8-Attachment B - Scope-of-Work.docx

Scope of Work TJ26-12 Introduction

This solicitation is a Request for Proposal (RFP). This RFP is designed to provide interested vendors with sufficient information to submit replies meeting the intent of the RFP. It is not intended to limit a respondent’s content or exclude any relevant or essential data. Information gathered during this RFP process will be used to:

· compare available digital asset management solutions;

· explore how these solutions connect with the Division of State Archives and Records Service's (DARS) available storage options, which currently include Google Drive, AWS glacier storage, and local network storage;

· determine how these solutions relate to DARS’ current collections management system (AXAEM);

· demonstrate the relationship between digital asset management and digital preservation within the system; and

· result in selection of a Digital Asset Management System and secure a five-year contract with the awarded vendor.

Background

The Division of Utah State Archives and Records Service (DARS) is mandated to care for the entire life cycle of government records. This includes the short- and long-term management and preservation of records on paper, as well as those created in a digital environment (“electronic records”). Over the next three years, Archives is building its capacity and expertise for electronic records management in phases by: improving its digital storage environments for short- and long-term needs; managing these records through a digital asset management system; and facilitating a digital preservation workflow that follows the Open Archival Information Standard (OAIS), ISO 14721:2012.

Scope of Work

DARS is committed to responsibly managing its digital assets according to archival principles, standards, and best practices. DARS recently implemented new short- and long-term storage options for its production and preservation files. To best manage the use of this space and the assets within it, a Digital Asset Management System (DAMS) is the next step in practicing responsible, state-mandated stewardship of the State of Utah's government records.

This Scope of Work is for the procurement of a Digital Asset Management System (DAMS) that provides secure, scalable cloud-based storage solutions with options for redundancy and backup. It must ensure long-term preservation of digital assets, accommodate large file sizes and supporting various file formats. The State of Utah strongly prefers to host the cloud solution and data in-house. Hosting in AWS, GCP, or Azure is preferred, but not required. The system must perform the following:

· Configurable to store a variety of archival file types including TIFF, JPEG2000, PDF and PDF/A, PNG, MOTION, MOV, AVI, MPEG4, WAV, AIFF, FLAC

· Pulls technical metadata and supports customizable metadata schemas

· Retains integrity of technical metadata upon import and export

· Ensures synchronization of data across cloud environments

· Automatically creates derivatives

· Bulk description utility

· Fixity/verification utilities and reporting capabilities

· Provides automated persistent identifiers

· Robust search and discovery capabilities

· Includes tools for collaborative work, version control, commenting, and approval workflows

· Offers reporting functions for key performance indicators

· Possible integration with DARS current collections management system, APPX/AXAEM.

· Secure transfer of data while at rest and in-transit, regardless of the transfer method - must support PII and HIPAA compliance

All responders must be prepared to provide a demo of the product, either in person or via videoconferencing. Thorough responses will include startup costs, annual costs, extra fees, training costs, and all travel charges when training and implementing the system.

Funds will be available July 1, 2026. DARS staff will be ready in July to establish a five (5) year contract (2026-2031) with the award-winning vendor. Setup, installation, training and implementation will occur in Q1/Q2 of FY27.

Requirements

The product must meet the following basic requirements:

· Integrable with Archives' digital systems and storage environments: Google Drive, AWS S3 glacier storage

· Allow for remote accessibility

· Provide controlled access settings and security compliance, including data encryption and PII recognition

· Front-end web server

· SSL Capable

· Data and development code/application must be hosted and accessed within the United States

· Must be compatible with SAML 2.0 for Single Sign On authentication.

Required vendor Response to below requirement expectations & Compliance Sections;

1. Whether the requirement is met today

2. Whether the capability is native, configured, custom-developed, manual, or dependent on a third party.

3. Any limitations, assumptions, additional fees, or services required

4. Whether the capability applies to customer data, metadata, logs, derived data, indexes, backups, and sub processors

5. What documentation, screenshots, reports, sample exports, audit logs, or certifications the vendor can provide as evidence

6. Whether the requirement will be included in the final contract and flow down to all subcontractors/sub processors.

The State will treat any refusal to accept GDPA compliance, state ownership/control of personal data, state controlled retention and destruction, breach support, data subject request support, subprocesses flow down, or limits on secondary use as a material privacy risk.

Requirements and Expectations;

· Search, Export, Correction, and Restriction. The system must allow authorized State users to locate, review, export, correct, annotate, restrict, suppress, or otherwise manage records and perusal data as needed to fulfill legally required requests and privacy obligations.

· The system must support data minimization, including role-based access, configurable fields, configurable metadata, collection controls, access restrictions, retention controls, and the ability to avoid collecting or retaining unnecessary personal data.

· The vendor must disclose all personal data sharing, transfers, integrations, sub processors, hosting locations, support access, analytics, monitoring, logging, and third party services that may access or process state personal data.

· The system must maintain audit logs sufficient to show access, changes, exports, disclosures, administrative actions, retention actions, deletion/destruction actions, permission changes, and vendor support access involving state records or personal data.

· The vendor must comply with state incident response requirements and must notify the state promptly of any actual or suspend unauthorized access, acquisition, disclosure, loss of access, destruction, compromise, or other incidents involving state data or the system.

· The vendor must assist the state with breach investigation, containment, forensics, documentation, cyber center attorney general notification affected individual notification and remediation when an incident involves state personal data or vendor systems services.

· At contract end, the vendor must return state data in usable format, securely destroy remaining state data after state approval, certify destruction, and ensure the same return destruction requirements apply to sub processors and backups where technically feasible.

Compliance

Standards applied include:

· State Purchasing rules and procedures

· DTS and Archival standards for managing digital assets efficiently and responsibly

· Code and data must be housed in the United States. All contractors are required to go through the State/BCI background check process, and implementation and ongoing support resources should be static. Data may not leave the United States. Vendor will utilize the State’s VPN. Vendor will need to provide proof of these standards being upheld once environments are created.

· Security: vendors should include in their response all certifications such as SOC2 Type II, ISO, FEDRamp/GovRamp approval, etc. Additionally, on top of technical specifications, please provide your encryption standard used for data in transit and at rest. A GovRamp certification will be required. Depending on the level required the awarded Vendor will have a specified amount of time to become compliant if not already compliant.

· If Contractor is offering a cloud component you must be willing to obtain FedRamp or GovRamp Moderate authorized status.

· In compliance with the Utah terms and conditions, where the product does not already have a FedRAMPor GovRAMP authorization status the following provision apply:

· At the time of contract execution, the product must be enrolled in the GovRAMP progressing snapshot program and remain in the program until a verified status is achieved.

· For sensitive data the following must be added: The product must achieve a verified status of GovRAMP core no later than 12 months after the date of contract execution and achieve a verified status of GovRamp Moderate Authorized no later than 24 months after the date of contract execution.

· If the contractor fails to maintain or achive the security requirements outlined above, the using department may reevaluate the terms of the contract and determine whether the failure to comply justifies contract termination.

Project Deliverables

· Product installation

· Staff training (either in person or remote)

· Customer service assistance as needed (ongoing)

Project Timeline

· July-August 2026: RFP posted

· August-September 2026: Evaluation Team reviews products

· October-November 2026: Award contract, negotiate, and sign

· January 2027 - June 2027 Product fully functioning as part of regular workflow. Exact miles stones of project deliverables will be negotiated after award of the contractor.