74330226R0044 Attachment 2 Questions Matrix.xlsx
XLSX spreadsheet 46 KB Posted
- Attached to
- ABMC Human Resources Information System
- Solicitation number
- 74330226R0044
- Issued by
- Not on record
About this file
This file is a comprehensive Questions Matrix used as an attachment to the ABMC Human Resources Information System solicitation (74330226R0044). It functions as a detailed requirements questionnaire that vendors must address to demonstrate their system capabilities across multiple functional domains.
The matrix is organized into four major sections totaling approximately 200+ specific questions. Section 1 covers Human Capital Management Functionality with 16 subsections including Organizational Charts, Remuneration, Absence Management, Pension Benefits, Positions/Jobs, Employment Purposes, Onboarding, Document Management, Reporting, Manager Self-Service, International Dimension, Recruitment, Talent Optimization, Platform Administration, Reporting and Analysis, and Access Control. Section 2 addresses Support Services with inquiries regarding support center accessibility, staffing experience, customer satisfaction metrics, and availability during and after implementation. Section 3 covers Professional Services including Deployment Methodology, Data Conversion, Training, Documentation, Customer Success, Update/Upgrade Support, with questions about implementation timelines, team composition, and testing procedures. Section 4 focuses on Technology across 15 subsections encompassing Data and Interoperability, Data Residency and Sovereignty, Security Controls, Zero Trust Architecture, Privacy Controls, Accessibility, Records Management, Cloud and Hosting, Workflow and Internal Controls, Application Specifications, Audit and Traceability, Performance and Service Levels, Migration and Transition-In/Out Requirements, Architecture, Extensibility, Integration, Workflow Services, Corporate Security, Application Security, and Reporting and Analysis capabilities.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 74330226R0044-45 Vendor Questions.xlsx | XLSX spreadsheet | |
| 743302226R0044 Attachment 3 Payroll ITS File Specifications.pdf | ||
| 74330226R0044 RFP Instructions.pdf | ||
| 74330226R0044 Attachment 1 HRIS PWS.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| 1. Human Capital Management Functionality | Comment/Answer |
| 1.1 Organizational Charts | |
| A. How does your system configure organizational structures by country, division, location, functional groups (for example, the Enterprise group includes finance, accounting, legal, and human resources), or departments? | |
| B. Describe how your system handles reorganizations. | |
| C. Describe the options for tracking hierarchical history and the features for viewing history. | |
| D. Is it possible to run an organization report and view it as an organizational chart? | |
| E. Can a supervisor generate and print an organizational chart of his or her group? | |
| F. Is it possible to represent the different types of subordinate relationships in the flowchart as a solid line or a dashed line? | |
| G. Is it possible to create organizational charts and reports on the workforce according to different criteria (for example, regional rather than functional, etc.)? Is an index created to describe what appears in the flowchart? | |
| H. Can an organizational chart be executed on a specific effective date? Does the principle of role-based security apply to the display of future organizational charts? | |
| I. What options are available for workforce reporting and total workforce calculation? | |
| J. Does the system provide a summary of employees including fields such as date of hire, job designation, job code, supervisor, salary, department, etc.? | |
| K. Describe the data model planned to support reporting and analytics for human resource allocation, alignment, equity, and deployment? | |
| L. Explain the process for creating a workforce report for the different categories listed above. What does the user with the role of "Controller" have to do to achieve the expected result? What are the limitations/barriers to generating such a report and how long does it take to generate the data (e.g., 2 seconds, 2 minutes)? | |
| M. Explain how an organizational chart is executed. Is this an internal process of the system or does it require data to be exported using third-party software? If so, what software is supported? | |
| N. How are mass reorganizations managed? Are there any limits for an international company? If so, describe them. | |
| O. How do I create new cost centers or divisions? How long does it take to create a new entity? | |
| P. Is it possible to assign different organizational roles to different types of organizations, such as departments or geographically grouped organizations? | |
| Q. What organizational structures does your company support? How easy is it to deal with reorganizations? | |
| 1.2 Remuneration | |
| A. Provide an overview of the key compensation features of your system. | |
| B. How are compensation functionalities integrated with HRIS and payroll functions? | |
| C. Explain how your system creates and maintains salary history. | |
| D. What types of reports are available for compensation? | |
| E. Explain how your system calculates, displays and reports information from comparative ratios and/or quartiles. | |
| F. How does the system manage the payment of bonuses/awards? | |
| G. Describe how your system handles severance pay and other discretionary compensation. | |
| H. Explain how salary changes are entered into the system, including how bulk salary changes are made across a country or a job series. | |
| I. Describe how changes in salary are handled mid-period. | |
| J. Describe your functionality to support the review of compensation by integrating the international dimension. | |
| K. Is it possible to perform online compensation modeling? | |
| L. Is it possible to combine compensation criteria based on multiple elements such as job, location or division? | |
| M. Is it possible to use compensation data during the hiring process of an employee? | |
| N. Explain how the system allows managers to plan salary increases online, process approvals through the workflow, and automatically apply increases on the effective date. | |
