Attachment D - Requirement Traceability Matrix.xlsx
XLSX spreadsheet 64 KB Posted
- Attached to
- central communications system
- Solicitation number
- 25-565IGB-FISAD-B-45047
- Issued by
- Illinois
About this file
This document is an Attachment D - Requirement Traceability Matrix for a Request for Proposal (RFP) issued by the State of Illinois' Illinois Gaming Board for a Central Communications System Procurement.
The RFP seeks a vendor to provide a comprehensive Central Communications System to facilitate real-time communication, control, and data exchange across the entire video gaming network in the state. Key requirements include network infrastructure, reporting and analytics, security and compliance, service level agreements, and various administration and operational capabilities. The vendor will be responsible for managing the day-to-day operations of the system, deploying hardware and software, and providing 24/7 support. The contract term is not specified, but the RFP indicates the need for scalable and flexible solutions to accommodate future growth and changes in regulatory requirements.
View the file
Other files
Show all 26
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
1. Title Page
| STATE OF ILLINOIS - Illinois Gaming Board |
| Central Communications System Procurement |
| Attachment D. Requirements Traceability Matrix |
&10State of Illinois RFP V.24.3 &10&P of &N
2. Table of Contents
| STATE OF ILLINOIS - Illinois Gaming Board |
| Central Communications System Procurement |
| Instructions |
| This page provide a Table of Contents for the Traceability Matrix (TM). |
Each tab is defined and includes a hyperlinked title for easy navigation.
| Tab Title | ||
| Hyperlinked | Description | |
| 1. Title Page | Details the RFP and Attachment Title - no response required on this tab | |
| 2. Table of Contents | Details all tabs within the workbook - no response required on this tab | |
| 3. Instructions | Provides instructions for tabs the Offeror must fill out in their response - no response required on this tab | |
| 4. Desirable Functional Req. | Details all rated functional requirements for the solicitation - response required in tab | |
| 5. Desirable Technical Req. | Details all rated technical requirements for the solicitation - response required in tab | |
| 6. Desirable Service Req. | Details all rated service requirements for the solicitation - response required in tab | |
| 7. Service Level Requirements | Details all performance requirements for the solicitation - no response required on this tab | |
| 8. Performance Definitions | Details performance metrics and definitions the selected Offeror must maintain through their solution - no response required on this tab |
&10&A &10&F
&10State of Illinois RFP V.24.3 &10&P of &N
3. Instructions
| Instructions and Key Definitions | ||
| This worksheet describes the tabs that require Offeror inputs, specifically all Desirable tabs as follows: 4. Desirable Functionalities, 5. Desirable Technical Functionalities, and 6. Desirable Services. Offeror must review all worksheets and complete the actions described. | ||
| Instructions and Definitions for Tab 4. Desirable Functional Requirements | ||
| Column Letter | Column Headers | Instructions and Definitions |
| A | Requirement ID | Provides the unique ID for the Solution Desirable Functionality. |
| Instructions: This cell is locked and unable to be revised. | ||
| B | Level 0 Capability | Classifies the functionalities by level 0 capabilities. |
| Instructions: This cell is locked and unable to be revised. | ||
| C | Level 1 Capability | Classifies the functionalities by level 1 capabilities. |
| Instructions: This cell is locked and unable to be revised. | ||
| D | Desirable Functionality | Detailed description of the desirable functionality. |
| Instructions: This cell is locked and unable to be revised. | ||
| E | Desirable Functionality Met | Possible Values: |
A. Yes: Offeror Solution can meet this desirable functionality.
B. No: Offeror Solution cannot meet this desirable functionality.
| Instructions: Offeror shall use the provided drop-down menu to identify their ability to meet each desirable functionality. | ||
| F | Solution Method | Possible Values: |
A. Out of the Box: The desirable functionality will be met through available functionality.
B. Configuration: Adjusting the settings and options within the software to meet the desirable functionality without altering the core code of the software.
C. New Development / Customization: The desirable functionality will be met through customization, which requires custom code development.
D. Third-Party Product: The desirable functionality will be met by commercially available third-party software and is not included in this Proposal. NOTE: The name of the proposed third-party software vendor and proposed components must be indicated under "Comments".
E. None: The desirable functionality will not be met by the Solution.
| Instructions: Offeror shall use the provided drop-down menu to identify how they can meet each desirable functionality. | ||
| G | Reference to RFP response/ Comments | Provide reference to the RFP response if applicable. Free text field for comments. |
| Instructions: Offeror shall provide explanation or comments to explain entries in column F when necessary. | ||
| Instructions and Definitions for Tab 5. Desirable Technical Requirements | ||
| Column Letter | Column Headers | Instructions and Definitions |
| A | Requirement ID | Provides the unique ID for the Solution Desirable Technical Functionality. |
| Instructions: This cell is locked and unable to be revised. | ||
| B | Level 0 Capability | Classifies the requirements by level 0 capabilities. |
| Instructions: This cell is locked and unable to be revised. | ||
| C | Level 1 Capability | Classifies the requirements by level 1 capabilities. |
| Instructions: This cell is locked and unable to be revised. | ||
| D | Desirable Functionality | Detailed description of the desirable technical functionality. |
| Instructions: This cell is locked and unable to be revised. | ||
| E | Desirable Functionality Met | Possible Values: |
A. Yes: Offeror Solution can meet this desirable technical functionality.
B. No: Offeror Solution cannot meet this desirable technical functionality.
| Instructions: Offeror shall use the provided drop-down menu to identify their ability to meet each requirement. | ||
| F | Solution Method | Possible Values: |
A. Out of the Box: The desirable functionality will be met through available desirable technical functionality.
B. Configuration: Adjusting the settings and options within the software to meet the desirable technical functionality without altering the core code of the software.
C. New Development / Customization: The desirable technical functionality will be met through customization, which requires custom code development.
