Attachment A - Functionality Matrix - Amended.xlsx

XLSX spreadsheet 41 KB Posted Nov 9, 2026

Attached to: IT DISASTER RECOVERY PLANNING SOFTWARE
Solicitation number: 5400030169
Issued by: Richland County, South Carolina

About this file

Written by GovTribe AI · Nov 9, 2026

Attachment A - Functionality Matrix for South Carolina Disaster Recovery Planning Software

This is a Functionality Matrix for a disaster recovery planning software procurement by the South Carolina Department of Administration, Division of Technology Operations (DTO). The state is requesting a managed cloud-hosted solution to support development, maintenance, testing, documentation, and verification of over 100 disaster recovery plans for South Carolina IT agencies and critical infrastructure. The matrix outlines mandatory, critical, and desired functional and technical requirements that offerors must address in their proposals. The pre-proposal conference is scheduled for October 8, 2026 at 11:00 AM via Microsoft Teams, with questions due by 5:00 PM that same day. Proposals are due November 4, 2026, and implementation must be completed by May 1, 2027. The initial contract term is three years beginning December 24, 2026, with two optional one-year renewal periods, extending the maximum contract life through December 23, 2031. The state will evaluate proposals in two phases: Phase I evaluates system functionality, qualifications, experience, and pricing; the top three responsive offerors proceed to Phase II demonstrations scheduled December 1-3, 2026, with award notification anticipated December 14, 2026.

The Functionality Matrix requires offerors to complete all sections and indicate how their proposed solution aligns with DTO's preferences by marking functionality levels (Base Functionality, Configuration, Custom Development, or Not Supported) and complexity levels (High, Medium, or Low) for each requirement. Six mandatory requirements (1.1 through 1.6) address core capabilities including plan lifecycle management, file format compatibility, licensing and implementation services, role-based training, 24/7 technical support, and configurable disaster recovery templates. Failure to meet mandatory requirements may result in proposal elimination. The matrix also includes critical and desired requirements spanning functional capabilities, technical requirements, architecture, database management, interfaces, security, performance and scalability, application configuration and customization, system administration, disaster recovery protections, and reporting capabilities. Offerors must submit the completed spreadsheet in Microsoft Excel 2003 or 2007 format with no structural modifications permitted. All State data must be stored exclusively within the United States, and the vendor must comply with South Carolina security standards (SCDIS-210), Criminal Justice Information Services (CJIS) Security Policy, IRS Publication 1075, and provide 99.9% availability SLA with encrypted backups and tested disaster recovery procedures.

View the file

Other files

File	Type	Posted
Amendment 2.docx	DOCX document	Nov 9, 2026
Amendment 1.docx	DOCX document	Oct 19, 2026
Solicitation.docx	DOCX document	Sep 29, 2026
Attachment A - Functionality Matrix.xlsx	XLSX spreadsheet	Sep 29, 2026
Attachment C - Supplier Experience Matrix.xlsx	XLSX spreadsheet	Sep 29, 2026
Attachment D - Price Proposal.xlsx	XLSX spreadsheet	Sep 29, 2026

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Instructions 5400030169 - Disaster Recovery Planning Software tc={BB0559FE-1289-4D8C-B199-707C824A3604}: [Threaded comment]

Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924

Comment:

I am assuming Nathan will probablyo change this.

Reply:

@Creede, Paul @Schmidt, Robert Reply:

I believe so yes. We need to double check with Nathan just to make sure

Attachment A - Functionality Matrix

Instructions:

This spreadsheet provides Offerors the opportunity to describe how the attributes and capabilities of their proposed solution align with DTO's functional and technical preferences.

1 Offerors must complete each section of all the "Requirements" tab. Failure to do so may result in your Proposal being rejected.

2 Each preference has four functionality columns labeled Base Functionality, Configuration, Custom Development, and Not Supported.

Offerors must indicate the level of functionality supported by adding an "X" mark in the appropriate column for each preference.

3 Each preference has three configuration / customization complexity columns labeled High, Medium, and Low.

Offerors must indicate the level of complexity by adding an "X" mark in the appropriate column for each preference.

4 The response/description area immediately below each preference allows the entry of textual information.

Offerors must use this space to describe in detail how their proposed solution conforms with the preference. Precise references to other portions of the submission may be used as necessary. Simply repeating the preference or stating agreement will not be considered a satisfactory response.

5 There are five mandatory requirements (1.1 through 1.6). Proposals that do not meet these requirements may be eliminated from further consideration.

The Offeror must provide a text response in sufficient detail to demonstrate their proposal's compliance.

6 Offerors must submit the completed spreadsheet in Microsoft Excel 2003 or 2007 format.

Cells may be expanded to accommodate text responses. However, other formatting changes such as removing or inserting rows or columns, renumbering preferences, hiding or protecting cells, altering colors or fonts, or modifying headings are not permitted and may be grounds to dismiss a proposal.

I am assuming Nathan will probablyo change this.

@Creede, Paul @Schmidt, Robert

I believe so yes. We need to double check with Nathan just to make sure

Requirements Disaster Recovery Planning Software - 5400030169

Attachment A - Functionality Matrix

			Functionality Delivered Through (indicate with 'X')				Configuration / Customization Complexity (indicate with 'X')	Mandatory (M), Critical (C), or Desired (D)
		Preference Description	Base Functionality	Configuration	Custom Development	Not
Supported	High	Medium	Low	Priority
	1	Mandatory Requirements
	1.1	The solution must allow authorized users to import, export, create, edit, maintain, review, approve, verify, publish, archive, and test disaster recovery plans and related artifacts.					M
		Response/Description:
	1.2	The solution must be compatible with several file formats for input and export, including xls, xlsx, xlsm, doc, docx, vsd, vsdx, ppt, pptx, pdf, txt, csv, mpp, and other common formats.					M
		Response/Description:
	1.3	The solution must include 10 initial user licenses, all required administrator entitlements, software maintenance, updates, and support, and allow additional licenses to be purchased under a disclosed pricing schedule without requiring reimplementation.					M
		Response/Description:
	1.3	Project implementation must include project management, requirements validation, configuration, data migration, integration, testing, production deployment, knowledge transfer, go-live support, and documented acceptance criteria.					M
		Response/Description:
	1.4	The solution must include role-based administrator and end-user training, reusable training materials, job aids, and recordings of instructor-led training sessions.					M
		Response/Description:
	1.5	The solution must include 24x7x365 access to technical support, documented severity levels, response and restoration targets, escalation procedures, and phone and web-based support channels.

tc={F45EA043-4E32-4836-8371-184A31C7E325}: [Threaded comment]

Comment:

Removed 24x7x365			M
		Response/Description:
	1.6	The solution must provide configurable templates for disaster recovery plans, recovery runbooks, checklists, contact lists, system inventories, testing records, and after-action reports.		M
		Response/Description:

2	Functional Capabilities
	Critical or Desired
2.1	The solution enables users to create, edit, and manage workflows through a container or wizard that shows actionable steps via a workflow notification link.	C
	Response/Description:
2.1	The solution should support workflow and permission management, allowing users to review and approve documentation through a multi-approval process with single or multiple approvers at each development stage.	C
	Response/Description:
2.2	The solution supports configurable plan ownership, contributor, reviewer, approver, and read-only roles, together with due dates, reminders, escalations, publication, and recurring recertification workflows.	C
	Response/Description:
2.3	The solution can retain version history, identify who changed information and when, compare revisions, preserve approved and published snapshots, and restore an authorized prior version.	C
	Response/Description:
2.4	The solution should be able to associate plans with business services, business processes, applications, infrastructure, locations, vendors, recovery tiers, dependencies, owners, recovery time objectives, and recovery point objectives.	C
	Response/Description:
2.5	The solution should document and manage backup, replication, failover, restoration, validation, fallback, and return-to-normal procedures for in-scope systems and data.	C
	Response/Description:
2.6	The solution should schedule and manage simulations, technical recovery tests, and failover tests, including scenarios, objectives, participants, responsibilities, evidence, results, and approvals.	D
	Response/Description:
2.7	The solution should create and track test findings, risks, issues, lessons learned, corrective actions, owners, priorities, due dates, status, and closure evidence	D
	Response/Description:
2.8	The solution should support configurable dashboards and reports for plan currency, approval status, overdue reviews, test coverage, recovery objective gaps, unresolved findings, and organizational risk.	C
	Response/Description:
2.9	The solution should provide native mass-notification services, or a fully supported integration included in the proposed solution, for sending email, SMS or text, voice, and mobile or push communications to predefined and ad hoc recipient groups.	C
	Response/Description:
2.1	The solution should support reusable message templates, call trees, two-way acknowledgments, delivery status, failed-delivery reporting, recipient escalation, and event-level communication logs.	C
	Response/Description:
2.11	The solution should support authorized users in creating encrypted or access-controlled offline copies and printable exports of approved plans, contacts, checklists, and recovery runbooks.	C
	Response/Description:
2.12	The solution should support full-text search, filtering, tags, metadata, cross-references, and attachment management across plans, systems, locations, contacts, tests, risks, and findings.	D
	Response/Description:

3	Technical Requirements
3.1	The solution should configure and manage databases, document repositories, and notification services.	D
	Response/Description:
3.2	The solution should be browser-based, require no proprietary desktop plug-ins for standard functions, support commonly used browsers, and provide responsive mobile access.	C
	Response/Description:

