Attach 9 -Baseline Technical Requirements.xlsx
XLSX spreadsheet 35 KB Posted
- Solicitation number
- DPHHS-RFP-2024-0497KH
- Issued by
- Montana
About this file
The document is a detailed technical requirements spreadsheet for the Montana Access to Quality Childcare System (MAQCS) Rebid, developed by the State of Montana. The spreadsheet contains 178 line items across multiple technical domains including data conversion, data management, design/configuration, hosting environments, interfaces and integrations, operations/maintenance, security, and testing. The technical requirements cover comprehensive specifications for implementing a database system to support child care licensing functions for providers and facilities, including subsidy and contracting activities.
The technical requirements emphasize robust data management, security, and integration capabilities, with specific focus on compliance with federal standards like NIST 800-53, HIPAA, and other regulatory frameworks. Key technical expectations include providing secure, scalable hosting environments, supporting multiple authentication mechanisms, ensuring data privacy and protection, implementing role-based access controls, supporting real-time and batch data exchanges, and maintaining comprehensive audit trails. The system must accommodate complex workflows, support electronic document management, provide advanced reporting capabilities, and enable seamless integration with existing state enterprise systems while maintaining high performance and security standards.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| CCUBS Rows per table11.29.23.xlsx | XLSX spreadsheet | |
| Output_Inventory_MAQCS.xlsx | XLSX spreadsheet | |
| Attach 7 - Resource Allocation Schedules.xlsx | XLSX spreadsheet | |
| Project_Management_Deliverables_MAQCS.xlsx | XLSX spreadsheet | |
| Attach 8 - Technology Matrix.xlsx | XLSX spreadsheet | |
| Acronyms_Definitions_and_Terms_MAQCS.xlsx | XLSX spreadsheet | |
| CCUBS_Production_Calendar_2023_MAQCS.pdf | ||
| CCUBS_ERD_Tables_MAQCS.pdf | ||
| Section_5_Cost_Sheet.xlsx | XLSX spreadsheet | |
| 1200452-event.pdf | ||
| CCUBS_Data_Dictonary_MAQCS.xlsx | XLSX spreadsheet |
Show all 11
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Name | TSD Baseline Category | Description | Defined Tags | Delivery Type | Description |
| Data Conversion | Enter 5 for items met out of the box with no development or configuration |
Enter 4 for items met with configuration Enter 3 for items met with minor development (12 hours or less) Enter 2 for items that require design and development (13 to 79 hours) Enter 1 for items that require major desgin and developmen (80 hours or more)
| Enter 0 if this cannot be met | Describe how this will be met | |||
| DC01 | Data Conversion, Cleansing, & Migration | The Vendor shall make all efforts to work with Department guidelines to use legacy data stored in a Department data warehousing solution to make real-time retrieval and transformation of legacy data within the application for presentation within the solution. The Vendor will work with the Department to determine the extent of data conversion needed to meet business requirements where not feasible to use a data warehouse solution. | ||
| DC02 | Data Conversion, Cleansing, & Migration | The Vendor shall provide authorized Department or other designated staff access to an environment to validate converted data and provide support for the data validation effort. | Conversion,Data | |
| DC03 | Data Conversion, Cleansing, & Migration | The Vendor shall work with the Department to identify the data elements that will be converted into the Vendor's solution. For legacy data elements that cannot be converted into the Vendor's solution, the Vendor shall work with the Department to achieve desired business outcomes using the data elements in the Vendor's solution. | Conversion,Data | |
| DC04 | Data Conversion, Cleansing, & Migration | The Vendor shall work with the Department to identify data elements or fields in the Vendor's solution that are not available to be converted from the legacy system, and whether the conversion programs should fill them with default or initial values. | Conversion,Data | |
| DC05 | Data Conversion, Cleansing, & Migration | The Vendor must perform one or more test conversions as necessary, before final the conversion of the data, and present the results to the State. | Conversion,Data,Testing | |
| DC06 | Data Conversion, Cleansing, & Migration | The Vendor shall produce the reports necessary to demonstrate adequate checks and balances within the data conversion process. | Conversion,Data,Reports | |
| DC07 | Data Conversion, Cleansing, & Migration | The Vendor shall convert electronic documents identified by the Department in a format approved by the Department. | Conversion,Data | |
| DC08 | Data Conversion, Cleansing, & Migration | The Vendor shall provide convenient access to electronic documents from systems being replaced. Access will be considered a stipulation of the contract. | Conversion,Data | |
| DC09 | Data Conversion, Cleansing, & Migration | The Vendor shall produce comparative reports for all converted data. Any data quality issues will be addressed by the Department and a plan for mitigating the data quality issues will be developed with the Vendor. | Conversion,Data | |
| Design, Configuration, Build | ||||
| DCB01 | Design, Configuration, & Build | The Vendor solution shall be configured to use State standardized authentication mechanisms currently defined as Active Directory or AAD SAML/OAuth authentication for state employee logins, coupled with multi-factor authentication (RSA preferred), and OKTA for citizen authentication. | Authentication,Security | |
| DCB02 | Design, Configuration, & Build | The Vendor shall make all efforts to utilize Department and/or State Technology Platforms and State preferred Cloud-Hosting Infrastructure for deployment of the solution. The Vendor shall schedule a discovery session with the department to determine available platform technologies and where these can be used for the solution. | Environment,Hosting | |