D. Third-Party Product: The desirable technical functionality will be met by commercially available third-party software and is not included in this Proposal. NOTE: The name of the proposed third-party software vendor and proposed components must be indicated under "Comments".
E. None: The desirable technical functionality will not be met by the Solution.
| Instructions: Offeror shall use the provided drop-down menu to identify how they can meet each desirable technical functionality. | ||
| G | Reference to RFP response/ Comments | Provide reference to the RFP response if applicable. Free text field for comments. |
| Instructions: Offeror shall provide explanation or comments to explain entries in column F when necessary. | ||
| Instructions and Definitions for Tab 6. Desirable Service Requirements | ||
| Column Letter | Column Headers | Instructions and Definitions |
| A | Requirement ID | Provides the unique ID for the Solution Desirable Technical Functionality. |
| Instructions: This cell is locked and unable to be revised. | ||
| B | Level 0 Capability | Classifies the requirements by level 0 capabilities. |
| Instructions: This cell is locked and unable to be revised. | ||
| C | Level 1 Capability | Classifies the requirements by level 1 capabilities. |
| Instructions: This cell is locked and unable to be revised. | ||
| D | Desirable Functionality | Detailed description of the desirable technical functionality. |
| Instructions: This cell is locked and unable to be revised. | ||
| E | Desirable Functionality Met | Possible Values: |
A. Yes: Offeror Solution can meet this desirable technical functionality.
B. No: Offeror Solution cannot meet this desirable technical functionality.
| Instructions: Offeror shall use the provided drop-down menu to identify their ability to meet each requirement. | ||
| F | Solution Method | Possible Values: |
A. Out of the Box: The desirable functionality will be met through available desirable technical functionality.
B. Configuration: Adjusting the settings and options within the software to meet the desirable technical functionality without altering the core code of the software.
C. New Development / Customization: The desirable technical functionality will be met through customization, which requires custom code development.
D. Third-Party Product: The desirable technical functionality will be met by commercially available third-party software and is not included in this Proposal. NOTE: The name of the proposed third-party software vendor and proposed components must be indicated under "Comments".
E. None: The desirable technical functionality will not be met by the Solution.
| Instructions: Offeror shall use the provided drop-down menu to identify how they can meet each desirable technical functionality. | ||
| G | Reference to RFP response/ Comments | Provide reference to the RFP response if applicable. Free text field for comments. |
| Instructions: Offeror shall provide explanation or comments to explain entries in column F when necessary. | ||
| Description for Tab 7. Service Level Requirements | ||
| Column Letter | Column Headers | Instructions and Definitions |
| Instructions: | Refer to Section 9 of the Attachment H - Response Template and describe your approach to meeting the service level requirements provided in Tab 7. | |
| A | ID | Provides the unique ID for the Solution Desirable Technical Functionality. |
| B | Service Level Requirement (SLR) Name | Provides the name of the Service Level Requirement. |
| C | SLR Description/Objective | Performance goal or objective for service quality and delivery standards for the SLR |
| D | Target | Target expectations for service quality to be achieved for the SLR |
| E | Measurement Formula | The calculation used to evaluate the Vendor performance against SLR metrics. |
| F | SLR Reporting Period | SLR Reporting period is a defined time frame for reporting the SLR performance vs the target |
| G | SLR Measurement of Non-Compliance | The Vendor will be non compliant for an SLR if the performance falls below the agreed-upon SLR targets. |
| Description for Tab 8. Performance Definitions | ||
| Table # | Table Name | Description |
| Instructions: | Refer to Section 9 of the Attachment H - Response Template confirm your alignment with the Incident severity, definition and resolution timeframes. | |
| 1 | Incident Severity/Priority Definitions | This table defines the severity of an incident based on the impact and urgency of the incident. |
| 2 | Incident Impact Definition and Resolution Timeframe | This table defines the impact of an incident and associated resoution timeframe. |
&10&A &10&F
&10State of Illinois RFP V.24.3 &10&P of &N
4. Desirable Functional Req.
| ID# | Level 0 Capability | Level 1 Capability | Functional Requirement | Requirement Met | Solution Method | Reference to RFP response/ Comments |
| SY1 | System | Video Gaming Central Communication System (CCS) | The CCS facilitates real-time communication and control between every licensed video gaming terminal in the state. It ensures seamless coordination and data exchange across the entire video gaming network. | |||
| SY2 | System | Network | The solution should have a self-sustaining network that is isolated from the State, Establishments, Terminal Operators, and securely transfers data through public networks such as Internet Service providers and Cell Phone providers. | |||
| SY3 | System | Reporting | The Solution should have a data analytics tools set to provide comprehensive reporting for all possible consumers of reportable data. | |||
| SY4 | System | Data Repository | The Solution should hold all data related to the system and be usable for any Reporting or Audit tools. | |||
| SY5 | System | Logging | The Solution should have the capability to store logs needed to comply with all laws and regulations. | |||
| CP1 | Components | Licensed Video Gaming Terminals Management | The solution should control the administration of the Video Gaming Terminals deployed across various locations in Illinois. The solutions should allow Illinois staff the ability to/ enable / disable/ turn on-off the machines and specific games directly on the machines (VGPs). | |||
| CP2 | Components | Redemption Device Management | The solution should control the administration of the Redemption Devices, any third-party controllers, and any future versions of those devices, deployed across various locations in Illinois. | |||
| FN1 | Functionality | Real-Time Communication | The CCS enables instant communication between VGTs and central servers and support connection protocols such as G2S. | |||
| FN2 | Functionality | Control and Monitoring | It provides tools for regulating gaming activity, evaluating financial positions, and collecting revenue. | |||
| FN3 | Functionality | Security and Integrity | The system ensures fair play, prevents fraud, and maintains the overall security of the gaming environment. | |||
| FN4 | Functionality | Accounting | The CCS provides comprehensive financial management tools to facilitate accurate tracking, reporting, and analysis of all transactions and financial activities associated with the video gaming network. This includes the ability to capture and reconcile funds entered into and disbursed from every licensed video gaming terminal, ensure proper allocation and distribution of revenue according to state regulations, and support financial auditing requirements. The system should offer detailed financial reporting capabilities to monitor the economic health of the video gaming operations, including net terminal income, tax contributions, and operator fees. Additionally, the solution should enable seamless financial operations, such as the efficient transfer of funds between operators, establishments, and regulatory bodies, ensuring transparency and compliance with financial standards and legal requirements. | |||
| AD1 | Administration | Solution Management | The vendor should manage day-to-day operations of the CCS. The company oversees the system’s performance, maintenance, and service throughout the state. | |||
| AD2 | Administration | Funds Transferring | The vendor should ensure proper accounting of all funds and distribution required to fulfill the resulting contract. |
