Attachment_B_-_Functional_Requirements_(1).xlsm

XLSM spreadsheet 301 KB Posted

Attached to
Request for Information (RFI) - Building Embodied Carbon Reporting Tool (BECRT)
Solicitation number
0000031989
Issued by
California

About this file

This document is an Attachment B - Functional Requirements associated with a Request for Information (RFI) issued by the State of California. The RFI seeks information from vendors on available off-the-shelf or custom-built reporting/recordkeeping tools for a Building Embodied Carbon Reporting Tool (BECRT). The objectives of the BECRT are to provide a means for tracking and reporting embodied carbon in building materials and construction processes. The State is looking to identify a suitable technology, approximate costs and effort, vendor tasks, and the duration needed to acquire or build the reporting tool.

The RFI does not provide specific details on item quantities, response dates, site visits, or award timelines. It is focused on gathering information from the vendor community to assist the State in determining the feasibility and requirements for the BECRT. Pricing terms, set-asides, incumbents, and funding sources are also not specified in this RFI document.

View the file

Other files

File Type Posted
Attachment_A_-_High_Level_Process_Flows_(1).vsdx VSDX drawing
RFI_-_2024CARB_BECRT-RFI001_-_BECRT.pdf PDF

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

Instructions

STATEWIDE INFORMATION MANAGEMENT MANUAL

SECTION 19B.3 MID-LEVEL SOLUTION REQUIREMENTS TEMPLATE TOOL

PROJECT NUMBER:3900-078AGENCY/STATE ENTITY NAME:California Air Resources Board
The Statewide Information Management Manual (SIMM) 19B.3 Mid-Level Solution Requirements Template tool is provided as a guideline to document functional solution requirements. For functional solution requirements, the fields included in this template are required and must be included in an Agency/state entity's requirement documentation submission. Agencies/state entities may utilize another requirement documentation tool as long as the required fields are included. Additionally, Agencies/state entities may include more fields than those provided in this template.

INSTRUCTIONS:

Identify the Project Number and Agency/State Entity Name:

In the Instructions tab, enter the Project Number and Agency/State Entity Name. This information will automatically populate on each corresponding "Requirement Type" tab.

Enter requirements:

Enter mid-level solution requirements in the corresponding tab based on the "Requirement Type" (i.e., Functional Mandatory, Functional Desirable, Non-Functional Mandatory, Non-Functional Desirable, Project-Transition Mandatory, Project-Transition Desirable). For additional instructions , refer to the SIMM Section 19B.1 Preparation Instructions Section 2.6.

Note: Footer information may be modified based on Agency/state entity preference.

Create a combined worksheet that displays all requirements:

Click on the "Create Combined Worksheet" button to combine all the requirements from the separate "Requirement Type" tabs (i.e., Functional Mandatory, Functional Desirable, Non-Functional Mandatory, Non-Functional Desirable, Project-Transition Mandatory, Project-Transition Desirable) onto one worksheet. Do not re-select the "Create Combined Worksheet" button if a "Combined" tab already exists, as the automatic combine macro will not function correctly. To ensure proper functionality, first delete the existing "Combined" tab and then select the "Create Combined Worksheet" button to update the combined listing of requirements.

Format the "Combined" tab:

Click on the File Menu tab, select Print. In the Print Menu, use the appropriate drop down arrows to change the "Portrait Orientation" to "Landscape Orientation" and change the "No Scaling" to "Fit All Columns on One Page."

Set Print Area:

Prior to printing from a tab/worksheet, set the Print Area.

To do this, Select the entire area to be printed. Once selected, click the Page Layout Menu tab, then select Set Print Area.

Attach requirements:

Once completed and ready to submit, attach the completed requirements documentation as indicated in Section 2.6.

REQUIREMENT TYPE TAB
Combined requirements = Combined tab (viewable only if the "Create Combined Worksheet" button is used.)
Functional Mandatory tab
Functional Desirable tab
Non-Functional Mandatory tab
Non-Functional Desirable tab
Project/Transition Mandatory tab
Project/Transition Desirable tab

California Department of Technology SIMM Section 19 Mid-Level Solution Requirements B.3 Mid-Level Solution Requirements Template &P

August 2016

Create Combined Worksheet

Functional Mandatory

Project Number:3900-078Agency/state Entity:California Air Resources Board
Obj. Ref.
(Obj. #)Requirement CategoryRequirement NumberMain Business Capability/FunctionSub Business Capability/FunctionBusiness ProcessRequirementRequirement TypePriorityBusiness Owner/ Stakeholder
1.1REGREG-001RegistrationUser Account ManagementAccount RegistrationThe system should enable electronic registration and account establishment for users.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.1REGREG-003RegistrationUser Account ManagementNotification ManagementThe system should send account-related notifications to the email accounts of registered users.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.1REGREG-004RegistrationUser Account ManagementCommunication Log ManagementThe system should keep a log of all email communications sent to registered users.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2REGREG-012RegistrationUser Account ManagementAccount MaintenanceThe system should allow authorized users to create, retrieve, view, and update their account information (change of contact name).FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2REGREG-013RegistrationUser Account ManagementAccount MaintenanceThe system should allow authorized users to retrieve and update information as required during account creation.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.1REGREG-014RegistrationUser Account ManagementNotification ManagementThe system should generate real-time user notifications (e.g., registration submitted, incomplete registration information).FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.2REGREG-016RegistrationUser Account ManagementNotification ManagementThe system should display a message to inform the authorized users that data associated with their account has been modified (edited).FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
3.1REGREG-017RegistrationUser Account ManagementUser Roles and PermissionsThe system should provide internal administrators with the capability to define, assign, and maintain roles and permissions for all users.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
3.1REGREG-018RegistrationUser Account ManagementUser Roles and PermissionsThe system should provide external administrators with the capability to assign, and maintain roles for users within their company.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
3.1REGREG-019RegistrationUser Account ManagementUser Roles and PermissionsThe system should allow external administrator to associate and remove authorized users from third party company.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
3.1REGREG-020RegistrationUser Account ManagementUser Roles and PermissionsThe system should allow an account external administrator to modify or remove an authorized user's account.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2REGREG-021RegistrationUser Account ManagementAccount MaintenanceThe system should allow authorized users to update account information.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2REGREG-022RegistrationUser Account ManagementAccount MaintenanceThe system should allow an account user to update and maintain their account based on their roles and permissions.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2REGREG-023RegistrationUser Account ManagementAccount DeactivationThe system should allow authorized users to deactivate an account.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.1REGREG-024Company RegistrationSubmission RoutingCompliance ManagementThe system should route submitted registration forms to the regulatory authority for review.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.1REGREG-025Company RegistrationCompany RegistrationRegistration LogThe system should record approved company registration details for future reference.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
3.1REGREG-026RegistrationThird Party AssociationNotification ManagementThe system should send notifications to the third party if a company wants to associate them.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2DSDS-001Data SubmissionData EntryData EntryThe system should provide intuitive and user-friendly data entry forms.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2, 2.2DSDS-002Data SubmissionData EntryData VersioningThe system should implement version control for submitted data, allowing tracking of changes and updates over time.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.2DSDS-003Data SubmissionData EntryData TraceabilityThe system should maintain a revision history for data traceability.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.1DSDS-004Data SubmissionData EntryData ReviewThe system should allow users to review their submitted data before finalizing the submission.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.1DSDS-005Data SubmissionData EntryNotification ManagementThe system should provide users with a confirmation message upon successful data submission.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2DSDS-006Data SubmissionData EntryData FormatThe system should support data submission in various formats. Examples include numeric, text, dates, binary and geospatial, etc.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
3.1DSDS-007Data SubmissionError HandlingError GuidanceThe system should provide clear error messages to guide users in correcting any submission errors.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2DSDS-008Data SubmissionData SubmissionData UploadThe system should support file uploads for bulk data submission, including relevant documentation.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2DSDS-009Data SubmissionData SubmissionData FormatThe system should specify acceptable file formats and size limits.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2DSDS-010Data SubmissionData SubmissionData ValidationThe system should validate the entry of data (e.g. issuance date of data) according to requirements that the internal admins sets.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2DSDS-011Data SubmissionData SubmissionData UploadThe system should enable internal users to add, create or amend data submission forms without need for contract maintenance.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2DSDS-012Data SubmissionData SubmissionData UploadThe system should include an API to allow registered external users to upload data.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.1DSDS-013Data SubmissionCorrespondenceSecure messagingThe system should allow internal admins to send secure messages to registered parties requesting changes or resubmission.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.1DVRDVR-001Database, Data Visualization and ReportsData VisualizationUser Access ManagementThe system should facilitate different access levels for different types of users.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.1DVRDVR-002Database, Data Visualization and ReportsData ManipulationData CalculationThe system should utilize efficient algorithms for accurate processing of datasets.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.1, 3.1DVRDVR-003Database, Data Visualization and ReportsData ManipulationData CalculationThe system should enable internal users to define statististical functions and manipulate data.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2DVRDVR-004Database, Data Visualization and ReportsData VisualizationDashboard InterfaceThe system should include an intuitive and user-friendly dashboard interface.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.2DVRDVR-005Database, Data Visualization and ReportsData VisualizationData ExplorationThe system should implement drill-down functionality for users to explore detailed information.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2DVRDVR-006Database, Data Visualization and ReportsData VisualizationDashboard CustomizationThe system should allow internal users to customize the dashboard layout based on their preferences.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2DVRDVR-007Database, Data Visualization and ReportsData VisualizationPublic Dashboard AccessThe system should provide a public dashboard for users to access data without logging in.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
3.1DVRDVR-008Database, Data Visualization and ReportsReportsReport GenerationThe system should enable internal users to generate custom reports.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.1, 2.2DVRDVR-009Database, Data Visualization and ReportsReportsReport GenerationThe system should have an API that allows internal users to interface with stored data.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
3.1DVRDVR-010Database, Data Visualization and ReportsData AnalysisStatistical Analysis and VisualizationThe system should include user defined calculations, charts, graphs and geographic mapping for comprehensive insights.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.2DVRDVR-011Database, Data Visualization and ReportsDatabaseReport ManagementThe system should include a version history for reports to track changes over time.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.1DVRDVR-012Database, Data Visualization and ReportsDatabaseData Confidentiality and IntegrityThe system should implement security measures to ensure the confidentiality and integrity of data.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
1.2DVRDVR-013Database, Data Visualization and ReportsDatabaseDatabase ManagementThe system should implement auto-refresh functionality to maintain data accuracy.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.1, 2.2DVRDVR-014Database, Data Visualization and ReportsDatabaseProduct LedgerThe system should include a product ledger that tracks product flows and balances.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.1, 2.2DVRDVR-015Database, Data Visualization and ReportsDatabaseChain of Custody TrackingThe system should allow for the chain of custody of reported products to be tracked between and across registered partiesFunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.1, 2.2DVRDVR-016Database, Data Visualization and ReportsDatabaseProduct BalancesThe system should allow for estimation of product balances for different product categories across registered partiesFunctionalMandatoryAnnalisa Schilla/Pamela Gupta
2.2DVRDVR-017Database, Data Visualization and ReportsData AnalysisLedger CalculationsThe system should allow internal users to define custom calculations and aggregations of products to estimate summary statistics for product types and categories from reported dataFunctionalMandatoryAnnalisa Schilla/Pamela Gupta
3.1CORCOR-001CorrespondenceCorrespondenceSecure MessagingThe system should allow registered parties to send secure messages to internal admins.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
3.1CORCOR-002CorrespondenceSecure messagingFile TransferCorrespondence module should allow external users to attach files to messages.FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
3.1CORCOR-003CorrespondenceSecure messagingMessage TrackingThe system shall allow external ansd internal users to track correspondence by subject or issue (such as a ticket number of thread.)FunctionalMandatoryAnnalisa Schilla/Pamela Gupta
3.1CORCOR-004CorrespondenceSecure messagingRecipientsThe system shall allow internal admins to distribute correspondence to various subsets and groups of external usersFunctionalMandatoryAnnalisa Schilla/Pamela Gupta

FUNCTIONAL MANDATORY

&P of &N &D

Functional Desirable

Project Number:3900-078Agency/state Entity:California Air Resources Board
Obj. Ref.
(Obj. #)Requirement CategoryRequirement NumberMain Business Capability/FunctionSub Business Capability/FunctionBusiness ProcessRequirementRequirement TypePriorityBusiness Owner/ Stakeholder
1.1, 1.2DSDS-012Data SubmissionData Entry ValidationData SubmissionThe system shall provide real-time feedback during data entry to inform users about the accuracy and completeness of their submissions.FunctionalDesirableAnnalisa Schilla/Pamela Gupta
2.1, 2.2DVRDVR-022Database, Data Visualization and ReportsSecurity ManagementRole-Based Access ControlThe system must implement a secure role-based access control system, managing user authorization levels and enforcing access restrictions at the report, file, table, screen, and field levels based on individual user permissions.FunctionalDesirableAnnalisa Schilla/Pamela Gupta
1.2DVRDVR-023Database, Data Visualization and ReportsData ManagementData ValidationThe system shall include field validations to ensure the accuracy and validity of entered data.FunctionalDesirableAnnalisa Schilla/Pamela Gupta
1.2DVRDVR-024Database, Data Visualization and ReportsData ManagementData ValidationThe system shall implement predefined data validation rules to ensure accuracy and completeness.FunctionalDesirableAnnalisa Schilla/Pamela Gupta

FUNCTIONAL DESIRABLE

&P of &N &D

Non-Functional Mandatory

Project Number:3900-078Agency/state Entity:California Air Resources Board
Obj. Ref.
(Obj. #)Requirement CategoryRequirement NumberMain Business Capability/FunctionSub Business Capability/FunctionBusiness ProcessRequirementRequirement TypePriorityBusiness Owner/ Stakeholder
ERCERC-1Environmental Reporting and Compliance ManagementSystem Architecture and DesignSystem Expansion and Scalability PlanningThe system shall demonstrate the capability to seamlessly scale its infrastructure and accommodate a growing user base, ensuring optimal performance and responsiveness even under increased data processing loads.Non-FunctionalMandatory
ERCERC-2Environmental Reporting and Compliance ManagementSystem Architecture and DesignSystem Expansion and Scalability PlanningThe system should allow for easy integration of new features and functionalities to meet evolving business needs without compromising existing system stability.Non-FunctionalMandatory
APPDEV-01App. Dev.The system shall comply with CA AB 434, California State Administrative Manual (SAM) 4833, Section 508 Standards for accessibility, and the Americans with Disabilities Act (ADA).Non-FunctionalMandatory
APPDEV-03App. Dev.The system shall provide a responsive user interface.Non-FunctionalMandatory
APPDEV-04App. Dev.The system shall be compatible with the latest version of Chrome, Safari, and Edge at the time the software is released to production. FireFox may be used based on CARB project specifications.Non-FunctionalMandatory
APPDEV-07App. Dev.The system shall adhere to CARB OIS Standards for Coding.Non-FunctionalMandatory
APPDEV-08App. Dev.The solution shall store all source code, configuration, documentation, and IaC in CARB’s version control repository.Non-FunctionalMandatory
APPDEV-09App. Dev.The solution shall adhere to the OIS Coding Standards for UI development and styling.Non-FunctionalMandatory
APPDEV-10App. Dev.The development team shall conduct a formal code review with OIS in order to ensure compliance with OIS standards. The project schedule must provide one week for OIS code review upon completion of 25% of code development.Non-FunctionalMandatory
APPDEV-11App. Dev.The solution must provide evidence of a WCAG scan of the application's primary home or landing page, and the primary landing page encountered after a user has authenticated. The WCAG scan must be free of errors.Non-FunctionalMandatory
APPDEV-12App. Dev.The solution must provide evidence of an accessibility scan covering all documents. The scan must be free of errors.Non-FunctionalMandatory
APPDEV-13App. Dev.The development team shall conduct a formal code review with OIS in order to ensure compliance with OIS standards. The project schedule must provide one week for OIS code review upon completion of 75% of code development.Non-FunctionalMandatory
ARC-04ArchitectureThe system shall prevent the real-time download/export of data that exceeds two (2) GB through the web interface.Non-FunctionalMandatory
ARC-05ArchitectureThe system shall adhere to the CARB Software Architecture Standards and Technology Stack.Non-FunctionalMandatory
ARC-06ArchitectureCode comments should be compatible with dOxygen.Non-FunctionalMandatory
ARC-08ArchitectureFor the pages that require mobile device support, the system shall be viewable in the latest version of Chrome on an Android device without visual artifacts.Non-FunctionalMandatory
ARC-09ArchitectureFor the pages that require mobile device support, the system shall be viewable in the latest version of Safari on an iOS device without visual artifacts.Non-FunctionalMandatory
ARC-11ArchitectureThe system shall store non-structured files (i.e. images, CSV, etc.) on AWS S3. SaaS solutions may store non-structured files on natively supported storage systems if the systems have been pre-approved for this purpose by OIS .Non-FunctionalMandatory
ARC-12ArchitectureThe system shall prioritize the use of APIs for interactions between distinct software components.Non-FunctionalMandatory
ARC-13ArchitectureThe solution shall be configurable to execute from multiple environments (Ex. Development, UAT, and Production).Non-FunctionalMandatory
ARC-14ArchitectureThe system shall use relational SQL databases for OLTP data sets.Non-FunctionalMandatory
ARC-16ArchitectureThe system shall reduce image resolutions to the smallest dimensions that retain sufficient clarity. Sufficient clarity must be defined for each case by specific project requirements. Consult with legal to ensure compliance with best evidence rule.Non-FunctionalMandatory
ARC-18ArchitectureThe system shall be compatible with standard APIs for generating reports such as Tableau, Power BI.Non-FunctionalMandatory
ARC-19ArchitectureNo user other than a CARB OIS DevOp or OIS DBA should have access to modify any aspect of a UAT or Production environment. This includes remote access to servers (SSH/RDP). AWS-Business or “Big Data” is a production environment.Non-FunctionalMandatory
ARC-20ArchitectureAll APIs must follow the OIS API Standards specifications.Non-FunctionalMandatory
ARC-21ArchitectureThe system shall not store PII data in the same S3 bucket as other types of data, nor shall it store PII data in any S3 bucket that is configured as a static web server.Non-FunctionalMandatory
ARC-23ArchitectureAll closed-source or commercially licensed third-party services utilized within any SaaS application must be disclosed and pre-approved by CARB OIS.Non-FunctionalMandatory
ARC-25ArchitectureAll SaaS solutions that send email on CARB’s behalf must integrate with CARB's DKIM.Non-FunctionalMandatory
ARC-26ArchitectureThe project team shall submit a Solution Architecture Document for formal project approval prior to development. The Solution Architecture Document shall include an anticipated provisioning request that lists software and services, quantity, projected capacity/throughput, and data egress and ingress from cloud networks.Non-FunctionalMandatory
ARC-27ArchitectureThe project team shall develop build scripts, developer documentation, and documentation of build processes necessary for production deployment, for formal project approval prior to Go-Live. The project team shall provide sufficient detail in the build process documentation such that CARB is able to build and deploy the system without the assistance of the project team. The documentation shall be updated with each subsequent software iteration.Non-FunctionalMandatory
ARC-28ArchitectureThe project team shall submit documentation for all APIs according to CARB API Standards.Non-FunctionalMandatory
ARC-29ArchitectureThe solution must utilize CARB's standard payment processing service.Non-FunctionalMandatory
ARC-30ArchitectureThe solution must not store any unstructured data in formats that are proprietary products of the solution vendor.Non-FunctionalMandatory
ARC-31ArchitectureThe solution must announce all software releases to production environments using CARB's release tracking tool.Non-FunctionalMandatory
ARC-32ArchitectureThe project shall reside in the same Salesforce organization as existing CARB projects using a single-org approach unless otherwise approved by the CARB OIS Architecture Board.Non-FunctionalMandatory
ARC-33ArchitectureThe project shall document and describe the capabilities of all user rolesNon-FunctionalMandatory
ARC-34ArchitectureAll project documentation artifacts that utilize proprietary solutions that are not formally supported by CARB must store the same document content using a solution that is in CARB's Supported Technology List. The supported version of the document must be kept up to date on a monthly basis.Non-FunctionalMandatory
ARC-35ArchitectureThe solution shall complete the California Cloud Services Assessment (CCSA) submission process and obtain approval before any cloud resources can be provisioned.Non-FunctionalMandatory
ARC-07ArchitectureFor the pages that require mobile device support, the system shall provide a user interface with a minimum resolution of 640 x 1136 pixels.Non-FunctionalMandatory
ARC-24ArchitectureAll Salesforce applications must include sufficient documentation, configuration, and source code deliverables as to allow CARB to fully install the Salesforce application in a separate Salesforce account.Non-FunctionalMandatory
DEVOPS-02DevOpsThe system shall adhere to CARB OIS database guidelines.Non-FunctionalMandatory
DEVOPS-04DevOpsThe system shall adhere to CARB OIS DevOps Management Guidelines.Non-FunctionalMandatory
DEVOPS-05DevOpsThe development team shall develop scripts to deploy infrastructure as code as specified in CARB's IaC Matrix.Non-FunctionalMandatory
DEVOPS-07DevOpsThe project team shall submit a database request form to OIS before any databases can be provisioned.Non-FunctionalMandatory
ED-01Enterprise DataThe system shall utilize CARB environments for data storage, distribution and archive.Non-FunctionalMandatory
ED-03Enterprise DataThe solution shall utilize any existing reference data as defined by CARB.Non-FunctionalMandatory
ED-04Enterprise DataReference data utilized by a solution shall be updated whenever an update is requested by CARB.Non-FunctionalMandatory
ED-05Enterprise DataThe project team shall utilize and adhere to the CARB main business glossary throughout solution developmentNon-FunctionalMandatory
ED-06Enterprise DataSystems utilizing Tableau must comply with the OIS Tableau Standards & ProcessNon-FunctionalMandatory
ED-07Enterprise DataThe project team shall submit an entity relationship diagram (ERD), and a data dictionary to CARB for formal project approval (signoff) as follows:

1. At the end of the design phase and prior to coding

2. At the end of coding and prior to User Acceptance Testing

3. At the end of User Acceptance Testing and prior to Go-Live.Non-FunctionalMandatory
ED-10Enterprise DataThe solution shall store addresses and/or locations in accordance with CARB's international address standards.Non-FunctionalMandatory
ED-11Enterprise DataThe solution shall adhere to CARB's enterprise data guidelines & policiesNon-FunctionalMandatory
ED-12Enterprise DataAll projects must include Enterprise Data / Data Management in the "pre-planning" process and prior to any IT planning or development. The Enterprise Data / Data Management lead must be present in the planning meetings.Non-FunctionalMandatory
ED-13Enterprise DataIn the "pre-planning" process, all projects must identify a data governance representative for the project. Otherwise, the Subject Matter Expert (SME) will serve as the data governance representative. The name of the data governance representative must be documented in the Enterprise Data Questionnaire.Non-FunctionalMandatory
ED-15Enterprise DataThe project team shall submit a business logic diagram (indluding workflows between people and technology) at the end of the design phase and prior to development.Non-FunctionalMandatory
GIS-01GISThe system shall include the minimum set of metadata elements for a geospatial dataset according to CARB (CDFW) Minimum Metadata Standards.Non-FunctionalMandatory
GIS-02GISThe system shall adhere to the "Digital Accessibility Guidance for Maps and Technical Content" document.Non-FunctionalMandatory
GIS-03GISThe system shall utilize CARB Hosted ESRI REST API’s or other ESRI supported formats for serving, updating, and using geospatial data unless otherwise approved.Non-FunctionalMandatory
GIS-04GISThe system shall use CARB Hosted ESRI ArcGIS StreetMap Premium for physical address validation and geocoding unless otherwise approvedNon-FunctionalMandatory
GIS-06GISThe system shall utilize and adhere to the CARB Enterprise GIS Framework.Non-FunctionalMandatory
INF-02InfrastructureThe system must utilize Accellion for ingesting external bulk data. Files located on the SFTP server are temporal and must only reside on the server for the purposes of staging data and short term processing.Non-FunctionalMandatory
INF-03InfrastructurePaaS applications shall use Docker containers. AWS Fargate should be used when practical.Non-FunctionalMandatory
INF-04InfrastructureApplications shall not hard code IP addresses in source code.Non-FunctionalMandatory
INF-05InfrastructureAll domain services must be managed by CARB.Non-FunctionalMandatory
INF-06InfrastructureAll public-facing web traffic must go through the AWS edge account.Non-FunctionalMandatory
INF-07InfrastructureAll services hosted on AWS must be tagged as specified by CARB.Non-FunctionalMandatory
INF-10InfrastructureThe system shall, whenever possible, avoid the use of servers with full operating systems, and reflect a design preference for SaaS, containers, or serverless solutions.Non-FunctionalMandatory
INF-13InfrastructureServer operating systems and docker base images shall be limited to those approved by OIS.Non-FunctionalMandatory
INF-14InfrastructureAll bulk email's must be pre-approved by the PIO office and integrate with Granicus.Non-FunctionalMandatory
INF-15InfrastructureData retention and data archiving requirements must be defined within the projectNon-FunctionalMandatory
INF-16InfrastructureSolutions requiring a secondary backup region must utilize the AWS region us-east-1Non-FunctionalMandatory
PMO-01PMOThe solution shall include all deliverables identified for the solution according to the OIS SDLC document. The solution shall include an appendix listing each identified deliverable.Non-FunctionalMandatory
PMO-07PMOThe Development Team shall provide all source code to CARB, including source code for binary files, necessary for production deployment, on a mutually agreed upon basis throughout the project.Non-FunctionalMandatory
PMO-10PMOThe project team shall submit test cases, test scripts and test results for formal project approval prior to User Acceptance Testing.Non-FunctionalMandatory
PMO-14PMOThe project team shall submit a software license list detailing the software used for the Solution. The list shall include but is not limited to: the name of the software, license number, date purchased, purchaser and hardware on which the software is installed.Non-FunctionalMandatory
PMO-16PMOThe project team shall use CARB’s current approved task/issue tracking system for task management and bug tracking.Non-FunctionalMandatory
PMO-18PMOThe project team shall write and deliver tests to cover 100% of the business processes handled by the application for formal project approval prior to User Acceptance Testing. The project team shall use the tools and technologies for testing as defined in the OIS Technology Stack.Non-FunctionalMandatory
PMO-24PMOThe project team shall submit a Test Plan for formal project approval prior to coding.Non-FunctionalMandatory
PMO-25PMOIn RFI responses, the vendor shall submit a list of which non-functional requirements are met by the proposed solution.Non-FunctionalMandatory
SEC-001SecurityThe system shall encrypt data in transit.Non-FunctionalMandatory
SEC-002SecurityThe system shall encrypt data at rest for data identified by CARB as confidential or sensitive.Non-FunctionalMandatory
SEC-003SecurityThe system shall prevent anonymous users from accessing confidential or sensitive data.Non-FunctionalMandatory
SEC-004SecurityThe system shall authenticate a user at login.Non-FunctionalMandatory
SEC-005SecurityThe system shall authenticate a user prior to the user accessing confidential or sensitive data.
The system shall implement role based security.Non-FunctionalMandatory
SEC-006SecurityThe system shall enforce user access according to the user’s role(s) and privileges.Non-FunctionalMandatory
SEC-007SecurityThe system shall utilize a minimum of two (2) layers of security for a database which stores confidential or sensitive data.Non-FunctionalMandatory
SEC-008SecurityThe system shall comply with NIST sp800-53 (current version).Non-FunctionalMandatory
SEC-009SecurityThe system shall comply with State of California State Administrative Manual (SAM) 5300.Non-FunctionalMandatory
SEC-010SecurityThe system shall comply with CARB Information Security Manual.Non-FunctionalMandatory
SEC-011SecurityThe system shall create distinct user accounts for administrators. An administrator userid must be distinct from a non-administrator userid (For example, it could be prepended with "sa_"). An administrative account must only be used for administrative duties.Non-FunctionalMandatory
SEC-012SecurityThe development team shall create and scramble test data for the purposes of testing the system. The vendor shall not use confidential or sensitive data for testing.Non-FunctionalMandatory
SEC-013SecurityThe system shall support multi-factor authentication (MFA) for user and administrator accounts.Non-FunctionalMandatory
SEC-014SecurityInfrastructure as code should only be capable of executing when manually approved by a designated OIS representative.Non-FunctionalMandatory
SEC-015SecurityDynamically created files/objects should not be stored in the same physical location as application source code.Non-FunctionalMandatory
SEC-018SecurityThe system shall comply with the Miscellaneous Security Standards document.Non-FunctionalMandatory
SEC-019SecurityAny documents in the system that are subject to PRA or eDiscovery requirements must be stored in a location accessible by CARB’s existing eDiscovery tool, or the project must provide integration between the project and the existing eDiscovery tools.Non-FunctionalMandatory
SEC-020SecurityAll web server log files must log data in a format consistent with existing CARB applications. Log format to be consistent with other logs at CARB

IIS Webserver logs should be enabled and have the following options configured:

Change log format to "W3C" Add all fields except "Cookie" Add 3 Custom Fields:

Field Name Source type Source X-Forwarded-For Request Header X-Forwarded-For Content-Type Request Header Content-Type

https Server Variable HTTPSNon-FunctionalMandatory
SEC-021SecurityAll web traffic must be traceable to its source based on logged data. To be traced to its source, all web server logs should include the X-forwarded-for header, show the full URL, source IP etc.Non-FunctionalMandatory
SEC-022SecurityAll applications must log all user activity. The log should include who did what, when it was done, where it was done from and have some context as to why it was done. This includes reading data if the data is non public, and what data was read.Non-FunctionalMandatory
SEC-023SecurityThe system must integrate with and log, application and cloud events that include system access, security intrusion events, network events, etc., to CARB SEIM system, so that the system can be monitored for security threats and incident response. Integration of the data is the projects responsibility.Non-FunctionalMandatory
SEC-024SecurityTest data used for system testing must be non-confidential, so that system test is performed with accurate data while protecting the privacy and identity of the data.Non-FunctionalMandatory
SEC-025SecurityThe system must meet federal (NIST sp800-53), State(SIMM and SAM), and CARB information security controls requirements that includes security features, including, but not limited to, the following:

* Data security,

* Regulatory compliance,

* System access, and

* System vulnerability protection.

All artifacts called out by the above standards must be included in the project.Non-FunctionalMandatory
SEC-027SecurityThe project must produce the Privacy Impact Assessment document, which must be provided in the correct template provided by CARB/CDT. The format of these documents may not be modified. No sections may be removed, and all sections must be completed. In the event that the documentation implies that best practices have not been followed, CARB will require the project team to remediate the issues at the project team’s expense.Non-FunctionalMandatory
SEC-029SecurityThe project must produce the System Security Plan (SSP) document, which must be provided in the correct template provided by CARB/CDT. The format of these documents may not be modified. No sections may be removed, and all sections must be completed. In the event that the documentation implies that best practices have not been followed, CARB will require the project team to remediate the issues at the project team’s expense. The SSP must be presented at project desgin and updated duirng dveelopment. The finalk review will be before UAT testing.Non-FunctionalMandatory
SEC-030SecurityThe project must produce a STRIDE Model (produced by the Microsoft threat modeling application), the document must be provided in the correct template provided by the application. The format of these documents may not be modified. No sections may be removed, and all sections must be completed. In the event that the documentation implies that best practices have not been followed, CARB will require the project team to remediate the issues at the project team’s expense.Non-FunctionalMandatory
SEC-031SecurityThe project must produce the Fips 199 data classification document, which must be provided in the correct template provided by CARB/CDT. The format of these documents may not be modified. No sections may be removed and all sections must be completed.Non-FunctionalMandatory
SEC-033SecurityThe project must provide an Incident Response Plan document, which must be provided in the correct template provided by CARB/CDT. The format of these documents may not be modified. No sections may be removed, and all sections must be completed. In the event that the documentation implies that best practices have not been followed, CARB will require the project team to remediate the issues at the project team’s expense.Non-FunctionalMandatory
SEC-034SecurityThe project must provide the Security Risk Assessment document, which must be provided in the correct template provided by CARB/CDT. The format of these documents may not be modified. No sections may be removed, and all sections must be completed. In the event that the documentation implies that best practices have not been followed, CARB will require the project team to remediate the issues at the project team’s expense.Non-FunctionalMandatory
SEC-035SecurityThe application must be tested from a security perspective. In addition to positive functionality testing (user can do X), negative security test cases (user cannot do X) must also be performed for all security, authentication and authorization related use cases.Non-FunctionalMandatory
SEC-036SecurityThe system must implement NIST sp800-53r5 control CM-10: Software Usage RestrictionsNon-FunctionalMandatory
SEC-037SecurityApplications must integrate with the current standards based authentication solution deployed at CARB. The project team is responsible for know how to integrate applications using SAML 2.0, OIDC or OAUTH2 with CARB’s current identity platform.Non-FunctionalMandatory
SEC-038SecurityAll system components (Operating system, platform components, libraries etc.) must be kept up to date during the development and test cycles.Non-FunctionalMandatory
SEC-039SecurityA plan to keep all system components (Operating system, platform components, libraries etc.) up to date after deployment must be provided.Non-FunctionalMandatory
SEC-040SecurityThe system must use current encryption technology, so that all communication between the users, sub-systems, state entities, etc., and the system is secure and prevents the risk of data exposure.Non-FunctionalMandatory
SEC-042SecurityAll projects are responsible for integrating their solutions with any third-party systems or CARB systems that are part of the solution design. If CARB has an existing system that performs similar functionality to a system component. The CARB system must be integrated into the solution.Non-FunctionalMandatory
SEC-043SecurityThe system must implement NIST sp800-53r5 control AC-2: Account Management, together with control enhancements AC-2(1), AC-2(2), AC-2(3), AC-2(4), AC-2(5) and AC-2(13)Non-FunctionalMandatory
SEC-044SecurityThe system must implement NIST sp800-53r5 control AC-3: Access EnforcementNon-FunctionalMandatory
SEC-045SecurityThe system must implement NIST sp800-53r5 control AC-4: Information Flow EnforcementNon-FunctionalMandatory
SEC-046SecurityThe system must implement NIST sp800-53r5 control AC-5: Separation of DutiesNon-FunctionalMandatory
SEC-047SecurityThe system must implement NIST sp800-53r5 control AC-6: Least Privilege, , together with control enhancements AC-6(1), AC-6(2), AC-6(5), AC-6(7), AC-6(9), AC-6(10)Non-FunctionalMandatory
SEC-048SecurityThe system must implement NIST sp800-53r5 control AC-7: Unsuccessful Logon AttemptsNon-FunctionalMandatory
SEC-049SecurityThe system must implement NIST sp800-53r5 control AC-8: System Use NotificationNon-FunctionalMandatory
SEC-050SecurityThe system must implement NIST sp800-53r5 control AC-11: Session Lock, together with control enhancement AC-11(1)Non-FunctionalMandatory
SEC-051SecurityThe system must implement NIST sp800-53r5 control AC-12: Session TerminationNon-FunctionalMandatory
SEC-052SecurityThe system must implement NIST sp800-53r5 control AC-14: Permitted actions without identification or authenticationNon-FunctionalMandatory
SEC-053SecurityThe system must implement NIST sp800-53r5 control AC-17: remote access, together with contrrol enhancements AC-17(1), AC-17(2), AC-17(3) and AC-17(4)Non-FunctionalMandatory
SEC-054SecurityThe system must implement NIST sp800-53r5 control AC-18: wireless access, together with control enhancements AC-18(1) and AC-18(3)Non-FunctionalMandatory
SEC-055SecurityThe system must implement NIST sp800-53r5 control AC-19: access control for mobile devices, together with control enhancements AC-19(5)Non-FunctionalMandatory
SEC-056SecurityThe system must implement NIST sp800-53r5 control AC-20: use of external systems, together with control enhancements AC-20(1) and AC-20(2)Non-FunctionalMandatory
SEC-057SecurityThe system must implement NIST sp800-53r5 control AC-21: information sharingNon-FunctionalMandatory
SEC-058SecurityThe system must implement NIST sp800-53r5 control AC-22: publicly accessible contentNon-FunctionalMandatory
SEC-059SecurityThe system must implement NIST sp800-53r5 control AU-1: policy and proceduresNon-FunctionalMandatory
SEC-060SecurityThe system must implement NIST sp800-53r5 control AU-2: event loggingNon-FunctionalMandatory
SEC-061SecurityThe system must implement NIST sp800-53r5 control AU-3: content of audit records, with control enhancement AU-3(1)Non-FunctionalMandatory
SEC-062SecurityThe system must implement NIST sp800-53r5 control AU-4: audit log storage capacityNon-FunctionalMandatory
SEC-063SecurityThe system must implement NIST sp800-53r5 control AU-5: response to audit logging process failuresNon-FunctionalMandatory
SEC-064SecurityThe system must implement NIST sp800-53r5 control AU-6: audit record review, analysis, and reporting, together with control enhancements AU-6(1) and AU-6(3)Non-FunctionalMandatory
SEC-065SecurityThe system must implement NIST sp800-53r5 control AU-7: audit record reduction and report generation, together with control enhancements AU-7(1)Non-FunctionalMandatory
SEC-066SecurityThe system must implement NIST sp800-53r5 control AU-8: timestampsNon-FunctionalMandatory
SEC-067SecurityThe system must implement NIST sp800-53r5 control AU-9: protection of audit information, together with control enhancements AU-9(4)Non-FunctionalMandatory
SEC-068SecurityThe system must implement NIST sp800-53r5 control AU-11: audit record retentionNon-FunctionalMandatory
SEC-069SecurityThe system must implement NIST sp800-53r5 control AU-12: audit record generationNon-FunctionalMandatory
SEC-070SecurityThe system must implement NIST sp800-53r5 control IA-1: policies and proceduresNon-FunctionalMandatory
SEC-071SecurityThe system must implement NIST sp800-53r5 control IA-2: identification and authentication (organizational users), together with control enhancementsIA-2(1), IA-2(2), IA-2(8)Non-FunctionalMandatory
SEC-072SecurityThe system must implement NIST sp800-53r5 control IA-3: device identification and authenticationNon-FunctionalMandatory
SEC-073SecurityThe system must implement NIST sp800-53r5 control IA-4: identify management, together with control enhancements IA-4(4)Non-FunctionalMandatory
SEC-074SecurityThe system must implement NIST sp800-53r5 control IA-5: authenticator management, together with control enhancements-5(1), IA-5(2), and IA-5(6)Non-FunctionalMandatory
SEC-075SecurityThe system must implement NIST sp800-53r5 control IA-6: authentication feedbackNon-FunctionalMandatory
SEC-076SecurityThe system must implement NIST sp800-53r5 control IA-7: cryptographic module authenticationNon-FunctionalMandatory
SEC-077SecurityThe system must implement NIST sp800-53r5 control IA-8: identification and authentication (non organizational users), together with control enhancements IA-8(2) and IA-8(4)Non-FunctionalMandatory
SEC-078SecurityThe system must implement NIST sp800-53r5 control IA-11: re-authenticationNon-FunctionalMandatory
SEC-079SecurityThe system must implement NIST sp800-53r5 control IA-12: identity proofing, together with control enhancements IA-12(2), IA-12(3) and IA-12(5)Non-FunctionalMandatory
SEC-080SecurityThe system must implement NIST sp800-53r5 control SC-1: policies and proceduresNon-FunctionalMandatory
SEC-081SecurityThe system must implement NIST sp800-53r5 control SC-2: separation of system and user functionalityNon-FunctionalMandatory
SEC-082SecurityThe system must implement NIST sp800-53r5 control SC-4: information in shared system resourcesNon-FunctionalMandatory
SEC-083SecurityThe system must implement NIST sp800-53r5 control SC-5: denial of service protectionNon-FunctionalMandatory
SEC-084SecurityThe system must implement NIST sp800-53r5 control SC-7: boundary protection, together with control enhancements SC-7(3), SC-7(4), SC-7(5), SC7(7) and SC-7(8)Non-FunctionalMandatory
SEC-085SecurityThe system must implement NIST sp800-53r5 control SC-8: transmission confidentiality and integrity, together with control enhancements SC-8(1)Non-FunctionalMandatory
SEC-086SecurityThe system must implement NIST sp800-53r5 control SC-10: network disconnectNon-FunctionalMandatory
SEC-087SecurityThe system must implement NIST sp800-53r5 control SC-12: cryptographic key establishment and managementNon-FunctionalMandatory
SEC-088SecurityThe system must implement NIST sp800-53r5 control SC-13: cryptographic protectionNon-FunctionalMandatory
SEC-089SecurityThe system must implement NIST sp800-53r5 control SC-15: collaborative computer devices and applicationsNon-FunctionalMandatory
SEC-090SecurityThe system must implement NIST sp800-53r5 control SC-17: public key infrastructure certificatesNon-FunctionalMandatory
SEC-091SecurityThe system must implement NIST sp800-53r5 control SC-18: mobile codeNon-FunctionalMandatory
SEC-092SecurityThe system must implement NIST sp800-53r5 control SC-20: secure names/address resolution service (authoritative source)Non-FunctionalMandatory
SEC-093SecurityThe system must implement NIST sp800-53r5 control SC-21: secure names/address resolution service (recursive or caching resolver)Non-FunctionalMandatory
SEC-094SecurityThe system must implement NIST sp800-53r5 control SC-22: architecture and provisioning for name/address resolution serviceNon-FunctionalMandatory
SEC-095SecurityThe system must implement NIST sp800-53r5 control SC-23: session authenticityNon-FunctionalMandatory
SEC-096SecurityThe system must implement NIST sp800-53r5 control SC-28: protection of information at rest, together with control enhancements SC-28(1)Non-FunctionalMandatory
SEC-097SecurityAll NIST security requirements must be included in either the regular test plan, or a security specific test plan. Each test case in the test plan for a security requirement must include the corresponding NIST control ID -e.g. AC-3(13)Non-FunctionalMandatory

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it. Updated .