Attachment 02 - Submittal Form G - DOH IT Contractual Requirements - SaaS Solutions (v260313).xlsx

Instructions

This workbook provides the current Department of Health (DOH) Information Technology (IT) technical contractual requirements for Software as a Service (SaaS) solutions and is meant to accompany DOH IT-related solications and contracts.

Failure to complete this workbook will result in a proposal being deemed non-responsive or non-issuance or cancellation of the contract.

&"Arial,Bold"Version 1.3 (2024-03-14)

Technical Requirements

This includes hosted services, vendor personnel, vendor contracted services, contracted consulting services, and any sub-contracted resources. All elements and services that receive, process, store, or transmit data used by the solution must be located within the United States.

IT2 Security Standard Policy Solution The offeror shall conform to all relevant federal and State regulations and publications within thirty (30) calendar days of the initial offeror start date. Regulations and publications will include, but not be limited to:

a. Federal Information Security Risk Assessment (ISRA) Procedures and Digital Identity Guidelines

b. 45 CFR Part 160 Administration

c. 45 CFR Part 162 Administration

d. 45 CFR Part 164 Secuirty and Privacy

e. Criminal Justice Information Services (CJIS)

f. Internal Revenue Service (IRS) Publication 1075

g. Federal Information Security Management Act (FISMA)

h. Social Security Administration (SSA) Information System Security Guidelines for federal, State, and local agencies

i. Title XIX Confidentiality Rules

j. Privacy Act of 1974 at 5 U.S.C. 552a

k. Others as required by DOH at no additional cost to DOH.

IT3 Security Code Security Vendor The offeror must complete software development in compliance with DOH Secure Systems Development Lifecycle, including but not limited to:

a. Secure Coding – The offeror shall disclose what tools are used in the software development environment to encourage secure coding.

b. Disclosure – The offeror shall document in writing to the purchaser all third-party software used in the solution, including all libraries, frameworks, components, and other products, whether commercial, free, open-source, or proprietary.

c. Evaluation – The offeror shall make reasonable efforts to ensure third-party software meets all the terms of this agreement and is as secure as the custom code developed under this agreement.

d. Source Code Scanning – The offeror shall work with DOH staff to facilitate static code scanning for all product and third-party files using a DOH approved scanning solution.

IT4 Security Environment Vendor The offeror must adhere to current security best practices, including but not limited to those established by CIS, NIST, ISO/IEC, and OWASP. These examples are provided for reference only and are not intended to be an exhaustive list

The offeror shall confirm compliance with the most recent version of all applicable Federal Information Processing Standard (FIPS) publications within one year of the new publication’s release, for all solution environments, for the life of the Contract. The offeror shall assume any costs related to required solution updates, such as hardware or software, which are required to support publication adherence.

IT5 Security Environment Vendor Offeror shall facilitate requests for third-party vulnerability and/or penetration testing of DOH solutions.

IT6 Security Policy Vendor The offeror agrees to notify, in writing, the DOH contract administrator of any personnel transfers or termination of personnel, including sub-contractors, who possess DOH credentials and/or badges or who have DOH information system privileges, per current protected data security best practices.

IT7 Security Retention/Destruction Vendor The offeror agrees to dispose of all protected media in a manner consistent with the most current guidance provided by the National Institute of Technologies (NIST) Special Publication 800-88. This includes any Development, Test, and Production data (or any derivation thereof).

IT8 Security Retention/Destruction Vendor The offeror must ensure that all protected media (protected health information [PHI], personally identifiable information [PII], payment card industry [PCI], criminal justice information [CJI], etc.) must be disposed of in accordance with the respective regulatory authority requirements. If the respective regulatory authority does not provide a standard or requirement, all protected media must be disposed of in a manner consistent with the most current guidance provided by the Department of the Army’s brief, Cybersecurity: Sanitization of Media and NIST Special Publication 800-88. Disposed of media must receive a Certificate of Media Disposal or agreed upon proof of disposal for each device disposed (to be retained by the offeror in accordance with the respective regulatory authority retention requirements).