&10&A &10&F
&10State of Illinois RFP V.24.3 &10&P of &N
5. Desirable Technical Req.
| ID# | Level 0 Capability | Level 1 Capability | Technical Requirement | Requirement Met | Solution Method | Reference to RFP response/ Comments |
| HW1 | Hardware | Public Cloud: IaaS | Vendor should have the capability to provide Infrastructure as a Service (IaaS) solutions in the public cloud, offering scalable and flexible hardware resources to support solutions IT infrastructure needs effectively. | |||
| HW2 | Hardware | Public Cloud: PaaS | Vendor should have the capability to offer Platform as a Service (PaaS) solutions in the public cloud, providing the hardware and platform layer necessary for developers to build, deploy, and manage applications efficiently. | |||
| HW3 | Hardware | End User / Shared Resources: Device | Vendor should have the capability to supply and manage hardware devices for State facilities, Terminal Operators, and Establishments ensuring end users and shared resources are equipped with reliable, up-to-date technology that meets operational requirements and security standards. | |||
| IN1 | Infrastructure | Data Warehouse | Vendor should ensure the data warehouse is refreshed hourly to maintain the accuracy of operational data. | |||
| IN2 | Infrastructure | Virtual Service | Vendor should have capabilities to supply virtual services as part of the IT infrastructure, including virtual servers, storage, and networks, to enhance flexibility, scalability, and efficiency of IT operations. | |||
| SW1 | Software | Ad Hoc Reporting Portal | Vendor should include an Ad Hoc reporting feature with a user-friendly interface for custom report creation using centralized production data. | |||
| SW2 | Software | Ad Hoc Reporting Connector | Vendor should provide tools for IGB staff to create and maintain applications for ad hoc report generation, and at a minimum support integration with Microsoft tools such as Excel. | |||
| SW3 | Software | Integrated Reporting | Vendor should have capabilities to develop and integrate reporting functionalities for Undue Economic Concentration and Progressive Jackpots, aligning with regulatory changes. | |||
| SW4 | Software | Public Cloud: SaaS | Vendor should have capabilities to supply Software as a Service (SaaS) solutions in the public cloud, offering accessible, scalable, and secure software applications to meet diverse organizational needs without the burden of local installation and maintenance. | |||
| SW5 | Software | Tracking | Vendor should have capabilities to implement functionality to accurately track and account for Expired Vouchers, ensuring compliance and precise financial records. | |||
| SW6 | Software | End User / Shared Resources: Applications | Vendor should have capabilities to provide and manage software applications for state facilities, ensuring end users and shared resources have access to essential, up-to-date applications that support their daily operations and collaborative needs. | |||
| SW7 | Software | Web-based portal for pre-configured reports | Vendor should provide a web-based portal that hosts a suite of pre-configured reports for various operational and financial aspects of video gaming activities. |
&10&A &10&F
&10State of Illinois RFP V.24.3 &10&P of &N
6. Desirable Service Req.
| ID# | Service Domain | Sub Domain | Service Requirement | Requirement Met | Solution Method | Reference to RFP response/ Comments |
| CO1 | Cutover/Deployment/Hyper-care | Cutover/Deployment Plan | Vendor should have the capabilities to provide a dynamic, scalable deployment plan emphasizing seamless transition with minimal business disruption. They should incorporate real-time monitoring and feedback mechanisms to adjust strategies proactively during cutover, prioritize stakeholder communication and training to ensure smooth adoption, and establish a robust support system for immediate post-deployment issues. | |||
| CO2 | Cutover/Deployment/Hyper-care | Successful Deployment Report | Vendor should have the capabilities to generate comprehensive deployment reports that document successes and challenges, include user feedback, performance metrics, and areas for improvement. These reports should be utilized as learning documents for future deployments, with actionable insights and a roadmap for continuous enhancement of deployment methodologies. | |||
| CS1 | Cyber Security | Data Security Compliance: HIPAA: PHI and PII | Vendor should have the capabilities to develop an advanced compliance framework that exceeds basic HIPAA requirements for PHI and PII, incorporating state-of-the-art encryption, access controls, and continuous monitoring. They should embed compliance as a seamless aspect of the organizational culture, with regular training and updates reflecting the latest in privacy legislation and cyber threats. | |||
| CS2 | Cyber Security | Data Security Compliance: PII | Vendor should have the capabilities to establish a comprehensive PII protection strategy covering all aspects of data handling, from administrative communications to sensitive personal records. They should implement a multi-layered security approach, including encryption, access management, and anomaly detection, to protect against evolving cyber threats. | |||
| CS3 | Cyber Security | Incident Response | Vendor should have the capabilities to create a rapid, efficient incident response plan that minimizes impact and restores operations quickly. They should incorporate advanced threat detection, automated responses, and dedicate an incident response team equipped with cutting-edge tools and continuous training on the latest cyber security threats and mitigation strategies. | |||
| CS4 | Cyber Security | Network Security: IDS | Vendor should have the capabilities to implement a sophisticated intrusion detection system that identifies and learns from attempted breaches, using AI to predict and prevent future attacks. They should foster a proactive network defense posture through continuous monitoring and real-time threat intelligence. | |||
| CS5 | Cyber Security | Network Security: IPS | Vendor should have the capabilities to deploy an advanced intrusion prevention system that actively blocks attacks in real-time, integrates seamlessly with existing network infrastructure, and evolves with changing threat landscapes. They should ensure minimal false positives and maximum protection through sophisticated algorithms and machine learning. | |||
| CS6 | Cyber Security | Network Security: NextGen Firewall | Vendor should have the capabilities to utilize a NextGen Firewall that offers deep packet inspection, application-level security, and integrated intrusion prevention. This firewall should adapt to new threats through continuous updates and offer detailed analytics for informed decision-making. | |||
| CS7 | Cyber Security | Network Segmentation: PHI Network Isolation | Vendor should have the capabilities to implement strict network segmentation for PHI data, ensuring that sensitive information is isolated from general network traffic. They should utilize advanced monitoring to detect and respond to unauthorized access attempts, ensuring the highest level of data integrity and protection. | |||
| CS8 | Cyber Security | Network Segmentation: PII Network Isolation | Vendor should have the capabilities to establish robust network segmentation policies for PII, minimizing risk by segregating sensitive data from the broader network. They should apply strict access controls and monitoring to maintain security while ensuring data accessibility for authorized users. | |||
| CS9 | Cyber Security | Policies and Standards | Vendor should have resource availability and skillsets to lead the creation and management of comprehensive security policies and standards that are not only compliant with current regulations but are also forward-thinking, incorporating best practices and anticipating future security challenges. | |||
| CS10 | Cyber Security | Threat Intelligence | Vendor should have the capabilities to establish a state-of-the-art threat intelligence program that leverages global cyber threat data to inform and prioritize security strategies, ensuring the organization stays ahead of potential threats. | |||
| CS11 | Cyber Security | Vulnerability Management | Vendor should have the capabilities to implement a proactive vulnerability management strategy that continuously identifies, assesses, and mitigates vulnerabilities across all systems, using advanced scanning technologies and risk assessment tools to prioritize response efforts. | |||
| DM1 | Data Management | Compliance with the Video Gaming Act, Illinois Administrative Rules, and Technical Requirements | Vendor should have the capabilities to ensure all data and reporting capabilities adhere to legal and technical requirements, providing comprehensive regulatory compliance. | |||
| DM2 | Data Management | Data Migration Strategy | Vendor should have the capabilities to develop a comprehensive data migration strategy that ensures data integrity, minimizes downtime, and supports seamless transition between systems. | |||
| DM3 | Data Management | Data Mining | Vendor should have the capabilities to provide advanced data mining services to extract valuable insights and uncover patterns that drive business value. | |||
| DM4 | Data Management | Data retention from inception to the current date | Vendor should have the capabilities to maintain a robust data retention policy to keep data from the inception of gaming operations accessible up to the current date. | |||
| DM5 | Data Management | Data Warehouse Refresh | Design the data warehouse to support hourly refreshes, ensuring up-to-date and accurate data for reporting purposes. | |||
| DM6 | Data Management | Data Warehousing | Vendor should have the capabilities to design and manage scalable data warehousing solutions for advanced analytics and reporting. | |||
| DM7 | Data Management | Detailed data capture and reporting at the game, VGT, establishment, and terminal operator levels | Vendor should have the capabilities to capture and report detailed data across individual games, VGTs, establishments, and operators, offering a comprehensive operational overview. | |||
| DM8 | Data Management | Disaster Recovery Planning | Vendor should have the capabilities to develop and implement comprehensive disaster recovery plans ensuring business continuity. | |||
| DM9 | Data Management | Predictive Analytics | Vendor should have the capabilities to provide predictive analytics solutions, forecasting future trends and enabling proactive decision-making. | |||
| DM10 | Data Management | Reporting & Visualization | Vendor should have the capabilities to create dynamic reporting and visualization tools for complex data presentation. | |||
| DM11 | Data Management | Reporting for accounting and operational aspects, terminal operator billing, and auditing | Vendor should have the capabilities to provide comprehensive reporting features for operational, billing, and auditing purposes, facilitating thorough management of gaming activities. | |||
| DM12 | Data Management | Reporting summations and calculations as detailed | Vendor should have the capabilities for detailed reporting summations and calculations to support complex analysis requirements. | |||
| DM13 | Data Management | User activity, inventory reporting, and voucher activity reporting | Vendor should have the capabilities to offer detailed reporting on user activity, inventory, and voucher transactions for effective monitoring and management. | |||
| DS1 | Development Services | Agile Development Style | Vendor should have the capabilities to employ an Agile development methodology for rapid, iterative product development cycles. | |||
| DS2 | Development Services | API, Scripts, & Procedures Development & Documentation | Vendor should have the capabilities to develop robust APIs, scripts, and procedures, along with comprehensive documentation. | |||
| DS3 | Development Services | Content Creation & Migration | Vendor should have the capabilities to manage content creation and migration projects with integrity and minimal disruption. | |||
| DS4 | Development Services | Database Design and Schema Configuration & Documentation | Vendor should have the capabilities to design and configure optimized database schemas, accompanied by thorough documentation. | |||