| O. Explain how annual merit increases are handled in your system. | |
| P. Does your system validate the minimum and maximum wage (pay level) when pay is changed, and does it send a warning message if necessary? | |
| Q. Describe how salary ranges/levels are defined in the system, levels assigned to positions and positions assigned to employees. | |
| R. Describe how to make changes to salary ranges/levels in the system and the impact of these changes on the positions and the employees assigned to those positions. | |
| S. Explain how the same job may have different salary ranges depending on the place of work. | |
| T. Provide a sample total compensation report that employees can view in self-service and/or print. | |
| U. Does the solution support the pay-based management functionality used by certain countries such as Italy, Belgium, and France that have many laws or collective agreements, guaranteed fixed amounts or government and compliance regulations? | |
| V. Describe how clients can associate performance with compensation. | |
| 1.3 Absence Management | |
| A. How are absences identified and processed in the system? | |
| B. Describe how the system updates the history of long-term absences and hours used, including multiple absences over a continuous 12-month period, so that the leave does not exceed the maximum allowed. | |
| C. Describe how your system monitors employee compensation in terms of absences. | |
| D. Describe the process for collecting contributions to employee benefit plans when employees are on leave without pay. | |
| E. How are absent employees notified of open enrollments and how are benefits options handled? | |
| F. Can the system calculate leave accrual based on start date, company policy, and standard accruals, and upload the days to the employee file? | |
| G. Can the system support different levels of accruals based on hours worked in the previous year and seniority? | |
| H. Describe how the system calculates accumulated paid absences. Can it support different types of absence accounts (e.g., paid absences, vacation, sick or personal leave, etc.)? | |
| I. Can managers and employees view the absence of rights they have acquired, and the absences used in self-service? | |
| J. Can employees submit absence requests via self-service? Do absence requests follow the workflow set by the employer for review and approval/rejection by managers? | |
| K. Is it possible for managers and employees to calculate future cumulations on the basis of a given date? | |
| L. When a request is submitted online by an employee, does the system automatically validate it based on the employee's future balance of available absences? | |
| M. Does the system create an automated review if an employee takes additional leave before approved for future absences? | |
| N. Is it possible to replace/modify system-generated leave entitlements? | |
| O. Can an employee's absence balance be automatically reset to zero at the end of employment? | |
| P. Does the system allow for cascading absences to be defined and an employee's absence type to be automatically changed to another absence type when the absence balance is exhausted or from any other key date? For example, going from an absence for personal reasons to a short-term absence, then to a long-term absence. | |
| Q. Does the solution allow you to display the absences of an entire team in a single view? | |
| R. Can an employee make a request for absence that can be converted into other types of absence in order to use the balance of the various absence regimes to satisfy the absence request? | |
| S. How does the system handle leave balances (compensatory time or travel compensatory time) that have an expiration date? | |
| 1.4 Pension benefits | |
| A. Present the features of your system related to pensions. | |
| B. Describe how the system manages the number of years of seniority for re-hires and interruptions. | |
| C. Explain how your system tracks the payment of pensions to terminated employees | |
| D. Describe how the system manages the number of years of service. | |
| E. Does your system provide the ability to determine whether a re-employed person has already received a pension and, if so, the date of payment? | |
| F. Does your system allow you to calculate the amount of employer contributions per member? | |
| G. What types of information did you provide to third parties regarding changes of address, termination of employment, etc.? | |
| H. Explain how your system handles the maximum annual contribution amounts allowed by the IRS and how these amounts are changed. | |
| I. How are "catch-up" contributions covered by the system? | |
| 1.5 Positions/Jobs | |
| A. Describe the process for creating a job application. | |
| B. Describe the process for creating a job/position. | |
| C. Does the system track the number of employees and the full-time equivalents (FTEs) associated with positions? | |
| D. Is the history of changes to employee shift assignments unlimited? | |
| E. Is the history of changes in employee compensation unlimited? | |
| F. Does the system maintain standard job information, including job designation, location, supervisor, work periods, status, etc.? | |
| G. What rules does the system use to calculate full-time equivalents (FTEs)? Can we define what a “full-time equivalent” means, taking into account that different countries have different hours in a work year? | |
| A. Can the system calculate job turnover rates based on different categories (e.g., division, region, site, department, voluntary/involuntary departure, number of years of service, etc.)? | |
| H. Does the system manage vacancies and staffing positions (operational planning) in the same solution? | |
| I. Do you use AI (Artificial Intelligence) to create Position Descriptions? | |
| 1.6 Purposes of Employment | |
| A. Describe the employer-configurable termination workflow and how it supports the termination of employment for employees. Is there only one tool to run business processes? | |
| B. Can the system track terminations by reason (for example, dismissal, resignation, incapacity) by indicating effective date, last day worked, eligibility for re-employment. | |