IT9 Security Retention/Destruction Vendor The offeror ensures that the solution will comply with the respective regulatory authority retention requirements. The offeror must provide procedures and agree to all data (including development, test, production, or any derevation thereof) destruction when contract ends if continuing operations and maintenance is not provided by the offeror.

The offeror must provide an information system with an audit reduction and report generation capability that complies with the respective regulatory authority requirements.

a. Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents;

b. Does not alter the original content or time ordering of audit records;

c. Retains audit records for at least ninety (90) days and archives old records for six (6) years to provide support for after-the-fact investigations of security incidents and to meet regulatory and organizational information retention requirements

IT10 Security Authorization Package Vendor Solutions shall be granted Authority to Operate before they can be used to support DOH activities.

The offeror agrees to adhere to security compliance requirements and accommodate an appropriate number of remediation cycles to address any identified defects.

The offeror shall develop, submit, and update a Plan of Action and Milestones (POA&M) for the information system in DOH approved template within thirty (30) days of publishing the final results of any internal or external audit, assessment, review, or test resulting in privacy or security findings. POA&M findings may derive from, but not be limited to, security controls assessments (SCAs), penetration tests, automated configurations, and vulnerability scan results.

IT11 Security Authorization Package Vendor The offeror’s Plan of Actions and Milestones (POA&M) shall document the planned remedial actions to correct all weaknesses or deficiencies noted during the assessment of the security controls and to reduce or eliminate known vulnerabilities in the system. POA&M finding details shall include, but not be limited to:

a. Finding identifier

b. Control family and control details

c. Finding description

d. Finding source

e. Affected host(s) (for technical findings)

f. Point of contact and required resources

g. Initial scheduled completion date, updated completion date(s), and actual completion date

h. Risk level

i. Compensating controls

j. Comments, with history

k. Others as requested by DOH at no additional cost to DOH.

The offeror shall update and submit to DOH the existing Plan of Action and Milestones (POA&M) once all findings are resolved and ready for DOH to reassess.

Additionally, if applicable, the offeror shall respond to all risks identified through the periodic security risk assessments with Centers for Medicare & Medicaid Services (CMS) within the POA&M and include clarifying information, a proposed mitigation strategy, and a timeline for implementation. The offeror shall work with DOH to successfully execute the POA&Ms.

IT12 Security Authorization Package Vendor The offeror shall agree to submit one Interconnection Risk Assessment Worksheet (IRAW), per interconnection, outlining its specifications and security components upon offeror award.

IT13 Security Encryption Vendor The offeror shall confirm their solution ensures all sensitive, confidential, and/or restricted data are encrypted in-transit and at-rest, per current security best practice for protected data.

Criminal Justice Information Systems (CJIS) and those systems requiring Acceptable Risk Controls for ACA, Medicaid, and Partner Entities (ARC-AMPE), formerly MARS-E, compliance shall meet these encryption requirements using the most current Federal Information Processing Standards (FIPS) certified product.

IT14 Security Architecture Vendor The offeror shall attest their solution will be hosted in a FedRAMP compliant cloud-based model (public, private, or government cloud).

IT15 Security Auditing and Logging Solution The offeror shall provide an information system with an audit reduction and report generation capability that:

a. Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents;

b. Does not alter the original content or time ordering of audit records;

c. Retains audit records in compliance with the respective regulatory and organizational information retention requirements.

d. These Audit records will be maintained for investigative purposes and should be readily searchable by user ID or client ID.

The offeror’s solution shall have security audit trail reporting capabilities that automatically record and maintain an audit trail of users and record key information on each session and event. Session and event key information includes, but is not limited to:

The offeror's solution will log the following events, per record:

e. Record was created/modified

f. Record was deleted

g. Record was viewed

h. Record was printed

i. Record was searched

j. System login (both successful and unsuccessful)

k. System logout

l. Success/fail indications

m. Others as required by DOH, at no additional cost to DOH.