| DS5 | Development Services | Integration of real-time data access for both IGB and licensed Terminal Operators | Vendor should have the capabilities to offer real-time data access for both IGB and licensed Terminal Operators, providing immediate operational insights. | |||
| DS6 | Development Services | Monitoring & Logging Setup | Vendor should have the capabilities to set up comprehensive monitoring and logging frameworks for real-time system visibility. | |||
| DS7 | Development Services | Security Configuration & Documentation | Vendor should have the capabilities to configure robust security measures, accompanied by detailed documentation. | |||
| DS8 | Development Services | System & Environment Architecture Configuration & Documentation | Vendor should have the capabilities to design and document scalable, resilient system architectures. | |||
| DS9 | Development Services | Web browser-based configuration application using Microsoft Excel as a front-end program | Vendor should provide a web browser-based configuration tool that utilizes Microsoft Excel, enabling easy report configuration by IGB staff. | |||
| KT1 | Knowledge Transfer and Exit Transition | Knowledge Transfer Plan | Vendor should have the capabilities to develop a detailed knowledge transfer plan that ensures organizational readiness post-vendor exit. | |||
| KT2 | Knowledge Transfer and Exit Transition | System and User Documentation | Vendor should have the capabilities to provide comprehensive system and user documentation for all stakeholders. | |||
| MO1 | M&O | Cyber Security: Audit | Vendor should have the capabilities to conduct comprehensive cybersecurity audits, assessing systems and processes to identify vulnerabilities and recommend corrective actions to strengthen security posture. | |||
| MO2 | M&O | Cyber Security: Data Privacy | Vendor should have the capabilities to ensure data privacy, implementing best practices and technologies to protect sensitive information against unauthorized access and breaches. | |||
| MO3 | M&O | Cyber Security: Regulatory Compliance | Vendor should have the capabilities to manage regulatory compliance, staying abreast of and adhering to all relevant cybersecurity laws, regulations, and standards. | |||
| MO4 | M&O | Cyber Security: Risk Analysis | Vendor should have the capabilities to perform detailed risk analyses, identifying potential security threats and developing strategies to mitigate these risks. | |||
| MO5 | M&O | Infrastructure Monitoring | Vendor should have the capabilities to provide 24/7 infrastructure monitoring services, ensuring the health, performance, and security of IT systems. | |||
| MO6 | M&O | Inventory Management | Vendor should have the capabilities to manage IT inventory, tracking hardware and software assets to ensure efficient utilization and compliance. | |||
| MO7 | M&O | License Management | Vendor should have the capabilities to manage software licenses, ensuring compliance with licensing agreements and optimizing software expenditure. | |||
| MO8 | M&O | Lifecycle Management | Vendor should have the capabilities to manage the entire lifecycle of IT assets, from procurement to disposal, ensuring assets are updated, maintained, and retired efficiently. | |||
| MO9 | M&O | Maintenance & Repairs | Vendor should have the capabilities to provide timely maintenance and repair services for IT assets, minimizing downtime and extending asset lifespan. | |||
| MO10 | M&O | Procurement & Installation | Vendor should have the capabilities to manage the procurement and installation of IT assets, ensuring that hardware and software meet organizational needs and are installed with minimal disruption. | |||
| MO11 | M&O | Software Support and Maintenance: License Management | Vendor should have the capabilities to specifically manage software licenses under support and maintenance contracts, ensuring legal compliance and operational efficiency. | |||
| MO12 | M&O | Software Support and Maintenance: Patch Management | Vendor should have the capabilities to manage and deploy software patches, ensuring systems are protected against vulnerabilities and are up to date. | |||
| MO13 | M&O | Software Support and Maintenance: Software Upgrades | Vendor should have the capabilities to manage software upgrades, ensuring that applications remain current, secure, and functional. | |||
| MO14 | M&O | Software Support and Maintenance: Technical Support | Vendor should have the capabilities to provide technical support for software issues, resolving problems quickly to maintain operational efficiency. | |||
| MO15 | M&O | Web Hosting and Management | Vendor should have the capabilities to provide reliable web hosting and management services, ensuring high availability, performance, and security of web applications. | |||
| OC1 | OCM | Organizational Change Management | Vendor should develop and implement in partnership with the State a comprehensive plan for managing the organizational changes and process changes needed for successful implementation. This should include at a minimum: stakeholder analysis, change impact assessment, project and communications plan. | |||
| PM1 | Product Management | Device Management | Vendor should have the capabilities to manage device lifecycles, ensuring devices are secure, up-to-date, and operating efficiently across the organization. | |||
| PM7 | Product Management | General Staffing | Vendor should maintain appropriate levels of staff for the necessary skillsets required to fulfill the resulting contract. | |||
| PM2 | Product Management | Help Desk Support | Vendor should have resource availability and skillsets to provide comprehensive help desk support services, ensuring rapid response and resolution of IT issues to minimize downtime and maintain user satisfaction. | |||
| PM3 | Product Management | IT General Support | Vendor should have the capabilities to offer a wide range of IT general support services, covering everything from software installation to troubleshooting, aimed at ensuring smooth operational continuity for all technology users. | |||
| PM4 | Product Management | IT Maintenance | Vendor should have resource availability and skillsets to perform regular IT maintenance tasks, including software updates, hardware checks, and system optimizations, to ensure technology infrastructure remains reliable and efficient. | |||
| PM5 | Product Management | IT Management | Vendor should have the capabilities to provide IT management services that oversee and coordinate all IT-related activities within the organization, aligning IT strategies with business objectives to drive growth and innovation. | |||
| PM6 | Product Management | IT Security | Vendor should have the capabilities to implement and manage comprehensive IT security measures, including cyber threat detection, data protection protocols, and employee awareness training, to safeguard organizational assets against evolving cyber risks. | |||
| QA1 | Quality Assurance | Cutover/Deployment Test Plan | Vendor should have the capabilities to develop a detailed test plan for cutover/deployment, ensuring all aspects of the system are fully functional and meet operational requirements prior to going live. | |||
| QA2 | Quality Assurance | Cutover/Deployment Test Results Report | Vendor should have the capabilities to provide comprehensive test results reports for cutover/deployment, documenting testing outcomes, issues encountered, and corrective actions taken. | |||
| QA3 | Quality Assurance | Performance (Load and Stress) Test Plan | Vendor should have the capabilities to formulate a performance test plan, including load and stress testing, to evaluate the system's behavior under normal and anticipated peak load conditions. | |||
| QA4 | Quality Assurance | Performance Test Results Report | Vendor should have the capabilities to provide performance test results reports, highlighting the system’s stability, speed, and scalability under varying levels of demand. | |||
| QA5 | Quality Assurance | Security Test Plan | Vendor should have the capabilities to design a security test plan that identifies and mitigates potential vulnerabilities within the software or system, protecting against unauthorized access and data breaches. | |||
| QA6 | Quality Assurance | Security Test Results Report | Vendor should have the capabilities to issue security test results reports, detailing the effectiveness of security measures and any vulnerabilities identified during testing. | |||
| QA7 | Quality Assurance | System Security Plan | Vendor should have the capabilities to create a comprehensive system security plan, outlining the policies, controls, and procedures to protect information system assets from threats and vulnerabilities. |
&10&A &10&F
&10State of Illinois RFP V.24.3 &10&P of &N
7. Service Level Requirements
| ID | Service Level Requirement (SLR) Name | SLR Description/Objective | Target | Measurement Formula | SLR Reporting Period | SLR Measurement of Non-Compliance | |
| SLR1 | Availability | The Application should be available to all users of the System | 99.99% | (# of minutes of uptime during the reporting period) / (Total planned uptime during the reporting period) | Monthly | Uptime percentage below the target | |
| SLR2 | Performance - Average Response Time | System performance should meet end-user expectations to deliver increased customer satisfaction and efficiency gains | Average response time should be 5 minutes (response time from entering command to receiving result) | (Sum of all transaction response time) / (Number of transactions) | Monthly | Time difference between measured average response time and 5 minutes | |
| SLR3 | Performance - Maximum Response Time | System performance should meet end-user expectations to deliver increased customer satisfaction and efficiency gains | 95% of transactions complete (response time from entering command to receiving result) in less than 10 minutes | (Transactions completed within required time) / (Total Transactions) | Monthly | Percentage of transactions below target | |
| SLR4 | Critical and High Severity Incident Resolution Timeframe | Critical and High severity incidents should be addressed quickly to minimize the business impact of the incident (See Severity (S1 - S4) definition in the Performance Definitions Tab) | 95% of critical and high severity incidents fixed within specified resolution times | (Number of critical and high severity incidents fixed within SLA Target) / (Total number of critical and high severity incidents) | Monthly | Per unresolved incident exceeding the resolution time by 20% | |
| SLR5 | Critical and High Severity UAT Defect Resolution Timeframe | Critical and high UAT defects should be addressed quickly to minimize the impact of the defect on UAT timelines (See Severity (S1 - S4) definition in the Performance Definitions Tab) | 95% of critical and critical and high severity UAT defects are fixed within specified resolution times | (Number of critical and high severity UAT defects fixed within SLA Target) / (Total number of critical and high severity UAT defects) | Monthly | Per defect not fixed exceeding the resolution time by 25% | |
| SLR6 | Security Incidents Response Time | The State security point-of-contact should be notified of any security incidents as quickly as possible | All of notifications completed within 1 hour of identifying | ||||
| (all notifications should occur as soon as possible) | Number of incidents not reported within 1 hour | Monthly | Per incident not reported within 1 hour | ||||
| SLR7 | Disaster Recovery Restoration Timelines | In case of a disaster and crisis situations that effects the availability of the service, the system has to be restored as rapidly as possible with minimal data loss. | The Recovery Time Objective (RTO) to be less than 1 hour, and the Recovery Point Objective (RPO) to be no data loss | Actual time to restoring service from disaster declaration, and amount of data lost attributed to occurrence of disaster | Per disaster event occurrence | Minutes greater than target | |
| SLR8 | Delivery of Enhancements | To avoid scheduling issues and potential end-user issues, all enhancements should be completed in alignment with the proposed schedule | Enhancements are deployed into production per schedule agreed in the project plan. | (Date approved) - (Planned production deployment date (captured in the proposal)) | Per enhancement effort | Per day the enhancement is deployed to production after the planned date |
&10&A &10&F
&10State of Illinois RFP V.24.3 &10&P of &N
8. Performance Definitions
| Description |
| Table 1. Incident Severity Definitions |
| The matrix below establishes the criteria for assigning severity to defects and incidents. |
| Scenario Description | Urgency | Impact | |||
| State-Wide | Location | Multiple Users | Single User | ||
| A full outage of multiple services or all business capabilities and/or noncompliance with regulations. | Critical | Critical | High | High | |
| An incident completely affecting a service or business capability, no workaround available. | Critical | High | High | Medium | |
| An incident partially to significantly affecting a service or business capability; workaround is available. | High | Medium | Medium | Medium | |
| An incident that has no impact to the availability of the affected service or business capability; redundancy is available. | Medium | Low | Low | Low |
| Description |
| Table 2. Incident Impact Definition and Resolution Timeframe |
| The service level standards below apply to incidents |
| Incident Resolution Timeframe is the elapsed time from when the incident is reported or escalated to the Offeror's Help/Service Desk to the time the incident is resolved. |
| Incident Severity | Incident Impact Definition and Resolution Timeframe | Incident Resolution Timeframe | |
| S1 | |||
| Severity 1 - Critical | The production system is down, or a mission critical functionality is inoperable. Users are unable to reasonably perform their normal functions. The situation is considered an emergency. | 4 hours |
| Examples: portal outage, network outage, critical system component outage (e.g., lab operations) | ||
| S2 | ||
| Severity 2 - High | The system is usable but severely limited. Significant impact to application functionality, data, or performance which is resulting in a high number of users being unable to perform their normal functions or is resulting in a high number of customer benefits being blocked/incorrect. There is no workaround, or it is cumbersome to business operations. | 1 business day |
| Examples: Integration hub is down resulting in lack of ability to receive test orders from EHRs, or web-based provider portal is down resulting in lack of ability to update patient demographics, submit test orders, and view and print certified result reports. | ||
| S3 | ||
| Severity 3 - Medium | Moderate impact to application functionality, data, or performance resulting in multiple users being impacted in their normal function or resulting in a high number of customer benefits being blocked/incorrect. For application functionality issues, a readily apparent and State approved workaround exists. For performance issue, the degradation is minor and is not rendering the normal functions of the system unusable or causing a significant disruption to users. | 5 business days |
| Examples: Incorrect abnormal range values for a test or assay small subset of a program), incorrect validation requiring workaround. | ||
| S4 | ||
| Severity 4 - Low | Minor loss of application functionality resulting in limited or no impact to users being able to perform their normal function. A workaround is not required as a result of the limited impact. | 20 business days |
| Examples: typo with material impact, display alignment issues |
&10&A &10&F
&10State of Illinois RFP V.24.3 &10&P of &N
Sheet1
Data Validation
| Functional Requirements | Technical Requirements | Service Requirements | |||||||||||||||||
| Level 0 Capability | Level 1 Capability | Level 2 Capability | Priority | Requirement Met | Solution Method | Customization | Integration w/ 3rd Party Product | Future Product Release | Level 0 Capability | Level 1 Capability | Level 2 Capability | Priority | Requirement Met | Solution Method | Customization | Integration w/ 3rd Party Product | Future Product Release | Service Domain | Sub Domain |
| 1. Application Processing | 1.1. Conduct Criminal History Evaluation Letters | Mandatory | Yes | Out of the Box | Yes | Yes | Yes | 1. General Technology | 1.1. Databases | Mandatory | Yes | Configuration | Yes | Yes | Yes | 1. Project and Security Management | 1.1. Planning | ||
| 2. License Management | 1.2. Conduct Experience Audits for Applicants | Optional | No | Configuration | No | No | No | 2. Enabling Technology | 1.2. Infrastructure | Optional | No | Business Rules Automation | No | No | No | 2. Requirements Validation | 1.2. Change Management | ||
| 3. Investigations & Enforcement | 1.3. Intake Applications | New Development / Customization | 3. Online Portal | 1.3. Maintainability | Both | 3. Solution Design and Development/Configuration | 1.3. Communication Management | ||||||||||||
| 4. Inspections | 1.4. Issue Licenses/Registrations | Third-Party Product | 4. Application Security | 1.4. Performance | None | 4. Data Migration | 1.4. Deliverables Management | ||||||||||||
| 5. Education | 1.5. Manage Review Lifecycle | None | 5. Reporting | 2.1. Communications | 5. Testing | 1.5 Documentation Management | |||||||||||||
| 6. Financial Management | 1.6. Perform Detailed Review for Eligibility | 6. System Interfaces | 2.2. Configuration | 6. User Training | 1.6 Meeting Management | ||||||||||||||
| 7. Online Portal | 1.7. Submit Application | 2.3. Digital Signature | 7. SaaS (hosting and solution provisioning) | 1.7 Security Management | |||||||||||||||
| 8. General Operations | 1.8. Submit Supporting Documentation | 2.4. Electronic Document Management System (EDMS) | 8. Cutover/Deployment/Hypercare | 1.8 Service Level Management | |||||||||||||||
| 9. System Admin | 1.9. Update Application | 2.5. Geographical Information System (GIS) | 9. Maintenance and Operations | 1.9 Staff Management | |||||||||||||||
| 1.10. Verify Background Check | 2.6. Key Performance Indicators (KPI) | 10. Knowledge Transfer and Exit Transition | 2.1 Requirements Management | ||||||||||||||||
| 1.11. Verify Payment | 3.1. Configuration | 11. Multi-Vendor Integration | 3.1 Design | ||||||||||||||||
| 2.1. Manage License Status | 3.2. General Portal | 12. Organizational Change Management | 3.2 Configuration Management | ||||||||||||||||