4	Architecture
4.1	The solution should be able to logically isolate State data from other customers' data and use redundant production components to eliminate single points of failure for critical functions.	C
	Response/Description:
5	Database / Data Management
5.1	The solution should support bulk export of existing plans, contacts, inventories, attachments, and related records.	C
	Response/Description:
5.2	The solution should support required fields, input validation, controlled values, referential integrity, and duplicate detection.	C
	Response/Description:
5.3	The solution should be able to provide audit history in documented, commonly usable formats at any time and upon contract termination.	D
	Response/Description:
5.4	The vendor recognizes the State's ownership of its data and permits complete export of records, attachments, metadata, relationships.	C
	Response/Description:
6	Interfaces
6.1	Solution has an intuitive, web-based interface that is easily configured to adapt to a wide variety of workflows and automated or auto-assisted processes. Service is available over the Internet.	C
	Response/Description:
6.2	Solution provides a separate administrative interface with drag-and-drop support for folders and objects, standard Windows keyboard shortcuts, online help, navigation wizards, search capabilities, and standard word processing functionality.	C
	Response/Description:
6.3	Solution provides customizable and configurable context-specific help within the system.	D
	Response/Description:
7	Security
7.1	The solution supports single sign-on, multi-factor authentication for privileged accounts, and role-based access control.	C
	Response/Description:
7.2	The solution has the capability to encrypt State data in transit and at rest using Advanced Encryption Standard (AES) AES-256.	C
	Response/Description:
7.3	The solution can maintain tamper-evident audit records for authentication, administrative actions, configuration changes, content changes, approvals, exports, testing activities, and emergency communications.	C
	Response/Description:
7.4	The solution should have the capability to generate information security administrative alerts.	C
	Response/Description:
7.4	The solution should be able to make authorized audit records searchable and exportable, and support retention periods.	C
	Response/Description:
7.5	The solution should operate a documented vulnerability and patch management process to remediate identified vulnerabilities within defined, risk-based service levels.	C
	Response/Description:
7.6	The Vendor should be compliant with the following regulatory standards: PCI, HIPAA/PHI, CJIS, IRS Pub 1075	C
	Response/Description:
7.7	The solution should include a documented security incident response process and notify the State of suspected or confirmed incidents affecting State data or service availability within 24 hours of discovery.	D
	Response/Description:
7.8	The solution should ensure that hosted State data and backups are stored exclusively within the United States.	M
	Response/Description:
8	Performance and Scalability
8.1	Vendor should provide information on Data Center Rollover to an Alternate Facility to address an outage, as well as procedures for planned and emergency maintenance outages.	C
	Response/Description:
8.2	Vendor should provide acceptable SLA for technical support service level response and resolution times.	C
	Response/Description:
8.3	Vendor provided SLA for documented guarantee level(s) of 99.9% availability or better, and the actual uptime for the period of 12 months.	M
	Response/Descripition:
8.4	Vendor provided information on its customer notification procedures for solution maintenance (e.g., planned and unplanned maintenance, bug/fix deployment, feature roll-out).	C
	Response/Descripition:
8.5	Vendor provides an escalated response SLA for critical outages.	C
	Response/Descripition:
8.6	Vendor provides an online portal for trouble ticket status reporting.	D
	Response/Description:
9	Application Configuration
9.1	The solution enables users to configure forms, fields, required data, templates, workflows, statuses, roles, notifications, data classification, review cycles, and branding without vendor-developed code.	C
	Response/Description:
9.2	The solution provides a non-production environment or an equivalent protected configuration workspace and a controlled method to test, document, promote, and roll back configuration changes.	C
	Response/Description:
10	Application Customization
10.1	The solution should ensure that approved custom integrations or extensions are compatible with standard upgrades and are separately identified with all one-time and recurring costs.	C
	Response/Description:
10.2	The solution should ensure that approved custom integrations or extensions use documented interfaces and are separately identified with all one-time and recurring costs.	C
	Response/Description:
11	System Administration
11.1	The solution should provide an administrative console for managing users, roles, groups, licenses, delegated administrators, authentication settings, integrations, workflows, templates, and system-wide configuration.	C
	Response/Description:
11.2	The solution provides reports and alerts on service status, failed integrations, jobs, storage, licenses, user activity, security events, and administrative actions.	C
	Response/Description:
12	Disaster Recovery
12.1	The solution should protect State data with encrypted backups, geographically separate copies "Must be within the United States", documented retention periods, recovery capabilities, and regularly tested restoration procedures.	C
	Response/Description:
12.2	The solution should maintain a documented business continuity and disaster recovery plan for the SaaS service with contractual recovery time objective and recovery point objective values approved by the State.	C
	Response/Description:
12.3	The solution should test its SaaS disaster recovery capability at least annually, remediate material findings, and provide the State with an executive summary and evidence of test completion.	C
	Response/Description:
12.4	The vendor has defined escalation contacts for incident requests and updates, aligned with pre-defined timeframes.	C
	Response/Description:
12.4	Vendor has a service status apparatus to notify the State in case of disasters to support State data recovery and validation within a contractual recovery time objective.	C
	Response/Description:
13.0	Reporting
13.1	The solution supports custom report creation, including simple dashboards and dynamic dashboards.	C
	Response/Description:
	The Solution has the capbility for automatic report distribution and scheduling.	C
	Response/Descripition:
13.2	The solution provides automatic notifications at a user-defined cadence.	D

Response/Description:

Removed 24x7x365

File details come from the government source that posted it. Updated Nov 9, 2026.