Attachment_C_Cloud_Technical_Capabilities.docx

ATTACHMENT C

CLOUD TECHNICAL CAPABILITIES

The terms “System”, “Software”, and “Application” is used throughout this attachment. These terms are meant to represent the Consultant’s proposed software and infrastructure, as applicable.

1. Consultant must respond to each individual capability by entering an ‘X’ in one of the non-grey columns provided. Select the appropriate response using the following guidelines below. If the columns are grey, provide a description in the “Describe” column. It is highly recommended that a technical resource complete this attachment.

· If the System requires specialized configuration, Consultant must enter required configuration in the “Describe” section provided.

· If the capability is satisfied by third-party software, please indicate the third-party product proposed.

· Consultant must provide an explanation of the work required to perform the modification in the “Describe” section provided.

2. Consultant is strongly encouraged to provide a brief explanation of how the capability will be satisfied for each capability.

· Consultant may also include screen shots, diagrams, samples, and inventories for any capability listed.

· If unable to meet the capability, Consultant must offer a brief explanation or propose an alternative way to meet the capability.

The System will not be allowed to use the City’s email system. Describe how the System will send emails.

The proposed System must be hosted under a valid and registered domain name (e.g., https://yourcompany.vendor.com) and not solely accessible via an IP address. The System must:

· Provide a fully qualified domain name (FQDN) for the hosted service.

· Not make use of raw IP addresses for production access, user login, or application endpoints.

The System must run over a web browser and not require a thick or thin client for both administrative- and end-users.

System supports current browser versions, including but not limited to Firefox, Chrome, Edge and implements modern web standards.

If the System provides a native mobile application, describe how the application renders on smart phones and/or tablets, including any hardware or operating system limitations.

If a mobile application is available, it continues to be functional during loss of network connectivity, e.g. store locally and automatic sync when network connectivity is available. Describe how this can be achieved.

Software is designed to run on a wide variety of form factors using a responsive or native design.

Application Security

System does not require users to have local administrator rights to access or use the solution.

System design adheres to the principle of least privilege (see, for reference, NIST’s definition: https://csrc.nist.gov/glossary/term/least_privilege).

System must allow the City to perform authenticated or non-authenticated scans and penetration tests without impact to production data, or provide the results of such recent scans and tests.

Application must comply with OWASP top 10 risks for web applications.

System operates with controls applied by mobile device and mobile application management technology services (MDM, MAM).

Application must support SAML for modern authentication protocols for single sign-on for City users and provide a mechanism for additional identity provider for constituents.

The security features provided in the System and by the hosting facility (if applicable) is compliant with the relevant industry recognized security standards.

Data Security

System has the ability to classify data elements and unstructured data that are regulated as private or otherwise not public under local, state or federal law.

System has the ability to mask and/or redact regulated not-public data from system views, query results, and outputs.

System has the ability to classify and prevent changes to structured or unstructured data elements that are considered official (immutable) government records within the System.

System has the ability to support input validation to maintain data quality and integrity.

System has the ability to prevent unauthorized users from changing or deleting data.

System has the ability to secure data transferred between the client (ie. on City devices, client devices, or a web browser) and the application.

System has the ability to encrypt data, including backups, at rest and in transmission.

System must ensure confidentiality, integrity and availability of the data.

Secure Maintenance

Describe how Consultant maintains an active vulnerability and threat-monitoring program that conforms to the following standards:

· Zero day vulnerabilities are remediated within two business days

· Critical and high vulnerabilities are remediated within 30 business days

At minimum, System supports versions of software with a standard of Current Minus Two (two versions behind most recent release).

Cybersecurity

System must protect City data and services with a firewall or other City-approved solution that excludes all network traffic to environments hosting City data and services, except that which is explictly allowed. Examples of untrusted networks includes:

· Internet

· Other customer networks

· Consultant management network

· Consultant corporate network

System employs and monitors network and host-based intrusion detection and prevention solutions to protect City data and services. This includes anti-malware capabilities.

System employs a continuous security monitoring solution including the ability to manage and protect log files from tampering and retain logs for up to 12 months.

The System must ensure full separation of the City’s data from that of other customers, tenants, or clients on the same platform, and guarantee that no other customer can access the City’s data.

System must restrict access to City data and services by Consultant’s personnel to only those who have an approved business need.

System has the ability to log and report on physical access to infrastructure hosting City data and services.

System must ensure all City data, including backups, resides within the continental United States.

Describe how the System uses artificial intelligence to fulfill any of the functionality provided by the System.

System will not transmit city data over API to general purpose AI models such as ChatGPT.

System must include documented procedures to audit at least annually all user access accounts to City data.

System preserves and protects logs against tampering or deletion by privileged users.

System must have the capability to enforce auditing and log basic information about user access activity, administration activities, system events and errors, and access violation reports. Activity logs must capture at least the following:

· User authentication

· Type of event

· Date and time

· Success or failure indication

· Origination of event

· Identity or name of affected data, system component or resource

System logs and reports on security events including, but not exclusive to:

· Log on

· Log off

· Failed Log on

· Account Locked

· Account Unlocked

· Password Reset

System logs and reports on access/authentication changes including, but not exclusive to:

· New account created

· Accounts disabled / enabled

· Account deleted

· Authorization changes such as adding user (or removing from) a new role or other evidence of an authorization change.

· Privilege escalation (ie. escalation from any user role to system administrator role)

System has the ability to implement ‘separation of duties’ (fraud prevention) controls around critical workflow and transaction changes and approvals.

System logs and reports on changes to configuration settings.

System logs and reports on application and data management events such as:

· Data Element Changes

· System Error messages

· Files opened and closed

· Files modified

System provides mechanism to consume secure SOAP-based and/or REST-based web services from external and internal systems.

System provides mechanism that can be automated to export data via batch process(es).

System provides capability for automated near real-time export of data out of the system.

System integration layer is kept on same upgrade schedule as the core system.

System provides a repeatable and automated mechanism to access to data required by the City to perform all reporting and ETL functions necessary to support business processes.

System allows for the configuration of data retention rules within the System.

The System must include robust reporting functionality that meets both operational and strategic business needs. Specifically, the System must:

· Provide a comprehensive set of standard out-of-the-box reports relevant to the solution’s core functions.

· Support the ability to generate custom reports based on business-specific criteria, including filtering, grouping, date ranges, and user-defined fields.

All data collected within the System (whether it be out-of-the-box or customized) must be accessible via the System’s robust reporting functionality.

System has the ability to back-up and restore data to support the following:

· Recovery Point Objective: [24-hours – no more than 24-hours data loss.]

· Recovery Time Objective (Incidental Restore Requests): 4 hours

System supports 99.9% uptime.

System supports testing or other verification of the disaster recovery process on an annual basis.

If available, describe how each release of the System is compliant with Section 508 and/ or WCAG2.1 AA specifications.

If available, describe how all interfaces (both for administrators and end-users) are compliant with Section 508 and/or WCAG2.1 AA specifications throughout the System’s lifecycle.