| DCB03 | Design, Configuration, & Build | The Vendor must provide the Department with a copy of the Custom Software Source Code if Vendor provides such Custom Software to the Department for the solution or a component of the solution, together with the Configuration, and updated associated technical Documentation for the Custom Software and configuration. The information must be provided: (i) upon Acceptance of each solution or component; (ii) when Vendor delivers or implements an Enhancement to a Module during the Term; (iii) as described in the Statement of Work; and (iv) at other times during the Project and Maintenance as requested by the Department. The Vendor must provide such Source Code and Documentation at no additional cost in a format acceptable to the Department. The Vendor must Deliver custom code to a code repository of the Department's choosing in an automated fashion. | ||
| the Department may request that the completeness and accuracy of any such Custom Software Source Code and/or associated technical documentation be verified by a representative of the Department after full disclosure to Vendor of information reasonably requested by the Vendor about such representative. Unless otherwise agreed in writing by Vendor and the Department, verification will be performed on-site at Vendor's premises, utilizing Vendor's equipment and software, at a time reasonably acceptable to Vendor. The Vendor must make technical and support personnel available as reasonably necessary for the verification. In the event the Custom Software Source Code and/or associated technical Documentation is not accurate or complete, Vendor must promptly correct such inaccuracies or incomplete code, but in all cases within 10 Days. | Source Code | |||
| DCB04 | Design, Configuration, & Build | The Vendor shall work with the department to determine the scope of use for Artificial Intelligence and Machine Learning in the Solution. The use of these technologies will be strictly governed by the Department and the State in terms of use, data access, learning models, and parameters around interaction with users. | AI,Design | |
| DCB05 | Design, Configuration, & Build | The Vendor's solution shall accommodate customer preferences for communications by electronic inbox, written correspondence, email, text, and phone. | ||
| DCB06 | Design, Configuration, & Build | The Vendor shall develop and submit a design session schedule, agendas, and minutes for review by the Department. | Design | |
| DCB07 | Design, Configuration, & Build | The Vendor shall conduct collaborative design sessions to address all gaps identified during requirements validation. | Design | |
| DCB08 | Design, Configuration, & Build | The Vendor shall, in the design sessions, recommend solutions for each configuration gap, as defined in requirements validation, that will produce the desired business outcomes. If a gap cannot be addressed via configuration, the Department may consider making policy changes before approving customizations to the solution. | Design | |
| DCB09 | Design, Configuration, & Build | The Vendor shall work with the Department to develop and deliver baseline, transition, and target architecture models and diagrams for consumption by IT staff, business staff, and all associated stakeholders. | Design | |
| DCB10 | Design, Configuration, & Build | The Vendor shall demonstrate completed functionality, on a cadence determined by the Department, as the solution is configured/built, using a fully functioning environment. | Configuration | |
| DCB11 | Design, Configuration, & Build | The Vendor shall migrate completed releases promptly through relevant testing levels to User Acceptance Testing (UAT) following an agreed-upon release process and policy. | Migration,Testing | |
| DCB12 | Design, Configuration, & Build | The Vendor shall provide the design for the online help approach and documentation, as appropriate. | Design,Support | |
| DCB13 | Design, Configuration, & Build | The Vendor shall work with the Department to establish the required interfaces as defined in the detailed scope of work. | Interface | |
| DCB14 | Design, Configuration, & Build | The Vendor shall ensure the implementation of auditing and general controls as defined by NIST 800-53 current revision to ensure the effective use of the technical architecture and data in meeting requirements. | Audit,Design | |
| DCB15 | Design, Configuration, & Build | The Vendor must provide all technology and equipment for Vendor staff necessary to support and complete the scope of work and the contractual obligations. | ||
| DCB16 | Design, Configuration, & Build | The Vendor shall be responsible for operating and maintaining any software needed to support all components and project tools in use by the Vendor. | Maintenance,Operations | |
| DCB18 | Design, Configuration, & Build | The Vendor shall provide recommendations for simplified business rules and business processes to the Department. | Design | |
| DCB19 | Design, Configuration, & Build | The Vendor shall configure, support and maintain all components of the solution in a manner that reflects the performance expectations described in this RFP. | ||
| DCB20 | Design, Configuration, & Build | The Vendor's solution shall be free of any software components that are the result of legacy code transformation. | ||
| DCB21 | Design, Configuration, & Build | The Vendor's solution shall provide Web-based content that is supported by standard modern web browsers without requiring specialized plug-ins or applets to function, and is mobile device compatible either through a mobile web view or a mobile app. | Design | |
| DCB22 | Design, Configuration, & Build | The Vendor's solution shall allow the Department to edit and change any logo, color scheme, and static text in the application and correspondence templates to match current Department branding guidelines. All static text must be approved by the Department. | Configuration,Design | |
| DCB23 | Design, Configuration, & Build | The Vendor's solution shall provide inactivity and idle time limit session expiration as specified in NIST 800-53 current revision. | Configuration,Security | |
| DCB24 | Design, Configuration, & Build | The Vendor shall ensure all hardware, software, and communication components installed for use by Department staff are compatible with the State's currently supported versions of desktop operating systems, supported desktop productivity software, modern browsers, and current technologies for data interchange. | Configuration,Design | |
| DCB25 | Design, Configuration, & Build | The Vendor's solution shall allow internal and external stakeholders to upload and view electronically submitted documents as determined by business requirements. | Configuration,Design | |
| DCB26 | Design, Configuration, & Build | The Vendor's solution shall have business process orchestration in an event-driven environment that maximizes process automation. | Configuration,Design | |
