Attachment_B_-_Functional_Requirements_(1).xlsm
XLSM spreadsheet 301 KB Posted
- Solicitation number
- 0000031989
- Issued by
- California
About this file
This document is an Attachment B - Functional Requirements associated with a Request for Information (RFI) issued by the State of California. The RFI seeks information from vendors on available off-the-shelf or custom-built reporting/recordkeeping tools for a Building Embodied Carbon Reporting Tool (BECRT). The objectives of the BECRT are to provide a means for tracking and reporting embodied carbon in building materials and construction processes. The State is looking to identify a suitable technology, approximate costs and effort, vendor tasks, and the duration needed to acquire or build the reporting tool.
The RFI does not provide specific details on item quantities, response dates, site visits, or award timelines. It is focused on gathering information from the vendor community to assist the State in determining the feasibility and requirements for the BECRT. Pricing terms, set-asides, incumbents, and funding sources are also not specified in this RFI document.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Attachment_A_-_High_Level_Process_Flows_(1).vsdx | VSDX drawing | |
| RFI_-_2024CARB_BECRT-RFI001_-_BECRT.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
STATEWIDE INFORMATION MANAGEMENT MANUAL
SECTION 19B.3 MID-LEVEL SOLUTION REQUIREMENTS TEMPLATE TOOL
| PROJECT NUMBER: | 3900-078 | AGENCY/STATE ENTITY NAME: | California Air Resources Board |
| The Statewide Information Management Manual (SIMM) 19B.3 Mid-Level Solution Requirements Template tool is provided as a guideline to document functional solution requirements. For functional solution requirements, the fields included in this template are required and must be included in an Agency/state entity's requirement documentation submission. Agencies/state entities may utilize another requirement documentation tool as long as the required fields are included. Additionally, Agencies/state entities may include more fields than those provided in this template. |
INSTRUCTIONS:
Identify the Project Number and Agency/State Entity Name:
In the Instructions tab, enter the Project Number and Agency/State Entity Name. This information will automatically populate on each corresponding "Requirement Type" tab.
Enter requirements:
Enter mid-level solution requirements in the corresponding tab based on the "Requirement Type" (i.e., Functional Mandatory, Functional Desirable, Non-Functional Mandatory, Non-Functional Desirable, Project-Transition Mandatory, Project-Transition Desirable). For additional instructions , refer to the SIMM Section 19B.1 Preparation Instructions Section 2.6.
Note: Footer information may be modified based on Agency/state entity preference.
Create a combined worksheet that displays all requirements:
Click on the "Create Combined Worksheet" button to combine all the requirements from the separate "Requirement Type" tabs (i.e., Functional Mandatory, Functional Desirable, Non-Functional Mandatory, Non-Functional Desirable, Project-Transition Mandatory, Project-Transition Desirable) onto one worksheet. Do not re-select the "Create Combined Worksheet" button if a "Combined" tab already exists, as the automatic combine macro will not function correctly. To ensure proper functionality, first delete the existing "Combined" tab and then select the "Create Combined Worksheet" button to update the combined listing of requirements.
Format the "Combined" tab:
Click on the File Menu tab, select Print. In the Print Menu, use the appropriate drop down arrows to change the "Portrait Orientation" to "Landscape Orientation" and change the "No Scaling" to "Fit All Columns on One Page."
Set Print Area:
Prior to printing from a tab/worksheet, set the Print Area.
To do this, Select the entire area to be printed. Once selected, click the Page Layout Menu tab, then select Set Print Area.
Attach requirements:
Once completed and ready to submit, attach the completed requirements documentation as indicated in Section 2.6.
| REQUIREMENT TYPE TAB |
| Combined requirements = Combined tab (viewable only if the "Create Combined Worksheet" button is used.) |
| Functional Mandatory tab |
| Functional Desirable tab |
| Non-Functional Mandatory tab |
| Non-Functional Desirable tab |
| Project/Transition Mandatory tab |
| Project/Transition Desirable tab |
California Department of Technology SIMM Section 19 Mid-Level Solution Requirements B.3 Mid-Level Solution Requirements Template &P
August 2016
Create Combined Worksheet
Functional Mandatory
| Project Number: | 3900-078 | Agency/state Entity: | California Air Resources Board | |||||||
| Obj. Ref. | ||||||||||
| (Obj. #) | Requirement Category | Requirement Number | Main Business Capability/Function | Sub Business Capability/Function | Business Process | Requirement | Requirement Type | Priority | Business Owner/ Stakeholder | |
| 1.1 | REG | REG-001 | Registration | User Account Management | Account Registration | The system should enable electronic registration and account establishment for users. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.1 | REG | REG-003 | Registration | User Account Management | Notification Management | The system should send account-related notifications to the email accounts of registered users. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.1 | REG | REG-004 | Registration | User Account Management | Communication Log Management | The system should keep a log of all email communications sent to registered users. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | REG | REG-012 | Registration | User Account Management | Account Maintenance | The system should allow authorized users to create, retrieve, view, and update their account information (change of contact name). | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | REG | REG-013 | Registration | User Account Management | Account Maintenance | The system should allow authorized users to retrieve and update information as required during account creation. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.1 | REG | REG-014 | Registration | User Account Management | Notification Management | The system should generate real-time user notifications (e.g., registration submitted, incomplete registration information). | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.2 | REG | REG-016 | Registration | User Account Management | Notification Management | The system should display a message to inform the authorized users that data associated with their account has been modified (edited). | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 3.1 | REG | REG-017 | Registration | User Account Management | User Roles and Permissions | The system should provide internal administrators with the capability to define, assign, and maintain roles and permissions for all users. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 3.1 | REG | REG-018 | Registration | User Account Management | User Roles and Permissions | The system should provide external administrators with the capability to assign, and maintain roles for users within their company. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 3.1 | REG | REG-019 | Registration | User Account Management | User Roles and Permissions | The system should allow external administrator to associate and remove authorized users from third party company. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 3.1 | REG | REG-020 | Registration | User Account Management | User Roles and Permissions | The system should allow an account external administrator to modify or remove an authorized user's account. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | REG | REG-021 | Registration | User Account Management | Account Maintenance | The system should allow authorized users to update account information. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | REG | REG-022 | Registration | User Account Management | Account Maintenance | The system should allow an account user to update and maintain their account based on their roles and permissions. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | REG | REG-023 | Registration | User Account Management | Account Deactivation | The system should allow authorized users to deactivate an account. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.1 | REG | REG-024 | Company Registration | Submission Routing | Compliance Management | The system should route submitted registration forms to the regulatory authority for review. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.1 | REG | REG-025 | Company Registration | Company Registration | Registration Log | The system should record approved company registration details for future reference. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 3.1 | REG | REG-026 | Registration | Third Party Association | Notification Management | The system should send notifications to the third party if a company wants to associate them. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | DS | DS-001 | Data Submission | Data Entry | Data Entry | The system should provide intuitive and user-friendly data entry forms. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2, 2.2 | DS | DS-002 | Data Submission | Data Entry | Data Versioning | The system should implement version control for submitted data, allowing tracking of changes and updates over time. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.2 | DS | DS-003 | Data Submission | Data Entry | Data Traceability | The system should maintain a revision history for data traceability. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.1 | DS | DS-004 | Data Submission | Data Entry | Data Review | The system should allow users to review their submitted data before finalizing the submission. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.1 | DS | DS-005 | Data Submission | Data Entry | Notification Management | The system should provide users with a confirmation message upon successful data submission. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | DS | DS-006 | Data Submission | Data Entry | Data Format | The system should support data submission in various formats. Examples include numeric, text, dates, binary and geospatial, etc. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 3.1 | DS | DS-007 | Data Submission | Error Handling | Error Guidance | The system should provide clear error messages to guide users in correcting any submission errors. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | DS | DS-008 | Data Submission | Data Submission | Data Upload | The system should support file uploads for bulk data submission, including relevant documentation. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | DS | DS-009 | Data Submission | Data Submission | Data Format | The system should specify acceptable file formats and size limits. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | DS | DS-010 | Data Submission | Data Submission | Data Validation | The system should validate the entry of data (e.g. issuance date of data) according to requirements that the internal admins sets. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | DS | DS-011 | Data Submission | Data Submission | Data Upload | The system should enable internal users to add, create or amend data submission forms without need for contract maintenance. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | DS | DS-012 | Data Submission | Data Submission | Data Upload | The system should include an API to allow registered external users to upload data. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.1 | DS | DS-013 | Data Submission | Correspondence | Secure messaging | The system should allow internal admins to send secure messages to registered parties requesting changes or resubmission. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.1 | DVR | DVR-001 | Database, Data Visualization and Reports | Data Visualization | User Access Management | The system should facilitate different access levels for different types of users. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.1 | DVR | DVR-002 | Database, Data Visualization and Reports | Data Manipulation | Data Calculation | The system should utilize efficient algorithms for accurate processing of datasets. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.1, 3.1 | DVR | DVR-003 | Database, Data Visualization and Reports | Data Manipulation | Data Calculation | The system should enable internal users to define statististical functions and manipulate data. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | DVR | DVR-004 | Database, Data Visualization and Reports | Data Visualization | Dashboard Interface | The system should include an intuitive and user-friendly dashboard interface. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.2 | DVR | DVR-005 | Database, Data Visualization and Reports | Data Visualization | Data Exploration | The system should implement drill-down functionality for users to explore detailed information. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | DVR | DVR-006 | Database, Data Visualization and Reports | Data Visualization | Dashboard Customization | The system should allow internal users to customize the dashboard layout based on their preferences. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | DVR | DVR-007 | Database, Data Visualization and Reports | Data Visualization | Public Dashboard Access | The system should provide a public dashboard for users to access data without logging in. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 3.1 | DVR | DVR-008 | Database, Data Visualization and Reports | Reports | Report Generation | The system should enable internal users to generate custom reports. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.1, 2.2 | DVR | DVR-009 | Database, Data Visualization and Reports | Reports | Report Generation | The system should have an API that allows internal users to interface with stored data. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 3.1 | DVR | DVR-010 | Database, Data Visualization and Reports | Data Analysis | Statistical Analysis and Visualization | The system should include user defined calculations, charts, graphs and geographic mapping for comprehensive insights. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.2 | DVR | DVR-011 | Database, Data Visualization and Reports | Database | Report Management | The system should include a version history for reports to track changes over time. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.1 | DVR | DVR-012 | Database, Data Visualization and Reports | Database | Data Confidentiality and Integrity | The system should implement security measures to ensure the confidentiality and integrity of data. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 1.2 | DVR | DVR-013 | Database, Data Visualization and Reports | Database | Database Management | The system should implement auto-refresh functionality to maintain data accuracy. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.1, 2.2 | DVR | DVR-014 | Database, Data Visualization and Reports | Database | Product Ledger | The system should include a product ledger that tracks product flows and balances. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.1, 2.2 | DVR | DVR-015 | Database, Data Visualization and Reports | Database | Chain of Custody Tracking | The system should allow for the chain of custody of reported products to be tracked between and across registered parties | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.1, 2.2 | DVR | DVR-016 | Database, Data Visualization and Reports | Database | Product Balances | The system should allow for estimation of product balances for different product categories across registered parties | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 2.2 | DVR | DVR-017 | Database, Data Visualization and Reports | Data Analysis | Ledger Calculations | The system should allow internal users to define custom calculations and aggregations of products to estimate summary statistics for product types and categories from reported data | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 3.1 | COR | COR-001 | Correspondence | Correspondence | Secure Messaging | The system should allow registered parties to send secure messages to internal admins. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 3.1 | COR | COR-002 | Correspondence | Secure messaging | File Transfer | Correspondence module should allow external users to attach files to messages. | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 3.1 | COR | COR-003 | Correspondence | Secure messaging | Message Tracking | The system shall allow external ansd internal users to track correspondence by subject or issue (such as a ticket number of thread.) | Functional | Mandatory | Annalisa Schilla/Pamela Gupta | |
| 3.1 | COR | COR-004 | Correspondence | Secure messaging | Recipients | The system shall allow internal admins to distribute correspondence to various subsets and groups of external users | Functional | Mandatory | Annalisa Schilla/Pamela Gupta |
FUNCTIONAL MANDATORY
&P of &N &D
Functional Desirable
| Project Number: | 3900-078 | Agency/state Entity: | California Air Resources Board | |||||||
| Obj. Ref. | ||||||||||
| (Obj. #) | Requirement Category | Requirement Number | Main Business Capability/Function | Sub Business Capability/Function | Business Process | Requirement | Requirement Type | Priority | Business Owner/ Stakeholder | |
| 1.1, 1.2 | DS | DS-012 | Data Submission | Data Entry Validation | Data Submission | The system shall provide real-time feedback during data entry to inform users about the accuracy and completeness of their submissions. | Functional | Desirable | Annalisa Schilla/Pamela Gupta | |
| 2.1, 2.2 | DVR | DVR-022 | Database, Data Visualization and Reports | Security Management | Role-Based Access Control | The system must implement a secure role-based access control system, managing user authorization levels and enforcing access restrictions at the report, file, table, screen, and field levels based on individual user permissions. | Functional | Desirable | Annalisa Schilla/Pamela Gupta | |
| 1.2 | DVR | DVR-023 | Database, Data Visualization and Reports | Data Management | Data Validation | The system shall include field validations to ensure the accuracy and validity of entered data. | Functional | Desirable | Annalisa Schilla/Pamela Gupta | |
| 1.2 | DVR | DVR-024 | Database, Data Visualization and Reports | Data Management | Data Validation | The system shall implement predefined data validation rules to ensure accuracy and completeness. | Functional | Desirable | Annalisa Schilla/Pamela Gupta |
FUNCTIONAL DESIRABLE
&P of &N &D
Non-Functional Mandatory
| Project Number: | 3900-078 | Agency/state Entity: | California Air Resources Board | ||||||
| Obj. Ref. | |||||||||
| (Obj. #) | Requirement Category | Requirement Number | Main Business Capability/Function | Sub Business Capability/Function | Business Process | Requirement | Requirement Type | Priority | Business Owner/ Stakeholder |
| ERC | ERC-1 | Environmental Reporting and Compliance Management | System Architecture and Design | System Expansion and Scalability Planning | The system shall demonstrate the capability to seamlessly scale its infrastructure and accommodate a growing user base, ensuring optimal performance and responsiveness even under increased data processing loads. | Non-Functional | Mandatory | ||
| ERC | ERC-2 | Environmental Reporting and Compliance Management | System Architecture and Design | System Expansion and Scalability Planning | The system should allow for easy integration of new features and functionalities to meet evolving business needs without compromising existing system stability. | Non-Functional | Mandatory | ||
| APPDEV-01 | App. Dev. | The system shall comply with CA AB 434, California State Administrative Manual (SAM) 4833, Section 508 Standards for accessibility, and the Americans with Disabilities Act (ADA). | Non-Functional | Mandatory | |||||
