7-Attachment F - Tech and Security Requirements Innovation Challenge.xlsx
XLSX spreadsheet 25 KB Posted
- Solicitation number
- 544695
- Issued by
- Wayne County, Detroit City, Michigan
About this file
This is a Technical and Security Requirements Matrix document prepared by the City of Detroit Office of Contracting and Procurement for the Tech Innovation Challenge - AI for Municipal Code Search RFP. The document establishes technical and security specifications that vendor proposals must address, organized into two primary functional areas: General Security (44 requirements) and Cloud Checklist Questionnaire (26 requirements), for a total of 70 requirements and questions. The contract opportunity is a six-month engagement with a contract value of $50,000 to provide AI services for assisting with navigation of Detroit's rules, regulations, and municipal codes.
The General Security section requires vendors to demonstrate compliance across multiple security domains, including single sign-on capabilities with Active Directory and Azure Active Directory/SAML integration, multi-factor authentication support, encryption standards for data at rest and in transit, granular role-based access controls at multiple levels (department, division, role, user, screen, menu, report, and field), comprehensive audit trail capabilities with timestamp precision to the nearest second, and compliance certifications such as HIPAA, CJIS, and IRS Publication 1075. The Cloud Checklist section requires vendors to provide detailed information regarding infrastructure responsibilities, SOC 2 Type 2 reports, governance and compliance processes, security control framework adherence (NIST, ISO/IEC, COBIT, or ITIL), data separation in multitenant environments, network security architecture, backup and media sanitation procedures, and system environment availability. Vendors must indicate whether requirements are met with standard features (C), met with alternative approaches (A), or not met (N) in their proposals.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Table of Contents
| Table of Contents | ||
| Tab No. | Functional Area | Number of Requirements / Questions |
| 1 | General Security | 44 |
| 2 | Cloud Checklist Questionnaire | 26 |
| Total Requirements + Questions: | 70 |
1. Security
| ATTACHMENT F - REQUIREMENTS MATRIX | ||||
| RFP Name & RFP # _________ | Enter vendor name here | |||
| Available Responses | ||||
| C | Requirement Met and Proposed (Standard features available in the product) | 0 | ||
| A | Intent of Requirement Met and Proposed with Alternative | 0 | ||
| N | Requirement Not Met with Proposal | 0 |
TOTAL 0
| Req # | Function | General Security Requirement | Vendor Response | |
| (C, A, N) | Comments | |||
| 1 | SSO | The system has the ability to utilize the City's Active Directory user validation to achieve single-sign-on, regardless of deployment method. | ||
| 2 | AD integration | The system has the ability to inherit groups from Active Directory for application authentication. | ||
| Multi Factor Authentication | The system has the ability to support Multi Factor Authentication (MFA) | |||
| 3 | SAML | The system has the ability to utilize the City's SAML Authentication (Azure Active Directory) for user validation to achieve single-sign-on, regardless of deployment method. | ||
| 4 | SAML | The system has the ability to map SAML groups or App roles from Azure Active Directory for application permissions . | ||
| 5 | Password Encryption | The system has the ability to store passwords in encrypted form, if applicable. | ||
| 6 | Encryption | The system has the ability to encrypt data stored in the database. | ||
| 7 | Encryption | The system has the ability to encrypt data stored in the application. | ||
| 8 | Encryption | The system has the ability to encrypt data in transit. | ||
| 9 | Encryption | Please provide information as to what level of encryption/encryption methods are used in transit and at rest. | ||
| 10 | Role based security | The system has the ability to provide read, write, update, and delete access using role based security. | ||
| 11 | Role based security | The system has the ability to provide security at the following levels: | ||
| 12 | Role based security | Department or Agency; | ||
| 13 | Role based security | Division; | ||
| 14 | Role based security | Role or group; | ||
| 15 | Role based security | User ID; | ||
| 16 | Role based security | Screen; | ||
| 17 | Role based security | Menu; | ||
| 18 | Role based security | Report; | ||
| 19 | Role based security | Field; | ||
| 20 | Role based security | The system allows for departmental administrative self-service (e.g. ability to make changes to roles and workflows) with audit trail capability. | ||
| 21 | Role based security | The system has the ability to update all user profiles automatically (user discretion) when a change in their role (s) is/are made. | ||
| 22 | Role based security | The system has the ability to allow a City system administrator to add and change permissions for system access. | ||
| 23 | User Groups | The system has the ability to establish, deactivate, and archive user groups. | ||
| 24 | User Groups | The system has the ability to delete user groups that do not have historical data, with an audit trail. | ||
| 25 | City Administration | The system allows for departmental administrative self-service (e.g. ability to make changes to roles and workflows) with audit trail capability. | ||
| 26 | Compliance | The system is HIPAA compliant and vendor will enter into a BAA with the City. | ||
| 27 | Compliance | The system is CJIS compliant | ||
| Compliance | The system is IRS Publication 1075 compliant | |||
| 28 | Compliance | The system meets compliance rules / regulations in order to ensure the sensitive digital assets are guarded against loss, theft and misuse | ||
| 29 | Compliance | The system is compliant with applicable compliance regulations. | ||
| 30 | Security Certifications | Please list any industry standard security certifications the solution / vendor has. (Ex: ISO 27001). |
Please note annual SOC 2 type reports will be required via the City’s contract.
| 31 | Audit Capabilities | The system has the ability to track and audit changes throughout the system that creates a log of all records maintained and includes: |
| 32 | Audit Capabilities | Date; |
| 33 | Audit Capabilities | Time; |
| 34 | Audit Capabilities | User; |
| 35 | Audit Capabilities | Information prior to change; |
| 36 | Audit Capabilities | Changed information |
| 37 | Audit Capabilities | The system has the ability to allow the audit trail to have a date/time stamp to the nearest second. |
| 38 | Audit Capabilities | The system has the ability to allow a City system administrator to configure the duration that time audit logs are retained (e.g. 90 days). Proposer to describe how this feature works. |
| 39 | Audit Capabilities | The system has the ability to provide customizable audit reports. |
| 40 | Access Time Out | The system has the ability to log users off the system after an administrator-defined period of inactivity, based on user-defined roles. |
| 41 | Access Time Out | The system has the ability to allow a system administrator to log out users. |
| 42 | Security | The system has the ability to allow authorized users to have access to a log of security activity to determine users that have signed on and off the system, as well as unsuccessful attempts to sign on to the system. |
| 43 | Security | The system has the ability to scan attached files for viruses, malware, or other cybersecurity threats (vendor to specify capability for using City preferred anti-virus solutions). |
| 44 | API | The system has the ability to support API's (Application Programming Interface) for third-party system integration, imports, and exports of data. |
2. Cloud Checklist
ATTACHMENT F - REQUIREMENTS MATRIX
RFP Name & RFP # _________
| Cloud Service Provider Security Checklist | ||
| Please provide an answer or statement to all issues listed | ||
| Enter vendor name here | ||
| Prompt # | Topic | Vendor Response |
| 1 | Describe who is responsible uptime, maintenance, patching and administration of the server. | |
| 2 | The provider must show diagram (and possible past examples) of their governance and notification processes for their services. | |
| 3 | Describe how the provider will guarantee legal and regulatory compliance with government and sectorial (industry specific) laws and regulations. | |
| 4 | Does the solution follow one of the following sets of security and privacy control best practices? Indicate which. | |
| 4a | NIST Series | |
| 4b | ISO/IEC Series | |
| 4c | COBIT | |
| 4d | ITIL | |
| 5 | The vendor will provide to the City, at no additional cost, the most recent SOC 2 Type 2 report from its cloud hosting provider covering the environments used by the City. | |
| 6 | Describe process for Account Management | |
| 7 | Define who is responsible for security monitoring. If the City will be responsible for securing the environment, describe how the City will obtain logs to ingest into its SIEM. | |
| 8 | Describe how a data inventory of City of Detroit Data Assets will be kept. | |
| 9 | Will subcontractors be used? If yes, will all security controls be inherited by subcontractors? | |
| 10 | Describe Public Key Infrastructure | |
| 11 | Process for separation of data belonging to different consumers in a multi‐tenant environment. | |
| 12 | Does the solution use a private, shared or hybrid cloud? | |
| 13 | Process used to separation of network traffic in a shared multi‐tenant provider environment | |
| 14 | Statement guaranteeing adherence to all privacy laws governing the physical areas of data storage. | |
| 15 | Willing to participate in a Risk Assessment and Privacy Impact Assessment covering the storage of PII. | |
| 16 | Network traffic must be screened and firewall protected network must have intrusion detection & prevention in place. | |
| 17 | Network must have detailed logging and documented alerting capabilities. | |
| 18 | Dedicate VLANs with dedicated virtual firewall. | |
| 19 | Describe how the City of Detroit network access separated from provider network access. | |
| 20 | Are the City of Detroit VMs are on a dedicated hypervisor? | |
| 21 | Will provider's servers only communicate with the City of Detroit logical disk units? | |
| 22 | Will online storage and backup media be scrubbed when retired or replaced? | |
| 23 | Identify system environments that will be available to the City (e.g. production, development, test) | |
| 24 | Identify shared components of the system (e.g., network segments, backup tapes, etc.) | |
| 25 | Identify Data storage and transfer limits | |
| 26 | Identify normal and peak bandwidth requirements |
File details come from the government source that posted it. Updated .