| DCB27 | Design, Configuration, & Build | The Vendor's solution shall provide context sensitive-help (situational clarification and support associated with process-specific steps), to support user activities. | Configuration,Design,Support | |
| Data Management | ||||
| DM01 | Data Management | The Vendor's solution shall maintain a record/audit trail of errors during update processes, accounting for originating source and user. | Audit,Data | |
| DM02 | Data Management | The Vendor shall ensure that all narrative descriptions of codes and abbreviations used in the solution are available for reporting. | Data | |
| DM03 | Data Management | The Vendor shall develop and maintain an electronic data dictionary using industry best practices to be approved by the Department. At a minimum, the data dictionary shall contain for each field: field name in a human-readable format, field description, database field name, database table, field type and length, valid values, and their corresponding descriptions. | Data | |
| DM04 | Data Management | The Vendor's solution shall be compliant with the Social Security Number Removal Initiative. (SSNRI) where applicable. | Data | |
| DM05 | Data Management | The Vendor shall be able to demonstrate the ability to support requirements for backup and archiving consistent with Department SLAs, State, and industry standards. The Vendor shall also adhere to data retention requirements cited in 45 CFR 164.316 and the State's Administrative Rules. | Data | |
| DM06 | Data Management | The Vendor shall provide the capability to exchange data in standard and non-standard formats as well as structured and unstructured data with multiple sources including a data warehouse and large data storage solutions. | Data,Interface,Integration | |
| DM07 | Data Management | The Vendor's solution shall perform batch control including logging and reporting where applicable. | Data,Reports | |
| DM08 | Data Management | The Vendor's data management strategy shall include the following concepts: Data Integrity (data cannot be modified undetectably), Data Availability (access is not inappropriately blocked or denied), Data Authenticity (validation of transactions), Data Security (encryption and Department approved security protocols and processes), Non-repudiation of Data (parties to a transaction cannot deny their participation in the transaction). | Data | |
| DM09 | Data Management | The Vendor shall ensure complete transparency of all data fields in reports generated by the system including providing the Department with query language, pseudo code, narrative description, analytic protocols, and assumptions to document the logic and formulas used in all calculations. | Data,Reports | |
| DM10 | Data Management | The Vendor shall create and maintain a suite of Department/Vendor-defined online reports to allow users to choose from pre-built defined parameters to generate customized reports for monitoring the daily operations of the solution. | Data,Reports | |
| DM11 | Data Management | The Vendor shall certify that all unmasked or unscrambled Department data will reside in data centers located in the continental United States. Additionally, this data will only be accessible by resources within the continental United States that have completed the necessary HIPAA and PHI training. Any data that will be accessed by resources that are not physically located in the United States will be masked or scrambled thereby removing the HIPAA, PHI, and PII connection between interested parties and the data. | Data | |
| DM12 | Data Management | The Vendor's solution shall be configured and maintained to validate and standardize addresses according to United States Postal Service (USPS) verification, validation, and standardization rules when addresses are used in the solution. | Data | |
| DM13 | Data Management | The Vendor's solution shall facilitate real-time data processing including data cleansing, data loading, data brokerage, integration, validation, reconciliation, and synchronization with the Department's and State's enterprise systems. | Data | |
| DM14 | Data Management | The Vendor's solution shall optimize and consolidate data management storage. | Data | |
| DM15 | Data Management | The Vendor's solution shall maintain a normalized RDBMS with referential integrity and is optimized to meet performance requirements when using standard database technologies. The Vendor shall schedule a discovery and review session to determine the best strategy for database technologies. | Data | |
| DM16 | Data Management | The Vendor's solution shall provide a method to access, query, and report against archived data external to the Operational Data Store (ODS). | Data,Reports | |
| DM17 | Data Management | The Vendor shall demonstrate through data analysis that the implementation outcomes have been validated and are accurate. | Data | |
| DM18 | Data Management | The Vendor shall participate in ongoing data governance meetings as required by the Department. | Data | |
| DM19 | Data Management | The Vendor's solution must have the flexibility to quickly accept new and incremental data items from interfaces, integrations, and external data sources as needed | Data,Interface,Integration | |
| DM20 | Data Management | While the Department prefers real-time/event-driven processes, the Vendor shall provide a tool to easily administer and execute scheduled events (e.g. reports, file transfers, processes, notifications) to be performed regularly (e.g. daily, weekly, monthly). | Data | |
| DM21 | Data Management | The Vendor shall provide an architectural data model that identifies the data elements required for an end-to-end business process execution including the identification of data standards that will reduce future rework to achieve successful data sharing across the enterprise and for intrastate/interstate exchanges. The model is required to be used as a reference to provide a high-level overview of the data and relationships used by the enterprise and to provide a tool for ensuring the completeness of the business model. | Data,Design | |
| DM22 | Data Management | The Vendor shall standardize the structure and visibility of data and applications to support automated electronic data exchanges within the Department's and State's enterprise to promote interoperability. | Data,Interface,Integration | |
| DM23 | Data Management | The Vendor's solution shall maintain online access to selected management reports and annual reports on a schedule defined by the Department. | Data,Reports | |