| C. Can the termination workflow be different depending on the reason for termination or other termination criteria? | |
| D. Does the system keep the departure maintenance information up to date? | |
| E. Can the system automatically cancel an employee's benefits when their employment ends? | |
| F. Can the system notify the relevant departments of the organization (security, payroll, IT, accounting) that the employee's employment has ended? | |
| G. Describe how your system can trigger post-payroll events for employees whose employment has ended (for example, terminating access to HRIS, disabling building access cards, removing PINs for bank transfers, etc.). | |
| H. Can the system track temporary layoffs and provide alerts when there is an urgent need to make a decision on whether to terminate a contract? | |
| 1.7 Onboarding | |
| A. Quickly present your onboarding solution. | |
| B. Does the solution allow newly hired employees to update their work profile in the system? | |
| 1.8 Document management | |
| A. Describe how the system enables the distribution of documents and the tracking of acknowledgment status via electronic signatures. | |
| B. Does your product support e-signatures? | |
| C. Does the system offer a functionality of employment contracts for use in countries where employees generally work on fixed-term or permanent contracts? | |
| 1.9 Reporting | |
| A. Provide an example of your standard reports. | |
| 1.10 Manager self-service | |
| A. Describe the features available in Manager Self-Service. | |
| B. Describe the integration between your manager self-service application and your HRIS/payroll system. | |
| C. Describe the level at which access to information can be controlled (for example, at the page level, at the field level, etc.). | |
| D. Do managers have access to all employee self-service features? Please elaborate. | |
| E. What employee data can managers NOT access and how much control does our organization have over this? | |
| F. Can managers run reports from self-service? What is the procedure? | |
| G. Explain how managers can create and save their own reports. | |
| H. What limitations might a system administrator face in monitoring employee or manager self-service in a hosted environment? | |
| I. What does the view of the manager's direct reports look like? | |
| J. In how many languages is manager self-service available? | |
| 1.11 International dimension | |
| A. What are the specific features of your system for supporting international languages and currencies? | |
| B. Does the system maintain a globally unique identifier? | |
| C. Does your system allow you to define standard job profiles and compensation packages based on local employment data to compare employment and labor costs around the world? | |
| D. Does your system allow you to display team pay in a single currency while suggesting bonuses or merit pay amounts in each employee's local currency? | |
| E. Does your system allow the end user to view transactions in both the local and reference currencies in business processes, custom reports, and the employee profile? | |
| F. Does the system allow for the creation and allocation of an unlimited number of compensation plans and allowances based on international and/or local requirements? | |
| G. Does the system allow for monitoring and comparison of country-specific diversity data? | |
| H. Does your system track international postings? | |
| 1.12 Recruitment | |
| A. How does the solution support tracking item requests throughout their lifecycle (pending, approved, open, closed, canceled, blocked)? | |
| B. Does the solution allow us to know if a request corresponds to an item with a budget? | |
| C. Does the solution allow you to set due dates for filling a position and send notifications if these dates are not met? | |
| D. Can the solution automatically route to multiple approvers for each request? | |
| E. Can the solution source candidates in-house? (Explain how this works.) | |
| F. Does the solution allow candidates to be assigned to specific pools or portfolios of candidates? | |
| G. Does the solution allow you to assign and update the start date of a new recruit, which feeds into the HR file? | |
| H. Does the solution allow external and internal job postings to be separated in order to tailor the advertisement to a specific audience? | |
| I. Is the solution optimized for mobility and tablets? | |
| J. Does the system allow for easy capture of interview minutes and notes taken during contacts with candidates? | |
| K. Is there a separate process for current employees applying for a posted job opening? Does the workflow notify their current supervisors? Are candidates flagged in the system so recruiters know they are internal candidates? | |
| L. What does an internal candidate need to provide to apply for a job? | |
| M. Does the recruitment solution allow for resume analysis? | |
| N. Can we post jobs on non-company sites? Please details on which site for each country listed on the RFP. | |
| 1.13 Talent Optimization | |
| A. Do you have tools to facilitate internal mobility? | |
| B. How does the solution support an agile team structure? | |
| C. How can employees identify one-time assignments and short-term opportunities? | |
| D. Does your system offer the ability to manage a skills library in the cloud? | |
| E. What do you offer to support the continuous development of employees and retain them? | |
| F. Does the system maintain information on performance evaluations, including evaluation history, overall evaluation scores, evaluation schedules, and approvals? | |
| G. Does the system support multi-evaluator or 360-degree evaluations? | |
| H. Is it possible to have multiple evaluation forms for each type of employee and automatically associate the manager with the correct form? | |
| I. Is it possible to keep an unlimited history of performance reviews? | |
| J. Is there a configurable workflow for completing and submitting performance reviews online, looking for employee feedback first, then feedback from their manager, and working your way up the approval hierarchy to HR and payroll for processing? | |
| K. Does the system track where the assessment process is at? | |
| L. Does the system support performance and/or talent calibration? | |
| M. Is it possible to set targets for employees outside the appraisal process? | |
| N. How are the organization's goals associated with an employee? | |
| O. Is it possible to monitor the results of the performance appraisal? If so, can these evaluation data be tracked separately from merit pay increases? | |
| P. Can completed performance appraisals be attached to the employee's file? | |
| Q. Is the information related to the evaluation available to feed into an ongoing analysis of employees? | |
| R. Can an in-house developed performance management system (hosted on the extranet) be integrated into your HRIS? | |
| S. Describe your ability to capture talent-related information. | |
| T. Is there a space to store employees' personal reporting information that can be used for talent planning? | |
| U. Does the system allow a manager to assess the potential, risk of departure and the impact of leaving his entire team from a single screen? | |
| V. Describe how clients can manage their succession plans. | |
| W. Is it possible to view succession plans in a hierarchical view? | |
| X. Can the details of succession plans be displayed for an entire organization? | |
| Y. What types of reports are available for succession planning? | |
| Z. Describe how clients can search their employee population for those who meet a specific set of criteria or skills? | |
| AA. Explain how your solution supports career development plans, taking into account the employee's aspirations and interests, career paths, level of preparation, and development needs. | |
| 1.14 Platform Administration and Features | |
| A. Is it possible to carry out continuous and unlimited surveys throughout the year if/when necessary, and at what additional cost? | |
| B. Can schedules be set to automate the pace of investigations, or does everything have to be done manually? | |
| C. Does the whole organization have to share the same investigation schedules or can it be decided locally? | |
| D. Is it possible to survey blue-collar and white-collar workers digitally and does it involve an additional cost? | |
| E. How long does it take for directors, managers, and senior leaders to make quantitative and qualitative analyses available? | |
| F. What are the possibilities for querying data in the different layers of the organization and do boundaries apply? | |
| G. What is your experience in supporting the digital transition of organizations like ours and in a more regular approach to engagement? | |
| H. How will your company help us understand the impact of our people's data on other key business metrics? | |
| I. What happens when an employee changes cost center or legal unit in the middle of a month or year? | |
| J. How many pre-configured business processes are provided when HRIS is installed? | |
| 1.15 Reporting and Analysis | |
| A. Describe the feedback analytics capabilities you offer and how high-risk feedback can be identified in your Employee Engagement solution. | |
| B. How does your solution track employee engagement through the different phases of the company's lifecycle (e.g., onboarding and offboarding)? | |
| C. How do you ensure security when transferring employee data and GDPR compliance? | |
| D. Please describe the process for our organization to access the database in order to query it or extract data | |
| E. Describe how managers' access is limited to the information of their direct reports. | |
| 1.16 Access Control | |
| A. Describe the flexibility of access control/permissions granted to different user groups. | |
| B. Can I make retroactive changes on the platform (absences, promotions, etc.)? Describe the steps you need to take to do this. | |
| C. Can the system Integrate Azure Entra ID SSO to allow system users to use authentication tokens from the ABMC.gov M365 environment? |
| 2. Support Services |
| A. How can ABMC reach your support center? |
| B. Is unlimited service included? |
| C. What is the level of experience of your customer service and technical support staff? What is the average length of service in your support services? |
| D. What metrics do you use to measure customer satisfaction? Ask current users how they feel about the quality of your support, and if so, how often? Please send us your most recent report. |
| E. Is technical support and customer service permanent or only available for a limited period of time after implementation? |
| F. What is the turnover rate of your customer service and technical support staff? |
| G. Describe the support service you provide during implementation and after implementation, whether customer service or technical support. |
| H. Describe the security measures you implement when receiving phone calls. |
| I. How many support centers do you have and where are they located? |
| J. Is technical support available to perform maintenance and repair operations online and/or on-site? |
| K. Do you have tools to troubleshoot and provide remote support? |
| 3. Professional Services |
| 3.1 Deployment Methodology |
| A. Describe your approach to deployment. What is your approach to effectively managing the implementation process? |
| B. Can you describe the typical project implementation team (implementation, customer service, training, common tasks, etc.) and the experiences, roles, and responsibilities within this team? |
| C. Identify the person ultimately responsible and the person to contact in the event of a conflict between the project manager and our organization. |
| D. Describe the project management tools typically used during your deployments (work plans, meetings, conference calls, progress reports, workflow flowcharts, problem logging and resolution, personnel management, etc.). |
| E. How long does it usually take to deploy a product? |
| F. What support will be provided for system deployment and customization? |
| G. Describe your testing procedure, including test types, variance resolution methods, and criteria to ensure comprehensive testing. |
| H. Confirm that you have the appropriate team available and engaged with our organization throughout this period to ensure a successful and timely deployment. |
| I. What is the average time it takes to integrate the acquired company's data? |
| J. What do you offer to help us during the initial phases of deployment? |
| K. How do you ensure that the process from failover to production is well planned and coordinated as part of the project rollout? |
| L. What governance model do you use to validate the transition from one stage of deployment to the next? |
| 3.2 Data Conversion |
| A. Describe the data conversion process in detail. Describe how existing history is extracted and imported into your system during conversion. |
| B. Does the system allow the import of initial data? Describe the types of data that can be imported. |
| C. What kind of support do you provide during the conversion process? |
| 3.3 Training |
| A. Who will conduct the training and what is the level of expertise and experience of the trainers? |
| B. What changes do you foresee for your training offer over the next two years? |
| C. Where do your training courses take place? Online, in presence or webinars ? |
| D. Do you provide manuals or other technical guides? If so, do they contain screenshots and examples? |
| E. How long does it take for an end user (or trainer) to be trained in your solution? |
| F. Do you offer more advanced training on more complex topics or for teams that use more system components? |
| 3.4 Documentation |
| A. What documentation is available within your system? |
| 3.5 Customer Success |
| A. Do you offer help sessions, webinars, seminars, or conferences for users? If so, when, where and how often do they take place? |
| 3.6 Support for Updates/Upgrades |
| A. How often do you release new releases? |
| B. What is the migration process when upgrading to a new version? Do you provide consulting services? What is the average delay? Is our organization forced to upgrade to the new version, or can we set our own pace of upgrade? |
| C. If specific configurations have been defined at the system level, how are they supported when upgrading to the new version? |
| D. How does the upgrade process impact personalization? |
| E. What is the cost of new versions? |
| F. What is the testing process for new versions? Is there a fully functional sandbox environment where we can test updates and changes to the system? |
| G. Are there any additional costs associated with upgrades? How much does your annual maintenance plan cost? |
| H. How and when do you notify customers of upcoming upgrades or enhancements? Do you give our users enough time to familiarize themselves with the upgrades, communicate with their employees and train them? |
| 4. Technology | ||
| 4.1 Data and Interoperability | ||
| A. Please describe data structure, supported standards and formats, and export/import formats? | ||
| B. Does the system support industry-standard data feeds for personnel and payroll data? Please list supported feed types and protocols. | ||
| C. Which third-party Human Resources Managed Payroll solutions do you currently have a "standard" interface with, and which new vendors do you plan to include in your standard product line? | ||
| D. Does the system provide auditable data lineage, allowing traceability from source transactions through outbound reporting? Please explain how lineage is tracked and audited. | ||
| E. Does the system provide APIs or secure batch interfaces to integrate with: | ||
| • | Payroll systems | |
| • | Identity management platforms | |
| • | Time and attendance systems | |
| • | Reporting tools | |
| • | Please describe supported integration methods and security controls. | |
| 4.2 Data Residency and Sovereignty Controls | ||
| A. Where are the HR data, backup and logs physically stored? | ||
| B. Does the system incorporate controls on unauthorized cross-border access, data transfer and replication? | ||
| 4.3 Security Controls | ||
| A. Does the system implement role-based and attribute-aware access control? Please describe how roles and attributes are defined and enforced. | ||
| B. Does the system require multi-factor authentication (MFA) for both privileged and non-privileged remote access? | ||
| C. Does the system enforce least privilege and separation of duties across HR, payroll, and administrative functions? Please provide examples. | ||
| D. Is data encrypted in transit and at rest? Please specify encryption standards used. | ||
| E. Does the system provide centralized logging, audit trails, and alerting for security-relevant events? | ||
| F. Does the system support vulnerability scanning and patch management? Please describe cadence and responsibility. | ||
| G. Are secure configuration baselines documented and maintained? | ||
| H. Does the system enforce session timeouts and reauthentication controls? | ||
| I. Does the system support privileged access monitoring? Please describe monitoring and alerting mechanisms. | ||
| J. Does the system provide backup, recovery, and continuity capabilities? Please specify RTO/RPO options. | ||
| K. How are development, test, and production environments segregated? | ||
| L. Can production data be copied to non-production environments? If that is the case please describe how the data is anonymized/masked and the process of approving and performing the environment refresh. | ||
| M. Are all interfaces and APIs secured and authenticated? Please describe authentication methods. | ||
| N. Does the system comply with NIST SP 800-63-4 for identity proofing, authentication, and federation? | ||
| O. Can you provide the Software Bill of Material (SBOM) of the system? Please detail any third party dependencies. | ||
| P. Can you provide the vulnerability disclosure policy and timeline? | ||
| 4.4 Zero Trust and Network Access | ||
| A. Does the system support a Zero Trust operating model, where access decisions are based on identity, device, session, and context rather than network location? Please describe the model and roadmap. | ||
| B. Does the system support modern federation, conditional access, encrypted traffic, and strong segmentation between application tiers and administrative paths? | ||
| 4.5 Privacy Controls | ||
| A. Does the system incorporate privacy-by-design principles? | ||
| B. Does the system support: | ||
| • | Data minimization | |
| • | Purpose limitation | |
| • | Field-level visibility restrictions for sensitive data |
Please describe how these are implemented.
