APPENDIX A - Functional and Technical Requirements FINAL.xlsx
XLSX spreadsheet 90 KB Posted
- Attached to
- Replacement of MFCU eDiscovery Platform Project
- Solicitation number
- RFP-123975
- Issued by
- Virginia
About this file
This is a Functional and Technical Requirements spreadsheet for the Virginia Office of the Attorney General's (OAG) Request for Proposal to replace the eDiscovery platform infrastructure for the Medical Fraud Control Unit (MFCU). The RFP solicits sealed proposals from qualified suppliers to establish a contract for comprehensive infrastructure replacement, including hardware, software, managed services, and professional services. The project requires suppliers to provide an on-premises Relativity Server environment with full infrastructure replacement supporting 25-50 concurrent users and at least 100TB of scalable storage, currently running Relativity Server 2024 with capabilities to support Relativity Server 2025. The scope includes complete data migration from the existing environment to the replacement environment with validation and post-deployment testing, both onsite installation at the OAG office in Richmond, Virginia and offsite backup configuration at an existing OAG disaster recovery site in Northern Virginia.
Suppliers must meet all Must Have requirements to be considered, including offering a separate comprehensive managed services plan for 24/7/365 monitoring and support, providing both onsite and offsite backup solutions with hardware and software, including all hardware warranties and software licenses for at least a three-year period, and ensuring annual AICPA SOC-2 Type 2 audits covering Security, Availability, Processing Integrity, Privacy, and Confidentiality. Additional critical requirements include compliance with all current Commonwealth of Virginia Information Technology Resource Management (VITA) Security Policies and Standards, compliance with the Health Insurance Portability and Accountability Act, provision of help desk support with severity-level assignment for requests, notification of security incidents within 24 hours, daily submission of log telemetry data for endpoint detection and response monitoring, and provision of user training documentation. The proposal must also address disaster recovery planning, security risk management processes, post-implementation reporting, and compliance with Section 508 accessibility standards where applicable.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
| Instructions |
| Please review the RFP document, including the Appendices, prior to updating this spreadsheet. |
| Must Have Requirements |
OAG will review each proposal received by the due date and time to determine whether it meets the Must Have requirements of this RFP. Supplier responses to Must Have requirements on the second tab are evaluated on a Met-or-Not-Met basis. Any proposal that does not meet all of the Must Have requirements will be set aside and receive no further consideration. For each requirement, insert a "Y" in Column C if the proposed service meets that requirement. Insert an "N" in Column C if it does not meet that requirement.
Functional And Technical Requirements
Tab "B VITA" involves requirements for the technical components of proposed services.
Tabs "A" through "E" list detailed requirements in questionnaire format to facilitate direct responses and establish accountability regarding delivery of the solution by Suppliers. You must respond to each requirement by entering, in the space provided in Column C, a code that best corresponds to its intended response for the requirement listed.
The acceptable codes in Column C are:
Y - "Yes" - The Supplier can fully meet the requirement as documented with its current service. The Supplier should provide in Column D an explanation of how the requirement will be met. This may include use of alliances with other Suppliers. Supplier may also use Column D to cross-reference a detailed explanation included in an attachment of its proposal.
F - "Yes, Future" - The Supplier will be able to fully meet this requirement in the near future (not longer than six months from the date of the proposal). In Column D, the Supplier should provide an explanation of how the requirement will be met, the approximate date the requirement will be imet and cross-reference any attached documentation.
N - "No" - The Supplier cannot meet the requirement and has no firm plans to be in the position to meet this need within six months from the date of the proposal.
