Attachment_H.xlsx
XLSX spreadsheet 68 KB Posted
- Attached to
- Comprehensive Child Welfare Information System
- Solicitation number
- 2000018525
- Issued by
- Ramsey County, Minnesota
About this file
Non-Functional Requirements Traceability Matrix for CCWIS Project
This document is a Non-Functional Requirements Traceability Matrix (RTM) prepared by the Minnesota Department of Children, Youth, and Families (DCYF) for the Comprehensive Child Welfare Information System (CCWIS) project, in coordination with the Department of Information Technology Services (MNIT). The attachment specifies detailed non-functional requirements organized into nine primary categories: Usability (NFR1), Security (NFR2), Audit and Compliance (NFR3), Backup and Recovery (NFR4), Solution Architecture (NFR5), Solution Monitoring and Administration (NFR6), Reporting and Dashboards (NFR7), Interfaces (NFR8), and Data Conversion (NFR9). Respondents to the RFP must complete this workbook by indicating whether their proposed solution meets each requirement using response codes of "Y" (Yes) or "N" (No), with explanatory notes required for all negative responses. The matrix contains 478 individual requirements across the nine categories, designed to ensure the CCWIS solution meets all applicable federal, state, and operational standards while supporting case management, Title IV-E eligibility and claiming, and federally required reporting functions.
The requirements encompass comprehensive technical and operational specifications covering accessibility compliance (ADA and WCAG 2.1 Level AA), multi-factor authentication, role-based access controls, encryption standards (FIPS 140-3 and TLS 1.3), disaster recovery with documented recovery time objectives, data retention and legal hold capabilities, interface integration with external systems using REST APIs and standard formats, integration with the State's Data Lakehouse and Azure infrastructure, automated reporting and dashboard functionality, and complete audit trail maintenance. The document establishes that all security controls must align with NIST 800-53 Revision 5 Moderate baseline standards, federal policies including HIPAA and 42 CFR Part 2, and state-specific requirements. Respondents must demonstrate compliance with open-source software disclosures, API versioning, support for multiple browsers and resolutions, configurable business rules without code changes, and the ability to support offline operations for field users. The RTM serves as the authoritative evaluation tool for assessing vendor proposals against the State's defined technical and operational requirements for the CCWIS implementation.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Attachment_F.docx | DOCX document | |
| Attachment_L.docx | DOCX document | |
| Attachment_K.docx | DOCX document | |
| Attachment_B.docx | DOCX document | |
| Attachment_J.xlsx | XLSX spreadsheet | |
| Sample_Contract.docx | DOCX document | |
| Attachment_E.docx | DOCX document | |
| Attachment_N.docx | DOCX document | |
| CCWISRFP.pdf | ||
| Comprehensive_Child_Welfare_Information_System.pdf | ||
| Attachment_M.docx | DOCX document | |
| Attachment_G.xlsx | XLSX spreadsheet | |
| Attachment_C.xlsx | XLSX spreadsheet | |
| Attachment_I.xlsx | XLSX spreadsheet | |
| Exhibit_A_Supplement_1_Prevailing_Wage_Rates.pdf | ||
| Attachment_O.docx | DOCX document | |
| Attachment_D.pdf | ||
| Attachment_A.docx | DOCX document |
Show all 18
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Introduction Attachment H: Non-Functional Requirements Traceability Matrix (RTM)
| Introduction |
| This document captures the Non-Functional Requirements for the DCYF's CCWIS Project. |
The Non-Functional Requirements document contains the following sections:
1) Introduction
2) Instructions
3) Non-Functional Requirements
Within this document, the requirements are categorized by area as detailed below. Each category has its own tab in this workbook.
