8-Attachment D1 - Tech and Security Requirements Innovation Challenge.xlsx
XLSX spreadsheet 25 KB Posted
- Attached to
- Tech Innovation Challenge - Fire Department
- Solicitation number
- 542905
- Issued by
- Wayne County, Detroit City, Michigan
About this file
Summary
This is a Technical and Security Requirements Matrix prepared by the City of Detroit Office of Contracting and Procurement for a Technology Innovation Challenge focused on equipping Detroit firefighters and medics with modern safety and response technologies. The requirements document establishes baseline security and cloud infrastructure standards that prospective vendors must meet or address through their proposed solutions. The matrix comprises 70 total requirements and questions organized across two functional areas: General Security (44 requirements) and Cloud Checklist Questionnaire (26 requirements). Vendors are required to respond using a standardized coding system indicating whether requirements are met as proposed (C), met with alternatives (A), or not met (N), with space for explanatory comments.
The General Security section addresses single sign-on and Active Directory integration, multi-factor authentication, SAML authentication through Azure Active Directory, encryption protocols for data at rest and in transit, role-based security controls at multiple organizational levels, user group management, and compliance certifications including HIPAA, CJIS, and IRS Publication 1075. Additional security requirements cover audit trail capabilities with second-level precision timestamps, administrative configuration of log retention periods, customizable audit reporting, session timeout functionality, security activity logging, and file scanning for cyber threats. The Cloud Checklist section requires vendors to describe uptime responsibilities, governance and notification processes, legal and regulatory compliance strategies, adherence to security frameworks such as NIST, ISO/IEC, COBIT, or ITIL, and provision of SOC 2 Type 2 reports at no additional cost. Vendors must also address account management, security monitoring, data inventory procedures, subcontractor security inheritance, public key infrastructure, data separation in multitenant environments, network segmentation, firewall protection with intrusion detection, dedicated virtual resources, media sanitization procedures, and system environment availability.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Table of Contents
| Table of Contents | ||
| Tab No. | Functional Area | Number of Requirements / Questions |
| 1 | General Security | 44 |
| 2 | Cloud Checklist Questionnaire | 26 |
| Total Requirements + Questions: | 70 |
1. Security
| ATTACHMENT F - REQUIREMENTS MATRIX | ||||
| RFP Name & RFP # _________ | Enter vendor name here | |||
| Available Responses | ||||
| C | Requirement Met and Proposed (Standard features available in the product) | 0 | ||
| A | Intent of Requirement Met and Proposed with Alternative | 0 | ||
| N | Requirement Not Met with Proposal | 0 |
TOTAL 0
| Req # | Function | General Security Requirement | Vendor Response | |
| (C, A, N) | Comments | |||
| 1 | SSO | The system has the ability to utilize the City's Active Directory user validation to achieve single-sign-on, regardless of deployment method. | ||
| 2 | AD integration | The system has the ability to inherit groups from Active Directory for application authentication. | ||
| Multi Factor Authentication | The system has the ability to support Multi Factor Authentication (MFA) | |||
| 3 | SAML | The system has the ability to utilize the City's SAML Authentication (Azure Active Directory) for user validation to achieve single-sign-on, regardless of deployment method. | ||
| 4 | SAML | The system has the ability to map SAML groups or App roles from Azure Active Directory for application permissions . | ||
| 5 | Password Encryption | The system has the ability to store passwords in encrypted form, if applicable. | ||
| 6 | Encryption | The system has the ability to encrypt data stored in the database. | ||
| 7 | Encryption | The system has the ability to encrypt data stored in the application. | ||
| 8 | Encryption | The system has the ability to encrypt data in transit. | ||
| 9 | Encryption | Please provide information as to what level of encryption/encryption methods are used in transit and at rest. | ||
| 10 | Role based security | The system has the ability to provide read, write, update, and delete access using role based security. | ||
| 11 | Role based security | The system has the ability to provide security at the following levels: | ||
| 12 | Role based security | Department or Agency; | ||
| 13 | Role based security | Division; | ||
| 14 | Role based security | Role or group; | ||
| 15 | Role based security | User ID; | ||
| 16 | Role based security | Screen; | ||
| 17 | Role based security | Menu; | ||
| 18 | Role based security | Report; | ||
| 19 | Role based security | Field; | ||
| 20 | Role based security | The system allows for departmental administrative self-service (e.g. ability to make changes to roles and workflows) with audit trail capability. | ||
| 21 | Role based security | The system has the ability to update all user profiles automatically (user discretion) when a change in their role (s) is/are made. | ||
| 22 | Role based security | The system has the ability to allow a City system administrator to add and change permissions for system access. | ||
| 23 | User Groups | The system has the ability to establish, deactivate, and archive user groups. | ||
| 24 | User Groups | The system has the ability to delete user groups that do not have historical data, with an audit trail. | ||
| 25 | City Administration | The system allows for departmental administrative self-service (e.g. ability to make changes to roles and workflows) with audit trail capability. | ||
| 26 | Compliance | The system is HIPAA compliant and vendor will enter into a BAA with the City. | ||
| 27 | Compliance | The system is CJIS compliant | ||
| Compliance | The system is IRS Publication 1075 compliant | |||
| 28 | Compliance | The system meets compliance rules / regulations in order to ensure the sensitive digital assets are guarded against loss, theft and misuse | ||
| 29 | Compliance | The system is compliant with applicable compliance regulations. | ||
| 30 | Security Certifications | Please list any industry standard security certifications the solution / vendor has. (Ex: ISO 27001). |
Please note annual SOC 2 type reports will be required via the City’s contract.
