Attachment 3 Software Requirements.xlsx
XLSX spreadsheet 36 KB Posted
- Attached to
- Elections Campaign Finance Software
- Solicitation number
- RFP-2500004795
- Issued by
- Arizona
About this file
The document is a Software Requirements Questionnaire for Elections Campaign Finance Software for Pima County, Arizona, detailing comprehensive functional, technological, support, and training requirements for a campaign finance management system. The software must provide public access to campaign finance information with robust search capabilities, including advanced data search, sorting, aggregation, PDF document generation, and secure user access with encryption. Key functional requirements include the ability to search contributors, export data, validate filings, manage security settings, generate notifications, and support electronic signatures.
The technology requirements emphasize data security, with detailed specifications for hosting, compliance, audit trails, disaster recovery, and data protection. The vendor must maintain stringent security protocols, including background checks, incident response plans, and data storage exclusively within the continental United States. Support requirements include multiple support levels, problem resolution timelines, and comprehensive technical documentation. Training options range from telephone support to on-site and customizable training materials. The software must support multiple browsers, provide Single Sign-On for administrative users, and offer configurable reporting periods and filing windows with unlimited customer support and maintenance.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Attachment 4 Information Technology Requirements.xlsx | XLSX spreadsheet | |
| RFP-2500004795 Election Campaign Finance Software.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Functional
| FUNCTIONAL REQUIREMENTS QUESTIONNAIRE | FS | |||
| AVAILABILITY CODES: | PS | |||
| Fully Supported (FS): | The function is supported as a standard feature included within the proposed software or software suite. | NS | ||
| Partially Supported (PS): | The desired function is available in a separate, optional package, or could be made available through software customization. | |||
| Not Supported (NS): | The desired function is not available. | |||
| Reference # | General | Availability | Description/Explanation | |
| FS | PS | NS | ||||
| F.1 | Public access without username or password with all sensitive information blocked (redacted) from view. | |||
| F.2 | Enhanced search capabilities to enable the viewer to locate specific information easily. | |||
| F.3 | Sort and aggregate data by various fields and export results to Excel or Word. | |||
| F.4 | Advanced data search by name, by contributor/vendor, by transaction date, amount, and type. | |||
| F.5 | Perform a wildcard search on various fields such as contributors, committees, date ranges, etc., aggregate the results, and provide totals of monetary contributions, non-monetary contributions and total amount received. | |||
| F.6 | Enable aggregation of contributions between specified related contributors as well as between certain defined dates, e.g., the Election Cycle. | |||
| F.7 | Ability to produce documents in PDF format. | |||
| F.8 | Notification of the location of specific documents that are not currently available electronically. | |||
| F.9. | Can view contributors and all the campaigns to which they contribute, and export to excel. | |||
| F.10 | Secure access provided with a username and password for campaign. | |||
| F.11 | Data sent and received must be encrypted. | |||
| F.12 | Provide the filer the ability to search previous validated filings, in addition to the ability to create new filings to submit. | |||
| F.13 | Access to all authorized filing statement forms for completion. | |||
| F.14 | Inform the filer if a filing is declined (with explanation) or accepted. | |||
| F.15 | Limit access to information according to security settings (e.g., public, campaign filers, administrators). | |||
| F.16 | Must ensure proper data validation during the creation of new filings. | |||
| F.17 | If the candidate is not required to file electronically and the candidate chooses to only submit a paper filing, it must have the ability to capture and display an electronic copy of the paper filing. It must also be able to support high quality, and legible images of uploaded scanned documents and filings. | |||
| F.18 | Ability to sort data (i.e. filing date), create reports (i.e. delinquent filer), and store filings by statement periods. | |||
| F.19 | Ability to print by page or by report. | |||
| F.20 | Ability to enter miscellaneous notes. | |||
| F.21 | Must include merge components for generating deadline and past due notifications, and other miscellaneous letters. | |||
| F.22 | Unlimited customer support/maintenance. | |||
| F.23 | Calculates assessment penalties based on configurable penalty fees. | |||
| F.24 | Supports unlimited read-only users and concurrent read/write users. | |||
| F.25 | Requires minimal or no customization of program code for system to meet the County’s needs. | |||
| F.26 | Single Sign-On (SSO) for administrative users. | |||
| F.27 | Supports current browsers including (Micosoft Edge, Google Chrome, Safari and FireFox. | |||
| F.28 | Ability to send customizable notifications via email and or text messages to individual, Campaign or en-masse. | |||
| F.29 | Provides a forgot password option. | |||
| F.30 | Organizations can be added/inactivated/re-activated/suspended/terminated/edited by administrator. | |||
| F.31 | Front end administrator can upload filings to any filing period for any organization. | |||
| F.32 | Provide for electronic signture. | |||
| F.33 | Reporting period, report types, committee status, and filing window are configurable by adminstator. | |||
| F.34 | Provides an audit trail of report filings. |