| ID | CCWIS Non-Functional Requirements Section Titles |
| NFR | Non-Functional Requirement Section |
| NFR1 | Usability |
| NFR2 | Security |
| NFR3 | Audit and Compliance |
| NFR4 | Backup and Recovery |
| NFR5 | Solution Architecture |
| NFR6 | Solution Monitoring and Administration |
| NFR7 | Reporting and Dashboards |
| NFR8 | Interfaces |
| NFR9 | Data Conversion |
Responder Instructions
| Responder Instructions |
| This workbook contains Requirements for the CCWIS system. The response codes below should be used by Responders to indicate the fit of its solution to the State Requirements specified in this workbook. |
This attachment should be completed and submitted as an MS Excel file as part of the response to this RFP.
| Responses | Definition |
| Response Code: Y or N -- Will this Non-Functional Requirement be met by your solution? | Indicate whether the requirement, as currently written, will be met by the Respondent's proposal. Respond Y=Yes or N=No. |
| Responder Notes, applicable for responses N | If the Response Code is "N" the Responder should provide an explanation. |
NFR1-Usability
| Req # | Requirement Subcategory | Requirement Description | Response Code | |
| (Y,N) | Responder Notes |
(for N responses)
| NFR1.1 | AI Usability & Human Review | Define with the State and Agency the approved scope of artificial intelligence and machine learning use within the System. |
| NFR1.2 | AI Usability & Human Review | Support automated or intelligence-assisted decision support capabilities, including but not limited to summarization, prioritization, pattern identification, relevance cueing, and participant flagging, subject to State-defined governance, transparency, and human-oversight requirements. |
| NFR1.3 | AI Usability & Human Review | Ensure Artificial Intelligence (AI) capabilities are auditable, explainable to Authorized Users, traceable to contributing sources, configurable by the State, and subject to human-in-the-loop (HITL) review and override. |
| NFR1.4 | User Experience & Interface Design | Support functionality to create, organize, display, and maintain Frequently Asked Questions (FAQs). |
| NFR1.5 | User Experience & Interface Design | Provide dropdowns, list boxes, and multi-select screen elements as defined by the State. |
| NFR1.6 | User Experience & Interface Design | Support common display resolutions and ensure application screens display properly. |
| NFR1.7 | User Experience & Interface Design | Provide clear visual indicators that identify required fields, conditionally required fields, and federally mandated data elements, enabling Authorized Users to recognize data entry requirements in accordance with State and Federal rules. |
| NFR1.8 | User Experience & Interface Design | Validate data fields at the point of entry to ensure that Authorized Users provide complete, accurate, and properly formatted information before proceeding. |
| NFR1.9 | User Experience & Interface Design | Support sending and resending generated correspondence to all relevant parties in accordance with each party's documented communication preference, including mail, email, secure portal, and Short Message Service (SMS), and comply with State and Agency communication policies and requirements. |
| NFR1.10 | User Experience & Interface Design | Generate dynamic error messages based on rules and user context. |
| NFR1.11 | User Experience & Interface Design | Display the State-approved privacy policy prominently within the user interface and ensure that the most current State-approved version is consistently presented to Authorized Users in accordance with State policies and legal requirements. |
| NFR1.12 | User Experience & Interface Design | Retain user interface and formatting preferences and automatically apply them after System updates. |
| NFR1.13 | User Experience & Interface Design | Allow Authorized Users with administrative permissions to configure Authorized User alert severity levels, including informational, warning, and critical levels. |
| NFR1.14 | User Experience & Interface Design | Provide configurable System-wide notifications that allow Authorized Users to define notification triggers, content, delivery methods, recipients, and timing in accordance with State and Agency requirements and policies. |
| NFR1.15 | User Experience & Interface Design | Allow undo and redo along with corresponding confirmations. |
| NFR1.16 | User Experience & Interface Design | Allow Authorized Users to configure their homepage experience based on their personal preferences and frequently used functions. |
