8-Attachment F Technical Criteria.docx

Technical Criteria Attachment F For ease of evaluation, the proposals must provide a narrative point-by-point response, addressing in detail each area of the evaluation criteria. The criteria are not intended to limit a proposal’s content or exclude any relevant or essential data. Vendors are at liberty and are encouraged to expand upon the criteria to demonstrate the vendor’s ability to provide the State with a solution.

Vendors need to provide a narrative for the following criteria.

1. System Functionality and Core Modules (160 Points possible)

a. Describe how the solution provides end-to-end travel booking and expense management, including policy enforcement, per diem compliance, receipt imaging, mileage, and integration with Travel Management Companies.

b. Explain the capabilities for pre-travel authorization (Request Module), including configurable workflows, forms, and audit rules.

c. Detail the reporting and analytics features, such as dashboards, customizable reports, and export formats.

d. Provide examples of the solution that supports scalability to handle at least 65,000 transactions annually, with transparent reporting and of transaction counts and costs.

e. Provide examples of AI tools and how they integrate for admins, end users,

f. Provide examples of AI tools for reporting that can assist in audit and compliance.

2. Implementation, Integration, and Configuration (125 points possible)

a. Provide a detailed implementation plan. Include milestones, timelines, and resources required.

b. Explain how the solution integrates with the State accounting and payroll system through flat files, APIs, or web services.

c. Describe the sandbox/test environment, its functionality, and how it will be used for training and validation before production release.

d. Identify any risks or challenges and provide a mitigation strategy.

3. Security, Compliance and Hosting (100 points possible)

a. Describe how the system ensures data encryption (in transit and at rest), user authentication (multi-factor authentication) and access control.

b. Provide details on system availability (99.9% uptime SLA or equivalent)

c. Explain how the solution supports compliance with state and federal travel regulations and accessibility standards.

d. Explain how audit logs are maintained, including what information is captured (timestamps, user actions, verification results) and how it can be accessed.

e. Describe in detail the life cycle that data received from the State of Utah and its vendors will go through. Please include what data will be collected, when and how it will be collected, how it will be stored, any other intended uses of the data, and when it will be destroyed.

f. A Privacy Impact Assessment (PIA) is required for all new systems and must be completed between the design and development phases. Are you willing and able to provide a detailed system inventory, data inventory, and other information required to complete the PIA?

g. Does the system allow for the configuration of custom notices on data intake forms?

h. Are you willing to attest that the State of Utah is the data controller, that you will not collect or process personal data for any purpose other than contracted services, and that you will not sell or share data received from the State of Utah or its vendors without authorization?

i. Provide a copy of your standard Master Service Agreement as a separate PDF attachment to your proposal.

j. Describe the technical and administrative controls (e.g., data segregation, access controls, and employee training) in place to ensure that data obtained from the State of Utah or its vendors will not be used for secondary or unauthorized purposes.

k. Describe your process, available formats (e.g., CSV, JSON), any associated costs, and the standard time frame for a complete data export upon contract termination. The State prefers a single, complete export in an open-source, non-proprietary format (e.g., CSV/JSON).

l. In the event of contract termination, can you provide a certificate of destruction for all State of Utah data?

m. Describe how the system ensures compliance with state and federal data privacy requirements, including handling of personal data and sensitive financial data.

n. Describe how your system enables the management of data according to customer-defined record series.

o. Describe your system’s retention and disposition features, including if the retention time can be customized, if disposition can be automated, and if the features require human approval.

p. If your system utilizes AI, describe how State of Utah data will be used to train or refine existing AI models, if it is possible to isolate or disable training on State of Utah data, and how you will ensure that State of Utah data cannot be accessed by other entities through the use of the your organizations AI tools.

q. Describe how your organization uses customer data to generate anonymized data and aggregate data, if this data is shared with 3rd parties, and how this data will be used for the creation or development of goods and services.

r. Describe how the system ensures compliance with WCAG 2.1 AA compliance which is a Federal Mandate with a mandatory effective date of April 24, 2026. Provide any supporting documentation or certificate of compliance.

s. Describe and provide documentation of proof that the hosted environment is FedRamp or GovRamp certified. If not currently certified, will it be by June 2027.

4. Support, Maintenance and Advanced Care (65 points possible)

a. Explain the support structure, including ticketing, escalation paths, and defined response/resolution times.

b. Describe Advanced Care services, such as dedicated account management, priority support, and advisory assistance and confirm the availability of this service for the full potential 5-year contract term.

c. Provide examples of system updates, upgrades, and optimization processes, including how enhancements will be communicated and deployed.

5. Training and Documentation (50 points possible)

a. Describe the training approach for administrators and end users, including delivery methods (in-person, virtual, self-paced, etc.)

b. Provide examples of training materials.

c. Outline how the vendor will ensure that the State has sufficient resources to maintain system knowledge over time.

6. AI-Driven Compliance Reporting

a. Describe the system’s AI- and Machine Learning-driven reporting capabilities, including the key metrics, dashboards, and analytics available to support auditing and compliance functions.

b. Explain how the system generates and maintains AI Audit Logs, including what information is captured (e.g., flagged exceptions, rationale such as policy violation codes or confidence scores, and subsequent administrative actions or resolutions).

c. Describe how the system reports on AI-identified policy exceptions over time, including how trends are monitored and how this information can be used to inform future policy updates or controls.