&"Georgia Pro Cond Light,Bold"&18A&14TTACHMENT &16 3&14: &18S&14OFTWARE &18R&14EQUIREMENTS
Technical
| TECHNOLOGY OVERVIEW QUESTIONNAIRE | ||
| (NOTE: SOME QUESTIONS MAY NOT APPLY IF HOST APPLICATION) | ||
| Reference # | Requirement | Response |
| T.1 | What is the progression path for upgrades? | |
| T.2 | What is the frequency for upgrade releases? Patches? | |
| T.3 | How are upgrades delivered? | |
| T.4 | Are all patches included in the next formal software release? | |
| T.5 | Which Web browsers and versions do you support? | |
| T.6 | Describe the security of the data center locations at which the application and data is hosted? Describe any compliance or certifications. | |
| T.7 | What is your ability to ensure that any agent, including a Vendor or subcontractor, to whom the County provides access to information systems, agrees to implement reasonable and appropriate safeguards to ensure the confidentiality, integrity, and availability of the information systems. | |
| T.8 | Ability to maintain audit events according to County policy, state and federal requirements or other best practices as applicable and provide this information to the County upon request. These audit logs must be kept according to the County records retention policies, or state and federal requirements (whichever is the longest). | |
| T.9 | Ability to demonstrate implemented policies and procedures regarding the use of information systems that describes how users are to protect against intrusion, tampering, viruses, etc. | |
| T.10 | Ability to produce the Vendor’s minimum security training requirements for staff and to ensure minimum security training to staff that access information systems is provided. | |
| T.11 | Ability to conform to the requirement that the Vendor shall return or destroy all confidential information received from the County, or created or received by the Vendor on behalf of the County. For any items destroyed, the County will require certification of secure destruction (DoD standards) along with a list of what was destroyed (model, serial number, content, date of destruction, etc.). A few references of examples for media destruction are listed below: Campagin filing reports, statement of orginzation, & termination statement | |
| T.12 | Ability to conform to the requirement that the Vendor will return all data that is the property of the County in a format specified by the County. | |
| T.13 | Ability to develop and implement a disaster recovery plan for timely restoration of the system in the event of a disaster or major incident during, before, or after an election. This is applicable to Vendors that are selling products and services that include hosting or storing County data, systems, or applications. | |
| T.14 | Ability to provide the process and plans to update the application to stay current with platforms and infrastructure. | |
| T.15 | Ability to support encryption and upgrade key levels. Describe the current maximum key level or other parameters that allow the solution to remain secure in the future. | |
| T.16 | Application development must be done in a secure manner. Describe your security practices regarding secure application development. | |
| T.17 | The Vendor must have an incidence response plan. Describe the Vendor’s incident response structure and communication process to customers during a disaster or incident. | |
| T.18 | Ability for the Vendor to respond to potential compromises. Describe the Vendor’s process for how the County may request logs and other information if a compromise occurs, is suspected, or is being investigated by the County Security personnel involving the Vendor’s environment or technologies. | |
| T.19 | Describe what happens to the application or system and the data in the event the Contractor goes out of business, is purchased by another entity, or if the Contract runs out. The response should cover any secondary cloud storage partner of the Offeror who is contracted with in support of the County’s Contract. | |
| T.20 | Ability for the County to audit the public facing IP addresses that are declared by the Vendor as nodes that process, store, or transmit County data. If the IP addresses or the scan results of the County or its agent indicate security issues, the Vendor agrees to immediately resolve of the matter, regardless of whether the IP address or system is dedicated to the County or shared with other Vendor’s customers. | |
| T.21 | Ability to provide information about location of data storage, addressing requirements to keep all data in the United States (including in a disaster scenario). Describe how the Vendor will assure the County that its data will not be relocated without its written approval. | |
| T.22 | Ability for the Vendor’s internal service desk to keep County’s tickets secure. The County personnel creating service desk tickets with the Vendor must be securely authenticated. For example, when a service request or a service incident request involves a County configuration setting, requests about data, network architecture, manual and automated controls, access control, remote access, or procedures, the data in the request must remain secure. Requesters must be always authenticated through documented agreed upon procedures and controls. | |
| T.23 | Data transmission must be secure. Describe the Vendor’s ability to secure data transmission when data is electronically transmitted between systems locally in a single Vendor or multi-Vendor contracted scenarios. | |
| T.24 | Ability to provide documented backup and restore and disaster recovery capabilities. Describe features of the disaster recovery model, including encryption and access control. If disaster recovery model includes storage of data at a location other than the County, describe the location ensuring it is within the continental United States. | |
| T.25 | The Vendor must immediately notify designated County security personnel of any potential breach or risk, including when: |
