Appendix A - Updated Specifications and Requirements for Legislative Tracking Tool.docx

Appendix A

Executive Ethics Commission - Legislative Tracking Tool

The following functional and security specifications are required:

Functional Specifications

1. Provides real time electronic tracking service of all Illinois General Assembly legislative and executive actions;

2. Allows for at least six (6) users with individual user IDs to access the system simultaneously from their individual computers;

3. Includes a daily synopsis of legislative and executive actions;

4. Includes search functionality and ability to export search results to Microsoft Excel;

5. Includes ability to sort and track specific items of interest to the users;

6. Subscription users must have the ability to electronically share their tracked legislative updates, so stakeholders are kept up to date without needing a subscription. Examples of electronically sharing include, but are not limited to sending the detail via email or a browser link;

7. Includes automated email alert functionality that alerts users in real time when action is taken on tracked legislative or executive items;

8. Includes a real time schedule of upcoming legislative and executive actions as soon as they are available to the public;

9. Ready to be fully accessible to end users within 14 calendar days of contract execution (if this timeframe cannot be met, provide an explanation of the reasons for a delayed implementation and an estimated alternative date for implementation);

10. Includes training materials sufficient for first time users to successfully navigate the system;

11. Provide a copy of the Service Level Agreement (SLA);

12. The contract template is attached for vendor review. This document, Appendix A, will become part of the executed contract.

Security Requirements

13. Vendor will notify the State’s Chief Information Security Officer within 24 hours of any information breach or other security incident which impacts the State’s data.

14. Vendor shall ensure encryption of State of Illinois data at rest and in motion. This encryption must comply with encryption security controls as defined in the most current version of FIPS 140 using AES encryption with a minimum key length of 256 bits.

15. Vendor shall only use State or Participant data, or State-related or Participant-related data for the purposes stated in this Contract.

16. Vendor shall not use State or Participant data, or State-related or Participant-related data, for any other purpose, including, but not limited to, data mining or bids on other government contracts.

17. Vendor and/or its agents shall not resell nor otherwise redistribute information gained from its access to the State or Participants.

18. Vendor shall not engage in nor permit its agents to push adware, software, or marketing not explicitly authorized by the State.

19. If vendor has a documented security incident policy and plan, then vendor must provide a copy upon request.

20. Vendor must maintain a robust and reliable data backup system. Vendor must supply a description of backup methodology upon request.

21. Vendor must maintain a disaster recovery methodology. Vendor must supply a description of the disaster recovery methodology upon request.

22. Vendor shall ensure all of data pertinent to this contract remains located within the contiguous United States (no Alaska or Hawaii).

23. Vendor must provide a copy of all Executive Ethics Commission data to the State without delay upon request by the State.

24. Vendor must provide a copy of all Executive Ethics Commission data to the State upon request prior to termination of contract.

25. Vendor must purge Executive Ethics Commission data within 90 days of termination of the contract, including but not limited to account information and user generated content.

Other Requirements In addition to the requirements listed above, State and Federal laws, rules and regulations as well as industry-specific guidelines require specific and often enhanced security controls on information systems. The State of Illinois is required to comply with the below laws, standards and regulations. Vendors must ensure compliance with the below as appropriate based upon the formal risk assessment to include a data classification and system categorization process.

Federal, State laws, rules and regulations -

L1. Illinois Personal Information Protection Act (815 ILCS 530) L2. Illinois Freedom of Information Act (5 ILCS 140)

Any exceptions must be provided as part of the submission of vendor quote. Agency discourages taking exceptions. State law shall not be circumvented by the exception process. Exceptions may result in rejection of the quote.