| APPDEV-03 | App. Dev. | The system shall provide a responsive user interface. | Non-Functional | Mandatory | |||||
| APPDEV-04 | App. Dev. | The system shall be compatible with the latest version of Chrome, Safari, and Edge at the time the software is released to production. FireFox may be used based on CARB project specifications. | Non-Functional | Mandatory | |||||
| APPDEV-07 | App. Dev. | The system shall adhere to CARB OIS Standards for Coding. | Non-Functional | Mandatory | |||||
| APPDEV-08 | App. Dev. | The solution shall store all source code, configuration, documentation, and IaC in CARB’s version control repository. | Non-Functional | Mandatory | |||||
| APPDEV-09 | App. Dev. | The solution shall adhere to the OIS Coding Standards for UI development and styling. | Non-Functional | Mandatory | |||||
| APPDEV-10 | App. Dev. | The development team shall conduct a formal code review with OIS in order to ensure compliance with OIS standards. The project schedule must provide one week for OIS code review upon completion of 25% of code development. | Non-Functional | Mandatory | |||||
| APPDEV-11 | App. Dev. | The solution must provide evidence of a WCAG scan of the application's primary home or landing page, and the primary landing page encountered after a user has authenticated. The WCAG scan must be free of errors. | Non-Functional | Mandatory | |||||
| APPDEV-12 | App. Dev. | The solution must provide evidence of an accessibility scan covering all documents. The scan must be free of errors. | Non-Functional | Mandatory | |||||
| APPDEV-13 | App. Dev. | The development team shall conduct a formal code review with OIS in order to ensure compliance with OIS standards. The project schedule must provide one week for OIS code review upon completion of 75% of code development. | Non-Functional | Mandatory | |||||
| ARC-04 | Architecture | The system shall prevent the real-time download/export of data that exceeds two (2) GB through the web interface. | Non-Functional | Mandatory | |||||
| ARC-05 | Architecture | The system shall adhere to the CARB Software Architecture Standards and Technology Stack. | Non-Functional | Mandatory | |||||
| ARC-06 | Architecture | Code comments should be compatible with dOxygen. | Non-Functional | Mandatory | |||||
| ARC-08 | Architecture | For the pages that require mobile device support, the system shall be viewable in the latest version of Chrome on an Android device without visual artifacts. | Non-Functional | Mandatory | |||||
| ARC-09 | Architecture | For the pages that require mobile device support, the system shall be viewable in the latest version of Safari on an iOS device without visual artifacts. | Non-Functional | Mandatory | |||||
| ARC-11 | Architecture | The system shall store non-structured files (i.e. images, CSV, etc.) on AWS S3. SaaS solutions may store non-structured files on natively supported storage systems if the systems have been pre-approved for this purpose by OIS . | Non-Functional | Mandatory | |||||
| ARC-12 | Architecture | The system shall prioritize the use of APIs for interactions between distinct software components. | Non-Functional | Mandatory | |||||
| ARC-13 | Architecture | The solution shall be configurable to execute from multiple environments (Ex. Development, UAT, and Production). | Non-Functional | Mandatory | |||||
| ARC-14 | Architecture | The system shall use relational SQL databases for OLTP data sets. | Non-Functional | Mandatory | |||||
| ARC-16 | Architecture | The system shall reduce image resolutions to the smallest dimensions that retain sufficient clarity. Sufficient clarity must be defined for each case by specific project requirements. Consult with legal to ensure compliance with best evidence rule. | Non-Functional | Mandatory | |||||
| ARC-18 | Architecture | The system shall be compatible with standard APIs for generating reports such as Tableau, Power BI. | Non-Functional | Mandatory | |||||
| ARC-19 | Architecture | No user other than a CARB OIS DevOp or OIS DBA should have access to modify any aspect of a UAT or Production environment. This includes remote access to servers (SSH/RDP). AWS-Business or “Big Data” is a production environment. | Non-Functional | Mandatory | |||||
| ARC-20 | Architecture | All APIs must follow the OIS API Standards specifications. | Non-Functional | Mandatory | |||||
| ARC-21 | Architecture | The system shall not store PII data in the same S3 bucket as other types of data, nor shall it store PII data in any S3 bucket that is configured as a static web server. | Non-Functional | Mandatory | |||||
| ARC-23 | Architecture | All closed-source or commercially licensed third-party services utilized within any SaaS application must be disclosed and pre-approved by CARB OIS. | Non-Functional | Mandatory | |||||
| ARC-25 | Architecture | All SaaS solutions that send email on CARB’s behalf must integrate with CARB's DKIM. | Non-Functional | Mandatory | |||||
| ARC-26 | Architecture | The project team shall submit a Solution Architecture Document for formal project approval prior to development. The Solution Architecture Document shall include an anticipated provisioning request that lists software and services, quantity, projected capacity/throughput, and data egress and ingress from cloud networks. | Non-Functional | Mandatory | |||||
| ARC-27 | Architecture | The project team shall develop build scripts, developer documentation, and documentation of build processes necessary for production deployment, for formal project approval prior to Go-Live. The project team shall provide sufficient detail in the build process documentation such that CARB is able to build and deploy the system without the assistance of the project team. The documentation shall be updated with each subsequent software iteration. | Non-Functional | Mandatory | |||||
| ARC-28 | Architecture | The project team shall submit documentation for all APIs according to CARB API Standards. | Non-Functional | Mandatory | |||||
| ARC-29 | Architecture | The solution must utilize CARB's standard payment processing service. | Non-Functional | Mandatory | |||||
| ARC-30 | Architecture | The solution must not store any unstructured data in formats that are proprietary products of the solution vendor. | Non-Functional | Mandatory | |||||
| ARC-31 | Architecture | The solution must announce all software releases to production environments using CARB's release tracking tool. | Non-Functional | Mandatory | |||||
| ARC-32 | Architecture | The project shall reside in the same Salesforce organization as existing CARB projects using a single-org approach unless otherwise approved by the CARB OIS Architecture Board. | Non-Functional | Mandatory | |||||
