4773_Appendix_B_Approach_and_Technical_Specifications_Final.xlsx

XLSX spreadsheet 18 KB Posted Jul 2, 2024

Attached to: Request for Proposals - City of Chandler Utility Services Customer Portal ; PW4-920-4773
Solicitation number: BPM006370
Issued by: Maricopa County, Chandler City, Arizona

About this file

Written by GovTribe AI · Dec 8, 2025

This is an Appendix B technical specifications and approach document for the City of Chandler's Request for Proposals (RFP PW4-920-4773) for a utility services customer portal, posted July 2, 2024, with proposals due August 1, 2024. The solicitation seeks a comprehensive digital platform enabling utility customers to manage services, access billing information, and interact with the city's utility department through an online interface. Vendors must provide detailed responses across multiple categories including project management approach with schedule and critical path management, project initiation procedures, design and requirements gathering methodologies, setup and portal configuration tasks, system testing cycles (including end-to-end integration, solution, and user acceptance testing), role-based training curriculum with multiple training levels, and go-live processes with minimum 60 days of post-production support. The specifications require documentation of all requirements regardless of development methodology and define transition procedures to the technical support team following the post-production support period.

The technical specifications require vendors to address product information including solution overview and customer base, product differentiation and direction, APIs and integration methods, third-party product requirements, mobile and web accessibility capabilities, reporting functionality, data archiving strategies, WCAG 2.1 AA compliance, network configuration, performance and latency requirements, real-time monitoring capabilities, maintenance and release cycles, and support models with defined SLAs and escalation procedures. Critical requirements include StateRAMP compliance with demonstrated progress toward StateRAMP Ready status within 12 months and Authorized status within 18 months of agreement execution, comprehensive cloud services security controls including encryption standards (FIPS 140-2 capable), multi-factor authentication, role-based access controls, business continuity and disaster recovery plans with defined RTO and RPO metrics, continuous vulnerability management, and independent penetration testing. Vendors must demonstrate SAML/OpenID Connect integration capability with Azure AD, provide audit and event logging with SIEM integration capability, confirm city data ownership and restricted third-party vendor access, and describe processes for data purging and breach response. The solicitation is open to all qualified vendors with no specific set-aside designations mentioned, and vendors must provide availability across multiple environments including test, production, sandbox/training, and development environments.

View the file

Other files

File	Type	Posted
4773_Addendum_1_FINAL.pdf	PDF	Jul 2, 2024
4773_Appendix_D_Price_Proposal_Final.xlsx	XLSX spreadsheet	Jul 2, 2024
4773_Appendix_A_References_Qualifications_and_Experience_Final.xlsx	XLSX spreadsheet	Jul 2, 2024
4773_RFP_FINAL.pdf	PDF	Jul 2, 2024
4773_Appendix_C_Business_Requirements_Final.xlsx	XLSX spreadsheet	Jul 2, 2024
4773_Addendum_2_FINAL.pdf	PDF	Jul 2, 2024

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Project Approach

Category	Requirement	Response
Project Approach Project Management	Describe your project management approach which shall include the following but not limited to:
	Project schedule with critical path management
	Project action items/issue log management
	Project communications plan, monthly Sponsor Status updates, cadence of Core Team meetings
	Risk management assessment and mitigation plans
	Project budget management with project milestones itemized and value of each milestone
	Flexibility of timeline schedule
Project Approach Project Initiation	Describe how the project will be initiated and launched including required involvement from the City’s team
Project Approach Design and Requirements Gathering	Describe the approach to solution configuration and integration requirements gathering and confirmation
	Describe configuration requirements and integration requirements including any data mapping to be documented in configuration requirements and integration requirements documents
	Describe how documents will be reviewed and approved by the City before proceeding any configuration or integration work. An agile approach is acceptable but documentation of any and all requirements is required
Project Approach Setup and Portal Configuration	Describe the tasks and activities for both parties to complete to support the setup, configuration and integrations required to meet the city’s requirements
Project Approach System Testing Cycles	Describe the recommended testing cycles that will be performed to ensure the configured and integrated portal solution meets the City’s requirements. The minimum testing requirements are end-to-end integration testing, solution testing, and user acceptance testing
	Describe the ticketing, prioritizing, and resolution of testing issues so that acceptance testing is not delayed
Project Approach Training	Describe the role-based training curriculum that includes at the minimum an initial training, refresher training, advanced topics training, and administrative training. For each training class, provide a syllabus, training duration, and required attendee roles
	Describe product training mediums available for the end user community
	Describe the timing of these training courses during the project
Project Approach Go Live and Post-Production Support	Describe the go live process and at the minimum provide 60 days post-production support before transitioning to the technical support team
	Describe the transition process to the technical support team and the post-production support services proposed