| DM24 | Data Management | The Vendor shall be responsible for data management including ensuring that the architecture addresses data semantics, data harmonization, and shared data ownership. | Data,Design | |
| DM25 | Data Management | The Vendor's solution shall assign standardized unique internal identifiers for entities and prevent the creation of duplicate records. | Data | |
| DM26 | Data Management | The Vendor shall be responsible for backup and retention of data to include Incremental backups and Full backups of databases/data on a schedule defined by NIST 800-53 current revision or as defined by the Department. | Data | |
| DM27 | Data Management | The Vendor's solution shall maintain user-controlled parameters for all standards and messages. | Data | |
| DM29 | Data Management | The Vendor's solution shall provide proper data validation rules (e.g., all fields defined as alphabetic contain only alphabetic data, fields defined as numeric contain only numeric data, items with definitive upper and/or lower bounds are within the proper range, and dates are valid and reasonable). | Data | |
| DM30 | Data Management | The Vendor's solution shall capture and maintain the data items needed for State or Federal reporting requirements. | Data | |
| DM31 | Data Management | The Vendor's solution shall validate calculated data items. | Data | |
| DM32 | Data Management | The Vendor's solution shall support the Extract, Transform, and Load (ETL) processes from real-time web services or batch processes. | Data,Interface,Integration | |
| Hosting and Environments | ||||
| ENV01 | Hosting & Environments | The Vendor shall provide hosting services that shall meet all State requirements. | Environment,Hosting | |
| ENV02 | Hosting & Environments | The Vendor's hosting solution shall provide the flexibility to integrate other solutions for security and regulatory purposes in the future and be cost-effective with on-demand scaling capabilities based on load and traffic for the solution. | Environment,Hosting | |
| ENV03 | Hosting & Environments | The Vendor's hosting environment for all solution components shall be compliant as demonstrated with a SOC 2 Type 2 compliance report, Federal Risk and Authorization Management Program (FedRAMP) Certification, and/or a FedRAMP Risk Assessment that indicates compliance, or has a documented NIST 800-53 current revision at a "moderate" system risk assessment designation. | Environment,Hosting | |
| ENV04 | Hosting & Environments | The Vendor's solution and all environments shall be available and accessible twenty-four (24) hours a day, seven (7) days a week, except for planned downtime due to system upgrades or routine maintenance. All planned downtime and maintenance outages shall be coordinated and approved by the Department at least five (14) business days in advance. All planned downtime and maintenance shall follow the Department's change management processes. | Environment,Hosting | |
| ENV05 | Hosting & Environments | The Vendor shall provide the ability to run multiple sessions /environments/applications/areas/views simultaneously. This includes providing sufficient environments and configurations (e.g., multiple environments, multiple application layers, hub architecture) necessary to perform all required functions (e.g., testing, training, production operations, modeling, and disaster recovery). | Environment,Hosting | |
| ENV06 | Hosting & Environments | The Vendor shall identify the physical location(s) where the Vendor's solution is installed and operating. | Environment,Hosting | |
| ENV07 | Hosting & Environments | The Vendor shall identify and describe the licenses necessary for the scope of work to support the infrastructure that will provide sufficient bandwidth and redundancy to ensure accessibility, reliability/fault tolerance, and acceptable performance. | Design,Environment | |
| Interfaces and Integrations | ||||
| IN01 | Interfaces & Integration | The Vendor's solution must ensure that all data exchanges including inbound and outbound interfaces shall comply with industry standards (e.g., National Information Exchange Model (NIEM), National Institute of Standards and Technology (NIST), HIPAA-compliance standards, Health Level 7 (HL7), Fast Healthcare Interoperability Resources (FHIR)) and/or other standards defined by the Department | Interface | |
| IN02 | Interfaces & Integration | The Vendor shall support the exchange of data between the System and the systems with which it interfaces (including external entities) to facilitate business functions that meet the requirements of Department policy, and federal and State rules and regulations. | Interface | |
| IN03 | Interfaces & Integration | The system shall be capable of sending and receiving real-time discrete transactions between components, integrated systems,and interface-connected systems. | Interface,Integration | |
| IN04 | Interfaces & Integration | The Vendor's solution shall provide the ability to view raw daily interface files, archive raw daily interface files, and maintain said files according to a schedule coordinated with the Vendor and the Department. | Interface | |
| IN05 | Interfaces & Integration | The Vendor shall document all interfaces in an Interface Control model which will include data layout documentation, data mapping crosswalk, inbound/outbound capability, and frequency of all interfaces. The Department will approve finalized interface designs. | Interface | |
| IN06 | Interfaces & Integration | The Vendor's solution shall include a process and toolset to maintain interfaces, code, data models, and reference data. | Interface | |
| IN07 | Interfaces & Integration | The Vendor shall design, develop and maintain interfaces. Each Application Program Interface (API) and components will be documented to enable integration and consumption with a third-party solution, including generating access tokens, provisioning of secret/shared keys, and other mechanisms required for authentication. This effort is performed in collaboration with other stakeholders in the Department and State. | Interface,Integration | |
| IN08 | Interfaces & Integration | The Vendor shall ensure proprietary interfaces, integrations, and protocols are not used. Loosely coupled interfaces and integrations shall be used in all instances. | Interface,Integration | |
| IN09 | Interfaces & Integration | The Vendor's solution shall support the retrieval and presentation of data associated with geographic indicators such as by state, county, zip code, peer group, or other geographical indicators specified by the Department. | Interface | |