| ARC-33 | Architecture | The project shall document and describe the capabilities of all user roles | Non-Functional | Mandatory | |||||
| ARC-34 | Architecture | All project documentation artifacts that utilize proprietary solutions that are not formally supported by CARB must store the same document content using a solution that is in CARB's Supported Technology List. The supported version of the document must be kept up to date on a monthly basis. | Non-Functional | Mandatory | |||||
| ARC-35 | Architecture | The solution shall complete the California Cloud Services Assessment (CCSA) submission process and obtain approval before any cloud resources can be provisioned. | Non-Functional | Mandatory | |||||
| ARC-07 | Architecture | For the pages that require mobile device support, the system shall provide a user interface with a minimum resolution of 640 x 1136 pixels. | Non-Functional | Mandatory | |||||
| ARC-24 | Architecture | All Salesforce applications must include sufficient documentation, configuration, and source code deliverables as to allow CARB to fully install the Salesforce application in a separate Salesforce account. | Non-Functional | Mandatory | |||||
| DEVOPS-02 | DevOps | The system shall adhere to CARB OIS database guidelines. | Non-Functional | Mandatory | |||||
| DEVOPS-04 | DevOps | The system shall adhere to CARB OIS DevOps Management Guidelines. | Non-Functional | Mandatory | |||||
| DEVOPS-05 | DevOps | The development team shall develop scripts to deploy infrastructure as code as specified in CARB's IaC Matrix. | Non-Functional | Mandatory | |||||
| DEVOPS-07 | DevOps | The project team shall submit a database request form to OIS before any databases can be provisioned. | Non-Functional | Mandatory | |||||
| ED-01 | Enterprise Data | The system shall utilize CARB environments for data storage, distribution and archive. | Non-Functional | Mandatory | |||||
| ED-03 | Enterprise Data | The solution shall utilize any existing reference data as defined by CARB. | Non-Functional | Mandatory | |||||
| ED-04 | Enterprise Data | Reference data utilized by a solution shall be updated whenever an update is requested by CARB. | Non-Functional | Mandatory | |||||
| ED-05 | Enterprise Data | The project team shall utilize and adhere to the CARB main business glossary throughout solution development | Non-Functional | Mandatory | |||||
| ED-06 | Enterprise Data | Systems utilizing Tableau must comply with the OIS Tableau Standards & Process | Non-Functional | Mandatory | |||||
| ED-07 | Enterprise Data | The project team shall submit an entity relationship diagram (ERD), and a data dictionary to CARB for formal project approval (signoff) as follows: |
1. At the end of the design phase and prior to coding
2. At the end of coding and prior to User Acceptance Testing
| 3. At the end of User Acceptance Testing and prior to Go-Live. | Non-Functional | Mandatory | |||||
| ED-10 | Enterprise Data | The solution shall store addresses and/or locations in accordance with CARB's international address standards. | Non-Functional | Mandatory | |||
| ED-11 | Enterprise Data | The solution shall adhere to CARB's enterprise data guidelines & policies | Non-Functional | Mandatory | |||
| ED-12 | Enterprise Data | All projects must include Enterprise Data / Data Management in the "pre-planning" process and prior to any IT planning or development. The Enterprise Data / Data Management lead must be present in the planning meetings. | Non-Functional | Mandatory | |||
| ED-13 | Enterprise Data | In the "pre-planning" process, all projects must identify a data governance representative for the project. Otherwise, the Subject Matter Expert (SME) will serve as the data governance representative. The name of the data governance representative must be documented in the Enterprise Data Questionnaire. | Non-Functional | Mandatory | |||
| ED-15 | Enterprise Data | The project team shall submit a business logic diagram (indluding workflows between people and technology) at the end of the design phase and prior to development. | Non-Functional | Mandatory | |||
| GIS-01 | GIS | The system shall include the minimum set of metadata elements for a geospatial dataset according to CARB (CDFW) Minimum Metadata Standards. | Non-Functional | Mandatory | |||
| GIS-02 | GIS | The system shall adhere to the "Digital Accessibility Guidance for Maps and Technical Content" document. | Non-Functional | Mandatory | |||
| GIS-03 | GIS | The system shall utilize CARB Hosted ESRI REST API’s or other ESRI supported formats for serving, updating, and using geospatial data unless otherwise approved. | Non-Functional | Mandatory | |||
| GIS-04 | GIS | The system shall use CARB Hosted ESRI ArcGIS StreetMap Premium for physical address validation and geocoding unless otherwise approved | Non-Functional | Mandatory | |||
| GIS-06 | GIS | The system shall utilize and adhere to the CARB Enterprise GIS Framework. | Non-Functional | Mandatory | |||
| INF-02 | Infrastructure | The system must utilize Accellion for ingesting external bulk data. Files located on the SFTP server are temporal and must only reside on the server for the purposes of staging data and short term processing. | Non-Functional | Mandatory | |||
| INF-03 | Infrastructure | PaaS applications shall use Docker containers. AWS Fargate should be used when practical. | Non-Functional | Mandatory | |||
| INF-04 | Infrastructure | Applications shall not hard code IP addresses in source code. | Non-Functional | Mandatory | |||
| INF-05 | Infrastructure | All domain services must be managed by CARB. | Non-Functional | Mandatory | |||
| INF-06 | Infrastructure | All public-facing web traffic must go through the AWS edge account. | Non-Functional | Mandatory | |||
| INF-07 | Infrastructure | All services hosted on AWS must be tagged as specified by CARB. | Non-Functional | Mandatory | |||
| INF-10 | Infrastructure | The system shall, whenever possible, avoid the use of servers with full operating systems, and reflect a design preference for SaaS, containers, or serverless solutions. | Non-Functional | Mandatory | |||
| INF-13 | Infrastructure | Server operating systems and docker base images shall be limited to those approved by OIS. | Non-Functional | Mandatory | |||
| INF-14 | Infrastructure | All bulk email's must be pre-approved by the PIO office and integrate with Granicus. | Non-Functional | Mandatory | |||
| INF-15 | Infrastructure | Data retention and data archiving requirements must be defined within the project | Non-Functional | Mandatory | |||
| INF-16 | Infrastructure | Solutions requiring a secondary backup region must utilize the AWS region us-east-1 | Non-Functional | Mandatory | |||
| PMO-01 | PMO | The solution shall include all deliverables identified for the solution according to the OIS SDLC document. The solution shall include an appendix listing each identified deliverable. | Non-Functional | Mandatory | |||
| PMO-07 | PMO | The Development Team shall provide all source code to CARB, including source code for binary files, necessary for production deployment, on a mutually agreed upon basis throughout the project. | Non-Functional | Mandatory | |||
| PMO-10 | PMO | The project team shall submit test cases, test scripts and test results for formal project approval prior to User Acceptance Testing. | Non-Functional | Mandatory | |||
| PMO-14 | PMO | The project team shall submit a software license list detailing the software used for the Solution. The list shall include but is not limited to: the name of the software, license number, date purchased, purchaser and hardware on which the software is installed. | Non-Functional | Mandatory | |||
| PMO-16 | PMO | The project team shall use CARB’s current approved task/issue tracking system for task management and bug tracking. | Non-Functional | Mandatory | |||
| PMO-18 | PMO | The project team shall write and deliver tests to cover 100% of the business processes handled by the application for formal project approval prior to User Acceptance Testing. The project team shall use the tools and technologies for testing as defined in the OIS Technology Stack. | Non-Functional | Mandatory | |||
| PMO-24 | PMO | The project team shall submit a Test Plan for formal project approval prior to coding. | Non-Functional | Mandatory | |||
| PMO-25 | PMO | In RFI responses, the vendor shall submit a list of which non-functional requirements are met by the proposed solution. | Non-Functional | Mandatory | |||
| SEC-001 | Security | The system shall encrypt data in transit. | Non-Functional | Mandatory | |||
| SEC-002 | Security | The system shall encrypt data at rest for data identified by CARB as confidential or sensitive. | Non-Functional | Mandatory | |||
| SEC-003 | Security | The system shall prevent anonymous users from accessing confidential or sensitive data. | Non-Functional | Mandatory | |||
| SEC-004 | Security | The system shall authenticate a user at login. | Non-Functional | Mandatory | |||
| SEC-005 | Security | The system shall authenticate a user prior to the user accessing confidential or sensitive data. | |||||
| The system shall implement role based security. | Non-Functional | Mandatory | |||||
| SEC-006 | Security | The system shall enforce user access according to the user’s role(s) and privileges. | Non-Functional | Mandatory | |||
| SEC-007 | Security | The system shall utilize a minimum of two (2) layers of security for a database which stores confidential or sensitive data. | Non-Functional | Mandatory | |||
| SEC-008 | Security | The system shall comply with NIST sp800-53 (current version). | Non-Functional | Mandatory | |||
| SEC-009 | Security | The system shall comply with State of California State Administrative Manual (SAM) 5300. | Non-Functional | Mandatory | |||
| SEC-010 | Security | The system shall comply with CARB Information Security Manual. | Non-Functional | Mandatory | |||
| SEC-011 | Security | The system shall create distinct user accounts for administrators. An administrator userid must be distinct from a non-administrator userid (For example, it could be prepended with "sa_"). An administrative account must only be used for administrative duties. | Non-Functional | Mandatory | |||
| SEC-012 | Security | The development team shall create and scramble test data for the purposes of testing the system. The vendor shall not use confidential or sensitive data for testing. | Non-Functional | Mandatory | |||
| SEC-013 | Security | The system shall support multi-factor authentication (MFA) for user and administrator accounts. | Non-Functional | Mandatory | |||
| SEC-014 | Security | Infrastructure as code should only be capable of executing when manually approved by a designated OIS representative. | Non-Functional | Mandatory | |||
| SEC-015 | Security | Dynamically created files/objects should not be stored in the same physical location as application source code. | Non-Functional | Mandatory | |||
| SEC-018 | Security | The system shall comply with the Miscellaneous Security Standards document. | Non-Functional | Mandatory | |||
| SEC-019 | Security | Any documents in the system that are subject to PRA or eDiscovery requirements must be stored in a location accessible by CARB’s existing eDiscovery tool, or the project must provide integration between the project and the existing eDiscovery tools. | Non-Functional | Mandatory | |||
| SEC-020 | Security | All web server log files must log data in a format consistent with existing CARB applications. Log format to be consistent with other logs at CARB |
IIS Webserver logs should be enabled and have the following options configured:
Change log format to "W3C" Add all fields except "Cookie" Add 3 Custom Fields:
Field Name Source type Source X-Forwarded-For Request Header X-Forwarded-For Content-Type Request Header Content-Type
| https Server Variable HTTPS | Non-Functional | Mandatory | |||||
| SEC-021 | Security | All web traffic must be traceable to its source based on logged data. To be traced to its source, all web server logs should include the X-forwarded-for header, show the full URL, source IP etc. | Non-Functional | Mandatory | |||
| SEC-022 | Security | All applications must log all user activity. The log should include who did what, when it was done, where it was done from and have some context as to why it was done. This includes reading data if the data is non public, and what data was read. | Non-Functional | Mandatory | |||
| SEC-023 | Security | The system must integrate with and log, application and cloud events that include system access, security intrusion events, network events, etc., to CARB SEIM system, so that the system can be monitored for security threats and incident response. Integration of the data is the projects responsibility. | Non-Functional | Mandatory | |||
| SEC-024 | Security | Test data used for system testing must be non-confidential, so that system test is performed with accurate data while protecting the privacy and identity of the data. | Non-Functional | Mandatory | |||
| SEC-025 | Security | The system must meet federal (NIST sp800-53), State(SIMM and SAM), and CARB information security controls requirements that includes security features, including, but not limited to, the following: |
* Data security,
* Regulatory compliance,
* System access, and
* System vulnerability protection.
| All artifacts called out by the above standards must be included in the project. | Non-Functional | Mandatory | |||||
| SEC-027 | Security | The project must produce the Privacy Impact Assessment document, which must be provided in the correct template provided by CARB/CDT. The format of these documents may not be modified. No sections may be removed, and all sections must be completed. In the event that the documentation implies that best practices have not been followed, CARB will require the project team to remediate the issues at the project team’s expense. | Non-Functional | Mandatory | |||
| SEC-029 | Security | The project must produce the System Security Plan (SSP) document, which must be provided in the correct template provided by CARB/CDT. The format of these documents may not be modified. No sections may be removed, and all sections must be completed. In the event that the documentation implies that best practices have not been followed, CARB will require the project team to remediate the issues at the project team’s expense. The SSP must be presented at project desgin and updated duirng dveelopment. The finalk review will be before UAT testing. | Non-Functional | Mandatory | |||
| SEC-030 | Security | The project must produce a STRIDE Model (produced by the Microsoft threat modeling application), the document must be provided in the correct template provided by the application. The format of these documents may not be modified. No sections may be removed, and all sections must be completed. In the event that the documentation implies that best practices have not been followed, CARB will require the project team to remediate the issues at the project team’s expense. | Non-Functional | Mandatory | |||
| SEC-031 | Security | The project must produce the Fips 199 data classification document, which must be provided in the correct template provided by CARB/CDT. The format of these documents may not be modified. No sections may be removed and all sections must be completed. | Non-Functional | Mandatory | |||
| SEC-033 | Security | The project must provide an Incident Response Plan document, which must be provided in the correct template provided by CARB/CDT. The format of these documents may not be modified. No sections may be removed, and all sections must be completed. In the event that the documentation implies that best practices have not been followed, CARB will require the project team to remediate the issues at the project team’s expense. | Non-Functional | Mandatory | |||
| SEC-034 | Security | The project must provide the Security Risk Assessment document, which must be provided in the correct template provided by CARB/CDT. The format of these documents may not be modified. No sections may be removed, and all sections must be completed. In the event that the documentation implies that best practices have not been followed, CARB will require the project team to remediate the issues at the project team’s expense. | Non-Functional | Mandatory | |||
| SEC-035 | Security | The application must be tested from a security perspective. In addition to positive functionality testing (user can do X), negative security test cases (user cannot do X) must also be performed for all security, authentication and authorization related use cases. | Non-Functional | Mandatory | |||
| SEC-036 | Security | The system must implement NIST sp800-53r5 control CM-10: Software Usage Restrictions | Non-Functional | Mandatory | |||
| SEC-037 | Security | Applications must integrate with the current standards based authentication solution deployed at CARB. The project team is responsible for know how to integrate applications using SAML 2.0, OIDC or OAUTH2 with CARB’s current identity platform. | Non-Functional | Mandatory | |||
| SEC-038 | Security | All system components (Operating system, platform components, libraries etc.) must be kept up to date during the development and test cycles. | Non-Functional | Mandatory | |||
| SEC-039 | Security | A plan to keep all system components (Operating system, platform components, libraries etc.) up to date after deployment must be provided. | Non-Functional | Mandatory | |||
| SEC-040 | Security | The system must use current encryption technology, so that all communication between the users, sub-systems, state entities, etc., and the system is secure and prevents the risk of data exposure. | Non-Functional | Mandatory | |||
| SEC-042 | Security | All projects are responsible for integrating their solutions with any third-party systems or CARB systems that are part of the solution design. If CARB has an existing system that performs similar functionality to a system component. The CARB system must be integrated into the solution. | Non-Functional | Mandatory | |||
| SEC-043 | Security | The system must implement NIST sp800-53r5 control AC-2: Account Management, together with control enhancements AC-2(1), AC-2(2), AC-2(3), AC-2(4), AC-2(5) and AC-2(13) | Non-Functional | Mandatory | |||
| SEC-044 | Security | The system must implement NIST sp800-53r5 control AC-3: Access Enforcement | Non-Functional | Mandatory | |||
| SEC-045 | Security | The system must implement NIST sp800-53r5 control AC-4: Information Flow Enforcement | Non-Functional | Mandatory | |||
| SEC-046 | Security | The system must implement NIST sp800-53r5 control AC-5: Separation of Duties | Non-Functional | Mandatory | |||
| SEC-047 | Security | The system must implement NIST sp800-53r5 control AC-6: Least Privilege, , together with control enhancements AC-6(1), AC-6(2), AC-6(5), AC-6(7), AC-6(9), AC-6(10) | Non-Functional | Mandatory | |||
| SEC-048 | Security | The system must implement NIST sp800-53r5 control AC-7: Unsuccessful Logon Attempts | Non-Functional | Mandatory | |||
| SEC-049 | Security | The system must implement NIST sp800-53r5 control AC-8: System Use Notification | Non-Functional | Mandatory | |||
| SEC-050 | Security | The system must implement NIST sp800-53r5 control AC-11: Session Lock, together with control enhancement AC-11(1) | Non-Functional | Mandatory | |||
| SEC-051 | Security | The system must implement NIST sp800-53r5 control AC-12: Session Termination | Non-Functional | Mandatory | |||
| SEC-052 | Security | The system must implement NIST sp800-53r5 control AC-14: Permitted actions without identification or authentication | Non-Functional | Mandatory | |||
| SEC-053 | Security | The system must implement NIST sp800-53r5 control AC-17: remote access, together with contrrol enhancements AC-17(1), AC-17(2), AC-17(3) and AC-17(4) | Non-Functional | Mandatory | |||
| SEC-054 | Security | The system must implement NIST sp800-53r5 control AC-18: wireless access, together with control enhancements AC-18(1) and AC-18(3) | Non-Functional | Mandatory | |||
| SEC-055 | Security | The system must implement NIST sp800-53r5 control AC-19: access control for mobile devices, together with control enhancements AC-19(5) | Non-Functional | Mandatory | |||
| SEC-056 | Security | The system must implement NIST sp800-53r5 control AC-20: use of external systems, together with control enhancements AC-20(1) and AC-20(2) | Non-Functional | Mandatory | |||
| SEC-057 | Security | The system must implement NIST sp800-53r5 control AC-21: information sharing | Non-Functional | Mandatory | |||
| SEC-058 | Security | The system must implement NIST sp800-53r5 control AC-22: publicly accessible content | Non-Functional | Mandatory | |||
| SEC-059 | Security | The system must implement NIST sp800-53r5 control AU-1: policy and procedures | Non-Functional | Mandatory | |||
| SEC-060 | Security | The system must implement NIST sp800-53r5 control AU-2: event logging | Non-Functional | Mandatory | |||
| SEC-061 | Security | The system must implement NIST sp800-53r5 control AU-3: content of audit records, with control enhancement AU-3(1) | Non-Functional | Mandatory | |||
| SEC-062 | Security | The system must implement NIST sp800-53r5 control AU-4: audit log storage capacity | Non-Functional | Mandatory | |||
| SEC-063 | Security | The system must implement NIST sp800-53r5 control AU-5: response to audit logging process failures | Non-Functional | Mandatory | |||
| SEC-064 | Security | The system must implement NIST sp800-53r5 control AU-6: audit record review, analysis, and reporting, together with control enhancements AU-6(1) and AU-6(3) | Non-Functional | Mandatory | |||
| SEC-065 | Security | The system must implement NIST sp800-53r5 control AU-7: audit record reduction and report generation, together with control enhancements AU-7(1) | Non-Functional | Mandatory | |||
| SEC-066 | Security | The system must implement NIST sp800-53r5 control AU-8: timestamps | Non-Functional | Mandatory | |||
| SEC-067 | Security | The system must implement NIST sp800-53r5 control AU-9: protection of audit information, together with control enhancements AU-9(4) | Non-Functional | Mandatory | |||
| SEC-068 | Security | The system must implement NIST sp800-53r5 control AU-11: audit record retention | Non-Functional | Mandatory | |||
| SEC-069 | Security | The system must implement NIST sp800-53r5 control AU-12: audit record generation | Non-Functional | Mandatory | |||
| SEC-070 | Security | The system must implement NIST sp800-53r5 control IA-1: policies and procedures | Non-Functional | Mandatory | |||
| SEC-071 | Security | The system must implement NIST sp800-53r5 control IA-2: identification and authentication (organizational users), together with control enhancementsIA-2(1), IA-2(2), IA-2(8) | Non-Functional | Mandatory | |||
| SEC-072 | Security | The system must implement NIST sp800-53r5 control IA-3: device identification and authentication | Non-Functional | Mandatory | |||
| SEC-073 | Security | The system must implement NIST sp800-53r5 control IA-4: identify management, together with control enhancements IA-4(4) | Non-Functional | Mandatory | |||
| SEC-074 | Security | The system must implement NIST sp800-53r5 control IA-5: authenticator management, together with control enhancements-5(1), IA-5(2), and IA-5(6) | Non-Functional | Mandatory | |||
| SEC-075 | Security | The system must implement NIST sp800-53r5 control IA-6: authentication feedback | Non-Functional | Mandatory | |||
| SEC-076 | Security | The system must implement NIST sp800-53r5 control IA-7: cryptographic module authentication | Non-Functional | Mandatory | |||
| SEC-077 | Security | The system must implement NIST sp800-53r5 control IA-8: identification and authentication (non organizational users), together with control enhancements IA-8(2) and IA-8(4) | Non-Functional | Mandatory | |||
| SEC-078 | Security | The system must implement NIST sp800-53r5 control IA-11: re-authentication | Non-Functional | Mandatory | |||
| SEC-079 | Security | The system must implement NIST sp800-53r5 control IA-12: identity proofing, together with control enhancements IA-12(2), IA-12(3) and IA-12(5) | Non-Functional | Mandatory | |||
| SEC-080 | Security | The system must implement NIST sp800-53r5 control SC-1: policies and procedures | Non-Functional | Mandatory | |||
| SEC-081 | Security | The system must implement NIST sp800-53r5 control SC-2: separation of system and user functionality | Non-Functional | Mandatory | |||
| SEC-082 | Security | The system must implement NIST sp800-53r5 control SC-4: information in shared system resources | Non-Functional | Mandatory | |||
| SEC-083 | Security | The system must implement NIST sp800-53r5 control SC-5: denial of service protection | Non-Functional | Mandatory | |||
| SEC-084 | Security | The system must implement NIST sp800-53r5 control SC-7: boundary protection, together with control enhancements SC-7(3), SC-7(4), SC-7(5), SC7(7) and SC-7(8) | Non-Functional | Mandatory | |||
| SEC-085 | Security | The system must implement NIST sp800-53r5 control SC-8: transmission confidentiality and integrity, together with control enhancements SC-8(1) | Non-Functional | Mandatory | |||
| SEC-086 | Security | The system must implement NIST sp800-53r5 control SC-10: network disconnect | Non-Functional | Mandatory | |||
| SEC-087 | Security | The system must implement NIST sp800-53r5 control SC-12: cryptographic key establishment and management | Non-Functional | Mandatory | |||
| SEC-088 | Security | The system must implement NIST sp800-53r5 control SC-13: cryptographic protection | Non-Functional | Mandatory | |||
| SEC-089 | Security | The system must implement NIST sp800-53r5 control SC-15: collaborative computer devices and applications | Non-Functional | Mandatory | |||
| SEC-090 | Security | The system must implement NIST sp800-53r5 control SC-17: public key infrastructure certificates | Non-Functional | Mandatory | |||
| SEC-091 | Security | The system must implement NIST sp800-53r5 control SC-18: mobile code | Non-Functional | Mandatory | |||
| SEC-092 | Security | The system must implement NIST sp800-53r5 control SC-20: secure names/address resolution service (authoritative source) | Non-Functional | Mandatory | |||
| SEC-093 | Security | The system must implement NIST sp800-53r5 control SC-21: secure names/address resolution service (recursive or caching resolver) | Non-Functional | Mandatory | |||
| SEC-094 | Security | The system must implement NIST sp800-53r5 control SC-22: architecture and provisioning for name/address resolution service | Non-Functional | Mandatory | |||
| SEC-095 | Security | The system must implement NIST sp800-53r5 control SC-23: session authenticity | Non-Functional | Mandatory | |||
| SEC-096 | Security | The system must implement NIST sp800-53r5 control SC-28: protection of information at rest, together with control enhancements SC-28(1) | Non-Functional | Mandatory | |||
| SEC-097 | Security | All NIST security requirements must be included in either the regular test plan, or a security specific test plan. Each test case in the test plan for a security requirement must include the corresponding NIST control ID -e.g. AC-3(13) | Non-Functional | Mandatory |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .