8960_Addendum1.pdf

Rev. 07/28/2016-8960_Addendum1.doc

Finance Department David P. Schmiedicke, Finance Director City-County Building, Room 406 Purchasing Services 210 Martin Luther King, Jr. Boulevard Madison, Wisconsin 53703 Phone: (608) 266-4521 Fax: (608) 266-5948 finance@cityofmadison.com www.cityofmadison.com/finance/purchasing

DATE: Wednesday, July 8, 2020

RE: ADDENDUM 1

8960-0-2020-AH

Virtual Reality Training Equipment for Police Department

Notice to All Bidders.

RFP 8960 has been re-opened and the due date is now July 29, 2020 at 2:00 PM CST. There are additional questions that must be answered in your submission, listed on the RFP document Part 3.2 and 3.3 on page 10 as well as in Appendix C. These have been added at the end of this addendum. Please read bid document and specifications carefully, then note the following responses to the questions received:

1. To confirm, no hard copies, just electronic ones submitted to bids@cityofmadison.com correct?

Yes, this is correct. When sending, please do not forget label it with RFP 8960-0-2020-AH so your bid will be saved in correct document/folder.

2. Paragraph 1.3 says to submit technical and cost proposals (Form D) in separate, distinct parts within the proposal package. Form D seems limited (and maybe a cut/past from excel), is this the exact format that must be submitted or can we include a separate quote in addition to the required forms?

No, this is not the exact format that must be used. You can include separate quote, or submit quote using your own format. We just put an excel spread sheet copy to give an example of how to submit your cost proposal. If you want to put it in your own format as long as it is clear, broken down, and detailed so we can make an informed decision, there is no problem at all.

3. Paragraph 2.2 states that all vendors need to describe any on-site installation and resources required, which form are we stating this information on?

There is no specific form for this. You could include a detailed plan for on-site installation as part of submitting Form D, or you could include it at the end of product specification that you submit to us, just as long as you clearly label it as such.

4. We would like to include additional dialogue about our product, is this okay and if so where would you like that information to be located?

Yes, we welcome additional information so that we will be able to make a very informed decision regarding this capital project. And there is no specific requirement to where you can attach this. Similar to question no. 3 above you may attach this as part of Form D, or you could attach this as part of product specifications that you submit to us, or wherever you may think is an appropriate place to maintain good flow of information for the City panels who will read your submission.

5. Paragraph 1.12 discusses addendums but only as additional information provided to the vendors by the City of Madison, not for vendors to include other pertinent information to the City.

Yes, this is correct.

July 8, 2020

7/8/2020-8960_Addendum1.doc

Bidders must acknowledge receipt of this addendum accordingly on RFB Form B, Receipt Forms and Submittal Checklist.

Please direct any other questions to the Purchasing contact person below.

Andy Hargianto City of Madison Purchasing Services

PH: (608) 266-4523

ahargianto@cityofmadison.com

REQUEST FOR PROPOSALS RFP # 8960-0-2020-AH

01. Request for Proposal.doc Page 8

Please be aware that the MPD requires a 2 year minimum warranty on all software and hardware.

In addition to the Madison Police Department selection criteria, the City Information Technology Department will review proposals for adherence to information technology technical standards.

Notice that if awarded, the proposer may be required to sign a separate Software License Agreement with the City of Madison.

3 REQUIRED INFORMATION AND CONTENT OF PROPOSALS TO BE RETURNED

Responses must be in the same sequence as listed and must be identified with the corresponding question number, i.e., Question 1, Question 2, etc.

3.1 General Information and Signatures

a. Form A – Signature Affidavit

b. Form B – Receipt Forms and Submittal Checklist

c. Form C – Vendor Profile Information

d. Form D – Cost Proposal

e. Form E – References

f. Appendix C – IT Software Acquisition Questions

3.2 Background

1. Firm Background – Describe your company in details, including the story of when it was founded, who were the founding members, how and why your company was founded, to include the missions and visions.

2. Staff Background – Describe the proposed implementation team, each member’s role, making particular mention if said members have prior law enforcement or military experience. Include subconsultants in the description. Provide a brief summary of each staff member’s qualifications, relevant experience, and additional expertise that might help in this project.

3.3 Project Qualifications and Approach

1. Previous Project Experience – Provide a description of up to two similar projects implementing and designing various scenarios of law enforcement virtual reality training. Explain your team’s project approach, to include schedules and major milestones. Were these met without any delay?

And if there were any delays describe what contributed to the delay, how your team approached the situation, and how it was resolved. Provide references and contact information associated with each project example (this can be entered on Form E).

2. Project Implementation – Please outline your plan for implementing your proposed solution for the

City of Madison Police Department. Include schedules and major milestones, and please describe what you foresee to be issues or problems (if any) associated with this project.

3. Specific Solution – How does your solution benefit a mid-sized city such as Madison, WI. Are there specific functions that can be tailored to unique and specific nature of the demographic and socio-economic makeup of Madison, WI?

09. Appendix C.docx 7/7/2020 1:16 PM Page 1 of 5

Appendix C: Information Technology Software Acquisition Questions

I. Software and Systems

a. General

1. ADA Compliance. ADA Law Accessibility & Compliance – Indicate how software is or will meet the Priority 1 checkpoints of the Web Content Accessibility Guidelines 1.0 (http://www.w3.org/WAI/) outlined by the W3C. In the event that a particular page or feature of your application is not WCAG Level 1.0 compliant, explain how you will provide an alternative, compliant page. Indicate if current application compliant with U.S. Section 508 (29 U.S.C. ‘794d) (See https://www.section508.gov/test). Provide a version of each Code you host for Disability Access, accessible via your mobile site. This version of the code should contain no frames and be mobile friendly for access from any modern smartphone or tablet running iOS, Android, or Windows. Vendor provides a sample ADA/Mobile Link.

2. Administrative Privileges. Does the application require local administrative privileges to the device it is running on? If so, please explain.

3. Application Security and Architecture. Please explain your approach to application security. For example, do you follow practices set forth by the SANS Institute, Securing Web Application Technologies http://software-security.sans.org/resources/swat and the practices of Open Web Application Security Project www.owasp.org?

4. Browser Support. Indicate the architecture used to develop the application. Indicate if all content is rendered in standard HTML5 and is viewable in all modern browsers.

Please indicate any browser restrictions, including Microsoft Edge, and the preferred browser(s) and version(s) recommended for best user experience.

5. Client footprint. Does this software require installation of anything on client workstations? If so, please explain.

6. Data Privacy. Please explain how you manage protecting Personally Identifiable

Information (PII) as defined in Wis. Stat. § 19.62(5) and other confidential information in your application.

7. Identity and Permissions Management. Please describe how identity management is handled. Does the application provide for integration with the City’s Active Directory system? How are system permissions managed? Can AD groups be leveraged – please explain and be specific. Are proper controls in place to prevent direct access to the database?

8. Legacy Data. If applicable. Please describe your method to convert data from legacy system(s).

9. Mobile Device Support. Please describe what mobile devices your application supports. Please describe what the connectivity requirements are? How does your system operate in areas without connectivity to our network or the internet?

10. Multilingual Support. Please describe the ability of your software to operate in a multilingual environment. For example, how are translations for field labels, error messages, confirmation emails, report headings, and the like handled? What languages are supported? How do users specify which language they would prefer to use? Do you accept special characters and accented characters to be entered into forms and fields?

09. Appendix C.docx 7/7/2020 1:16 PM Page 2 of 5

11. Open Data. Please explain your support for Open Data Standards found at http://project-open-data.github.io/. Do you have experience interfacing with ESRI’s Open Data portal?

12. Operating System. Please indicate any Microsoft operating system restrictions, including Windows 10.

13. Records Compliance and Data Access. Please indicate how access to data will be available to comply with Wisconsin open records laws. Do we have the ability to apply retention and disposition schedules to the data within the application? If this is Software-as-a-Service, how does the City ensure all of our data is purged from your system according to the data/records retention schedule or upon contract termination? Will we have unfettered access to our data that allows us to download and store it on our premises, and will there be additional costs to access the data for these purposes? Can we use our own reporting tools such as SSRS? Does the application have published API’s and/or web services available for us to use?

14. Software Modifications. Are you willing to make software modifications?

15. Third Party Software. Fully describe any third party software that will be needed for this system, and how you manage licensing, maintenance, and support for those.

b. Special cases

1. Financial Reporting and Data Sharing. Please explain your experience in providing

GASB-34 compliant financial reporting and data sharing with Government oriented financial software. Do you have any experience interfacing with Munis?

2. HIPAA Compliance. If this application is involved in collecting or processing protected health information, please provide proof of a HIPAA audit conducted by an independent auditor against the OCR HIPAA Audit Protocol.

3. PCI Compliance. If this application involved collecting or processing any type of online payments or financial transactions, please provide a PCI DSS Attestation of Compliance from within the past two year, and proof of registry on the VISA Global Registry of Service Providers.

4. Spatial Data. If this application is managing or interacting with spatial data, the City of

Madison used ESRI-based GIS software for managing spatial data. Please explain your experience interfacing with ESRI software.

5. CJIS Compliance. If this application is collecting or processing data related to criminal justice or law enforcement, please provide proof of CJIS compliance.

c. Support and upgrades

1. Fully explain when support is available. Include what hours are included in your maintenance agreement as well as what is available as extended service.

2. Describe your levels of severity for support calls and what your typical response times are for each level of severity.

3. Describe your handling of bugs in your software and subsequent fixes for these bugs.

4. If you allow modifications, how do you support those modifications going forward? Are they included in new releases?

09. Appendix C.docx 7/7/2020 1:16 PM Page 3 of 5

5. How are new releases and enhancements developed and notification of availability made to your customers.

6. How often do you provide product upgrades, and are the costs of upgrades included in the annual maintenance?

7. Describe a typical upgrade process, including the length of time expected and if system downtime is expected.

8. Is source code provided with your software? If not fully explain what provisions are made for the source code if your company goes out of business.

