security violations within the system capturing user identification, system function for which unauthorized access was attempted and date and time of security violation. Ability to export out log incidents to external systems for evaluation (e.g. Log Rhythm). |
| Standard | ITS.58 | Technical | IAM & Users Accounts | Allow the system administrator or authorized users to generate a formatted user-friendly report and online availability review of invalid password attempts or security violations within the system. This may only be applicable for local accounts. Note: Please clarify in comments if this is revelant and the extent of functionality. |
| Standard | ITS.59 | Technical | IAM & Users Accounts | Allow system administrator or other authorized user to define the allowable period for user inactivity while logged on and be able to differentiate time out parameters for self-service users. Note: If not configurable, please indicate in comments, the standard length of timeout. |
| Standard | ITS.60 | Technical | IAM & Users Accounts | Track last activity date for a security role/groups to facilitate removal of security roles/groups that are no longer used. Note: If not available/applicable, please use the comments to elaborate as to how this can be achieved or why not necessary. |
| Standard | ITS.61 | Technical | IAM & Users Accounts | Disconnect or log out a user session when it exceeds the allowable period of inactivity as established by the system administrator and configured in the system. Warn user that they will be disconnected before automatically logging off user with appropriate options for advance warnings to stay connected. Note: Please clarify the extent of functionality in the comments, specific to the user experience and any configuration available. |
| Standard | ITS.62 | Technical | IAM & Users Accounts | Ensure report and ad-hoc query results are subject to the system security model such that users cannot access data through reports and queries, including during distribution, for which they are not authorized in the operational system. Note: Please confirm in comments if this applies to all reporting within the system, including but not limited to custom reports provided by the vendor and/or through system administrator creation. |
| Standard | ITS.63 | Technical | IAM & Users Accounts | Provide inactivation of a user account based on no use of the system over a user-defined period of time which may vary by module. System default will be user-defined number of days and any user-defined period for an individual function except for self-service functions must not exceed this threshold. Note: Please clarify functionality and configurability in comments. |
| Standard | ITS.64 | Technical | IAM & Users Accounts | Provide system security administrator or Identity Management System ability to grant security roles to persons who are neither employees nor enrolled students (e.g., auditors, contractors, parents of minors), if applicable. Note: Please use the comments to elaborate on this functionality, configurability, and use-cases. |
| Standard | ITS.65 | Technical | IAM & Users Accounts | Provide the ability to support individual user accounts with multiple institutional roles (e.g., faculty, staff and student roles). Note: Please elaborate in the comments on any system limitations (e.g. not supported in systems with multip-modules). |
| Standard | ITS.66 | Technical | IAM & Users Accounts | Provide security administrator or Identity Management System to enter a future dated change to security access to accommodate new and retiring employees. Note: Please use the comments to elaborate on this functionality, configurability, and use-cases. |
| Standard | ITS.67 | Technical | IAM & Users Accounts | Allow ability for security administrators to attach approval documents or training completion document in the user profile when granting access to a user. Note: Please use the comments to elaborate on this functionality, configurability, and use-cases. |
| Standard | ITS.68 | Technical | IAM & Users Accounts | Provide report and/or online listing all users and roles/user groups, including a description of the roles/user groups, that is sortable by either user or role/user group. Note: Please use the comments to elaborate on this functionality, configurability, and report delivery options/formats. |
| Standard | ITS.69 | Technical | IAM & Users Accounts | Support role based security to allow users to modify (e.g., add, change, cancel, delete) transactions online, with audit trail. Note: Please use the comments to elaborate on this functionality, configurability, and use-cases. |
| Data Share / Integrations | ITS.70 | Technical | Interfaces and Integration | Provide a comprehensive interface management system which enables authorized users of the system to document, manage, monitor and track all types of interfaces and integrations using tools (e.g., APIs, data exports) provided by the vendor. |
| Data Share / Integrations | ITS.71 | Technical | Interfaces and Integration | Support a comprehensive and effective API security and control system and protocols which can be used to limit both internal the Institution personnel and external constituent access to all APIs - with hardened security measures for externally-facing APIs. Note: Please use comments if APIs are not available and/or not available for all modules/system functions. |