| Additional Information |
| OAG recognizes that supplier products may have functions and features that have not been asked about. While it will not be scored, vendors wishing to share additional information about their product may list them on the "Additional Product Information" tab at the end of this workbook. |
| The height of each row, and cell width, may be increased as needed, but otherwise the format of this document should not be significantly changed. Suppliers may also reference other information to avoid duplication or provide attachments if more space is needed. Changes to the document should not prevent the document from being printed. |
&F
&P
A. Must Have
| A. Must Have Requirements | |||
| Reference No. | Requirement | "Y"/Yes, "N"/No, | Additional Details |
| A.1 | Proposals must be received by the due date and time. No late proposals will be accepted or reviewed. |
| A.2 | Supplier must be able to offer a separate comprehensive managed services plan for 24/7/365 monitoring and support for the full lifecycle of the deployed environment. Managed services agreement must include but is not limited to 24/7/365 remote monitoring, proactive maintenance patching and updates, troubleshooting and system upgrades, access to eDiscovery industry experts and ongoing optimization and reporting. |
| A.3 | Proposal provides an on-premises (non-cloud-based) Relativity Server environment. |
| A.4 | Proposal provides a full infrastructure replacement including network switches, redundant firewalls, and other hardware for existing Relativity Server environment supporting 25-50 concurrent users with at least 100tb of scalable storage currently running Relativity Server 2024 with capabilities to support Relativity Server 2025. |
| A.5 | Proposal includes full data migration from existing environment to replacement environment with validation and post deployment testing to ensure a seemless transition. |
| A.6 | Proposal includes both an onsite and offsite backup solution including hardware, software and methodology. |
| A.7 | Proposal includes all hardware warranties and software licenses to operate the environment for at least a 3 year period. Software includes but is not limited to all required operating systems, backup software, network monitoring and threat detection solutions, and software to enable native imaging within Relativity. Exceptions for licensing include the Relativity user and processing licenses to be provided by OAG and potential exception for VMware vSphere Foundation licensing if that product is identified as the preffered solution for virtualization and is unable to be provided by supplier. |
| A.8 | Proposal includes all professional services to configure and deploy the environment. This includes onsite installation and configuration of all hardware and data migration at our office in Richmond, VA as well as the offiste data backup solution at an existing OAG disaster recovery site in Northern Virginia. |
| A.9 | Supplier shall ensure performance of an AICPA SOC-2 (Type 2) audit at least once annually of the Application’s environment. Upon request from OAG, Supplier shall provide a non- redacted copy of current AICPA SOC-2 (Type 2) audit. Supplier shall assist OAG in obtaining the current AICPA SOC-2 (Type 2) audit report from any third-party providing services to Supplier, if said third-party services involve the processing or storage of any Content. The Trust Service Principles that should be covered in the SOC -2 Type 2 are: Security, Availability, Processing Integrity, Privacy and Confidentiality. A copy of this report shall be emailed to Security@oag.state.va.us. |
| A.10 | The Supplier must abide by all the rules and regulations of the Health Insurance Portability and Accountability Act of 1996, 104-191 (HIPPA). |
| A.11 | The Supplier agrees to notify OAG of Security Incident Notifications within 24 hours. |
| A.12 | The Supplier shall share and submit log telemetry data to the OAG for endpooint detection response and monitoring on a daily basis to Security@oag.state.va.us. |
&F
&P
B. VITA
| B. VITA Requirements | |||
| Reference No. | Requirement | "Y"/Yes, "N"/No, "F"/Future | Explanation and Cite Section of your Response as Needed. |
| B.1 | Does your solution comply with all current COV ITRM Security Policies and Standards, as applicable, found at: https://www.vita.virginia.gov/it-governance/itrm-policies-standards/? |
If proposed solution does not, please provide details that specify the Standard/Policy and how Supplier's solution does not comply.
B.2 Does your solution comply with all current COV ITRM Policies and Standards, as applicable, found at: https://www.vita.virginia.gov/it-governance/itrm-policies-standards/?
If proposed solution does not, please provide details that specify the Standard/Policy and how Supplier's solution does not comply."
B.3 Does your solution/application/product provide effective, interactive control and use with nonvisual means and provide 508 Compliance in accordance with the following standard regarding IT Accessibility and 508 Compliance:
https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/psgs/domain-amp-topic-reports/pdf/ETAITAccessibilityTopicReportGOV103.pdf (Refer to https://www.section508.gov/ and www.access-board.gov for further information) If yes, please describe how this functionality is achieved and include a completed Voluntary Product Accessibility Template (VPAT) with your proposal. The VPAT template can be accessed at the following URL: https://www.section508.gov/sell/vpat If no, does your solution/application/product provide alternate accessibility functionality? Please describe.
If not applicable to this procurement, mark “N/A.”
B.4 Do your proposed interfaces to Commonwealth systems comply with or have approved exceptions to all applicable Commonwealth Data Standards as found at:
https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/docs/COV_Adopted_Standards.xlsx
If not, please explain.
B.5 Does your proposed equipment meet the current U.S. Environmental Protection Agency’s and Department of Energy’s Energy Star guidelines?
If no, please explain.