| IN10 | Interfaces & Integration | The Vendor's solution shall provide an architecture designed to support vertical and/or horizontal infrastructure and application scaling to meet demand increases and provide model documentation for such architecture. | Interface | |
| IN11 | Interfaces & Integration | The Vendor's solution shall use standard messaging formats (e.g. XML, JSON, EDI, etc.) to ensure interoperability. | Interface,Integration | |
| IN12 | Interfaces & Integration | The Vendor's solution shall have the ability to identify errors in transactions and immediately notify the source system of the specific errors including whether the errors have precluded loading and/or using the data. | Interface,Integration | |
| IN13 | Interfaces & Integration | The Vendor's solution shall support standard web services and specifications (e.g., REST, WSDL, WS-*, SOAP, JSON, XML, EDI). | Interface,Integration | |
| IN14 | Interfaces & Integration | The Vendor's solution must be capable of receiving, translating, and processing data to and from a variety of protocols (e.g., FTPs, SFTP, HTTPS, JMS, JDBC, ODBC, NET, AS2, AS3, SMTP, SSH, TCP, CICS). The Vendor shall include in their response a list of protocols supported. | Interface,Integration | |
| IN15 | Interfaces & Integration | The Vendor shall provide an architecture that has clearly defined service endpoints. | Design | |
| IN16 | Interfaces & Integration | The Vendor shall provide technical, functional, and performance documentation as required for all interfaces and integrations. | Interface,Integration | |
| IN20 | Interfaces & Integration | The Vendor's solution shall ensure information and event notifications include aggregated and integrated information. | Interface,Integration | |
| IN22 | Interfaces & Integration | The Vendor's solution shall provide the ability to share and federate data with other data-sharing partners. | Interface,Integration | |
| IN23 | Interfaces & Integration | The Vendor's solution shall provide the ability to create/edit, send, receive, and process standardized transactions and data relative to the Vendor's scope of work. | Interface,Integration | |
| IN25 | Interfaces & Integration | The Vendor shall be responsible for understanding the business processes to automate and orchestrate appropriate workflows, business rules, data flow, and metadata within the solution and work collaboratively with other systems. | Interface,Integration | |
| IN26 | Interfaces & Integration | The Vendor shall provide an environment where components are loosely coupled and can be added or replaced quickly. | Interface,Integration | |
| IN27 | Interfaces & Integration | The Vendor's solution shall allow internal and external users to enter data using electronic forms and receive documents electronically from other systems. | Interface,Integration | |
| IN28 | Interfaces & Integration | The Vendor's solution shall have the capability to receive and display data, messages, and alerts from other systems in real time. | Interface,Integration | |
| Operations, Maintenance, & Support | ||||
| OMC01 | Operations, Maintenance, & Support | The Vendor shall cooperate and assist the Department in responding to all law enforcement, Federal, and State audit and review requests. The Vendor shall provide audit support including random sample generation, data extracts, hard-copy documents, and provide any requested data or information. | Operations | |
| OMC02 | Operations, Maintenance, & Support | The Vendor shall develop operational procedures in coordination with the Department and Enterprise to restore system availability. | Operations | |
| OMC03 | Operations, Maintenance, & Support | The Vendor shall support the disaster recovery activities that will provide timely failover as defined by business requirements and create relevant documented policies and procedures to implement recovery. | Operations | |
| OMC04 | Operations, Maintenance, & Support | The Vendor shall conduct an annual test of the Disaster Recovery and Business Continuity Plan and submit the Disaster Recover/Business Continuity Test Report that includes the outcome, corrective action plan, and revisions, if any, to the Department. | Operations | |
| OMC05 | Operations, Maintenance, & Support | The Vendor shall provide electronic notification including detailed release notes for Major and Minor versions, patches, updates, and fixes deployed to the production environment. | Operations | |
| OMC06 | Operations, Maintenance, & Support | The Vendor shall provide Operations Support, Maintenance, and ongoing Configuration of the provided Solution(s) throughout the life of the Contract. This includes providing Operations support as described in the scope of work as well as providing Maintenance and Enhancements to the provided Solution(s). The Vendor will follow project management and system development processes throughout the life of the Contract. |
The Department defines maintenance as follows:
1. Making configuration updates as requested by the State. Configuration includes changes to table values, parameters, codes, and business logic, including hardcoded business logic.
2. Correcting deficiencies (defects) found in the solution(s) based on detailed requirements described in the scope of work and published design specifications.
3. Correcting deficiencies (defects) found in the solution(s) based on a failure to meet the detailed requirements in completed enhancement, configuration, or maintenance requests.
4. Conducting research requested by the Department or required to support the Department's programs. For example:
a. System behavior and results
b. New Department initiatives
c. Best practices research across states and industry
d. Impacts of new State and Federal legislation
5. Performing mass adjustments or mass changes as requested by the Department or required to support the Department's programs.
6. Performing regular maintenance as needed by the Department required to support the Department's programs. Examples of maintenance include but are not limited to:
a. Performance optimization.
b. Database management.
c. Software, hardware, and tools (e.g., patches, upgrades, and replacement).
d. Interface, report, and correspondence changes.
e. Making corrections or changes to maintain the integrity of the system or the data within it (e.g., backing out changes, correcting duplicate records, cleansing corrupt data, adding security measures, adding redundancy).