Technical Specifications

Category	Requirement	Response
Product Information
Product Description	Overview of your solution
Product Customer Base	Overview of key clients using your solution: in production, beta-testing, consideration
Product Direction	Summary of product “future state” direction
Product Differentiation	Describe how your product is different from other products on the market today
Product Accessibility
Product Integration	Describe the APIs or integration methods available along with a summary of each
Product 3rd Party Products	List any required third party software or service required to facilitate your product application functionality
Product UI Platforms	Describe your product’s portability to mobile devices, tablet PCs, smart phones, etc
Product Reporting Capabilities	Summary of product reporting methods (e.g., built-in, custom, ad hoc capabilities, data mining/data warehouse generation, formatting supported (pdf, excel, csv, etc.)
Product Data Archiving	Overview of product strategy for data archiving and data purging
Product Web Accessibility	Describe your product’s ability to meet the WCAG (Web Content Accessibility Guidelines) Level 2.1 AA requirements for government accessibility.
Product Performance and Maintenance
Network Considerations	Describe all necessary network configuration settings including specified ports, IP ranges, connections from wildcard domain names
Performance and Latency	List the minimal required bandwidth and maximum latency to achieve acceptable performance
Monitoring	Does your system include real time performance network monitoring? Please elaborate.
Product Maintenance (Releases & Patches)	1) Overview and cycle time interval timelines for standard release updates maintenance functionality
	2) Process for installing new and updated versions or patches
	3) Provide the number releases planned per year
	4) Provide the number of times updates were released in the past year for your software
	5) Describe support which is provided for updates. Describe documentation/release notes to be provided
	6) Describe the willingness to warrant the management of new releases into the tool and their effect on the City of Chandler instance
	7) Describe time allowed for testing mandatory releases
Product Support
Product Support Model	1) Overview of product generic support model (e.g., general SLAs, customer support, critical issue support, outages, availability of application)
	2) Provide the hours of operation for technical support and escalation for emergencies.
	3) Describe your service/support call procedures.
	4) Describe specific technical support and account management people to be assigned to our account and where they are located.
	5) Describe how you prioritize customers for support.
	6) Describe the General Support SLA severity and priority.
	7) Location of technical support resources
Product Problem Support	1) Describe the processes available for customers to report bugs and receive software fixes.
	2) Describe the guarantees for turnaround time on problems
Product Enhancements	Describe product enhancement request process and product enhancement release cycle time frequencies to the market
Product User Adoption
Product Documentation	1) Overview of standard product documentation access (e.g., online documentation, help access, etc.)
	2) Provide how and when this documentation updated.
	3) Describe documentation updates that accompany any new software releases
Cloud Services
Policy, Controls, and Compliance	1) Does your company have a written controls plan, policy, standards that contains the administrative, technical and physical safeguards you use to collect, process, protect, store, transmit, dispose or otherwise handle our data (e.g., Information Security Plan, System Security Plan, Written Information Security Program) and can you provide that documentation?
	2) What information security controls framework(s) do you follow?
	3) What third party audited certifications /authorizations, if any, does your company have? Please provide documentation.
	a. SOC1 / SOC2
	b. ISO 27001
	c. NIST 800-53, 800-171
	d. CSA STAR
	e. HITRUST
	f. PCI DSS
	g. HIPAA
	h. Other
	4) Where is your SaaS hosted?
	a. Is your SaaS hosted in an environment with FedRAMP or StateRAMP authorization?
	5) Does your company require annual security awareness training for all employees?
	6) How will you help the city comply with all applicable policies, privacy, regulations, and security laws?
	a. Do you have guides and instructions for how the city would maintain regulatory compliance and protect confidential data?
	7) Does the system or application provide multi-tenant controls for separation of users and data within the service?
	8) Does your company utilize encryption methods for data in transit and data at rest where technically possible and legally permissible?
	a. Is your product capable of FIPS 140-2 compliant encryption?
	9) Are files and records reviewed, retained, and purged in accordance with legal requirements, contractual obligations, and service level agreements?
	10) What is your process for purging all files and records and removing access upon completion of the service, task, or contract?
	11) Does your company have written business continuity/disaster recovery plans, which are tested on a periodic basis? Please elaborate.