If not applicable to this procurement, mark “N/A.”
B.6 Does your solution comply with VITA's current COV IT Prohibited Hardware, Software and Services Policy: https://www.vita.virginia.gov/policy--governance/itrm-policies-standards/ If proposed solution does not, please provide details that specify how the Supplier's solution does not comply.
B.7 Does your solution comply with VITA's current SEC520 Policy: extension://efaidnbmnnnibpcajpcglclefindmkaj/https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/psgs/pdf/SEC520-IT-Risk-Management-Standard.pdf ?
If it proposed solution does not, please provide details that specify how the Supplier's solution does not comply.
B.8 Does your solution comply with VITA's current SEC530 Policy: extension://efaidnbmnnnibpcajpcglclefindmkaj/https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/psgs/pdf/SEC530_Information_Security_Standard.pdf ?
If it proposed solution does not, please provide details that specify how the Supplier's solution does not comply.
C. General Functional
| C. General Functional Requirements | |||
| Reference No. | Requirements | "Y"/Yes, "N"/No, "F"/Future | Explanation and Cite Section of your Response as Needed. |
| Functionality / Technical | |||
| C.1 | Proposal provides a detailed description of the proposed onsite and offsite backup solutions and methodology. | ||
| C.2 | Proposal provides a detailed description of the plan to deploy and configure the new environment including description of the data migration and validation process. | ||
| C.3 | Proposal provides a detailed description of the approach to handling software licenses on this project with a list of proposed software pachages to be utilized. | ||
| C.4 | Proposal describes estimated timeframe for configuration and deployment of the environment and methodology to minimize system downtime during the transition to the new environment. | ||
| C.5 | If applicable, describe your company’s AI features. Include Ethical components, transparency and accountability, data privacy and security measures, regular updates and improvements, bias mitigation, compliance with regulatory standards, performance and reliability and ethical considerations. | ||
| Security | |||
| C.6 | Proposal describes how your company intends to comply with the data security requirements outlined within this RFP and includes confirmation of your company’s SOC 2 Type II certification or equivalent. | ||
| C.7 | Security Risk Management Process: Must include your application, monitoring and management of the controls used. How you establish context for security risk-based decisions, how you assess the risk, how you respond to the risk once it’s determined and how you monitor on an ongoing basis using communications and feedback for continuous improvement within your organization. | ||
| C.8 | Disaster Recovery/Security Plan: Must include how your organization mitigates risk against any disaster that would affect the ability to provide OAG with the proposed background services solution as well as implement robust data security measures to protect sensitive data. | ||
| Service and Support Management | |||
| C.9 | Will the Supplier notitfy OAG if there are issues with the configuration and deployment process? If yes, please describe the process and method of notification. |
C.10 Please describe your post implementation and reporting plan.
&F
&P
D. Help Desk & Support
| D. Help Desk & Support Requirements | |||
| Reference No. | Requirements | "Y"/Yes, "N"/No, "F"/Future | Explanation and Cite Section of your Response as Needed. |
| D.1. | Does the Supplier offer help desk services? If yes, please describe the specific levels of support, the general skills of staff at each level of support, hours of operation, how user agencies contact the help desk, escalation procedures and the Supplier's help desk operations generally. Note: Information provided in response to this question should also be included in the Supplier's response to Appendix C - Service Level Agreements (SLAs). |
D.2. Does your help desk processes assign a level of severity to each help desk request? If yes, please describe. If no, how do you prioritize help desk requests? Note: Since level of severity normally is factored into performance measures, the Information provided in response to this question should also be included in the Supplier's response to Appendix C - Service Level Agreements (SLAs).
D.3. Does the Supplier provide ongoing support for updates to ensure compliance with Technical and Operation Updates (TOUs) issued by federal agencies, and with statutory requirements issued by the Commonwealth of Virginia? If yes, please describe. If no, please describe the plan (if any) to provide ongoing support for updates to ensure compliance with Technical and Operation Updates (TOUs).
&F
&P
E. User Training
| E. User Training Requirements | |||
| # | Requirements | "Y"/Yes, "N"/No, "F"/Future | Explanation and Cite Section of your Response as Needed. |
| E.1. | Does the service provide OAG end users with system/application training to include access to or receipt of user training documentation? Please provide details. |
&F
&P
F. Additional Product Info
File details come from the government source that posted it. Updated .