7. Using appropriate testing, configuration, and change control procedures.
8. Updating system, user, and training documentation and online help to reflect changes that have been made to the solution.
| 9. Performing the activities above to maintain customizations implemented as part of an approved enhancement. | Maintenance,Operations | |||
| OMC07 | Operations, Maintenance, & Support | The Vendor shall provide a notification web page that displays when the system is unavailable for scheduled maintenance or unscheduled outages. | Maintenance,Operations,Support | |
| OMC08 | Operations, Maintenance, & Support | The Vendor shall have processes in place to restrict access when inappropriate system access or misuse is detected. | Operations | |
| OMC09 | Operations, Maintenance, & Support | The Vendor shall test and implement all production-ready patches, upgrades, and releases for all software, firmware, and operating systems in a timely manner. | Maintenance,Operations | |
| OMC10 | Operations, Maintenance, & Support | The Vendor shall notify the appropriate user community, as defined by the Department, of system events (e.g., major system changes and system outages). | Operations,Support | |
| OMC11 | Operations, Maintenance, & Support | The vendor shall maintain monitoring, notification, and proactive remediation systems for all components of the solution. Notifications of issues and outages and their resolution shall be sent to appropriate users as designated by the department at the time of the issue or outage and again at the time of resolution. | Operations,Support | |
| OMC12 | Operations, Maintenance, & Support | The Vendor shall provide help desk services to provide level 0 (customer self-service) level 1(basic support), level 2 (moderate support) that includes as appropriate, escalation to the Department, and level 3 (technical/integration) support related to the functionality of the solution's scope of work. Level 1 help desk is the first point of contact and is responsible for logging the issue and, if possible, assisting the user. | Operations,Support | |
| OMC13 | Operations, Maintenance, & Support | The Vendor shall provide online help for external and internal users. | Operations,Support | |
| OMC14 | Operations, Maintenance, & Support | The Vendor shall maintain adequate technical support/staffing to provide 24x7x365 coverage. | Operations,Support | |
| OMC15 | Operations, Maintenance, & Support | The Vendor shall notify the Department when updated reference materials (e.g., Requirements Matrices, Manuals, System Documentation, System Design Documentation, User Documentation, Business Rules Catalog, and Training Materials) are available for review. | Operations,Support | |
| OMC16 | Operations, Maintenance, & Support | The Vendor shall provide 24x7 access to the Department for all reference materials (e.g., Requirements Matrices, Manuals, System Documentation, System Design Documentation, User Documentation, Business Rules Catalog, and Training Materials). | Operations,Support | |
| OMC17 | Operations, Maintenance, & Support | Unless otherwise mutually agreed to in writing, the Vendor must maintain all hardware and software products required to support the Vendor's solution at their most current major version (patches, fixes, upgrades, and releases for all software, firmware, and operating systems) or no more than one version back from the most current major version. | Maintenance,Operations,Support | |
| Security | ||||
| SEC01 | Security | The Vendor's solution shall meet the minimum requirements surrounding user authentication methodologies, PKI, and password requirements as outlined in NIST 800-53 current revision unless otherwise specified by the Department. | ||
| Authentication,Security | ||||
| SEC02 | Security | The Vendor's solution shall meet the minimum requirements surrounding encryption guidelines as outlined in NIST 800-53 current revision. This shall include any data at rest, transmitted, or transported either physically or electronically. | Security | |
| SEC03 | Security | The Vendor shall ensure that any unneeded hardware, software, and licenses have been decommissioned. | Security | |
| SEC04 | Security | The Vendor's solution shall streamline electronic transactions by incorporating electronic and digital signatures compliant with HIPAA and other State and Federal statutes where needed or defined by the Department where required. | Security | |
| SEC05 | Security | The Vendor's solution shall provide tools (e.g., alerts or reports), which identify usage anomalies or users who may have misused the system. | Audit,Reports,Security | |
| SEC06 | Security | The Vendor's solution shall meet the minimum requirements surrounding audit tracking and item requirement guidelines as outlined in NIST 800-53 current revision unless otherwise specified by the Department. | ||
| Audit,Reports,Security | ||||
| SEC07 | Security | Risk assessments and security audit reports shall be completed on an annual basis, or when one of these triggering events occur: additions or changes to functionality that impact the security framework; changes to the solution architecture; when a new vulnerability exists. | Audit,Reports,Security | |
| SEC08 | Security | The Vendor's solution shall manage role-based permissions and provide a National Institute of Standards and Technology (NIST) compliant identification, authentication, and accounting solution. | Authentication,Security | |
| SEC09 | Security | The Vendor's solution shall have multiple layers of external and internal security that provide administrative, physical, and technical mechanisms to protect sensitive or confidential information used in performing the responsibilities and duties defined for the solution or component scope of work. | Security | |
| SEC10 | Security | The Vendor's solution shall not include any code of unknown origin. | Security | |
| SEC11 | Security | The Vendor shall provide an independent third party to perform penetration testing within six (6) months before implementation. Penetration testing must also be performed by an independent third party on an annual basis and when additions or changes to functionality impact the security framework, architecture or when a new vulnerability exists. Penetration Test Report results shall be supplied to the Department and any major or critical vulnerabilities mitigated. | Security | |
| SEC12 | Security | The Vendor shall provide the primary and disaster recovery facility(s) which will ensure security, performance, and disaster recovery requirements outlined in the solution scope of work. | Security | |
| SEC13 | Security | The Vendor will provide a completed Security Audit Report with results to the Department annually on a schedule determined by the Department. The Security Audit Report must include a NIST 800-53 current revision assessment at a "moderate" system risk control level. |
| The Vendor shall provide a mitigation plan for all reported deficiencies. Major and critical deficiencies must be corrected within forty (40) calendar days of the report submission to the Department. | Audit,Reports,Security | |||
| SEC14 | Security | The Vendor's solution shall provide security features that support increasing the complexity of the authentication and authorization as the sensitivity of the data or functionality increases. | Authentication,Security | |
