Appendix_V_-_Technical_Requirements.docx

APPENDIX V – Technical Requirements

The County of Sacramento operates a robust, multi-zone Internet, Intranet and Extranet network with established network and datacenter architectures, operating and technology standards and security practices and requirements. The County’s Department of Technology provides Information Technology services across a broad spectrum of disciplines and has applicable skill sets for solution architecture, development and delivery.

Internet Data Flow As shown in the “Internet Data Flow” figure provided in this section, session initiation is critical to County security perimeter models when deploying Internet-based solutions.

Internet-based solutions provide services to County constituents and Business Partners or in some cases may receive services from County Business Partners.

Alternatives to the referenced data flows, such as utilizing an Enterprise Service Bus (ESB) or F5 Access Policy Manager (APM) can be discussed and will be considered. Note: a generic reverse proxy will not be considered secure or a viable solution.

Extranet Data Flow As shown in the “Extranet Data Flow” figure provided in this section, session initiation is critical to County security perimeter models when deploying Extranet-based solutions.

Extranet-based solutions provide services to or receive services from County Business Partners.

Alternatives to the referenced data flows, such as utilizing an Enterprise Service Bus (ESB) or F5 Access Policy Manager (APM) can be discussed and will be considered. Note: a generic reverse proxy will not be considered secure or a viable solution.

DMZ Architecture Whether the proposed solution is internally hosted, Internet or Extranet based, if it requires a data path that traverses our DMZ it must meet the tiered or staged architecture supported by the County’s DMZs. The DMZs are complemented by the Internet and Extranet Data Flows noted in the below diagrams.

Internet DMZs Zone 1, eDMZ, provides front‐end hosting Web services and other Internet exposed components Zone 2, iDMZ provides back-end database and application services and is not exposed to the Internet.

Extranet DMZs Zone 5, xDMZ, provides a staging area for Web, database or application resources used or leveraged by County Business Partners so that internal County assets are not directly exposed.

Alternatives to the referenced data flows, such as utilizing an Enterprise Service Bus (ESB) or F5 Access Policy Manager (APM) can be discussed and will be considered. Note: a generic reverse proxy will not be considered secure or a viable solution.

Public Cloud (AWS, Azure, Azure Gov, etc.)

The County of Sacramento has established a presence in Azure Commercial, Azure Government and AWS which mimics the infrastructure of our on premise data centers. Rules and guidelines for communication within the cloud are the same as on premise.

The County of Sacramento is in the process of establishing a “Cloud Connect” presence within a third party data center to provide direct connection to the major cloud vendors. We intend to deploy all the previously stated zones as the business need is developed. Additionally the opportunity exists to establish peer-to-peer connections with other Cloud tenants where feasible and appropriate. These connections would be considered “Extranet” connections as it relates to the traffic flow requirements.

Figure 1: Internet Data Flow Diagram

Figure 2: Extranet Data Flow Diagram

These technical requirements represent both infrastructure and application (technical, not business) requirements. Using all standards and diagrams provided in this Appendix, please respond to each of the requirements and explain, in detail how each requirement will be met.

Definitions of the table heading:

· [D] Desirable – Specification that is not required. Failure to meet this specification or item will NOT disqualify your response.

· [R] Required/Mandatory – You must satisfy or exceed this specification or element for your response to be deemed acceptable. If your system does not currently address the requirement, but can be modified to accommodate the requirement, indicate in your response the resources needed to make this accommodation (i.e., work plan, personnel, elapsed time, man-hours, and/or total costs).

· Narrative Request. Required to be answered.

· [Y] Yes, in current release, satisfies requirement straight out of the box.

· [YR] Yes, in current release, satisfies requirement with custom programming or beyond normal configuration. Comments and/or additional pricing required.

· [P] In next planned release. Comments and estimated release date required.

· [N] No, neither in current release nor planned in future releases.

Although your solution may not directly satisfy a requirement, if you believe modifications or adjustments are possible to satisfy the requirement respond with a P for planned and explain in the comment column.

Technical Requirements (All Responders)

GENERAL TECHNICAL REQUIREMENTS

Proposed solutions must include a complete system network diagram with the following:

· All components of the proposed system (servers, clients, peripherals, storage, etc.)

· All systems/services (support, backups, other systems, etc.) that interface with the proposed system

· Data flow between the various components and interfaces

· Protocols/Ports used per link between components

· Access/Authentication to the various components of the system.

N/A

For each component of the above system diagram, please notate any exception to the County Technical Standards as outlined at the end of this appendix.

N/A

Identify all Application modules included in the proposed system. Include the module name, version number, if it is part of the base package or optional, developer, development language, operational status, date first installed, and the number of counties where it is installed and operational. All modules listed must be included in the Cost Proposal.