| NFR1.17 | User Experience & Interface Design | Comply with Americans with Disabilities Act (ADA). |
| NFR1.18 | User Experience & Interface Design | Support multiple browsers such as Microsoft Edge, Google Chrome, Mozilla Firefox, and Apple Safari. |
| NFR1.19 | User Experience & Interface Design | Support the 3 most current browser versions for each browser supported. |
| NFR1.20 | User Experience & Interface Design | Allow limited offline operation for field Authorized Users and synchronize data when connectivity is restored. |
| NFR1.21 | User Experience & Interface Design | Allow configuration of error handling parameters (verbosity, retry limits, thresholds) without code changes. |
| NFR1.22 | Help, Guidance & User Assistance | Provide role-based help filtering that delivers context-appropriate help content based on an Authorized User’s assigned role, permissions, and System access rights. |
| NFR1.23 | Help, Guidance & User Assistance | Provide configurable field-level help that delivers concise, context-sensitive, and relevant guidance for individual data fields and that can be managed by Authorized Users in accordance with State and Agency requirements. |
| NFR1.24 | Help, Guidance & User Assistance | Provide comprehensive help and support content in all State-approved languages. |
| NFR1.25 | Help, Guidance & User Assistance | Provide tooltip and context-sensitive help throughout the user interface. |
| NFR1.26 | Help, Guidance & User Assistance | Provide comprehensive help content for every user interface (UI) module. |
| NFR1.27 | Help, Guidance & User Assistance | Provide interactive interface walkthrough guidance that assists Authorized Users in understanding and completing key tasks within each user interface module. |
| NFR1.28 | Help, Guidance & User Assistance | Allow Authorized Users to access policy-specific help content that explains applicable Agency, State, and Federal policies relevant to the functions they are performing. |
| NFR1.29 | Help, Guidance & User Assistance | Support the deployment of help content updates—such as changes to field-level help, tooltips, FAQs, module help, and policy-specific help—without requiring System downtime or interrupting user activity. |
| NFR1.30 | Help, Guidance & User Assistance | Provide help content tailored to Federal and State-specific policies, regulations, and procedures. |
| NFR1.31 | Help, Guidance & User Assistance | Display role-based error messages with appropriate detail and guidance. |
| NFR1.32 | Application Lifecycle Management (ALM), Traceability & Product Documentation | Fully leverage the State's Application Lifecycle Management environment as the authoritative system of record for all Comprehensive Child Welfare Information System (CCWIS) lifecycle activities—including requirements, design, development tasks, test cases, execution results, defects, change requests, documentation, and traceability. |
| NFR1.33 | Application Lifecycle Management (ALM), Traceability & Product Documentation | Provide an administrator role with the ability to restrict, control, and manage help content maintenance, including creating, updating, approving, or deactivating help documentation, in accordance with State and Agency policies. |
| NFR1.34 | Productivity & Workflow Navigation | Provide graphical user interface (GUI) supporting workflow navigation. |
| NFR1.35 | Productivity & Workflow Navigation | Allow Authorized Users to save incomplete workflows and resume them at a later time without loss of data, in accordance with State-defined business rules and security requirements. |
| NFR1.36 | Productivity & Workflow Navigation | Provide a simple, intuitive, and consistent user interface, including navigation elements, form layouts, icons, and labeling across all modules, in accordance with State and Agency user experience standards and requirements. |
| NFR1.37 | Productivity & Workflow Navigation | Provide intuitive, user-friendly navigation that enables Authorized Users to locate features, functions, and information with minimal training or external guidance and that complies with Agency- and State-defined user experience standards, design guidelines, and usability requirements. |
| NFR1.38 | Productivity & Workflow Navigation | Autosave Authorized Users' work in progress at configurable intervals and during key user actions, including navigation changes, idle timeout, and System interruptions. |
| NFR1.39 | Productivity & Workflow Navigation | Allow copy and paste unless otherwise defined by State-defined business rules. |