| SEC15 | Security | The Vendor's solution shall provide the ability to grant authorization through role-based security (create, delete, modify, and view) access to user interfaces, reports, data elements/field level, and menu items. | Authentication,Security | |
| SEC16 | Security | The Vendor's solution shall allow access and role changes to be made in real time with appropriate authorizations. | Authentication,Security | |
| SEC17 | Security | The Vendor's solution shall access the database from the application through a standard database abstraction layer in order to protect the database from common or new application-based database attacks. | Security | |
| SEC18 | Security | The Vendor's solution shall implement role-based and group-based security at the data element/field level for authorized users based upon individual characteristics or functional security groups. | Authentication,Security | |
| SEC19 | Security | The Vendor shall establish security and privacy standards and standard operating procedures. These standards include HIPAA, Federal Information Security Management Act (FISMA), Privacy Act, Federal Tax Information (FTI), and other Federal and State laws, regulations, and policies. The Vendor shall also establish business and technical protocols to ensure that the transmission and storage of information remains secure. | Security | |
| SEC20 | Security | The Vendor's solution shall employ malicious code protection mechanisms at IT systems entry and exit points, at workstations, servers, and mobile computing devices on the network to detect and eradicate malicious code. | Security | |
| SEC21 | Security | The Vendor's solution shall use foundational technical standards such as X.509 Certificate format and Public Key Cryptography Standard (PKCS). | Security | |
| SEC22 | Security | The Vendor shall have an overall data security process that supports data security auditing. | Audit,Reports,Security | |
| SEC24 | Security | The Vendor shall monitor system activity and prevent and detect intrusion, hacking, unusual activity, or system compromise. The Vendor shall immediately report any incidents of such, regardless of the outcome to the state, activate a Department approved communication strategy, perform mitigation activities, and provide continuous status updates to the Department until the issues are resolved to the Department's satisfaction. Only authorized Vendor personnel may override system security alerts and edits. | Audit,Reports,Security | |
| SEC25 | Security | The Vendor shall provide and operate solutions that terminate access immediately and/or generate alerts for conditions that violate security rules, unauthorized attempts to access data and system functions, and system activity based on security parameters. | Security | |
| SEC26 | Security | The Vendor's solution shall meet the minimum requirements surrounding user authentication methodology and password requirements as outlined in NIST 800-53 current revision unless otherwise specified by the Department. | ||
| Authentication,Security | ||||
| SEC27 | Security | The Vendor shall provide to the Department, upon request, a listing of all users having access to the Vendor's solution and/or data with details regarding the access granted to each user. | Audit,Reports,Security | |
| SEC28 | Security | The Vendor shall provide and operate solutions for security incident reporting and mitigation mechanisms. The Vendor shall preserve and report specified audit data when security violations are detected and mitigated. | Security | |
| SEC29 | Security | The Vendor shall comply with NIST Special Publication 800-111: Guide to Storage Encryption Technologies for End User Devices where required to protect confidential information stored on end-user devices. | Security | |
| SEC30 | Security | The Vendor shall comply with NIST Federal Information Processing Standards (FIPS) Publication 180-4: Secure Hash Standards as required for the use of secure hash algorithms. | Security | |
| SEC31 | Security | The Vendor shall comply with NIST Federal Information Processing Standards (FIPS) Publication 186-4: Digital Signature Standard as required for the use of secure algorithms in digital signatures. | Security | |
| SEC32 | Security | The Vendor shall provide logical segregation of the Vendor's solution, components, and network connections with other entities and prevent any unauthorized disclosure of Department data. | Security | |
| SEC33 | Security | The Vendor shall ensure the confidentiality, privacy, and security of all Department data passing through the Vendor and sub-contracted networks. | Security | |
| SEC34 | Security | The Vendor shall establish and implement emergency access procedures for the Department to obtain secure access to solution data during an emergency. Emergency access procedures shall be subject to the Department's approval. | Security | |
| SEC35 | Security | The Vendor's solution must protect data from improper alteration or destruction including authentication mechanisms and corroborate that the data has not been altered or destroyed in an unauthorized manner. | Security | |
| SEC36 | Security | The Vendor's solution shall display a standard security warning banner before allowing entry into the system. The solution shall have security warning banners and headers and footers that adhere to Federal, State, and other applicable standards that are prominently displayed on introductory screens. The banner language will be provided by the Department. | Security | |
| SEC37 | Security | The Vendor shall ensure user account access is reviewed quarterly at a minimum. User accounts should be appropriately disabled as roles and responsibilities change. | Audit,Reports,Security | |
| SEC38 | Security | The Vendor's solution shall meet the minimum password requirements as outlined in NIST 800-53 current revision unless otherwise specified by the Department. | ||
| Authentication,Security | ||||
| SEC39 | Security | The Vendor's solution shall track disclosures of PHI and PII; provide authorized users access to and reports on the disclosures. | Audit,Reports,Security | |
| SEC40 | Security | The Vendor shall provide the ability to de-identify and/or redact data for entities not authorized to receive PII or PHI and utilize de-identification algorithms to allow for the re-identification of data if required. | Security | |
| SEC41 | Security | The Vendor shall provide a process for masking, sanitizing, scrambling, or de-sensitizing sensitive data (e.g., PII/PHI) when extracting data from the production environment for use in non-production environments. | Security | |
| SEC42 | Security | The Vendor shall review and identify monthly, any unneeded hardware, software, and licenses, present recommendations to the Department for review, and ensure that any unneeded hardware, software, and licenses have been decommissioned upon approval from the State. | Audit,Reports,Security | |
| SEC43 | Security | The vendor shall comply with the MT-BASE State Security Controls document in its entirety. | Authentication,Security | |
| Testing | ||||
| TEST01 | Testing | At a minimum, the Vendor shall provide sufficient segregated environments to support testing processes that are equivalent to the following: |
a. Integration Testing: End-to-end testing performed to expose defects in the interfaces and the interactions between integrated components or other systems and validate the system's readiness to meet non-functional requirements.
