Attachment B - Technical Requirements.docx

Attachment B: Technical Requirements This section specifies the operational and system requirements of the learning management system and associated content being procured under RFR # . The OCA is seeking a vendor to provision a cloud-based, Software as a Service LMS solution along with the content necessary to deliver Mandated Reporter training to a wide variety of mandated reporters, including educators, first responders, and medical personnel in the Commonwealth.

Cloud-based, Software-as-a-Service The OCA is seeking to procure a fully cloud-based, Software-as-a-Service (SaaS) Learning Management System. Under this SaaS model, the selected Vendor will be responsible for hosting, maintaining, and updating, the proposed software solution for the duration of the contract.

Managed Services System Availability and Disaster Recovery Any proposed system is expected to have availability at or above 95% and have adequate disaster recovery infrastructure and protocols in place to minimize or avoid data loss all together. In their response, the bidder must propose their system’s anticipated system availability percentage as well as provide details related to their disaster recover protocols that meet or exceed the OCA’s requirements. For additional DR and system availability information refer to Attachment E: SaaS Terms.

Help Desk, User Support As part of this procurement, the OCA is seeking help desk functionality to support internal and external users of the LMS. Internal users must have reasonable access to the bidder’s support including the ability to open tickets and schedule meetings when necessary to resolve system usage issues. External users should be able to open support tickets for system usage issues. All support tickets should be prioritized and resolved by the selected vendor according to the Service Level Agreement. The selected vendor should provide a report to the OCA of all support tickets, classification, and resolution monthly.

While a system that relies on help desk support to resolve user access issues and password resets, the OCA’s preference if for a system that is capable of allowing users to self-manage, including resetting passwords, and unlocking accounts on their own, using best practices, including: multifactor authentication or recovery emails.

Service Level Agreement The Service Level Agreement (SLA) shall be in effect once the system is implemented and the OCA has accepted delivery. The following SLA is the minimum bidders are expected to meet and are encouraged to exceed these requirements in their proposal.

Upgrades and Enhancements As part of the managed services contract, the OCA is seeking a vendor to implement the required LMS and to manage the system as a SaaS provider. This includes managing and implementing any regular system updates, upgrades, or enhancements provided by the software provider. The OCA expects the vendor to use commercial best practices for managing these updates including notifying the OCA prior to executing any changes, testing the updates to ensure they do not interfere with the OCA’s implementation, and notifying the OCA of successful update completion.

In the event a system update fails, or interferes with the OCA’s implementation, the vendor should be prepared with a rollback procedure. Any downtime required to execute upgrades, updates or enhancements shall not exceed the agreed upon system availability percentage and should be executed in such a manner as to avoid impact system usability by all users.

Security While the OCA does not plan on integrating this LMS with any other Commonwealth properties or applications, bidders must propose a solution that meets commercially available best practices in security. At a minimum, bidders must provide a SOC 2 Type 1 report for their system detailing their security controls, procedures, and safeguards. If available, bidders are invited to submit a SOC 2 Type 2 report.

In addition to providing security reporting, the selected vendor should conduct a regular penetration test to identify any potential security faults. Any findings found in these regular tests must be communicated with the OCA and will be handled according to the SLA. Additional security requirements can be found in Attachment E: SaaS Terms.

Identity and Access Management The selected vendor must be prepared to implement a system with standalone user authentication and management functionality. This includes the ability to self-enroll, manage the user’s account, and reset passwords. Although not required, the proposed solution should be able to utilize multi-factor authentication for all users.

System Capacity The proposed system and associated content must be able to support over 100,000 Mandated Reporters across the Commonwealth, including about 76,000 pre-Kindergarden-12th grade educators, and 5 internal users.

Content Compliance The LMS system must be capable of hosting content across a variety of mediums and all content provided must meet standard interoperability frameworks such as SCORM or xAPI. While it is anticipated that in the initial release of this system, all Mandated Reporters will access this LMS to take their required training, the OCA expects that other cohorts of Mandated Reporter, including First Responders and Medical Providers, may shift to using their own LMS solutions in the future as a way to simplify their training experience. As such, content interoperability is of utmost importance and any learning modules proposed must be able to be separated from their underlying LMS platform.

While not required for the initial release of this system, learning content must be able to be provide in multiple languages, including: Spanish, Portuguese, Mandarin, and Haitian-Creole.

Accessibility Both the Learning Management System and all content hosted on the platform must be compliant with Section 508 and WCAG 2.1 standards to support access and certification of individuals with disabilities. All bidders must provide a VPAT (Voluntary Product Accessibility Test) report as part of their bid. Please refer to Attachment D: Accessibility Requirements for the full set of requirements related to accessibility.

Data Migration & Conversion The OCA does not anticipate any need for data migration or conversation as part of this LMS implementation. The only case in which data migration will be required is if the OCA determines to procure the LMS and associated learning content separately. In this case, the OCA will ensure that all content meets SCORM or xAPI interoperability frameworks to minimize the work required to integrate the content.

Data Storage, Archiving, & Warehousing The data stored in the proposed LMS platform breaks down into two main types: content and user data. Content data, includes courses and learning paths. User data includes, but is not limited to:

· Name (First Last)

· Accommodate multiple rRoles (K-12 Educator, Teacher, First Responder, Medical Provider, coach, para-professional, etc.)

· Affiliated Organization (School District, Agency Program, etc.) (if applicable)

· Registration status

· Courses completed

· Status through courses (percentage complete)

· Certification status

· Certification expiry issuance date Content data should be available in perpetuity, so long as the system remains available, with the OCA having the ability to publish and unpublish courses as their curriculum changes.

User data should be stored for a minimum of 3 years in the proposed system.

The system must be able to allow the OCA to periodically run reports that provide the system all user data to be used with other Commonwealth data to derive insights. This data should be available in a variety of formats; however Microsoft Excel is preferred.

Technical Reporting The selected vendor must provide the OCA an initial Software Bill of Materials for the initial LMS and update in conjunction with major product releases to ensure the OCA has the most current product documentation. Additionally, the selected vendor must be prepared to provide:

· Annual system performance reports

· Monthly or quarterly support ticket reports

· Annual security reports Project Management Bidders must provide a high-level project plan and implementation roadmap for their proposed LMS platform and/or content development. The tentative implementation start date is September 6, 2022, with a minimal viable general mandated reporter training program available in Fall of 2022. Vendors must explain how they will be able to meet this timeframe, or otherwise present to the OCA an acceptable alternative for launch of this platform and training program. Implementation and user training details must be explained in detail, with an approach and plan for successful training and change management for external and internal users of the proposed LMS platform and mandated reporter training program. Bidders must also provide the resumes for key project personnel they are proposing for this engagement, including, but not limited to: Account Manager, Project Manager, and Technical Lead.