| C. Does the system support consent and notice handling, where applicable? | ||
| D. How does the system facilitate access to information in the context of GDPR or Privacy Act requests? | ||
| E. Are disclosures and data sharing events logged? | ||
| 4.6 Accessibility | ||
| A. Does the system conform to Section 508 accessibility requirements? | ||
| B. Is accessibility testing conducted throughout the software development lifecycle and after major changes? | ||
| 4.7 Records Management | ||
| A. What is the retention policy applied to payroll records? | ||
| B. Does the system support the items below? | ||
| • | Designation of official record copies | |
| • | Metadata preservation | |
| • | Retention and disposition controls | |
| • | Legal hold capability | |
| C. Can records be exported in usable, non-proprietary formats? | ||
| D. Does the system provide auditability of record changes and destruction events? | ||
| E. Does the system support portability to enable transition to a new platform? | ||
| F. Are linked artifacts (approvals, attachments, notices) retained with the official record? | ||
| G. Does the system support records retention durations required by U.S. federal regulations and longer local-country requirements where applicable? | ||
| 4.8 Cloud and Hosting | ||
| A. If cloud-hosted, is the system Fedramp (FedRAMP | FedRAMP.gov) certified? | ||
| B. Describe how the system meets NIST SP 800-53 rev5 security baseline controls? | ||
| C. Is a documented shared-responsibility model provided? | ||
| D. Does the system provide tenant isolation? | ||
| E. Are disaster recovery objectives contractually defined? | ||
| F. Does the system provide data extraction rights upon transition or termination? | ||
| 4.9 Workflow and Internal Control | ||
| A. Does the system support configurable workflows based on: | ||
| • | Delegation of authority | |
| • | HR servicing office structure | |
| • | Supervisory chain | |
| • | Legal review requirements | |
| B. Does the system enforce or flag incompatible role combinations and support compensating controls? | ||
| 4.10 Application Specifications | ||
| A. Do you support custom fields and interfaces? The Agency needs to be able to enter a specific rate of exchange at the time of payroll disbursement. How can the system be customized to accommodate this functionality? Please refer to Appendix II and III. | ||
| B. Is the Application User Interface following a Responsive Design? | ||
| C. Is the Application supporting Edge, Safari and Chrome browsers? | ||
| 4.11 Audit and Traceability | ||
| A. Does every payroll transaction include a complete audit trail, showing: | ||
| • | Who initiated, viewed, modified, approved, rejected, transmitted, or deleted the action | |
| • | Timestamps | |
| • | Before/after values for key fields | |
| B. Are audit logs tamper-resistant and exportable? | ||
| 4.12 Performance and Service | ||
| A. Does the system support 99.9% or better production availability, excluding approved maintenance? | ||
| B. Are RTO and RPO targets defined? | ||
| C. Are response-time targets defined? | ||
| D. Does the system support defined batch processing windows for nightly interfaces? | ||
| E. Is the architecture scalable to accommodate growth? | ||
| F. Does the system provide monitoring for interface failures and transaction reconciliation? | ||
| G. Are release management and regression testing processes documented? | ||
| H. How is the system architected to respond to peak scenarios such as payroll cut-offs, mass-updates, country-wide regulatory updates? | ||
| 4.13 Migration and Transition-In | ||
| A. Does the solution and project plan support: | ||
| • | Data mapping and cleansing | |
| • | Validation and conversion rehearsal | |
| • | Document migration | |
| • | Parallel testing | |
| • | Interface cut-over | |
| B. Does the system preserve legal and audit integrity of historical personnel actions, attachments, and approvals? | ||
| 4.14 Transition-Out Requirements | ||
| A. How will the contractor support an orderly and secure transition of services, data, documentation, and operational knowledge upon contract expiration or termination? | ||
| B. Does the contractor maintain a Transition-Out Plan that can be activated at the client’s direction? | ||
| C. Can all client data be exported in complete, usable, and documented formats? | ||
| A. Do data exports support the following requirements? | ||
| • | Use non-proprietary formats | |
| • | Include data dictionaries | |
| • | Preserve data relationships and referential integrity | |
| • | Support bulk export of all records | |
| A. Will tools or scripts required to import data into a successor system be provided? | ||
| B. Will complete and up-to-date documentation be provided prior to transition completion? | ||
| C. Will structured knowledge transfer be provided to client personnel or a successor contractor? | ||
| D. Will full operational support continue until transition is confirmed successful? | ||
| E. Will full security and privacy compliance be maintained throughout transition-out? | ||
| F. Will a Certificate of Data Destruction be provided after decommissioning? | ||
| 4.15 Architecture | ||
| A. Please provide an overview of your system architecture. | ||
| B. Describe Your Software Development Lifecycle. | ||
| C. Describe the level of integration between all the modules you offer to our organization. | ||
| D. Support for Effective Date Transactions, Both Future and Past. | ||
| E. What are the hardware, software, and network requirements to run the web-based system? | ||
| F. Is it possible to use the hardware on which we already run our applications? If so, what upgrades do you think are needed? | ||
| G. Does the web-based system work on both Mac and PC? | ||
| H. Please list compatible web browsers: Microsoft Edge, Google Chrome, Windows Internet Explorer, Safari, Mozilla Firefox, others? | ||
| I. Do you offer your products with a license, in a hosted environment, in SaaS, or all three? | ||
| J. Can your web system meet the needs of our growing employee population? Is there a maximum limit to the number of employees that can be added to the HRIS? | ||
| K. How configurable is your web system? Can customizations interfere with future upgrades? | ||
| L. Please describe the data transfer process for ongoing changes throughout the year. Our organization would like to ensure that it will not be necessary to re-enter the data into different systems. | ||
| M. If our data is hosted on your servers, will our organization retain ownership of it? Will we be able to download and/or migrate them at any time (i.e. change providers)? Is it free? | ||
| N. Please describe the online processing and the frequency of data refreshes. Is performance real-time or are trades generated via a batch process? If it is a combination of both, please indicate which functions are performed in batches, in real-time, or both at the same time. | ||
| O. How are post-dated employee maintenance transactions handled until their effective date? | ||
| P. Can pending transactions be displayed online? How can they be changed or deleted? | ||
| Q. How is the flow of transactions through the system tracked in audit reports? Is all customer data audited by default? | ||
| R. How is history stored? In the database or on a separate file? | ||
| S. What is the maximum size of the history that the HRIS can store? How do I delete historical records from the employee file to save space? | ||
| T. Is the web-based system accessible 24/7? From anywhere? | ||
| U. Can your system take advantage of mobile and/or GPS-enabled devices? Describe the types of transactions and reports that are supported. How is security ensured for mobile access? | ||
| V. Outline your mobile strategy/technology. | ||
| W. Is it possible to submit/approve charges via a mobile device? | ||
| X. Is it possible to attach the image of a receipt (photo or scan) from a mobile device? | ||
| Y. Please list the mobile applications available to support your solutions. | ||
| Z. What open source software is included with your solution or needed to run your solution? Is it necessary to download software to users' computers so that they can use the full functionality of the solution? | ||
| AA. What are the costs of mobile deployment? Does this involve additional licensing fees and/or implementation fees? Is the solution available on the App Store and Google Play? | ||
| AB. Are all the features offered updated at the same time? Are they all hosted in the same data center? | ||
| AC. What languages are supported on mobile devices? Which ones do you plan to add? | ||
| AD. How often do you patch the application and how long does this process interrupt? | ||
| AE. What is your innovation cycle and how do you launch new features with each new release/update? | ||
| AF. Does the latest update apply to all configurations (such as workflows and custom reports) without customer intervention? | ||
| AG. How is your company adapting to changing technologies for its user interface?\Is the experience of your app the same for all users (end users, managers, or administrators)? | ||
| AH. Do users have to interact with multiple mobile apps or are all features offered and presented through a single app? | ||
| AI. Is it up to ABMC to install the updates or is it the publisher who takes care of them? Is it possible to be late on updates? | ||
| AJ. When users sign in to your app via a mobile device, can they authenticate with Touch ID? Do you support other authentication methods? | ||
| AK. Is any management data cached on mobile devices? | ||
| AL. Who are your Internet Service Providers and how many do you have per data center? | ||
| AM. What virus scanning/detection mechanisms have been put in place? Is there an intrusion detection system? | ||
| 4.2 Infrastructure and Operations | ||
| A. How many data centers do you have? | ||
| B. Do you conduct security audits of your data centers? If yes, please indicate the frequency, type of audit and provider. | ||
| C. What is your general system availability and what service level agreement (SLA) are you willing to commit to when it comes to response times? How do you measure it? Please describe your real-time performance and availability monitoring systems and how you track and manage SLA results. | ||
| D. What are your official system maintenance windows? | ||
| E. Do you publish an annual schedule of planned maintenance and upgrades? Namely, will I be notified a year in advance of a planned outage and how long that outage will last? Does the service level agreement (SLA) include planned outage commitments? Is emergency maintenance considered a planned outage or a service level agreement (SLA)? | ||
| F. If the system is slow, is there a contractual commitment to performance? | ||
| G. Please provide a list of supported APIs. | ||
| 4.3 Extensibility | ||
| A. Describe the customization and extensibility capabilities of your solution. | ||
| B. Where do configuration changes take place? Is it on the same user interface that is used to make the transactions? | ||
| C. Who is responsible for updating changes to customizations? Will our customizations be overwritten if we upgrade? Do you offer custom scripting capabilities? | ||
| D. Please explain the system requirements and expansion capabilities. | ||
| 4.4 Integration | ||
| A. Which third-party vendors do you currently have a "standard" interface with, and which new vendors do you plan to include in your standard product line? | ||
| B. If we want to create an interface to a third-party system for which you do not offer a standard interface, what architecture, tools and/or processes will we need? | ||
| C. What third-party software can HRIS integrate with? Is there any additional cost? | ||
| D. During the testing phase, will your team communicate with the relevant vendor team to ensure that the interfaces have been configured correctly? | ||
| E. Do you support custom interfaces? | ||
| F. How many lines of code (e.g. independent applications and databases) are in your solution, and how do you ensure that they are synchronized and integrated? | ||
| G. Possibility of automatic bidirectional integration with other programs | ||
| H. Supports external authentication mechanisms: LDAP or Active Directory | ||
| I. How many lines of code (e.g. independent applications and databases) are in your solution and how do you ensure that they are synchronized and integrated? | ||
| J. Are you able to provide a list of pre-configured integrations for external systems (e.g., payroll, training solutions, and benefits providers?) Who is responsible for updating these integrations? If the customer is responsible for this, what level of effort is required to ensure that these pre-configured integrations are kept up to date, especially during upgrades? | ||
| 4.5 Management process structure | ||
| A. Please describe your workflow services. | ||
| B. Ability to configure hiring or termination notifications both via email and APIs to enable automated orchestration of workflows. | ||
| C. What tools are available to enable workflow in your system? | ||
| D. Is it possible to define globally consistent business processes with regional variations for routing and workflow approval? | ||
| E. Does your system support non-disruptive changes to business processes, e.g., do users assigned to a process task have the ability to add an approval step to the process as an additional parallel step without having to start the process from scratch? Do these ad-hoc approval steps affect only the instance of the current process that the user is assigned to, and are they fully traceable? | ||
| F. How does your system provide visibility into business process information? Can users directly see the status of business processes on their home page when they log in? Can they process approval processes and their tasks from their mobile devices? | ||
| G. How does the upgrade process affect our organization's specific management workflow configurations? Do these configurations on the management processes survive upgrades or do they need to be reconfigured after each upgrade? | ||
| H. Is there a limit to the number of approvals that an action may require? Can there be different workflow or approval circuits depending on the reason or, if applicable, the logic of a change (e.g., a threshold exceeded or the level of the person requesting the change)? | ||
| I. How much IT involvement is required to set up the workflow and integration with other standard office software (Microsoft Excel, Microsoft Word and e-mail solutions)? | ||
| J. Ability to control the sequence of screens (the flow) by user and by function | ||
| K. Ability to set up automatic hiring/termination notifications | ||
| L. Do your business processes cover different modules (e.g., recruitment, onboarding, payroll, HCM, and finance)? | ||
| M. Besides approvals, what other steps/tasks/actions can your management processes perform? | ||
| 4.6 Corporate Security and Trust | ||
| A. Describe your formal security program that ensures data security and privacy, protects against threats or risks to data, and prevents unauthorized access to data. | ||
| B. Is the security model organized by function, transaction, field, subsystem, module, or reporter? | ||
| C. Can you describe your backup policies and procedures? | ||
| D. What protections does the solution implement against unauthorized access? | ||
| E. Does your application system meet data security compliance regulations and industry standards? Do its features comply with local, regional, national, and international legislation? | ||
| F. What is the default idle time set in the system before employees are prompted to log in again? | ||
| G. Is it necessary to have a unique user ID and password to authenticate and access the Service? | ||
| H. In the event of a breach or suspected breach of security and regardless of the type of breach, will you notify our organization? Please describe your policies and procedures in the event of a breach or suspected breach of security, regardless of the type of breach. | ||
| I. Is the data transferred in an encrypted format? Please describe the process and format. | ||
| J. Is your system SOX 404 compliant? Describe how your system is compliant with Sarbanes-Oxley Section 404. | ||
| K. Do you conduct regular audits and publish reports? | ||
| L. Please describe your security policy to ensure that policies and procedures have been put in place to protect our data. | ||
| M. How is sensitive personal data (national identity, global identifier, bank account numbers, tax identification number) protected? | ||
| N. How do you secure high availability environments? | ||
| O. Please describe the types of security certifications you have obtained. | ||
| P. Under the hosting agreement, do we own employee data? | ||
| Q. How do you ensure data security when users execute transactions or view sensitive data remotely via a mobile device? | ||
| R. Do you commit to regular audits (at least semi-annual SOC1/SOC2 audits)? | ||
| S. Do you have security certifications for your business applications? | ||
| T. Is the system password file encrypted using an encryption algorithm? If so, which algorithm? | ||
| U. How are access restrictions to systems containing perimeter data implemented by the solution? | ||
| 4.7 Application Security and Auditing | ||
| A. Can security be set for users who view and update data? Can security also be set at the function, page, and field level? Can the same security configuration be applied to your reporting tools? | ||
| B. Describe how your system supports role-based access controls to ensure that users have the appropriate access rights based on primary organizational roles. Describe the role delegation and proxy functionality. | ||
| C. Describe the supported "out-of-the-box" roles. How can the new roles be configured by HR administrators? How can role access be configured for all roles? | ||
| D. How does the app handle authentication, confidentiality, and data integrity to ensure that another of your customers doesn't accidentally access our data? | ||
| 4.8 Reporting and analysis | ||
| A. How can users access standard reports and what capabilities are available to create new reports and analysis? | ||
| B. Please describe your reporting capabilities. | ||
| C. To create more complex reports, do we have to call on your company or can we do everything in-house? | ||
| D. If internal report generators are used, what features are available? Can your report builder access all areas of the web-based system? Was your report builder developed in-house or by another vendor? | ||
| E. What types of exception reports are generated and what do they contain? | ||
| F. Can users configure business processes to view reports and analytics at any stage of the process? | ||
| G. Does the system accept links to other websites? | ||
| H. Is it possible to create reports from historical data? Please elaborate. | ||
| I. How can you create analytics reports that aggregate information from multiple application modules? | ||
| J. Is it possible to run large reports from the most recent data without affecting the performance of the application? | ||
| K. Does your application natively include a single reporting and analytics platform? Does the solution require data replication to achieve consolidated analytics or reporting? | ||
| L. Are analytics part of the same user experience, or do I need to log in to a different app? | ||
| M. Does your system provide an audit report of individual system and data access? Please elaborate. |
https://pages.nist.gov/800-63-4/sp800-63.htmlhttps://www.fedramp.gov/
File details come from the government source that posted it. Updated .