| NFR1.40 | Accessibility & Plain Language | Allow Authorized Users to adjust display scaling without screen display issues in compliance with State-approved accessibility and User Experience (UX) requirements. |
| NFR1.41 | Accessibility & Plain Language | Support configurable size, color, and font settings to ensure usability and accessibility for Authorized Users in compliance with State-approved accessibility and user experience requirements. |
| NFR1.42 | Accessibility & Plain Language | Comply with all applicable State branding standards, including approved logos, color palettes, typography, layout guidelines, accessibility standards, and messaging requirements. |
| NFR1.43 | Accessibility & Plain Language | Comply with plain-language principles and accessibility requirements, ensuring that all user-facing content, instructions, notifications, and interfaces are clear, understandable, and usable by individuals of varying abilities, in accordance with applicable State and Federal accessibility and usability standards. |
| NFR1.44 | Accessibility & Plain Language | Comply with Web Content Accessibility Guidelines (WCAG) 2.1 Level AA. |
NFR2-Security
| Req # | Requirement Subcategory | Requirement Description | Response Code | |
| (Y,N) | Responder Notes |
(for N responses)
| NFR2.1 | Security Governance & Compliance | Comply with Federal and State risk assessment policy. |
| NFR2.2 | Security Governance & Compliance | Integrate with centrally managed antivirus or endpoint protection solutions to support consistent malware protection and centralized administration. |
| NFR2.3 | Security Governance & Compliance | Track and maintain annual security training compliance. |
| NFR2.4 | Security Governance & Compliance | Detect and report anomalous data transfer activity, including unusually large or unauthorized data exfiltration. |
| NFR2.5 | Security Governance & Compliance | Limit a user's access to reports based on security profile. |
| NFR2.6 | Security Governance & Compliance | Generate periodic, on-demand security reports. |
| NFR2.7 | Security Governance & Compliance | Restrict copying, duplicating, or reproducing production data into non-production environments except as approved by the State and protected in accordance with State requirements. |
| NFR2.8 | Security Governance & Compliance | Define and enforce a State-approved non-production data handling strategy that addresses masking, de-identification, approved subsetting, synthetic data generation, and permitted uses of production-derived data in non-production environments. |
| NFR2.9 | Security Governance & Compliance | Prevent use of production data in non-production environments unless the data has been approved, protected, and prepared in accordance with the State-approved non-production data handling strategy. |
| NFR2.10 | Security Governance & Compliance | Notify the State of any actual or suspected loss of data within 24 hours of discovery. |
| NFR2.11 | Security Governance & Compliance | Implement a secure network environment with segmentation, boundary protections, and secure communication protocols. |
| NFR2.12 | Security Governance & Compliance | Comply with Federal and State audit and accountability policy. |
| NFR2.13 | Security Governance & Compliance | Comply with Federal and State contingency planning policy. |
| NFR2.14 | Security Governance & Compliance | Comply with Federal and State media protection policy. |
| NFR2.15 | Security Governance & Compliance | Comply with Federal and State physical and environmental protection policy. |
| NFR2.16 | Security Governance & Compliance | Comply with Federal and State System and communications protection policy. |
| NFR2.17 | Security Governance & Compliance | Comply with federal and State policies for System and information integrity. |
| NFR2.18 | Security Governance & Compliance | Comply with federal and State policies for System and services acquisition. |
| NFR2.19 | Security Governance & Compliance | Comply with federal and State policies for System maintenance. |
| NFR2.20 | Security Governance & Compliance | Implement physical security controls to restrict unauthorized physical access. |
| NFR2.21 | Security Governance & Compliance | Allow configuration of session timeout thresholds for inactivity, including automatic session termination after a configurable, State- and Agency-defined number of minutes. |
| NFR2.22 | Security Governance & Compliance | Comply with security policies, standards, requirements, and audits applicable to financial and banking institutions, including NACHA Operating Rules. |
| NFR2.23 | Security Governance & Compliance | Comply with laws, policies, standards and guidelines related to security from Federal and State sources. |