	12) Is your environment high availability? Please describe.
	13) Describe your backup frequency and process, and are backups stored offline?
	14) What are your recovery time objective (RTO) and recovery point objective (RPO)?
	15) Does your company maintain up-to-date versions of anti-virus software, anti-malware, antispyware, and operating systems security patches? Please elaborate.
	16) What will your company actively do to prevent security incidents or breaches, and how often do you plan to check for vulnerabilities? Please elaborate.
	17) Does your company practice continuous vulnerability management? Please elaborate.
	18) Does your system’s external DNS solution support DNS Security (DNSSEC) to provide origin authentication and integrity verification assurances?
	19) Does your company maintain a current, complete, and accurate inventory of the information system software, hardware, and network components?
	20) Does your company employ automated mechanisms to detect inventory and configuration changes?
	21) Does your company follow a formal change control process that includes a security impact assessment?
	22) Does your company scan for configuration settings on systems in the environment?
	23) Does your company have a Configuration Management Plan?
	24) Does your company hire an external audit firm to perform a compliance review of your operational controls?
	25) Does your company perform independent penetration tests of the environment storing, transmitting, and/or processing city data? How often? Please provide documentation.
	26) Does your company, or third party / sub-contractors used by your company, utilize IT workforce outside the United States? If yes, please list the countries.
	27) Can your company, and any relevant third-party service provider your company contracts with, send the results of your last security audit?
	28) Does your product provide audit and event logging? Identify the types of events the system records. Can your system send audit and event logs to city logging systems (e.g., syslog, SIEM, etc.)?
Data Security and Controls	1) Does the system or application which will be storing, transmitting, and/or processing our city data and services provide access control mechanisms? Please elaborate.
	2) OpenID Connect/SAML/Single Sign On, vendor agnostic. (Chandler uses Azure AD)
	3) Multi-Factor Authentication
	4) Unique User IDs and password standards
	5) Role-based access. Please elaborate.
	6) Web based dashboard for user management.
	7) Does your company ensure adequate steps are taken to guard against unauthorized access to our city data (e.g., firewall, IDS, IPS, etc.)? Please list the technology and processes that are in place.
	8) Does your company have a written plan to promptly identify, report, and respond to breaches of security related to our city data (e.g., incident response plan)?
	9) Would the city always retain ownership of our data?
	10) Will third party vendors (e.g., subcontractor, managed shared hosting) used by your company be restricted from having access to the system or application data of the city?
	11) Will city data be stored, processed, or transmitted outside the United States?
	12) Does your company provide assurance (in the form of a written report) of you and your third-party vendor's security and controls while customer data is being collected, processed, and retained?
StateRAMP Certification	1) Can your product demonstrate compliance with NIST 800-53 at the specified Impact Level?
	2) Has your company achieved StateRAMP Ready, Provisional, or Authorized status?
	a. If yes, submit documentation of StateRAMP Ready, Provisional, or Authorized status.
	b. If no, what is the company’s plan for achieving StateRAMP Ready, Provisional, or Authorized status?
	c. Will the company obtain StateRAMP Ready status within 12 months of Agreement execution?
	d. Will the company obtain StateRAMP Authorized status within 18 months of Agreement execution?
	3) Does the company have a valid StateRAMP Security Snapshot?
	a. If yes, submit documentation of the valid StateRAMP Security Snapshot obtaining a valid StateRAMP Security Snapshot.
	b. If no, what is the company’s plan for a valid StateRAMP Security Snapshot obtaining a valid StateRAMP Security Snapshot?
	c. Will the company obtain a valid StateRAMP Security Snapshot within 6 months of Agreement execution?
	d. Will the company provide monthly progress reporting to StateRAMP until StateRAMP Ready and StateRAMP Authorized status are obtained?
	4) Will the company grant access to continuous monitoring and reporting upon receiving award for StateRAMP Security Snapshot, Ready status and Authorization status through the life of the contract?
	5) Will the company all the city to review all Third-Party Assessment Organization (3PAO) audits, risk assessments, vulnerability assessments, and penetration tests of the contractor's environment?
	6) Will the company respond to all flaws discovered by providing a mutually agreed upon timeframe to resolve the issue and/or implement a compensating control?
Environments	Describe the number of environments available for CoC (Test, Prod, Sandbox/Training, Dev)

File details come from the government source that posted it. Updated Dec 8, 2025.