8-A07 - AI Platform Requirements.xlsx
XLSX spreadsheet 48 KB Posted
- Attached to
- AI Governance and Monitoring Platform
- Solicitation number
- 745-26-P33
- Issued by
- Bexar County, Texas
About this file
This is an AI Platform Requirements assessment document for the University of Texas Health San Antonio (UTHSA), a large academic health and research institution seeking a comprehensive AI Governance and Monitoring Platform. UTHSA requires a solution to establish centralized oversight, risk classification, policy enforcement, performance monitoring, lifecycle management, and audit readiness across all AI use cases currently deployed across administrative, research, clinical, and academic functions. The platform must support healthcare and higher education regulatory environments including HIPAA, FERPA, FDA considerations, state privacy laws, and emerging AI regulations. The requirements document specifies functional, technical, security, support and services, vendor health, and pricing categories that vendors must address, with priorities designated as High, Medium, or Low for each requirement.
The functional requirements span AI inventory and catalog management, shadow usage discovery, automated policy compliance and enforcement, data usage mapping, product usability with role-based interfaces, risk management frameworks, comprehensive audit trails supporting federal requirements, evidence collection for trust and security assessments, interoperability with data governance and model observability tools, workflow automation integrated with ticketing systems like ServiceNow and TeamDynamix, AI usage reporting, business-friendly user experience, ease of implementation, model observability, AI ethics and bias frameworks, and stakeholder collaboration with governance committee support. Technical requirements include data storage with disaster recovery capabilities, granular authorization with enterprise identity provider integration (LDAP, Azure AD), integration with systems such as DynaTrace, SolarWorks, ITSM platforms, PeopleSoft, Oracle Fusion, EPIC, Salesforce, and Banner, OAuth 2.0 support with MFA enforcement, real-time performance management with alerting, REST/SOAP API support, data sharing controls with external systems including LLMs, native application connectors, Cisco ACI network compatibility, comprehensive architecture documentation, customization capabilities, global localization support, high availability with documented RTO/RPO targets, exit strategy with full data export in standard formats, and deployment model options including SaaS, on-premises, or hybrid with TX-RAMP certification if cloud-based. Security requirements address privacy policy alignment, data encryption in transit and at rest with algorithm and key management details, embedded security testing in release management, identity and access management with SSO and two-factor authorization, security event logging with suspicious activity alerting, documented incident management and breach disclosure policies, disaster recovery and backup processes, intrusion prevention and detection capabilities, published hiring practices and employee security training, penetration testing capabilities, and compliance certifications including SOC 2, ISO 27001, NIST, FedRAMP, CCPA, or GDPR. Support and services requirements include 24/7 multi-language customer support, implementation resources meeting desired go-live dates, clear implementation planning with setup, testing and training, multi-format support access via phone, email, chat and online knowledge base, flexible deployment rollout options, relevant service level agreements for system performance and uptime, best-in-class training via online and offline mediums, aligned vendor expertise or partner resources, and regular feature updates with transparent release cadence. Vendor health evaluation focuses on financial strength metrics, vendor vision and culture fit, customer base focus and sector alignment, online user ratings of 4.2 or higher out of 5, and product strategy roadmap alignment with future requirements. Pricing and commercial terms requirements specify initial contract term length with renewal mechanics, license fee structures with defined pricing units and annual/monthly volume forecasts, implementation costs, training expenses, key contract terms including price protection and termination clauses, and ongoing service and maintenance fee tiers.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 12-A02 - Sample Agreement 745-26-P33.docx | DOCX document | |
| 6-A05 TX-Ramp 1003.pdf | ||
| 3-A01D Addenda Checklist 0725.pdf | ||
| 7-A03 VETHUB 0126.pdf | ||
| 2-A04 - Risk Assessment 0128.xlsx | XLSX spreadsheet | |
| 4-A01B Exec of Offer 0126.pdf | ||
| 1-A06 PDAA.xlsx | XLSX spreadsheet | |
| 5-S06 Pricing and Delivery Schedule 0725.pdf | ||
| 11-S04 Terms Conditions 0226.pdf | ||
| 14-01 RFP 745-26-P33 AI Governance and Monitoring Platform.pdf | ||
| 10-A07 - BAA.docx | DOCX document | |
| 9-A01C Gen Quest 0226.pdf | ||
| 13-A01A General info 0922.pdf |
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
| APPENDIX XXX | |
| AI PLATFORM REQUIREMENTS | |
| INSTRUCTION SHEET | |
| In the next tab (AI Platform Requirements) you will find items that are listed describing needs and wants. |
Your responsibility will to review each of the items listed and provide your company’s ability in Column D.