| NFR2.24 | Security Governance & Compliance | Comply with Social Security Administration (SSA) Government Information Exchange security policies. |
| NFR2.25 | Security Governance & Compliance | Comply with Health Insurance Portability and Accountability Act (HIPAA) and 42 Code of Federal Regulations (CFR) Part 2. |
| NFR2.26 | Security Governance & Compliance | Support secure remote access in accordance with State security policies, ensuring controlled and authorized access. |
| NFR2.27 | Security Governance & Compliance | Integrate with existing security solutions. |
| NFR2.28 | Security Governance & Compliance | Protect data against unauthorized access. |
| NFR2.29 | Security Governance & Compliance | Support acceptable cryptography standards as defined by Federal Information Processing Standards (FIPS) 140-x. |
| NFR2.30 | Security Governance & Compliance | Support Transport Layer Security (TLS) version 1.3 or higher for secure communications. |
| NFR2.31 | Security Governance & Compliance | Pass Open Worldwide Application Security Project (OWASP) Top 10 vulnerability tests. |
| NFR2.32 | Security Governance & Compliance | Provide restricted access based on security profile. |
| NFR2.33 | Security Governance & Compliance | Allow configuration of lockout and unlock policies including admin policies. |
| NFR2.34 | Security Governance & Compliance | Apply data filtering and output controls to ensure that Authorized Users can access and view only data for which they are authorized. |
| NFR2.35 | Security Governance & Compliance | Require authenticated user access for all non-public functions to ensure that only Authorized Users can perform restricted operations. |
| NFR2.36 | Security Governance & Compliance | Protect communications with Federal Information Processing Standards FIPS 140-3 crypto. |
| NFR2.37 | Security Governance & Compliance | Provide appropriate security provisions for all environments, including production and non-production. |
| NFR2.38 | Security Governance & Compliance | Implement Zero Trust security principles, ensuring verification of every user, device, and connection request regardless of network location. |
| NFR2.39 | Security Governance & Compliance | Provide a complete list of all open-source software components integrated into the System. |
| NFR2.40 | Security Governance & Compliance | Provide a copy of all data before contract termination. |
| NFR2.41 | Authorization, RBAC & Least Privilege | Support assignment of multiple roles unless segregation-of-duties (SoD) restricts. |
| NFR2.42 | Authorization, RBAC & Least Privilege | Enforce role-based controls to restrict data export privileges based on user profiles. |
| NFR2.43 | Authorization, RBAC & Least Privilege | Comply with Federal and State access control policy. |
| NFR2.44 | Authorization, RBAC & Least Privilege | Comply with Federal and State security and authorization policy. |
| NFR2.45 | Authorization, RBAC & Least Privilege | Implement the principle of least privilege so that Authorized Users and System components are granted only the minimum access necessary to perform their functions. |
| NFR2.46 | Authorization, RBAC & Least Privilege | Implement Role-Based Access Control (RBAC). |
| NFR2.47 | Authorization, RBAC & Least Privilege | Implement fine-grained access control to restrict user access at the role, function, and data level. |
| NFR2.48 | Authorization, RBAC & Least Privilege | Support geolocation-based access control to allow or restrict access based on defined geographic locations in accordance with applicable security policies. |
| NFR2.49 | Authorization, RBAC & Least Privilege | Enforce access control at the view and data element level. |
| NFR2.50 | Identity, Authentication & Account Management | Provide secure auditable password-reset workflows. |
| NFR2.51 | Identity, Authentication & Account Management | Comply with Federal and State identity and authentication policy. |
| NFR2.52 | Identity, Authentication & Account Management | Support industry-standard authentication protocols, including OAuth 2.0, OpenID Connect, and Security Assertion Markup Language (SAML). |
| NFR2.53 | Identity, Authentication & Account Management | Enforce Multi-Factor Authentication (MFA) for user access in accordance with applicable Federal and State security requirements. |
| NFR2.54 | Identity, Authentication & Account Management | Enforce Agency-defined password strength. |
| NFR2.55 | Identity, Authentication & Account Management | Support secure self-service password recovery. |
