6-Part B - RFP Scope of Work Final.pdf

City of Alexandria Request for Proposals

RFP: Transportation Stipend Card Management Services RFP No.: 2017

Part B – Scope of Work or Description of Items

Part B – Scope of Work

1. General Overview This section provides an overview of the scope of services and/or goods described in this Solicitation. This Request for Proposals (“RFP”) is issued in accordance with the Virginia Public Procurement Act using the competitive negotiation method of source selection.

Proposals will be evaluated against the evaluation criteria set forth herein to determine the proposal most advantageous to the City.

Detailed requirements governing contract administration, performance, scheduling, acceptance, and payment are addressed in Part C – Special Terms and Conditions, which supplement the City’s Part D – General Terms and Conditions.

2. Purpose The City of Alexandria, Virginia (the “City”) issues this Request for Proposals (“RFP”) to solicit proposals through the competitive negotiation process to establish a contract for the provision of comprehensive, secure, and scalable debit/prepaid card management solution for the City of Alexandria, as described in this Solicitation.

The Contractor shall furnish all labor, materials, equipment, software, implementation services, reporting tools, and ongoing support necessary to deliver a card-based financial management and transaction platform in accordance with the specifications, general clauses, and terms and conditions set forth herein.

The resulting contract will support multiple City departments, programs, and funding sources and must be configurable to accommodate varying program requirements.

3. Background As part of its service delivery modernization efforts, the City seeks to implement a flexible, secure, and scalable card-based payment platform to support financial disbursements, subsidies, stipends, incentives, reimbursements, and other authorized program payments.

4. Objectives The objective of this solicitation is to procure a vendor capable of providing the following:

• Prepaid, reloadable debit card issuance and management; and/or

• A card management database platform integrated with a financial institution; and

• Administrative tools for eligibility-based benefit assignment, balance management, and reporting.

The solution must adhere to the following:

• Be program-agnostic, configurable, and scalable. Scalability refers to the number of City program participants requiring pre-paid debit cards.

• Support multiple departments simultaneously

• Allow for different eligibility rules and funding sources

• Provide secure financial controls and reporting

RFP: Transportation Stipend Card Management Services

• Ensure compliance with all applicable federal, state, and industry standards

• The system shall support City-defined participant groups, vendors, merchants, and service providers without being limited to any single department or program area.

• The city anticipates an estimated 750 program participants will require cards at the outset, once the system is up and running. After that period, the number of participants requiring cards is subject to increase as the City scales up current programs or introduces new programs requiring cards. Proposers should note any limitations or caps on the number of cards that can be issued at any one time.

• The system shall achieve operational efficiency and value

• The system shall deliver effective, reliable, and timely services

5. Deliverables Deliverables may include, as applicable:

5.1. Reports

5.2. Data outputs

5.3. Service performance results

5.4. Documentation

5.5. Other items identified by the City

6. Performance Period, Location, and Workdays/Hours

6.1. Period of Performance

If an award (s) is made, the City will issue a Contract(s) for an initial period of three (3) years, with three (3) one (1) year option periods. Option years may be exercised one (1) year at a time by mutual agreement of both parties. The Contract period shall commence on the date of award and shall not exceed a six (6) year period. At the end of the period of performance, the contractor is expected to coordinate with an incoming vendor on an as-needed basis to ensure business continuity.

6.2. Work Location and Work Days/Hours or Delivery Location.

6.2.1 Work location: Services shall be performed in accordance with all requirements contained herein, and per all specifications incorporated by reference and specified in solicitation/Contract. Additional locations may be identified and authorized by change order signed by the Contracting Officer during the Contract term.

6.2.2 Workdays/hours, except for public holidays established by Federal law:

maintain standard business operations at minimum from 8:00 a.m. to 4:30 p.m.

Eastern Time, Monday through Friday, excluding City-observed holidays (unless otherwise agreed).

7. Offeror Responsibilities The Offeror shall:

7.1. Perform services in accordance with the Contract

RFP: Transportation Stipend Card Management Services

7.2. Provide qualified personnel

7.3. Meet required schedules and performance standards

8. Contractor Responsibilities - Card Management Services

8.1. Specifications

Offerors may propose to provide either:

• A card management database system that integrates with a City-approved financial institution and card issuer; OR

• A full-service banking/financial services solution that includes issuance and management of prepaid, reloadable open-loop debit cards.

Offeror shall provide a complete, version-controlled system architecture diagram documenting all data flows, integrations, storage locations, encryption boundaries, authentication flows, and hosting regions (including geographic jurisdiction of all cloud services).

Cards must:

1. Be Visa, MasterCard, American Express, or Discover branded

2. Be reloadable and configurable

3. Allow merchant category code (MCC) or vendor restrictions

4. Allow geographic restrictions if needed

5. Include participant name embossing or printed identification

6. Meet current PCI and banking industry standards

The Contractor shall provide all services necessary for issuance, activation, reloading, suspension, replacement, monitoring, reconciliation, and reporting.

8.2. Card Management System Requirements

The system must adhere to the following standards:

8.2.1 Support online and staff-assisted enrollment functionality.

8.2.2 Allow secure upload, storage, and retrieval of documentation (if required by specific programs).

8.2.3 Support role-based access controls for City staff, contractors, and participants. All administrative and user access must enforce MFA. SSO via SAML 2.0. Vendor must implement RBAC with least privilege defaults, session timeout enforcement, and support for modern authentication (e.g., WebAuthn/FIDO2).

RFP: Transportation Stipend Card Management Services

8.2.4 Allow participants to access account information online or via mobile platform (balance, transactions, alerts).

8.2.5 Provide real-time card balance verification.

8.2.6 Allow City-authorized staff to:

• Load funds

• Adjust balances

• Suspend or terminate cards

• Modify merchant restrictions

8.2.7 Track transactions including (but not limited to):

• Date

• Time

• Merchant

• Charge amount

• Authorization status

8.2.8 Provide fraud monitoring, suspicious activity alerts, and card lock capabilities. Vendor must provide real time fraud detection analytics, anomaly detection, and alerting, with integration into the City SIEM via Syslog, API, or webhook. System must support continuous monitoring informed by industry fraud threat intelligence.

Vendor must also implement identity validation processes aligned with NIST IAL1–2, with fraud-prevention measures such as duplicate enrollment detection, anomaly checks, and (if applicable) KYC-aligned verification.

8.2.9 Maintain compliance with:

• Payment Card Industry Data Security Standard (PCI DSS)

• Applicable banking regulations

• Federal and Commonwealth of Virginia data protection laws

• The following City Technology Guidelines

1. A.R. 10-13: Security of Confidential or Sensitive Data

2. A.R. 10-10: Information Systems Security Policies

• Americans with Disabilities Act (ADA) accessibility requirements

8.2.10 Hosting Standards / Network Security: Vendor hosting environments must meet CIS Level 1 or NIST 800 53 Moderate security controls and must implement tenant isolation, network segmentation, secure baselines, and continuous vulnerability scanning.

https://alexandriava1.sharepoint.com/sites/AlexConnect-Policies/SitePages/A.R.-10-13--Administrative-Regulations.aspx https://alexandriava1.sharepoint.com/sites/AlexConnect-Policies/SitePages/A.R.-10-10--Administrative-Regulations.aspx

RFP: Transportation Stipend Card Management Services

8.2.11 Encryption requirements: All data at rest must use AES 256 or stronger; all data in transit must use TLS 1.3 unless documented compensating controls are approved. Vendor must support crypto agile capabilities and implement formal key management practices aligned with NIST SP 800 57.

Confidential and Sensitive data must be encrypted at rest, logically separated, and hashed or tokenized where feasible. Vendor must generate immutable audit logs for all data access events, with active monitoring to detect anomalous access.

8.2.12 Offeror shall implement Virginia Consumer Data Protection Act (VCDPA_-aligned data minimization and purpose-binding practices, collecting and retaining only the minimum data required for operational use.

8.2.13 Include secure APIs or data export capability for integration with City systems, if required.

8.2.14 API Security: APIs must use OAuth 2.0 and OIDC with rotating tokens. API gateway controls must include rate limiting, schema validation, logging, and WAF protection. All API calls must be fully auditable.

8.2.15 Mobile App / Wallet Integration Security: Mobile app components must comply with the OWASP Mobile Top 10, implement device-level encryption, anti tampering controls, certificate pinning, and secure storage for credentials or tokens.

8.2.16 Downtime and loss tolerance: Vendor shall maintain documented Disaster Recovery (DR) plans with Recovery Time Objective (RTO) ≤ 4 hours and Recovery Point Objective (RPO) ≤ 1. DR plans must be tested annually, with results available to the City.