N/A

Please describe your system upgrade process. Response must address the following key points:

· Who performs the upgrade?

· Are they included in the maintenance agreement?

· Will Sacramento County be required to implement each upgrade?

· If Sacramento County does not implement an upgrade will the previous version still be supported? How long will an older version be supported?

· Will County specific vendor customizations continue to work post upgrades?

N/A

Describe how your source code is managed and any scenario(s) where Sacramento County would be provided the source code.

Response must address the following key points:

· Is the source code available through an escrow-type arrangement?

· Is the source code available through other arrangements? If yes, please describe.

N/A

Describe your solutions Internet presence. Detail must contain the following:

· Description of each internet-based service

· Compatibility with major browsers and platforms

· Compatibility with the County accessibility standards.

N/A

Describe in detail your approach to integrating your software with varying and new technologies as they become available?

N/A

Describe how your system is licensed, i.e. per user, per server, per processor? Include any hardware devices required for licensing (dongles, etc.)

Does the County have the right to migrate servers to new hardware, whether that is physical servers or new Virtual platforms with no increase in costs?

N/A

Describe how your product supports the release of and stays within compliancy for new versions, including:

· 3rd Party Application Upgrades

· Desktop Operating System upgrades

· Server Operating System upgrades

· VMWare ESX Upgrades (If utilized)

· Database Version Upgrades

N/A

Proposer shall identify all embedded third party software and hardware covered by a separate license agreement. These licenses shall be provided to the County as part of the documentation. Unless specified in the pricing, all third-party software and hardware is considered included in the price of the system.

Describe the system’s ability to perform archival/incremental backups and the ability to perform open/closed database backups. Include in your response any assumed roles that Proposer Administrator staff or the County Administrator staff have in these activities.

N/A

APPLICATION TECHNICAL REQUIREMENTS

The Proposer must provide all the software necessary for a fully functioning and fully integrated System at the time of implementation.

Describe how your implementation will satisfy the requirement.

The solution must provide a facility for County staff to grant permission for individuals or groups to perform system functions. Describe the facility your product provides for granting such permissions.

PERFORMANCE REQUIREMENTS

The vendor agrees to provide a system that is sufficiently responsive to end users, such that the slowness of the system does not impede the users of the system. The COUNTY in consultation with the VENDOR will determine whether the system provides sufficient speed and responsiveness during user acceptance testing.

SYSTEM uptime shall be 99.9% availability for all key functions of the SYSTEM applications on a 24 hour per day, 7 days a week basis. The COUNTY in consultation with VENDOR has authority to make the final determination of whether the components of the System meet specifications and performance standards listed in this section.

Note: This does not apply to standard maintenance windows or preplanned downtime.

The System shall have sufficient processing and data storage to accept continuous growth in records and management. (see Appendix S – Current Volumes)

The System shall support high-performance caching layer that consistently provides high-throughput at low latency to alleviate system performance bottleneck

The System shall have ability to support session replication and transparent failover

The System shall provide the ability to recover from data loss due to end-user error and client application error

The System shall provide tools for managing environment that supports both high availability and disaster recovery

The System shall have capability to schedule routine jobs or one-time jobs that are resource intensive (e.g., mass updates)

The system shall have capability to tune the system for increasing system performance for transaction screens, processes and/or reports (e.g., index a table, allocate more memory, etc.)

The system shall have capability to setup alert/ notification when system performance unit goes below/above the configured threshold

DATA MIGRATION REQUIREMENTS

The County would like to convert current and historical data into the new system, including:

a. Unsecured = ALL of it (about 21 years)

b. Unsecured and Unpaid = before 2000 (from MS Access / BIRT?) all

c. Secured = last 12 years.

d. Secured = anything unpaid Describe your company’s experience with data conversion.

· Include your company’s conversion methodology

· Provide references to specific conversions performed recently.

N/A

WEB PRESENCE

The Solution shall allow Customer facing pages to use County branding. Describe how the proposed solution meets this requirement.

INTERFACE REQUIREMENTS

It is desirable that the proposed solution remove the need for many of the secondary systems by providing functionality within the proposed solution. In case access to secondary applications are still needed please provide information on the interface options available in your proposed solution.

The Solution shall provide controls for managing import and export of data with external systems.

The Solution shall provide controls for managing import and export of data in an XML format with external systems. Indicate in the notes if an XML schema will be provided to the County.

The proposed solution shall provide web service interfaces that external applications may use to read/write data. If available, provide a list of interfaces in notes.

Does the proposed solution provide other options for import and export of data with external systems (such as EXCEL)?

The proposed solution shall support Application Programming Interfaces (API) such as but not limited to the following:

a. Simple Object Access Protocol (SOAP)

b. Representational state transfer (REST)

c. Open Data Protocol (ODATA)

d. GraphQL

SECURITY AND ACCESS CONTROL

The Solution must provide for a security model that ensures data is protected from unauthorized access.