1. County data may be at risk.
2. County data may be at risk of unauthorized disclosure(s).
3. County data may have been breached.
4. County data is subpoenaed through a legal channel.
5. County data may be inaccessible due to supplier disputes, bankruptcy, or other business and legal scenarios.
6. County data or copy of County data or any replica, or digital shadow has been intentionally or accidently copied or moved to a non-U.S. geography or non-County authorized third party.
Describe the Vendor's willingness to comply with this requirement.
T.26 Ability for the Vendor to protect the County’s sensitive data as part of the solution. Please describe the following when applicable:
1. Vendor’s own SOC 2 Type II audit results (no older than six (6) months) – not to be confused with Microsoft or Amazon’s SOC 2 Type II audit.
2. Vendor’s cloud storage provider’s SOC 2 Type II audit results (no older than 6 months).
3. Vendor’s cloud physical geography (limited to continental United States).
4. Vendor’s cloud storage meets the FedRamp requirements.
5. Vendor’s cloud storage meets the State of California requirements. Supplier should supply written proof of what has been certified.
6. Vendor’s security incident management, e-discovery and cloud forensics processes.
7. Vendor’s application and interface security must meet the applicable state and federal requirements.
8. Vendor’s threat and vulnerability management processes.
9. Vendor’s access management governance and processes when its staff and supplier staff can access regulated data.
10. Vendor’s commitment to independent security test of end-state solution before going live and remediating the findings in a timely fashion.
11. Vendor’s commitment to assure County-owned data on the supplier infrastructure is not accessed or mined.
12. Vendor’s agreement that all data supplied by the County will remain the sole property of the County and the Offeror may not sell or lease this data at any time.
T.27 Ability to maintain background checks for employees. Describe your employee and Contractors’ background-check level and frequency (for employees and Contractors who program, secure, administer, or service equipment or storage containing regulated data).
&"Georgia Pro Cond Light,Bold"&18A&14TTACHMENT &16 3&14: &18S&14OFTWARE &18R&14EQUIREMENTS
Support
| SUPPORT AND MAINTENANCE QUESTIONNAIRE | ||
| Reference # | Requirement | Response |
| S.1 | Describe the different levels of support available? | |
| S.2 | When problems are phoned in, does the customer get a phone answering service, message or a representative? | |
| S.3 | What is the turnaround time for the problem resolution? Is it based on severity of the problem? | |
| S.4 | If you are not resolving problems quickly enough, what alternatives are available to the County of Pima? | |
| S.5 | Does the support organization have resources that can be deployed to resolve problems? | |
| S,6 | Do you provide comprehensive technical documentation? | |
| S.7 | Is your documentation available in digital format? | |
| S.8 | How is the functionality of upgrades determined? (e.g., periodic schedule versus as needed) | |
| S.9 | Do you have any near term (in the next 12 months) plans for major system architecture changes? | |
| S.10 | Do you have any long-term plans (in the next 3 years) for major system architecture changes? |
&"Georgia Pro Cond Light,Bold"&18A&14TTACHMENT &16 3&14: &18S&14OFTWARE &18R&14EQUIREMENTS
Training
| END USER TRAINING QUESTIONNAIRE | ||
| Reference # | Requirement | Response |
| E.1 | Is extended telephone support available? | |
| E.2 | Is there a systems tutorial? | |
| E.3 | Is there classroom-oriented system training? | |
| E.4 | Is there on-site user training? | |
| E.5 | Can training material be customized to customer environment? | |
| E.6 | Is there management training? | |
| E.7 | Is end user documentation online? |
&"Georgia Pro Cond Light,Bold"&18A&14TTACHMENT &16 3&14: &18S&14OFTWARE &18R&14EQUIREMENTS
File details come from the government source that posted it. Updated .