In Column D, there are three choices:
- Fully: Your company can meet ALL of this requirement.
- Partially: Your company can meet PART of this requirement
- Does Not: Your company can NOT meet this requirement
Column H: Provide justification for your scoring.
AI Platform Requirements Category Requirement Title Requirement Description Support Meet Requirement Factor Priority Meet Requirement Priority Justification Provide a justification for your scoring
| Functional requirements | AI inventory and catalog | Provides a centralized, discoverable registry of all AI use cases and AI services, like Software as a Service, with embedded AI that can support multiple use cases. Enables applications, agents and models within the organization. | ERROR:#N/A | High | 0 | ||
| Functional requirements | AI inventory shadow usage | Discover shadow AI usage and provide ability to manage governance actions. Provide method for discovering shadow AI usage. | ERROR:#N/A | High | 0 | ||
| Functional requirements | Automated policy compliance and enforcement at runtime | Provides centralized, automated management and enforcement of AI-specific policies via multiple guardrails, including control validation for AI-specific risks, access controls, use case alignment and other enterprise policies and remediation advice. Include specifics on guardrails for HIPAA, FERPA, and IRB/research compliance. | ERROR:#N/A | High | 0 | ||
| Functional requirements | Data usage mapping | Captures data mapping used by various AI entities and tracks usage and misuse over time. Tracks the provenance of training data and interface with data governance platforms to include data lineage, classification, ownership and data observability. Include how you handle mixed datasets that contain both de-identified and identifiable data. | ERROR:#N/A | High | 0 | ||
| Functional requirements | Product usability | Provides easily understood, friendly interfaces with intuitive designs to facilitate user engagement. Can you demonstrate role-based interfaces with auditing capabilities in self-service portals for submitting AI use cases, reviewing those and support accessibility standards? | ERROR:#N/A | High | 0 | ||
| Functional requirements | Risk management and regulations | Supports AI features and risk cataloging applied to AI applications, models or use cases. Provides frameworks to classify, assess and mitigate AI-specific risks, including content libraries addressing unique regulations for AI and privacy frameworks. | ERROR:#N/A | High | 0 | ||
| Functional requirements | Audit | Provides comprehensive audit trails of actions taken in the platform and, where applicable, automatically logs all activities related to the AI life cycle. Must support federal audit requirements with tamper-evident logs and support retention period cleanup. | ERROR:#N/A | Medium | 0 | ||
| Functional requirements | Evidence collection | Offers documentation for trust, risk and security assessments, testing and validation results (such as security, bias detection, model), risk and compliance remediation evidence. | ERROR:#N/A | Medium | 0 | ||
| Functional requirements | Interoperability | Enables different systems, devices, applications or agents to exchange and utilize information effectively. Includes the data and analytics governance platform, model observability tools, AI discovery tools and AI cybersecurity platforms. | ERROR:#N/A | Medium | 0 | ||
| Category | Requirement Title | Requirement Description | Support | Meet Requirement Factor | Priority | Meet Requirement Priority | Justification |
Provide a justification for your scoring
| Functional requirements | Workflow and approvals | Automates routine governance tasks such as new AI use case model, application or agent approval by a governing body; risk and security assessments internal or external to the organization; approvals; testing procedures; and documentation generation. Describe how you can interact with ticketing applications like ServiceNow and TeamDynamix. | ERROR:#N/A | Medium | 0 | ||
| Functional requirements | AI usage reporting | Enables the generation of standardized documentation for AI models and use (e.g., model cards, datasheets, dashboards, reporting templates) for auditors and regulators. | ERROR:#N/A | Low | 0 | ||
| Functional requirements | Business-friendly user experience | Allows targeted users to navigate and complete their tasks without consulting with product subject matter experts or technical staff. | ERROR:#N/A | Low | 0 | ||
| Functional requirements | Ease of implementation | Enables users to quickly adopt a new instance of the tool to support AI governance activities without heavily customizing off-the-shelf templates/prebuilt workflows or changing the underlying data model. Supports how-to guides and easy plug-ins. | ERROR:#N/A | Low | 0 | ||