b. System testing: The process of demonstrating that a program, function, or integrated system component meets its requirements and objectives as stated in the requirements specification.
c. Regression Testing: Testing of a previously tested function following modification to ensure that defects have not been introduced or uncovered, as a result of the changes made. It is performed each time the software or its environment is changed and typically involves automated testing scripts.
d. Parallel Testing: Validates that the system achieves the same results as compared to another system (e.g., a legacy system) or previous software version.
e. Performance and Load Testing: Verifies the performance of a system will meet service level agreements and also measures the behavior of the system with increasing load (e.g. number of parallel users and/or numbers of transactions to determine what load can be handled by the system).
| f. User Acceptance Test: Testing conducted by the user or customer to determine whether or not a system satisfies the defined user acceptance criteria in an isolated environment. | Environment,Testing | |||
| TEST02 | Testing | The Vendor must identify and resolve interdependencies that restrict or impede required testing of the Vendor's solution or components from performing required testing. Unless otherwise identified by the Department strategies to resolve interdependencies must be reviewed and approved by the Department before implementing the resolution strategy. | Testing | |
| TEST03 | Testing | The Vendor shall perform testing and present the results for each of the following test levels: Performance Test results, System Test results, Parallel Test results, Regression Test results, and Integration Test results. Test results shall be traced to the use case/user story and design documentation being tested. | Testing | |
| TEST04 | Testing | The Vendor shall provide sufficient environments and resources for the following: |
a. Synchronize the software and the data from the production environment and testing and impact analysis environment at a minimum quarterly or at the discretion of the Department.
b. Synchronize the software and the data from the production environment and training environment following software deployments.
c. Provide a fully functioning online test environment, which includes batch and online programs, files, and supporting systems.
d. Provide technical and functional support to create and analyze "what-if" scenarios and compare results between scenarios in the impact analysis environment. Provide an analysis of outcomes in an impact analysis environment and another environment, such as production or test.
e. Provide Department and Vendor staff a minimum of read-only access to all environments and tools.
f. Provide sufficient resources to support the execution of automated regression testing.
h. Provide comparative analysis support of regression testing results.
i. Conduct testing of approved system configuration changes, corrections, enhancements, or before implementation.
| j. Allow Department resources and Vendors designated by the Department to create and edit appropriate data to support testing efforts, including provider, member, and reference data. | Environment,Testing | ||
| TEST05 | Testing | The Vendor shall ensure, in order to release code to UAT or production, it must meet the minimum acceptable defect levels: |
• Critical: 100% have been resolved.
| • High: 100% have been resolved. | Testing | |||
| TEST06 | Testing | The Vendor shall plan and execute testing for all inbound and outbound interfaces, ensure accurate and secure data transmission, and coordinate with external entities as appropriate. | Testing | |
| TEST07 | Testing | The Department plans to perform UAT on all software releases as part of the contract. The Vendor's approach to establishing testing environments should not impact the Department's ability to conduct continuous UAT in a separate, dedicated environment. | Testing | |
| TEST08 | Testing | The Vendor shall facilitate UAT as follows: |
a. Provide test cases and scripts from previous test levels.
b. Assist the Department in developing UAT test cases.
c. Provide a dedicated UAT environment to the Department and maintain the environment as needed to support continuous UAT throughout the design, configuration/build, and testing phases.
d. Refresh data, execute processes, and migrate releases or code fixes as requested or on an agreed-upon schedule.
e. Provide test data.
| f. Provide a mechanism for the Department to enter defects into the online defect-tracking tool. | Testing | |||
| TEST09 | Testing | The Vendor shall provide Department resources or their designee access to test cases, test results, and defect tracking via online tools. The Department reserves the right to inspect artifacts and results at any time. | Testing | |
| TEST10 | Testing | The Department reserves the right to conduct independent testing of the solution at any time. The Vendor must cooperate with the Department or its designee, and provide environments, data, and technical support for independent testing. | Testing | |
| TEST11 | Testing | The Vendor's Performance and UAT test environments shall be sized to be capable of mirroring the production System in its infrastructure, files, databases, processing, and reporting. | Environment,Testing | |
| TEST12 | Testing | The Vendor shall work proactively with the Department's designated testing resources to review all test results and provide the necessary system and functional information to create verification procedures and user acceptance test cases. | Testing | |
| TEST13 | Testing | The Vendor shall coordinate with the Department and specific vendors and other resources to conduct integration testing. | Testing | |
| TEST14 | Testing | The Vendor shall develop test criteria and algorithms for expected outcomes before the production of reports. | Testing | |
| TEST15 | Testing | The Vendor shall ensure that the Project Work Plan allocates sufficient time to the Department's user acceptance testing activities relative to the detailed scope of work, requirements, gaps, the number of manually executed test cases, and the complexity of module integration. The Vendor will be responsible for extended user acceptance testing if the proposed testing duration is not sufficient for the Department to validate the module. | Testing | |
| Total Items: | 178 |
Sheet2
Sheet3
ValidationData
| TRUE | Passed | Passed | Unassigned |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .