The file's text, extracted by GovTribe without its formatting.
Proposal Number: 68-SEAAESA0524 Vendor: _______________________________________
ATTACHMENT J: SYSTEMS REQUIREMENT WORKBOOK
| # |
| Requirement |
| Status |
| Fit/Gap |
| Comments |
Information Technology
| 1 |
| The system shall be built on a "Mobile First" front-end. |
| Must have |
| 2 |
| The system shall provide application programming interfaces (API) for ODBC, Java, HTML, etc. |
| Must have |
| 3 |
| The Vendor shall provide documentation of how the APIs are used within the proposed system. |
| Must have |
| 4 |
| The system shall allow the Authority to run an API on a schedule and/or on-demand. |
| Must have |
| 5 |
| The system shall support multiple environments (PROD, DEV, & TEST) for enhanced technical control through segmentation. |
| Must have |
| 6 |
| The system shall automate the backup of software configuration files and databases to an alternate environment at least daily. |
| Must have |
| 7 |
| The system shall provide role-based (admin, manager, general user, etc.) user authentication access for agency users. |
| Must have |
| 8 |
| The system shall provide detailed and automated systems reporting capabilities that include but are not limited to system alerts, account usage, performance metrics, etc. in multiple formats (PDF, XLSX, CSV, etc.). |
| Nice to have |
| 9 |
| The Vendor shall provide accurately written operational instructions. |
| Must have |
| 10 |
| The system shall provide automated file archiving and purging capabilities that will be configurable to align with the Authority’s retention policy. |
| Must have |
| 11 |
| The vendor shall have a documented Disaster Recovery Plan (DRP) that is tested annually. |
| Must have |
| 12 |
| The system shall encrypt data in transit and at rest. |
| Must have |
| 13 |
| The system shall enforce FIPS 140-2 approved ciphers when transmitting and storing data. |
| Must have |
| 14 |
| The system shall support TLS 1.2 or higher security protocols for all secure internet browser communications. |
| Must have |
| 15 |
| The system shall display a customizable login banner where the Authority can note acceptable use requirements to end users. |
| Nice to have |
| 16 |
| The system shall employ anti-virus software. |
| Must have |
| 17 |
| The system shall enforce the use of multifactor authentication for vendor administrators. |
| Must have |
| 18 |
| The system shall support multifactor authentication for program end users. |
| Nice to have |
| 19 |
| The vendor shall have a documented Business Continuity Plan (BCP) that is tested annually. |
| Must have |
| 20 |
| The vendor shall have a documented Data Privacy Policy. |
| Must have |
| 21 |
| The vendor shall perform security assessments of third-party companies that access Authority data. |
| Must have |
| 22 |
| The system shall provide data input validation and error messages. |
| Must have |
| 23 |
| The system shall employ a web application firewall (WAF) and protect against OWASP top 10 web threats. |
| Must have |
| 24 |
| The system shall support single sign-in protocols (SAML) for users and administer authentication. |
| Nice to have |
| 25 |
| The system shall enforce password/passphrase complexity requirements. |
| Must have |
| 26 |
| The system shall automatically lock the session or log-out an account after a period of inactivity. |
| Must have |
| 27 |
| The system shall adhere to an industry standard security framework (NIST, CIS, ISO, etc.) |
| Must have |
Portal requirements
| 28 |
| The system shall allow the Authority to manage users with security levels and user roles. |
| Must have |
| 29 |
| The system shall allow users to create user profile/passwords and security questions. The system shall provide auto password reset functionality. |
| Must have |
| 30 |
| The system shall be scalable to allow the Authority to add new programs and requirements via the UI. |
| Must have |
| 31 |
| The system shall allow the Authority to add/edit end date program attributes via the UI. |
| Must have |
| 32 |
| The system shall allow the Authority to manage/display specific tasks and timelines via a dashboard in each portal. |
| Must have |
| 33 |
| The system shall allow users to enter comments/notes at various places within each portal; the comments/notes will be supported by audit trails. |
| Nice to have |
| 34 |
| The system shall provide automated clearing house (ACH) functionality. |
| Must have |
| 35 |
| The system shall allow communications to one or more entities within and across portals. Communications will include but not be limited to chat, alerts, text messages, reminders and emails as well as allow attachments where appropriate. |
| Nice to have |
| 36 |
| The system must be compatible with the Authority’s accounting systems (Peoplesoft) and existing portals |
| Must have |
| 37 |
| The system shall provide audit trails to be displayed on the UI as well as on the tables. Audit trails may consist of date, time, username and/or add/edit/delete record status. |
| Must have |
| 38 |
| The system shall provide robust reporting functionality, including but not limited to canned & ad-hoc reporting, scheduled and on-demand reporting, the ability to report within and across programs, and the ability to auto email reports to one or more users. |
Examples: "point and shoot" query and reporting across all data bases (similar functionality, look and feel to user, downloadable in various formats (CSV, Excel, PDF, etc.)
Must have
| 39 |
| The vendor shall have a process for verifying accessibility conformance |
| Must have |