| Functional requirements | Observability | Allows model builders and owners to monitor, understand and diagnose the performance and behavior of AI models, applications and agents in production. Supports metrics and signals to ensure models function correctly and make accurate predictions. | ERROR:#N/A | Low | 0 | ||
| Functional Requirements | AI Ethics and Bias Framework | Platform must provide tools and frameworks for assessing and mitigating bias, ensuring fairness, and supporting ethical AI use aligned with institutional values. | ERROR:#N/A | High | 0 | ||
| Functional Requirements | Stakeholder Collaboration and Governance Committee Support | Platform must support multi-stakeholder governance processes including committee workflows, voting/approval tracking, minutes/documentation, and cross-functional collaboration. | ERROR:#N/A | Medium | 0 | ||
| Technical requirements | Data storage | Provides required data storage capacity, file types and locations. Supports processes such as disaster recovery, rollbacks, extraction or eradication. | ERROR:#N/A | High | 0 | ||
| Technical requirements | Granular authorization support | Offers granular authorization support to accommodate a wide range of business policies and rules that are closely tied to authorization policy management. Must provide integration with enterprise IdP (LDAP, Azure AD) | ERROR:#N/A | High | 0 | ||
| Category | Requirement Title | Requirement Description | Support | Meet Requirement Factor | Priority | Meet Requirement Priority | Justification |
Provide a justification for your scoring
| Technical requirements | Integration | Integrates with all relevant applications, data sources and technologies. List common integrations and systems including. (DynaTrace, Solarwinds), ITSM (TeamDynamix, ServiceNoe), Identity, Network platforms (Cisco ACI), PeopleSoft, Oracle Fusion, EPIC, SalesForce, Banner. Provoide API list and webhook capability. | ERROR:#N/A | High | 0 | ||
| Technical requirements | OAuth 2.0 support | Enables administrators to give applications and third-party services access to the vendor on their behalf. Permits establishment of standardized methods to limit access, handle consent, refresh and revoke individual application access. MFA enforcement. | ERROR:#N/A | High | 0 | ||
| Technical requirements | Performance management | Provides proactive alerts on system events. Enables logging and resolution reporting on all issues. Explain if alerts are real time. | ERROR:#N/A | High | 0 | ||
| Technical requirements | Business function APIs | Supports a business function API that provides REST or SOAP interfaces to crucial business capabilities of the solution. Provide full API / integration capabilities. | ERROR:#N/A | Medium | 0 | ||
| Technical requirements | Data sharing | Sends data to external systems such as large language models and uses insights from connected engines such as generative AI to deliver product functionality. Enables users to manage all aspects of data sharing, including full disablement. | ERROR:#N/A | High | 0 | ||
| Technical requirements | Native application connectors for integration platforms | Provides a rich set of native application connectors, instead of low-level protocol connectors. Supports wide-ranging integration requirements. Partners with integration-platform-as-a-service (iPaaS) and on-premises integration platform providers. | ERROR:#N/A | Medium | 0 | ||
| Technical requirements | Network | Leverages network technologies like software-defined wide area networks and over-the-top monitoring to ensure the optimal performance of the solution. Must work with Cisco ACI segmented architecture. | ERROR:#N/A | Medium | 0 | ||
| Technical requirements | Architecture diagrams for service | Provide comprehensice architecture documentation that clearly illustrates how the platform is deployed, integrated, secured, and operated within the enterprise environment. Includes logical architecture diagram, physical deployment diagram, network design, external dependencies, security, HA/DR design topology | ERROR:#N/A | High | 0 | ||
| Technical requirements | Developer tools and customization | Allows customization of the standard deployed solution with custom user interfaces, data tables, process components and business logic. | ERROR:#N/A | Low | 0 | ||
| Category | Requirement Title | Requirement Description | Support | Meet Requirement Factor | Priority | Meet Requirement Priority | Justification |
Provide a justification for your scoring