8.2.17 It is strongly preferred that the proposed system accepts existing data for upload.

8.3. Reporting Requirements

The system must provide configurable, exportable reporting capabilities including (but not limited to):

8.3.1 Total number of participants (by program, if applicable)

8.3.2 Active and inactive cards

8.3.3 Cards issued and replaced

8.3.4 Transaction-level reporting

8.3.5 Funding loads and balance adjustments

8.3.6 System access records; vendor shall comply with the Library of Virginia

Records Retention and Disposition Schedule – GS – 33 – Information Technology for system access record retention, including log retention, tamper-proof log storage, and export capabilities for SIEM integration. Logs must include full event correlation identifiers.

8.3.7 Data Retention & Deletion: Data retention shall comply with the Library of Virginia Records Retention and Disposition Schedule – GS- 02 -County & https://old.lva.virginia.gov/agencies/records/sched_local/GS-33.pdf https://old.lva.virginia.gov/agencies/records/sched_local/GS-33.pdf https://old.lva.virginia.gov/agencies/records/sched_local/GS-33.pdf https://old.lva.virginia.gov/agencies/records/sched_local/GS-02.pdf

RFP: Transportation Stipend Card Management Services

Municipal Governments - Fiscal Records. If other types of data are introduced during the period of performance that fall outside of the fiscal records category, the appropriate Library of Virginia records retention category requirements shall apply. Vendor must support verifiable deletion, including removal from backups within 30 days.

8.3.8 Fraud activity and dispute tracking

8.3.9 Financial reconciliation reports

8.3.10 Customizable reporting by department, funding source, or program

8.3.11 On-demand and scheduled automated reporting

Reports must be exportable in commonly used formats (e.g., Excel, CSV, PDF).

8.4. Project Management and Staffing

The Contractor shall:

8.4.1 Provide a dedicated implementation manager during system deployment.

8.4.2 Provide ongoing account management and technical support.

8.4.3 Provide training for City staff, including:

• Administrative system functions

• Reporting

• Financial controls

• Fraud monitoring

8.4.4 Issue new and replacement cards.

8.4.5 Provide real-time monitoring and fraud mitigation services.

8.4.6 Provide system maintenance, upgrades, and compatibility updates.

8.4.7 Return all City-owned data in a mutually agreed format upon contract termination.

8.4.8 Notify the City’s Information Technology Office and Contract Officer

Technical Representative within 1 business day of any suspected data breach, security incident, or compromise.

8.4.9 Maintain adequate cybersecurity insurance and financial liability coverage.

8.5. City Responsibilities

The City will:

8.5.1 Designate a Contracting Officer’s Technical Representative (COTR).

8.5.2 Provide timely responses to Contractor inquiries.

8.5.3 Manage and determine participant eligibility criteria

8.5.4 Determine funding amounts and benefit structures.

RFP: Transportation Stipend Card Management Services

8.5.5 Authorize balance loads and program parameters.

8.5.6 Make payments to the financial institution for approved funding loads.

8.5.7 Provide oversight and compliance monitoring.

8.5.8 Convene quarterly performance review meetings.

The City may elect to contract any portion of program administration, eligibility, customer service, or call center functions to third-party vendors. The card management Contractor must coordinate with such vendors as directed by the City.

8.6. Program Flexibility Requirement

The Contractor’s solution must be configurable to support:

8.6.1 Multiple departments

8.6.2 Multiple funding streams

8.6.3 Different benefit structures

8.6.4 Time-limited or recurring disbursements

8.6.5 Merchant-restricted or open-use cards

8.6.6 Incentive-based programs

8.6.7 Emergency assistance programs

8.6.8 Transportation or non-transportation uses

The City does not guarantee any minimum volume of cards or transactions.

8.7. Performance Standards

Performance standards will be finalized during contract negotiation but shall include, at minimum:

8.7.1 Card issuance turnaround time

8.7.2 Replacement card processing time

8.7.3 The system must support 99.9% uptime; one calendar day is the downtime tolerance. Vendor must provide load-testing evidence demonstrating system performance at projected peak usage.

8.7.4 Vendor shall maintain documented Disaster Recovery plans with Recovery Time Objective (RTO) ≤ 4 hours and Recovery Point Objective (RPO) ≤ 1.

Disaster Recovery plans must be tested annually, with results available to the City.

8.7.5 Fraud response time

8.7.6 Reporting delivery timelines

8.7.7 Implementation timeline

RFP: Transportation Stipend Card Management Services

Failure to meet agreed performance standards may result in corrective action or contractual remedies.