| 2.2. Manage Relationships | 4.1. Auditing | 13. Deliverable | 3.3 Build | ||||||||||||||||
| 2.3. Process/Issue Renewal | 4.2. Authentication | 3.4 Release Management | |||||||||||||||||
| 2.4. Process License Changes | 4.3. Error Handling | 4.1 Data Migration | |||||||||||||||||
| 2.5. Track Historical Events | 4.4. General Security | 5.1 Test Planning | |||||||||||||||||
| 3.1. Assign Complaint | 4.5. Security Infrastructure | 5.2 Test Execution | |||||||||||||||||
| 3.2. Intake Complaint | 4.6. Role-Based Access Control (RBAC) | 5.3 User Acceptance Testing | |||||||||||||||||
| 3.3. Investigate Complaint | 4.7. Security Reporting | 6.1. Training Plan | |||||||||||||||||
| 3.4. Report Disciplinary Action | 5.1. General Reporting | 6.2. Training Preparation | |||||||||||||||||
| 3.5. Resolve Complaint | 6.1. General Interfaces | 6.3. Training Execution | |||||||||||||||||
| 3.6. Review a Complaint for Validity | 7.1. Planning | ||||||||||||||||||
| 3.7. Submit Complaint | 7.2 Compliance | ||||||||||||||||||
| 3.8. Support Legal Proceedings | 7.3 Security | ||||||||||||||||||
| 3.9. Track Compliance | 7.4 Solution Data | ||||||||||||||||||
| 3.10. Track Compliance with Disciplinary Action | 7.5 Environments | ||||||||||||||||||
| 4.1. Perform Inspection | 7.6 Solution Performance | ||||||||||||||||||
| 5.1. Conduct Education Provide Audits | 7.7 Patch and Upgrade Management | ||||||||||||||||||
| 5.2. Conduct Education Tracking | 7.8 Disaster Recovery | ||||||||||||||||||
| 5.3. Fulfil Continuing Education Requirements | 8.1. Deployment Planning | ||||||||||||||||||
| 5.4. Manage Courses/Providers | 8.2. Deployment | ||||||||||||||||||
| 6.1. Accept Payment | 8.3. Post-Implementation Support | ||||||||||||||||||
| 6.2. Allocate Revenue | 9.1. Planning | ||||||||||||||||||
| 6.3. Manage Bond | 9.2. Maintenance and Operations | ||||||||||||||||||
| 6.4. Manage Customer Account Balance | 9.3 Service Desk | ||||||||||||||||||
| 6.5. Manage Exception Handling | 9.4 Security and Privacy | ||||||||||||||||||
| 6.6. Submit Payment | 9.6 Release Management | ||||||||||||||||||
| 6.7. Track Financial Events | 9.7 Patch and Upgrade Management | ||||||||||||||||||
| 7.1. Manage Account | 10.1. Planning | ||||||||||||||||||
| 7.2. Provide Data for Public Consumption/Licensee Search | 10.2. Data Transfer and Removal | ||||||||||||||||||
| 7.3. Provide Online Self-Service Features | 10.3. Operational Transition | ||||||||||||||||||
| 7.4. Provide Support for Online Users (Help/FAQ) | 11.1. Planning | ||||||||||||||||||
| 7.5. Publish Information and Messages | 11.2. Architecture Oversight | ||||||||||||||||||
| 8.1. Manage Communications | 11.3. Coding & Documentation Standards Compliance Assurance | ||||||||||||||||||
| 8.2. Manage Documents | 11.4. Service Level Management | ||||||||||||||||||
| 8.3. Manage Geographic Information | 12.1. Planning | ||||||||||||||||||
| 8.4. Manage Staff Workload & Performance | 13.1. Project Management Plan (PMP) | ||||||||||||||||||
| 8.5. Report On & Analyze Data | 13.2. Project Schedule | ||||||||||||||||||
| 9.1. Manage User Accounts & Security | 13.3. Monthly Status Report | ||||||||||||||||||
| 9.2. Manage Workflows & Business Rules | 13.4. Requirements Validation Report | ||||||||||||||||||
| 13.5. Configuration Management Plan | |||||||||||||||||||
| 13.6. System Design Document | |||||||||||||||||||
| 13.7. Detailed Functional and Technical Design Document | |||||||||||||||||||
| 13.8. Role to Position Mapping | |||||||||||||||||||
| 13.9. Data Migration Strategy | |||||||||||||||||||
| 13.10. Data Migration Plan | |||||||||||||||||||
| 13.11. Test Management Strategy | |||||||||||||||||||
| 13.12. Functional Test Plan | |||||||||||||||||||
| 13.13. Parallel Comparison Test Plan | |||||||||||||||||||
| 13.14. Performance (Load and Stress) Test Plan | |||||||||||||||||||
| 13.15. Integration Test Plan | |||||||||||||||||||
| 13.16. Security Test Plan | |||||||||||||||||||
| 13.17. User Acceptance Test Plan | |||||||||||||||||||
| 13.18. Data Migration Test Plan | |||||||||||||||||||
| 13.19. Cutover/Deployment Test Plan | |||||||||||||||||||
| 13.20. Disaster Recovery Test Plan | |||||||||||||||||||
| 13.21. Functional Test Results Report | |||||||||||||||||||
| 13.22. Parallel Comparison Test Results Report | |||||||||||||||||||
| 13.23. Performance Test Results Report | |||||||||||||||||||
| 13.24. Integration Test Results Report | |||||||||||||||||||
| 13.25. Security Test Results Report | |||||||||||||||||||
| 13.26. User Acceptance Test Results Report | |||||||||||||||||||
| 13.27. Data Migration Test Results Report | |||||||||||||||||||
| 13.28. Cutover/Deployment Test Results Report | |||||||||||||||||||
| 13.29. Disaster Recovery Test Report | |||||||||||||||||||
| 13.30. End-user Training Plan | |||||||||||||||||||
| 13.31. Training Curriculum Document, | |||||||||||||||||||
| 13.32. Train-the-Trainer Training Materials | |||||||||||||||||||
| 13.33. Final Training Materials | |||||||||||||||||||
| 13.34. Infrastructure Management Plan | |||||||||||||||||||
| 13.35. Infrastructure and Solution Recovery Plan | |||||||||||||||||||
| 13.36. Cutover/Deployment Plan | |||||||||||||||||||
| 13.37. Successful Deployment Report | |||||||||||||||||||
| 13.38. Production Support Plan | |||||||||||||||||||
| 13.39. Release Management Plan | |||||||||||||||||||
| 13.40. System Security Plan | |||||||||||||||||||
| 13.41. Plan of Action and Milestones (POAM) | |||||||||||||||||||
| 13.42. Knowledge Transfer Plan | |||||||||||||||||||
| 13.43. Technical Documentation | |||||||||||||||||||
| 13.44. System and User Documentation | |||||||||||||||||||
| 13.45. Exit Transition Plan | |||||||||||||||||||
| 13.46. Final Acceptance Document | |||||||||||||||||||
| 13.47. Multi-Vendor Integration Plan | |||||||||||||||||||
| 13.48. Business Process and Organizational Change Management Plan | |||||||||||||||||||
| 13.49. OCM Communication Plan | |||||||||||||||||||
| 13.50. Organizational Readiness Assessment | |||||||||||||||||||
| 13.51. Change Management Effectiveness Assessment |
File details come from the government source that posted it. Updated .