| Technical requirements | Global delivery | Supports off-the-shelf localization such as insights, language and currency support for required geographies. | ERROR:#N/A | Low | 0 | ||
| Technical Requirements | High Availability and Resiliency | Platform must delivery enterprise high availability with no single points of failure and documented RTO/RPO targets.Specify clustering design, failover bahavior (node, database, and network failure), automatic vs manaul failover, downtime requirements, multi-data center support, SaaS-specific data location/region information, and test recovery metrics. Include validated HA performance in production environment. | ERROR:#N/A | High | 0 | ||
| Technical Requirements | Exit Strategy | The platform must support full data access and export and documented exit process to prevent vendor lock-in. All data must be exportable in standard formats, and the vendor must define data retention, deletion timelines, and migration support upon contract termination. | ERROR:#N/A | High | 0 | ||
| Technical Requirements | Deployment Model & Infrastructure | Provide supported deployment models (SaaS, On-prem, hybrid), any propieetary hardware/sofwater dependencies, VMware & Cisco ACI network alignment confirmation. If Cloud based are you TX-RAMP certified (fill out appendix X)? | ERROR:#N/A | High | 0 | ||
| Security requirements | Appropriate privacy policy | Provides a publicly stated stance on privacy protections and data use that is compatible with the enterprise’s privacy principles and policies. Ensures the privacy policy can be compatible with the enterprise’s customers’ and partners’ privacy needs. | ERROR:#N/A | High | 0 | ||
| Security requirements | Data encrypted in transit | Encrypts data or electronic communications in transit with standardized protocols such as transport layer security (TLS) or IPsec. Uses recent versions with no known vulnerabilities. Uses implementations with no known exploits. | ERROR:#N/A | High | 0 | ||
| Security requirements | Embedded security testing in release management process | Performs automated code scanning on all vendor-developed code. Has a documented secure software development life cycle process. | ERROR:#N/A | High | 0 | ||
| Security requirements | Encrypt tenant data at rest | Encrypts data at rest (stored on disk or storage mediums). Provides detailed information on the encryption algorithms used, encryption key length and encryption key life cycle management practice, and who generates and possesses the encryption keys. | ERROR:#N/A | High | 0 | ||
| Security requirements | Identity and access management | Supports capabilities such as user authentication, password policy management, two-factor authorization, single sign on and role-based access. | ERROR:#N/A | High | 0 | ||
| Category | Requirement Title | Requirement Description | Support | Meet Requirement Factor | Priority | Meet Requirement Priority | Justification |
Provide a justification for your scoring
| Security requirements | Logging of security-related events | Provides logging for security-related events, and supports alerting for any suspicious activity when logs are accessed. | ERROR:#N/A | High | 0 | ||
| Security requirements | Published breach disclosure and remediation policy | Has a documented Incident management and breach disclosure policy in place, that meets requirements for notification, assistance and remediation. Outlines whom the vendor will notify, how and when, and what processes the vendor will follow to protect enterprise data, customers and users. | ERROR:#N/A | High | 0 | ||
| Security requirements | Disaster recovery and backup | Enables processes such as disaster recovery, rollbacks and version control. | ERROR:#N/A | Medium | 0 | ||
| Security requirements | Intrusion prevention and detection capabilities | Provides documentation to the enterprise detailing the technologies and capabilities employed to deliver intrusion prevention and detection capabilities, as well as processes for dealing with incidents. | ERROR:#N/A | Medium | 0 | ||
| Security requirements | Published hiring practices | Delivers documentation of screening and hiring practices for the vendor's employees and any third parties that will have access to the enterprise’s data. Has an associated governance program in place, including security awareness trainings relevant to their job function. | ERROR:#N/A | Medium | 0 | ||
| Security requirements | Regular penetration tests performed by specialists | Enables the enterprise to request, or provides the capability to run, penetration tests against the service, which validate that the solution is secure through receipt of sanitized evidence. | ERROR:#N/A | Medium | 0 | ||
| Security requirements | Compliance and third party certification | Has a documented ISMS policy in place. Complies with relevant regulatory standards/frameworks or government certifications such as SOC 2, ISO 27001, NIST or FedRAMP and/or privacy standards like CCPA, GDPR. | ERROR:#N/A | Low | 0 | ||
| Support and services | Customer support | Delivers required level of user and technical support, e.g., 24/7, multi-language and global support. | ERROR:#N/A | High | 0 | ||
| Support and services | Implementation timeline | Provides implementation resources, including setup, testing and training, to meet the desired go-live date. | ERROR:#N/A | High | 0 | ||
| Category | Requirement Title | Requirement Description | Support | Meet Requirement Factor | Priority | Meet Requirement Priority | Justification |
Provide a justification for your scoring
| Support and services | Implementation, onboarding and setup | Provides clear implementation plan and resourcing, including setup, testing and training, to meet the desired go-live date. | ERROR:#N/A | High | 0 | ||
| Support and services | Support formats | Allows access to support across multiple formats including phone, email, chat and online knowledge base. | ERROR:#N/A | High | 0 | ||
| Support and services | Deployment model | Presents clear rollout options such as staggered, proof of concepts or end-to-end enterprise deployments. | ERROR:#N/A | Medium | 0 | ||
| Support and services | Service levels SLAS | Meets relevant service level agreements related to system performance, concurrent users, uptime and issue resolution. | ERROR:#N/A | Medium | 0 | ||
| Support and services | Training and education | Supports best-in-class training and assistance for users using online and offline mediums. | ERROR:#N/A | Medium | 0 | ||
| Support and services | Services resources | Aligns sufficient expertise via vendor or partners to deliver all implementation objectives. | ERROR:#N/A | Low | 0 | ||
| Support and Services | Ongoing Innovation and Feature Releases | Vendor must provide regular feature updates, maintain transparency about release cadence, and offer early access or beta programs. | ERROR:#N/A | Low | 0 | ||
| Vendor health | Financial strength | Vendor is in a strong financial position as measured by key metrics such as balance sheet strength and revenue growth rate. | ERROR:#N/A | High | 0 | ||
| Vendor health | Vendor fit | Vendor vision, culture, and team demonstrate that vendor will be a good partner. | ERROR:#N/A | High | 0 | ||
| Category | Requirement Title | Requirement Description | Support | Meet Requirement Factor | Priority | Meet Requirement Priority | Justification |
Provide a justification for your scoring
| Vendor health | Customer base | Focus, size, and fit of vendor's customer base shows ability to understand your needs, company and sector. | ERROR:#N/A | Medium | 0 | |
| Vendor health | User ratings | Online reviews rate vendor at level of 4.2 or higher (out of 5) and include insights where they excel or not. | ERROR:#N/A | Medium | 0 | |
| Vendor health | Product strategy and roadmap | Overall strategy and product roadmap aligns well with your future requirements. | ERROR:#N/A | Low | 0 | |
| Pricing and commercial terms | Length of initial contract term and renewal mechanics | Defines initial contract term including, where applicable, implementation periods and billing start dates. Defines how renewals occur if automatic, notice periods and how terms, pricing or other contracted components such as functionality can change. | ERROR:#N/A | High | 0 | |
| Pricing and commercial terms | License fees | License pricing units (e.g. number of users, sessions or API calls), cost of each, and forecast annual and/or monthly volumes. | ERROR:#N/A | High | 0 | |
| Pricing and commercial terms | Implementation costs | Cost to implement and deliver software into full production using either vendor or partner resources. | ERROR:#N/A | Medium | 0 | |
| Pricing and commercial terms | Training costs | Expense to train and support current users for launch, provide their continuing education and onboard future new users. | ERROR:#N/A | Medium | 0 | |
| Pricing and commercial terms | Contract terms and conditions | Provides key terms such as price protection, termination clause, jurisdiction and limitation of liability. | ERROR:#N/A | Low | 0 | |
| Pricing and commercial terms | Service or maintenance fees | Supports fees related to ongoing support services and maintenance, including tiers and precise deliverables. | ERROR:#N/A | Low | 0 | |
| Total Value | 0 |
image1.png
File details come from the government source that posted it. Updated .