| Data Share / Integrations | ITS.72 | Technical | Interfaces and Integration | Provide the ability to develop, manage and support complex integrations which may include multiple bi-directional interfaces to multiple external systems and complex business and data processing and format translations. |
| Data Share / Integrations - Federal/Regulatory Agencies | ITS.73 | Technical | Interfaces and Integration | Provide a library of pre-developed integrations with common third party commercial applications and commonly used higher education services, agencies and regulatory bodies, such as: DOE, iPeds, etc. |
| Data Share / Integrations - Texas State Agencies | ITS.74 | Technical | Interfaces and Integration | Provide a library of pre-developed integrations with common higher education State of Texas agencies and regulatory bodies, including, but not limited to Texas: Higher Education Coordinating Board reports, Teacher Retirement System, Employee Retirement System, Comptroller's Office, etc. |
| Data Share / Integrations | ITS.75 | Technical | Interfaces and Integration | Provide a comprehensive toolset and a library of pre-developed templates which the Institution can use to develop custom interfaces and complex integrations. |
| Data Share / Integrations | ITS.76 | Technical | Interfaces and Integration | Support common standards for file-based data-transfer methods including, but not limited to: XML, spreadsheet and flat file (e.g. ASCII, CSV, variable and/or fixed length). Note: Please use the comments to elaborate on functionality. |
| Data Share / Integrations | ITS.77 | Technical | Interfaces and Integration | Support common & standard Web Service interfaces, including, but not limited to: SOAP, REST, JSON-RPC, and XML-based APIs. Note: Please use the comments to elaborate on functionality. |
| Data Load / Transformation | ITS.78 | Technical | Interfaces and Integration | Allow authorized users to schedule and monitor data extraction, cleansing, transformation and loading processes. |
| Data Load / Transformation | ITS.79 | Technical | Interfaces and Integration | Enable authorized personnel to perform incremental build data loads. |
| Data Share / Integrations - API Message Queues | ITS.80 | Technical | Interfaces and Integration | Provide communication services that provide message delivery and queuing for various types of communication (e.g., publish and subscribe, and request/reply). |
| Data Share / Integrations - API Message Queues | ITS.81 | Technical | Interfaces and Integration | Provide data-flow services that routes data when using API message queues to the appropriate destinations and filters messages. Note: Please use the comments to describe functionality, configurability, and use cases. |
| Data Share / Integrations | ITS.82 | Technical | Interfaces and Integration | Support data-mapping services to link data to the appropriate meaning in different schemas. |
| Data Share / Integrations | ITS.83 | Technical | Interfaces and Integration | Provide transaction processing services to manage transactions across multiple applications. |
| Data Share / Integrations | ITS.84 | Technical | Interfaces and Integration | Integrate with external systems using industry standard SOA architectures & platforms (e.g., those which support RESTFUL API). |
| Data Share / Integrations | ITS.85 | Technical | Interfaces and Integration | Utilize a common notification framework for all external application interfaces with multiple channels (e.g., SMTP, Instant Messaging, SMS) including an acknowledgement request option and/or ability to track/confirm receipt, if applicable. Note: Please use the comments to elaborate on functionality, configurability, and use-cases. |
| Data Share / Integrations | ITS.86 | Technical | Interfaces and Integration | Support inbound, outbound and bi-directional file interfaces via Secure FTP, Secure Network Storage Devices, and cloud data stores (e.g. Azure Data). |
| Data Share / Integrations | ITS.87 | Technical | Interfaces and Integration | Support inbound, outbound and bi-directional data interfaces via APIs. |
| Data Share / Integrations - MS Office Specific | ITS.88 | Technical | Interfaces and Integration | Support API integrations with Microsoft Office products. |
| Data Share / Integrations - APIs & Workflow | ITS.89 | Technical | Interfaces and Integration | Support API calls as built-in capability of workflow functionality. |
| Time Capture - Card Readers, IoT | ITS.90 | Technical | Interfaces and Integration | Support interfaces to common time capture devices/hardware (e.g., magnetic card readers) and software, as well other devices, such as: electronic door locks and other "Internet of Things" (IoT) devices. |
| Data Share / Integrations | ITS.91 | Technical | Interfaces and Integration | Provide an integrations development repository that includes documentation for the APIs, SDKs and other development resources. The repository must also include information on API versioning and life cycle management, including release, deprecation and retirement schedules. |
| Standard | ITS.92 | Technical | Performance Monitoring & Joint Processes | In addition to and distinct from specialized joint processes to respond to data breaches and other security incidents, provide a framework for joint processes for incident response and other system operational events which require collaboration, communication and shared effort across both vendor and the Institution personnel, functions, infrastructure and/or responsibilities. Joint process frameworks should include, but not be limited to: documentation of roles and responsibilities; standards and metrics for response and action(s), business process; workflows and assessment criteria. |
| Standard | ITS.93 | Technical | Performance Monitoring & Joint Processes | Agree to both Service Level Agreements (SLAs) and Operating Level Agreements (OLAs) that support a minimum system service performance level of 99.9% up-time for online inquiry and updates seven days a week outside the defined maintenance window(s). |
| Standard | ITS.94 | Technical | Performance Monitoring & Joint Processes | Agree to both Service Level Agreements (SLAs) and Operating Level Agreements (OLAs) that define and agree to adhere to applicable federal, state and other regulatory standards. |
| Standard | ITS.95 | Technical | Performance Monitoring & Joint Processes | Provide dashboards, system of alerts, notifications and other tools to enable complete and effective monitoring and assessment of all key metrics related to application performance, including but not limited to response time from the end-user perspective. |
| Standard | ITS.96 | Technical | Performance Monitoring & Joint Processes | Provide a complete set of SLA system and application service performance levels. |
| Standard | ITS.97 | Technical | Performance Monitoring & Joint Processes | Provide technical assistance to assess and troubleshoot application performance issues. |
| Standard | ITS.98 | Technical | Performance Monitoring & Joint Processes | Vendor provides automatic notification of missed of SLA service performance levels by level of severity and with info on remediation. |
| Standard | ITS.99 | Technical | Performance Monitoring & Joint Processes | Provide dashboard and system of alerts to monitor all key metrics of overall system performance. |
| Standard | ITS.100 | Technical | System Security & Audit Trails | Include a system-wide audit trail function and processes which logs all changes to application data, captures all functional data elements and provides system administrator(s) with the unrestricted ability to search, view, select, report on and/or download either complete or selected log data at any time. |
| Standard | ITS.101 | Technical | System Security & Audit Trails | Ensure that configured security parameters are also applied to audit trail data. |
| Standard | ITS.102 | Technical | System Security & Audit Trails | Log all system-level user account activity, including, but not limited to: login, logoff, account and profile changes, changes to authorizations and privileges, approval actions, and review functions and actions. At a minimum, the log data should include: IP address, User Name, user agent, date/time stamp, location, function being accessed, and applicable authorization status. Provide system administrator(s) with the unrestricted ability to search, view, select, report on and/or download either complete or selected log data at any time. |
| Standard | ITS.103 | Technical | System Security & Audit Trails | Provide the ability to generate automatic reports and/or notifications identifying all transactions where the same user initiated the transaction and provided final approval of that transaction (i.e., ability to create alerts of apparent violations of separation of duties). |
| Standard | ITS.104 | Technical | System Security & Audit Trails | Generate exception report when additional access is granted to an individual user beyond the authorized access of user's group. |
| Finance - Chart of Accounts | ITS.105 | Technical | System Security & Audit Trails | Enforce user-based security rules based on any Chart of Accounts element (either individually or in combinations), including row and column level security and the ability to control access to support business objectives. |
| IAM - Access Workflow Request Approvals | ITS.106 | Technical | System Security & Audit Trails | Allow a workflow for authorized institution administrators to request access for employees to specific system functions and obtain management approval based on college and department level business rules for this access, and/or integrate with other systems which may be used to perform this function. |
| IAM - Access Workflow Request Approvals | ITS.107 | Technical | System Security & Audit Trails | Provide mechanism for individuals to request access to the system and for the request to be routed via workflow. |
| Standard | ITS.108 | Technical | System Security & Audit Trails | Allow all users to configure and manage their own user profile through a common, easy-to-access user interface which is standard throughout the system. User profile functions should include, but not limited to: basic directory and contact information, password reset, security challenge questions, multi-factor authentication preferences, etc, if applicable. Note: Please elaborate in the comments on functionality, configurability, and use-cases. |
| Standard | ITS.109 | Technical | System Security & Audit Trails | Provide system administrator or an authorized user to delegate proxy roles to other users with an expiration date, and ability to notify user of new proxy right. |
| Standard | ITS.110 | Technical | System Security & Audit Trails | Grant user access based on the concept of least privilege. |
| Standard | ITS.111 | Technical | System Security & Audit Trails | Override system or user-defined defaults with proper security based on business rules with audit trail within individual system functions. |
| Standard | ITS.112 | Technical | System Security & Audit Trails | Treat each organizational structure (ie division, department, group) as a separate entity (e.g., Restrict departments from posting or viewing each other's data without cross-department security authorized.) |
| Standard | ITS.113 | Technical | System Security & Audit Trails | Enables system administrator(s) to restrict access to the system from specified geographic locations, if applicable. |
| Standard | ITS.114 | Technical | System Security & Audit Trails | Enables system administrator(s) to quickly shutdown all access to the system in emergency situations, and then restore access selectively by physical location, user group and/or functionality. |
| Standard | ITS.115 | Technical | System Security & Audit Trails | Enables system administrator(s) to directly control access to specific business functions by IP address or net block. |
| Standard | ITS.116 | Technical | System Security & Audit Trails | Control/prevent users from updating their own records via administrative screens. |
| Standard | ITS.117 | Technical | System Security & Audit Trails | Support one or more standards (e.g. DocuSign) for the implementation and enforcement of electronic/digital signatures for approvals and rejections in both workflows and individual/one-time documents based on user authentication to the system. Note: Please use the comments to elaborate on standard integrations or native system capibilities for this functionality. |
| Standard | ITS.118 | Technical | Technical Application Features | Allow the system administrator the option to not activate and/or opt into new software functions/features/enhancements/fixes/patches. |
| Standard | ITS.119 | Technical | Technical Application Features | Allow the system administrator control over when new functions/features/enhancements/fixes/patches are activated/accessible to the Institution users. |
| Standard | ITS.120 | Technical | Technical Application Features | Allow the system administrator to restrict all user access to the software during activation/opt in and testing processes, including the capability to schedule future restricted periods. |
| Standard | ITS.121 | Technical | Technical Application Features | Allow the system administrator to de-activate functions/features/enhancements/fixes/patches which were previously activated/made accessible to the Institution. |
| Standard | ITS.122 | Technical | Technical Application Features | Allow the system administrator to test new and existing functions/features/enhancements/fixes/patches in a non-production environment. |
| Standard | ITS.123 | Technical | Technical Application Features | Provide complete documentation (screenshots/purpose/benefit) of all new functions/features/enhancements/fixes/patches. |
| Standard | ITS.124 | Technical | Technical Application Features | Provide automated testing tools for enhancements/fixes/patches/bundles. Note: Please elaborate in comments. |
| Standard | ITS.125 | Technical | Technical Application Features | Provide support for the optional addition of click-to-call; click-to-text; and click-to-email functions in self-service/direct access functions, if applicable. |
| Standard | ITS.126 | Technical | Technical Application Features | Provide built-in architecture, capabilities and developer tools to enable the institution to add extended or add-on functionality to the system. |
| Standard | ITS.127 | Technical | Technical Application Features | Enable a customer-configurable login banner and/or branding. |
| Standard | ITS.128 | Technical | IAM & Users Accounts | Support configuration of seamless single sign-on and/or local authentication for system administrators or authorized users across all functional modules and components of the system. Note: Please use the comments to elaborate on this functionality, configurability, and use-cases. |
| Standard - Text Messaging | ITS.129 | Tehnical | Interfaces and Integration | Provide the ability to configure specific Opt-Out/In programs (e.g., Advising/Counseling, Finance, etc.), as well as all text communications. Store and provide reports and/or integrations capable of providing real-time opt preference with audit logs, including time, date, IP address, authentication method, etc. |
| Standard - Text Messaging | ITS.130 | Tehnical | Interfaces and Integration | Provide the ability to authenticate users, to confirm identity of person, receiving text-messages. |
| Standard | ITS.131 | Technical | Accessibility | Complies with the U.S. Federal Rehabilitation Act, Section 508 (36 CFR Part 1194, http://www.section508.gov). |
| Standard | ITS.132 | Technical | Accessibility | Complies with the Web Content Accessibility Guidelines (WCAG) to support web content accessibility. |
Data Validation
| Functionality Support | RFP Audience |
| SF - Standard Functionality | Standard |
| PM - Partially Met (Provide Comments) | SaaS / Hosted |
| FR - Future Roadmap (Provide Comments) | Payments / Payment Processing |
| TPINC - 3rd Party Integrated No Extra Cost | Data Share / Integrations |
| TPNNC - 3rd Party Non-Integrated No Extra Cost | Data Share / Integrations - Federal/Regulatory Agencies |
| DNM - Does Not Meet, Not on Roadmap | Data Share / Integrations - Texas State Agencies |
| Data Load / Transformation | |
| Data Share / Integrations - API Message Queues | |
| Data Share / Integrations - MS Office Specific | |
| Data Share / Integrations - APIs & Workflow | |
| Time Capture - Card Readers, IoT | |
| Finance - Chart of Accounts | |
| Standard - Text Messaging | |
| Standard - Chatbot | |
| IAM - Access Workflow Request Approvals |
File details come from the government source that posted it. Updated .