9. Do you have a user group and/or an annual conference?

II. Hosting

a. Self-Hosting Requirements (Hosted by the City)

The City may, at its option if available, choose to host the application ourselves. Please describe:

1. What server architecture is recommended? For example, do you recommend distributed client server design such separate client, application, web, and database servers? Or consolidated or hybrid client server architecture such as combined application, web and database servers?

2. What are the minimum server requirements?

3. Do you support virtualization environments? If yes, what virtualization technology is supported? E.G. VMWare

4. What DBMS is recommended, and what levels and versions?

5. If MS-SQL is supported, do you support Availability Groups?

6. Will your application run under a load balancer?

7. What is the estimated disk storage size?

8. Please list all software dependencies such as Java, .Net, C#, ColdFusion, Drupal, etc.

9. Do you have an installation and/or administrator guide? If so, please attach document(s).

b. Hosting Data Center Criteria (Hosted by vendor or their designated agent)

The City may, at its option if available, choose to have you host this application. Please describe:

1. Antivirus protection. Please indicate the antivirus software being used and how it is implemented.

2. Data Access. Please explain who will have access to what data, and when. Is explicit authorization required for access to our production environment? What about any data stored for your purposes, is it purged as soon as it’s no longer required?

09. Appendix C.docx 7/7/2020 1:16 PM Page 4 of 5

3. Data and Application Backups. Please explain how backups of data and applications are performed and the backup policies that are in place. Please indicate your method for routinely testing your backups.

4. Data Encryption. Is data in your platform encrypted both in transit (while it’s moving between users and servers) and at rest (when it’s stored in the cloud)? Please explain your encryption protocols.

5. Data redundancy. Please explain how data redundancy is provided.

6. Incident Response. Please describe how you classify and incident, and what your incident response plan is.

7. Internet Stability – Geographic Redundancy. Does the vendor house data in a secure SSAE 16 and PCI compliant data center? Indicate who owns and operates the data center(s). Outline the features of the datacenter, including redundant Internet providers, redundant power and cooling, and secure biometric access to the physical facility.

Indicate how systems are backed up and synchronized between one or more other datacenters, and their geographic locations to provide for full geographic redundancy should one of the sites become inaccessible.

8. Logging. What types of information about my environment would be logged, and how long are logs available? Please explain your logging protocols.

9. Penetration tests. Penetration tests, also known as pen tests, are simulated attacks on a system. They are performed by authorized experts to evaluate that system’s security and identify vulnerabilities, making them an important component of a proactive cybersecurity strategy. Please describe how often you perform pen tests.

10. Separation of Systems. Please describe how your environment provides for separation of instances so that corruption of one instance or client will not affect the City of Madison.

Please describe your practices to keep production environments isolated from test and development.

11. Server and Software patching. Please provide your policy or documentation that shows the methods you use to ensure your hardware and software remains patched and up-to-date.

12. Data Center Certifications. Please provide documentation that shows the data centers used to support this application meet the following certifications:

SSAE 18

The Statement on Standards for Attestation Engagements No. 18, establish requirements and provide application guidance to auditors for performing and reporting on examination, review, and agreed-upon procedures engagements, including Service Organization Controls (SOC) attestations.

Type 1 – A data center’s description and assertion of controls, as reported by the company.

Type 2 – Auditors test the accuracy of the controls and the implementation and effectiveness of controls over a specified period of time.

SOC 1

This set of Service Organization Controls reports, developed by the AICPA, measures the controls of a data center as relevant to financial reporting.

09. Appendix C.docx 7/7/2020 1:16 PM Page 5 of 5

SOC 2

This report and audit is completely different from the previous. SOC 2 measures controls specifically related to IT and data center service providers. The five controls are security, availability, processing integrity (ensuring system accuracy, completion and authorization), confidentiality and privacy. There are two types:

Type 1 – A data center’s system and suitability of its design of controls, as reported by the company.

Type 2 – Includes everything in Type 1, with the addition of verification of an auditor's opinion on the operating effectiveness of the controls.

SOC 3

This report includes the auditor’s opinion of SOC 2 components with an additional seal of approval to be used on websites and other documents. The report is less detailed and technical than a SOC 2 report.

III. Terms and Conditions

a. Fully describe licensing terms and conditions and how licenses are structured (e.g. named user, concurrent users, etc.). Attach a copy of any required licensing agreements or EULAs. Please also describe your licensing model – e.g. perpetual, subscription based, named users, concurrent users, etc.

b. Fully describe terms and conditions of your software support/maintenance program. Please include a copy of your standard agreement(s) for support and maintenance.

IV. Training

a. Fully describe all training that your company will provide, include the following information.

1. End user training; class size, length of class.

2. System administration training; class size, length of class.

3. Application support training.

4. Any custom reports tools training.

5. Any other training you deem necessary for use of your software.

b. Explain where the training is to be held, and who will be providing it.

c. Do you have any online training courses available? If yes, fully describe what is available.