Attachment_05_Technology Deployment_051724.docx

RFP for ERP Software and Implementation Services City of Salem, Oregon

Attachment 5 Technology Deployment If the question does not fit the type of technology deployment in your proposal enter “NA” – Not Applicable in the box and provide an explanation why it is “NA”.

Type of Deployment

Is the proposed solution a single application (with modules) or a set of independent, but related and integrated applications?

Proposed solution is an On-Premise solution (Yes/No)

Proposed solution is a hosted solution? (Yes/No)

Proposed solution requires client software to be installed on devices (Yes/No)

Proposed solution provides client functionality through a standard web-browser (Yes/No)

Proposed solution requires application components to be installed on devices (Yes/No)

Proposed solution is proposed as a multi-tenant solution (Yes/No)

All customers on proposed application must upgrade at same time (Yes/No)

Customers provided opportunity to test updates before application updated (Yes/No)

Proposed solution has it’s own dedicated technical environment, including servers, file storage, and databases (Yes/No)

Data Center

Where are the primary and secondary data centers located? (Note: The City requires US based data centers)

List the companies providing primary and secondary data center services for the proposed solution.

What is the security certification level for primary and secondary data centers?

Are any third-party providers used to deliver PaaS or IaaS services? If so, please list.

How many environments or tenants are proposed for: 1) Implementation and 2) Production?

Client Hardware & Access

Are there any on-site hardware requirements. If “Yes”, list in your answer. (Yes/No)

If your proposed solution requires customer managed servers, what are the server minimum requirements?

What are the minimum network requirements?

What are the internet connectivity requirements?

What are the minimum system requirements for client devices connecting to the proposed solution?

Does the proposed solution have any peripherals requirements, including minimum number of display monitors? (Yes/No). If Yes, describe.

Do all proposed solution client components/modules meet ADA Section 508 and WCAG AA compliance? (Yes/No). If No describe.

Availability Provide historical availability for data center for past six months. Report all time in minutes.

JAN 2024

DEC 2023

NOV 2023

OCT 2023

SEP 2023

AUG 2023

Updates

How often is the solution updated?

How much advance notice are customers provided for new updates?

Does customer have the opportunity to test updates in a pre-production environment? (Yes/No)

How long do customers have to test updates before the update is applied?

Do customers have the ability to decline updates? (Yes/No)

Do customers have the ability to enable/disable new features/functionality provided through an update to the solution? (Yes/No)

Security

Does the system support SSO or LDAP?

Does the system support MFA? If so, what methods and what authenticators?

Does the solution provide a fully functional API or Web Service set? (Yes/No). Provide details

Is your integration protocol based on SOAP or REST?

Does the entire proposed solution follow the same integration protocol (Yes/No)

Do data and documents stored in the proposed solution have end-to-end encryption, in transit, at rest, and encrypted backups? (Yes/No). If no, explain.

Information Security

What protections are provided against data breach?

Do you have a formal information security program or a security awareness program? (Yes/No). If Yes, please describe.

Does the proposed solution have a security policy document? (Yes/No). If yes, do you share that document with customers?

Does the proposed solution go through an annual security audit performed by an independent security company? (Yes/No). If yes, are the results of the audit provided to customers?

Provide a list of your staff roles who will have access to the proposed solution or data/file infrastructure?

Are all company staff who provide support for the solution or have access to data stored by the solution, during implementation based in the United States? (Yes/No). If no, explain?

Are all company staff who provide support for the solution or have access to data stored by the solution, during implementation based in the United States? (Yes/No). If No, explain?

Are all company staff who provide support for the solution or who have access to data stored by the solution after go-live based in the United States? (Yes/No). If No, explain?

Do all company staff who have access to solution environment or stored data/files, required to pass a criminal background check? (Yes/No)

Is access to all solution environments or data/files storage logged and are logs reviewed on a regular basis? (Yes/No)

Do all company staff who have access to the solution environments or data/file storage go through regular security and privacy training? (Yes/No)

Is company staff access to the solution environments or data/file storage reviewed/updated on a regular basis? (Yes/No)

Please include information regarding cybersecurity standards, recent independent audits, notification process, remedy, and indemnification provided.

Data Ownership/Privacy

Does the solution require Terms and Conditions to be accepted by customers or solution users? (Yes/No). If Yes, provide copy/link.

Does the solution require a Privacy Policy to be accepted by customers or solution users? (Yes/No). If Yes, provide copy/link.

Does your company claim any ownership right or access right to customer data/files stored in the proposed solution? (Yes/No). If Yes, describe.

Does your company provide access to customer data/files stored in the proposed solution? to affiliated/partner third parties? (Yes/No) If Yes, describe.

Does your company generate analytics or summary level data or data products from customer data/files stored in the proposed solution? (Yes/No). If Yes, describe

Integrations/Interfaces

Describe your company’s approach to integration/interfaces (company built, hybrid, customer built)?

Describe the integration technologies are supported by the proposed solution (API, web services, file transfer, etc.)?

Is access to interface technologies for the proposed solution an additional cost or provided as part of the procurement?

Are there any pre-requisites for setting up interfaces to/from the proposed solution?

Does the proposed solution have any “off the shelf” integrations with Microsoft products/solutions? (Yes/No). If Yes, please describe.

Mobile Functionality

Does the proposed solution contain any mobile components/modules? (Yes/No). If Yes, describe.

For any mobile components/modules, describe the deployment methodology (store, custom, customer hosted)?

For any mobile components/modules, describe how the solution is updated?

Are there any pre-requisites for setting up the mobile components/modules?

Community/Partner Solutions

Does the proposed solution contain any external community/partner components/modules? (Yes/No). If Yes, describe.

For any external community/partner components/modules, are there separate Terms and Conditions or Privacy Policy that must be accepted by external users?

Do all external community/partner components/modules meet ADA Section 508 and WCAG AA compliance? (Yes/No). If No describe.

Are there any pre-requisites for setting up external community/partner components/modules? (Yes/No). If Yes, describe.

Disaster Recovery

Describe the proposed solution’s data and document backup and retention policy?

Does the proposed solution have a Disaster Recovery Plan? (Yes/No). If yes, please provide an overview of the plan.

Does the proposed solution have built in redundancy or support high-availability through backup data centers located in geographically separate zones.

Disentanglement

Briefly describe the disentanglement process? In your description, please specify any timeline specific requirements?

Do you provide customers with a full copy of all customer data/files during the disentanglement process? (Yes/No). If Yes, is this a service charge?

How long do you retain customer data/files after disentanglement has started? Do you provide customers with written confirmation once all data/files have been destroyed?

Can customer data be exported in nonproprietary format? (Yes/No) If Yes, explain.

Production Support

Briefly describe the customer support approach for a production deployment of the proposed solution?

Who is responsible for provide primary support for the proposed solution (customer IT, vendor support)?

Describe the support resources and tools available for customer staff to be able to obtain training and understanding of the proposed solution, solution components, and knowledge required to provide technical and administrative support for the proposed solution.

Do customers have a Customer Portal through which to track their submitted support requests?

Does the proposed solution use proactive solution health monitoring components? If Yes, describe.

Proposed Service Level Guarantees If SaaS services are proposed, please complete the following table identifying proposed service level guarantees. For each service, please indicate the metric used to measure the service quality, the proposed requirement (target for service), and the proposed remedy or penalty if guarantee is not met.

System Availability (Unscheduled Downtime)

System Response (Performance)

Issue Response Time

Issue Resolution Time

Recovery Point Objective (RPO)

Recovery Time Objective (RTO)

System Data Restore

Implementation of System Patches

Notification of Security Breach

Please list other proposed service levels image1.png