Describe your system’s security model.

Please describe in detail your solutions authentication mechanism.

Sacramento County has established an enterprise-wide multi-domain Active Directory to further the goal of a ‘single sign-on’ for County staff across internal County systems.

Will your solution integrate with the County’s Active Directory?

N/A

The county supports multiple Universal Principal Names (UPNs) within the county’s Saccounty.NET forest. The primary UPN in use for employees is username@Saccounty.GOV. Will the proposed solution manage the difference between the forest domain name and the UPN domain name without any impact to performance, reliability, maintenance or ease of use?

NETWORK & SECURITY PERIMETER

The proposed solution shall effectively use bandwidth between system architecture tiers as Internet, Intranet and Extranet users/partners may have limited connectivity.

The proposed solution’s bandwidth shall be factored into overall security perimeter statics and usage requirements.

· Does the proposed solution effectively utilize bandwidth?

· Please explain in detail how the proposed solution utilizes bandwidth overall and if applicable by transaction.

The proposed solution shall limit and minimize TCP/UDP port usage in light of the County’s security measures and defense in depth strategies (Firewalls, IPS, etc.).

· Does the proposed solution minimize IP port usage?

· Please explain in detail all utilized ports and relate them to the components of the proposed system. In the provided detail ensure that port usage explanations include which component session initiates the request and which component listens for the request.

The proposed solution shall use IPv4and/or IPv6 RFC compliant protocols. In light of County security measures; Stateful Packet Inspection Firewalls, Deep Packet Inspection, Intrusion Prevention Systems and other security measures the proposed solution will traverse, it must adhere to protocol standards to function properly.

The proposed solution must comply with RFC protocol standards. Please explain in detail, the proposed solution’s use of compliant protocols.

The solution shall meet the tiered or staged architecture supported by the County’s DMZs.

Whether the proposed solution is internally hosted, Internet, or Extranet based, if it requires a data path that traverses our DMZ it must meet the tiered or staged architecture supported by the County’s DMZs. The DMZs are complemented by the Internet and Extranet Data Flows noted at the beginning of the Technical Requirements section.

Internet DMZs Zone 1, eDMZ, provides front-end hosting Web services and other Internet exposed components Zone 2, iDMZ provides back-end database and application services and is not exposed to the Internet

Extranet DMZs Zone 5, xDMZ, provides a staging area for Web, database or application resources used or leveraged by County Business Partners so that internal County assets are not directly exposed.

The proposed solution must comply with the County’s DMZ architecture. Please explain in detail the proposed solution’s system architecture and if necessary how it will be located in the DMZs of the County’s Security Perimeter.

*Note - Alternatives to the referenced data flows, such as utilizing an Enterprise Service Bus (ESB) or F5 Access Policy Manager (APM) can be discussed and will be considered. Note: a generic reverse proxy will not be considered secure or a viable solution.

The proposed solution shall comply with the County remote support model.

If the proposed solution requires remote support into the County, it must comply with the County remote support model. The County can provide SSL VPN, Point-to-Point VPN or Extranet Connection access to proposed solution components residing in Zone 3, the County of Sacramento Wide Area Network. Zone 3 based components of the proposed solution can be used to support any Zone 1, Zone 2 or Zone 5 components. The County requires use of Privileged Account Management (PAM) and dual-factor authentication to access internal resources.

The proposed solution must comply with the County’s Remote Support, if required. Please explain in detail, the proposed solution’s use Remote Support.

The solution shall limit or minimize access to critical system information including but not limited to: version, platform, and application or user information.

Internet or Extranet solutions, whether County or Vendor hosted, must not overly expose or provide ease of access to such critical system information.

Please explain in detail, how the proposed solution complies with this requirement.

Proposed solutions which have County DMZ based components cannot directly integrate with the County’s Directory solution. Windows Systems in the DMZ may utilize a Zone 2 only Domain, or Administration and user authentication must be locally provided.

· Will the proposed solution comply with this requirement?

· Please explain in detail, how your solution meets this requirement

The County operates an Enterprise Service Bus (ESB) to facilitate zone compliant communication (Reverse Invoke) between Zone1/Zone2 and Zone3 via Web Service architectures (SOAP & REST).

· Will the provided solution leverage the ESB?

· Please describe, in detail, how the proposed solution can use ESB Architectures.

· If another solution is proposed for cross-zone compliant communication please provide details of that solution.

The County operates F5 load balancers that include Access Policy Manager (APM) features.

· Will the provided solution leverage the APM for securely traversing the DMZ architecture?

· Please describe, in detail, how the proposed solution will utilize the APM features.

N/A

The County operates several IP Load Balancer appliances. These appliances provide front-end web services and load balancing for clustered or peering resources.

· Will the provided solution leverage IP Load Balancers?

· Please describe, in detail, how the proposed solution can use IP Load Balancers architectures.

· Will the provided solution leverage SSL offload allowing the F5 to establish encrypted connections to the client while allowing the backend communication to the server to be unencrypted?

N/A

The County operates F5 load balancers that include Web Application Firewall (WAF, formerly Application Security Manager).

· Will the provided solution include WAF policy elements or will they have to be developed as part of the deployment?

N/A

Technical Requirements (Responders Proposing Off Site Hosted Solutions)

SERVER AND INFRASTRUCTURE SERVICES

Describe your proposed solution capabilities to provide fault tolerant and redundant system architecture.

· If utilizing County infrastructure for Virtualization and Storage Area Network (SAN), you can assume an N+1 VMware ESX architecture with VMotion and a fault tolerant multi-site SAN implementation.

N/A

Describe your proposed solution to provide disaster recovery in the event the primary site is compromised.

· If utilizing County infrastructure for Virtualization and Storage Area Network (SAN), you can assume an N+1 VMware ESX architecture with VMotion and a fault tolerant multi-site SAN implementation.

N/A

(Constituent Access) The County of Sacramento operates an Identity Access Management (IAM) solution specifically for constituent access. One of the primary intents of this solution is to reduce the number of individual accounts constituents are required to have to do business with the County.

· Will the proposed solution leverage the existing constituent IAM solution?

· If not will the IAM solution allow for the use of:

· External authentication such as MS, Facebook, Google, etc.

· Multi-Factor Authentication such as Google Authenticator

Technical Requirements (Responders Proposing On-Site County Hosted Solution)

SERVER AND INFRASTRUCTURE SERVICES

If proposing an on-site solution, provide a detailed Server Specification. This specification should provide the following for each type of environment (Development / User Acceptance and Production). These should not be “minimum” requirements, but should specify the recommended level required to reach the desired performance of the system.

· Quantity of Servers required

· Recommended Processors/Cores

· Recommended Memory

· Required Disk Space

· Required Disk IOPs

· Required Network Connections

· Required Operating System

· Required Software (Both Vendor Provided and third party purchased)

· Specify Virtual or Physical or Optional

N/A

The County of Sacramento has an Enterprise class VMWare ESX environment for the virtualization of Servers. The solution should be compatible with the County’s environment. Describe which portions of your system could be implemented in our VM infrastructure.

RFP 2026-RFP-0026 Identity Management System – SMF Airport

Appendix V - Technical Requirements Page 1 of 1

COUNTY TECHNICAL STANDARDS

In providing your responses to this RFP, the County has the following standards and infrastructures which can be leveraged depending on design. Please respond with your ability to integrate with our infrastructure and be compatible with our standards.

Authentication and Authorization:

· Microsoft Active Directory

Servers:

· Server Hardware = HP or Dell

· Virtual Infrastructures = VMWare ESX

· Server OS = Windows Server, HP-UX ,SUSE Linux, Redhat

Voice Infrastructure:

· Cisco VOIP

Storage Infrastructure:

· SAN Storage – NetApp

· Backup Architecture – HP NAS StoreEasy running CommVault Simpana

Enterprise Service Bus:

· SoftwareAG WebMethods

Database Infrastructure:

· Oracle

· Microsoft SQL Server

Programing Standards:

· Microsoft .NET

· Angular

WebServer Infrastructure:

· Microsoft IIS

· Apache Tomcat

WebServer Content Management Systems:

· Microsoft SharePoint

Network Infrastructure:

· Cisco

· Network Speeds 10Gb (Datacenters & Core Infrastructure), 1GB, 100Mb (1.54Mb – Remote Connected sites)

Multi-zoned DMZ Security Perimeter Infrastructure:

· Palo Alto Firewall

· F5 Content Manager

Desktop Environment:

· Windows Professional

· Microsoft Office

Web Browsers:

· Edge

· Chrome

System Anti-Virus:

· Crowdstrike

Messaging Infrastructure:

· Email System = Microsoft Exchange

· Anti-Virus = CISCO ESA

· Anti-Spam = CISCO ESA

Backup Systems:

· Netapp Snapshot

· Comm Vault

Automated Alert Inputs:

· SIS (intrusion, fire, HVAC, panic)

· C-Cure (Access Control and can be used in conjunction with other devices to provide other security alerts)

· Moscad (radio site alarms)

· Elevator ring down lines

Geographic Information System (GIS):

· ESRI ArcGIS

Document Management:

· FileNet Security Tools

· Tanium

· Crowdstrike image1.png image2.png image3.png