Their log entries will include, at minimum:

n. User/process identifiers which accessed the record

o. Source and destination addresses

p. The date and time of the event

q. The information that was accessed

r. The record's data state before and after any edits

s. Filenames involved

t. Event descriptions

u. Access control or flow control rules invoked

IT16 Security Standards Vendor The offeror shall agree to comply with all applicable regulatory compliance requirements as identified by DOH Security Office. The offeror must also adhere to current security best practices, including but not limited to those established by CIS, NIST, ISO/IEC, and OWASP. These examples are provided for reference only and are not intended to be an exhaustive list.

IT17 Accessibility Standards Vendor The Contractor shall ensure that all products and services developed, procured, maintained, upgraded, or renewed under this Agreement comply with the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA, which serves as the State of Alaska’s standard for web accessibility.

The Contractor shall also ensure compliance with all applicable federal and state accessibility laws and regulations, including but not limited to:

a. Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. § 794d), as amended; and

b. Title II of the Americans with Disabilities Act (ADA) and implementing regulations

Pursuant to Administrative Order 129, all electronic and information technology, including websites, applications, authoring tools, and digital documents, must be accessible to individuals with disabilities and operable with commonly used assistive technologies.

To demonstrate conformance, the Contractor shall, upon delivery, provide one or more of the following:

c. A current Voluntary Product Accessibility Template (VPAT®) 2.4 WCAG edition;

d. A Website Accessibility Evaluation Report using the Website Accessibility Conformance Evaluation Methodology for WCAG 2.1 Level AA; or

e. Equivalent documentation verifying compliance with WCAG 2.1 Level AA.

Failure to meet these requirements may constitute a material breach of this Agreement and may subject the Contractor to remedial actions, up to and including termination

IT18 Architecture and Performance Architecture Vendor The offeror attests their solution was developed using modern design principles, applying principles of modularity, interface abstraction, and loose coupling to support ease of maintenance and readily allow future functional enhancements.

IT19 Architecture and Performance Architecture Vendor The offeror ensures that functionality added for other customers will not negatively impact DOH's solution instance.

IT20 Availability Standards Vendor The offeror attests to the level of availability that they will deliver.

The highest availability standard for systems is 99.999% or “five nines”–or about 5 minutes and 15 seconds of downtime per year (see table below). To achieve five nines, all components of the system must work seamlessly together. Software applications, compute resources, networking functionality, and physical data center services must be highly available to achieve five nines.

IT21 Database Standards Vendor The offeror attests they maintain database design and maintenance best practices, including provisions for:

a. Deploying Firewalls for Database Servers

b. Ensuring database software is patched to include all current security patches

c. Maintaining application code that is reviewed for SQL injection vulnerabilities

d. Monitoring the delivery of protected data to user workstations

e. Passwords for all database administrator (DBA), operating system accounts, and database accounts are required to be strong passwords

g. Secure authentication to the database is used

h. Tracking all logins to operating system and database servers, successful or unsuccessful

i. Protected data is encrypted at rest, as well as during transmission over the network

IT22 Desktop/Device Standards Vendor Offeror confirms their solution is device independent and/or fully functional operating on a Microsoft Windows desktop/laptop with standard Microsoft productivity suite software. Offeror's proposed solutions must operate on the minium OIT-specified equipment (subject to annual review)

Any solution specific requirements such as drivers, software versions, etc. should be described in Comments.

IT23 Hosting and Support Standards Vendor The offeror will work with DOH to determine content and schedule of system upgrades.

IT24 Integration Data Exchange Solution The offeror agrees to align their solution with DOH's interoperability standards. Data exchanges between this solution, and other DOH data, will be conducted through DOH's enterprise integration services.

IT25 Integration Data Exchange Solution Solutions that create, read, or update client, consumer, or other person demographic data shall integrate with DOH's Master Client Index (MCI) to ensure their demographic records are registered in the MCI and appropriately merged with matching client records in the index. Any alternatives must be approved by DOH IT.

IT26 Integration Authentication Solution The offeror must integrate their solution with the Alaska current Identity Management Service (currently DOH's Active Directory or DOH's Active Directory Federated Services (ADFS), Microsoft Business to Customer Identity, or SOA Entra ID) to support single sign-on authentication.

IT27 Integration Financial and Accounting Vendor Offerors whose proposed solution includes finance, accounting, and Human Resources (HR) functions agree to conduct a gap analysis with DOH ITS, DOH Program staff, and Department of Administration Division of Finance Integrated Resource Information System (IRIS) support subject matter experts.

This analysis will determine how the solution will integrate with the State of Alaska's existing Human Resources and Finance/Accounting systems.

IT28 Investment Assurance Asset Management Vendor DOH shall have unlimited rights to use, disclose or duplicate, for any purpose whatsoever, all information and data developed, derived, documented, installed, improved, or furnished by the offeror under this contract.

All files containing any DOH information are the sole and exclusive property of DOH. The offeror agrees not to use information obtained for any purposes not directly related to this contract without prior written permission from DOH. Offeror agrees to abide by all federal and state confidentiality requirements.

IT29 Investment Assurance Asset Management Vendor The offeror agrees to provide to DOH, upon request at any time during the contracted period, the data managed by the solution, in whole or in part, in a format agreed upon by both parties.

The offeror’s solution and transmission of data shall be secure as defined by the U.S. Commerce Department’s National Institute of Standards and Technology (NIST): “Providing the protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability.”

IT30 Investment Assurance Standards Solution The offeror's solution will offer continuous backup with geographically separated redundancy.

IT31 Mobile Device Standards Vendor If solution includes mobile devices, offeror confirms their solution will be fully functional with the standard DOH mobile devices:

a. Dell Windows based Tablets

i. Configured with the latest version of Microsoft Standard browsers

ii. Web applications are to be Browser version independent which means they support current versions of Internet browsers for Microsoft, and Firefox.

iii. Software should not be dependent on a specific version of MS Office Suite.

b. Apple iOS based Tablets and Smart Phones

i. Configured with the latest version of Safari and Firefox.

ii. Software should not be dependent on a specific version of MS Office Suite

The offeror confirms their solution:

c. Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices;

d. Authorizes the connection of mobile devices to organizational information systems.

e. Establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to access the information system from external information systems; and process, store, or transmit organization-controlled information using external information systems.

IT32 Mobile Device Standards Vendor The Offeror acknowledges that if their solution includes a mobile app companion to any system, or a purely mobile solution, they ensure their solution:

a. Integrates Push Notifications into App Functions

b. Provides High-Quality Image Resolution

c. Includes an Integrated Search Feature

d. Incorporates Social Media Integration Capability

e. Uses Responsive App Design

f. Follows the Principle of Simplicity-in-Design, with Uncluttered Elements (https://www.cerdonis.tech/blogs/the-process-of-mobile-app-designing/)

g. Provides Extensive Cross-Platform Coverage and Usability

h. Incorporates Robust Security Controls

i. Leverages Mobile Screen Touch Features

j. Integrates Provisions for User Feedback

k. Provides the Ability for Apps to Work Offline

IT33 Reporting Standards Solution The Offeror attests that any reporting capability contained within the solution will employ Embedded Data Analytics, features including:

a. Application Programming Interface (API) Integration

b. Extract, Transform, and Load (ETL) integration

c. Data Variety Support

d. Data Modeling Capability

e. Data Quality Monitoring and Remediation

f. Real-Time Performance Optimization

g. Scalability

h. Robust Security Controls

i. Data Privacy and Governance Controls

IT34 WAN General Vendor Bandwidth varies greatly in areas outside Juneau, Anchorage, Wasilla, and Fairbanks. In some rural communities bandwidth can be as low as 56k.

The Offeror agrees to denote any performance degradation that could be encountered by their solution along with suggested mitigations.

&"Arial,Bold"&14State of Alaska Department of Health &"Arial,Bold"&14Information Technology Contractual Requirements for Software as a Service (SaaS) Solutions

Version 1.5 (2025.01.22) Page &P of &N

Glossary of Acronyms

DropDownValues

image1.jpeg