| 31 | Audit Capabilities | The system has the ability to track and audit changes throughout the system that creates a log of all records maintained and includes: |
| 32 | Audit Capabilities | Date; |
| 33 | Audit Capabilities | Time; |
| 34 | Audit Capabilities | User; |
| 35 | Audit Capabilities | Information prior to change; |
| 36 | Audit Capabilities | Changed information |
| 37 | Audit Capabilities | The system has the ability to allow the audit trail to have a date/time stamp to the nearest second. |
| 38 | Audit Capabilities | The system has the ability to allow a City system administrator to configure the duration that time audit logs are retained (e.g. 90 days). Proposer to describe how this feature works. |
| 39 | Audit Capabilities | The system has the ability to provide customizable audit reports. |
| 40 | Access Time Out | The system has the ability to log users off the system after an administrator-defined period of inactivity, based on user-defined roles. |
| 41 | Access Time Out | The system has the ability to allow a system administrator to log out users. |
| 42 | Security | The system has the ability to allow authorized users to have access to a log of security activity to determine users that have signed on and off the system, as well as unsuccessful attempts to sign on to the system. |
| 43 | Security | The system has the ability to scan attached files for viruses, malware, or other cybersecurity threats (vendor to specify capability for using City preferred anti-virus solutions). |
| 44 | API | The system has the ability to support API's (Application Programming Interface) for third-party system integration, imports, and exports of data. |
2. Cloud Checklist
ATTACHMENT F - REQUIREMENTS MATRIX
RFP Name & RFP # _________
| Cloud Service Provider Security Checklist | ||
| Please provide an answer or statement to all issues listed | ||
| Enter vendor name here | ||
| Prompt # | Topic | Vendor Response |
| 1 | Describe who is responsible uptime, maintenance, patching and administration of the server. | |
| 2 | The provider must show diagram (and possible past examples) of their governance and notification processes for their services. | |
| 3 | Describe how the provider will guarantee legal and regulatory compliance with government and sectorial (industry specific) laws and regulations. | |
| 4 | Does the solution follow one of the following sets of security and privacy control best practices? Indicate which. | |
| 4a | NIST Series | |
| 4b | ISO/IEC Series | |
| 4c | COBIT | |
| 4d | ITIL | |
| 5 | The vendor will provide to the City, at no additional cost, the most recent SOC 2 Type 2 report from its cloud hosting provider covering the environments used by the City. | |
| 6 | Describe process for Account Management | |
| 7 | Define who is responsible for security monitoring. If the City will be responsible for securing the environment, describe how the City will obtain logs to ingest into its SIEM. | |
| 8 | Describe how a data inventory of City of Detroit Data Assets will be kept. | |
| 9 | Will subcontractors be used? If yes, will all security controls be inherited by subcontractors? | |
| 10 | Describe Public Key Infrastructure | |
| 11 | Process for separation of data belonging to different consumers in a multi‐tenant environment. | |
| 12 | Does the solution use a private, shared or hybrid cloud? | |
| 13 | Process used to separation of network traffic in a shared multi‐tenant provider environment | |
| 14 | Statement guaranteeing adherence to all privacy laws governing the physical areas of data storage. | |
| 15 | Willing to participate in a Risk Assessment and Privacy Impact Assessment covering the storage of PII. | |
| 16 | Network traffic must be screened and firewall protected network must have intrusion detection & prevention in place. | |
| 17 | Network must have detailed logging and documented alerting capabilities. | |
| 18 | Dedicate VLANs with dedicated virtual firewall. | |
| 19 | Describe how the City of Detroit network access separated from provider network access. | |
| 20 | Are the City of Detroit VMs are on a dedicated hypervisor? | |
| 21 | Will provider's servers only communicate with the City of Detroit logical disk units? | |
| 22 | Will online storage and backup media be scrubbed when retired or replaced? | |
| 23 | Identify system environments that will be available to the City (e.g. production, development, test) | |
| 24 | Identify shared components of the system (e.g., network segments, backup tapes, etc.) | |
| 25 | Identify Data storage and transfer limits | |
| 26 | Identify normal and peak bandwidth requirements |
File details come from the government source that posted it. Updated .