| NFR2.56 | Identity, Authentication & Account Management | Prevent the creation of duplicate user accounts. |
| NFR2.57 | Identity, Authentication & Account Management | Allow creation of temporary or emergency accounts with automatic termination. |
| NFR2.58 | Identity, Authentication & Account Management | Immediately deactivate user accounts in accordance with State-defined business requirements. |
| NFR2.59 | Monitoring, Logging & Security Issue Tracking | Allow Authorized Users to track, manage, and monitor security and privacy issues. |
| NFR2.60 | Monitoring, Logging & Security Issue Tracking | Provide automated capabilities to detect, log, and report abnormal usage patterns in accordance with applicable security policies. |
| NFR2.61 | Monitoring, Logging & Security Issue Tracking | Monitor System and network activity to detect and report intrusion attempts or unauthorized access. |
| NFR2.62 | Monitoring, Logging & Security Issue Tracking | Monitor, log, and generate alerts for high-volume data transfers in accordance with Agency-defined thresholds and security policies. |
| NFR2.63 | Monitoring, Logging & Security Issue Tracking | Show State-approved login warnings. |
| NFR2.64 | Monitoring, Logging & Security Issue Tracking | Comply with Federal and State incident response policy. |
| NFR2.65 | Monitoring, Logging & Security Issue Tracking | Comply with National Institute of Standards and Technology (NIST) 800-53 Rev5 Moderate baseline controls. |
| NFR2.66 | Monitoring, Logging & Security Issue Tracking | Mask or omit sensitive data in error logs to comply with privacy standards. |
| NFR2.67 | Monitoring, Logging & Security Issue Tracking | Integrate with the State's LoginMN and Microsoft Entra ID to provide Single Sign-On (SSO). |
| NFR2.68 | Monitoring, Logging & Security Issue Tracking | Enforce automatic account lockout after a configurable number of failed login attempts. |
| NFR2.69 | Monitoring, Logging & Security Issue Tracking | Enforce limits on concurrent user sessions and log simultaneous session activity for audit and security purposes. |
| NFR2.70 | Monitoring, Logging & Security Issue Tracking | Sanitize and destroy media per NIST Special Publication (SP) 800-88. |
| NFR2.71 | External Access, Interfaces & Integrated Tools | Allow Federal and State auditors read only access when requested to determine compliance with the associated Federal Agency policy. |
| NFR2.72 | External Access, Interfaces & Integrated Tools | Comply with all applicable Federal and State data security standards, including adherence to all data-sharing agreements required to access, view, transmit, and receive confidential data. This includes data sharing with non-State-owned systems, such as external accounting systems and shared Enterprise Document Management System (EDMS) capabilities used to cross-reference and retrieve related documentation. |
| NFR2.73 | External Access, Interfaces & Integrated Tools | Integrate with external identity management or Single Sign-On (SSO) solutions. |
| NFR2.74 | External Access, Interfaces & Integrated Tools | Support Row-Level Security (RLS) to ensure that Authorized Users, as well as integrated Artificial Intelligence (AI), Business Intelligence (BI), and reporting tools, can only query and expose data for which they are explicitly authorized. |
| NFR2.75 | External Access, Interfaces & Integrated Tools | Implement secure authentication mechanisms for all System and external interface interactions. |
| NFR2.76 | External Access, Interfaces & Integrated Tools | Implement secure storage and encryption of interface credentials and tokens. |
| NFR2.77 | External Access, Interfaces & Integrated Tools | Provide data masking for sensitive interface transactions. |
| NFR2.78 | External Access, Interfaces & Integrated Tools | Support automated encryption and decryption of interface data files using industry-standard cryptography. |
| NFR2.79 | External Access, Interfaces & Integrated Tools | Comply with privacy and security regulations for interface-based data exchanges. |
| NFR2.80 | External Access, Interfaces & Integrated Tools | Enforce security controls that prevent external, untrusted solutions from accessing trusted zones, in accordance with zero-trust and least-privilege principles. |
| NFR2.81 | Administrative & Privileged Access Controls | Allow Authorized Users with administrative permissions to configure and manage password policies and integrate with the State’s LoginMN and Microsoft Entra ID for policy enforcement. |
| NFR2.82 | Administrative & Privileged Access Controls | Allow Authorized Users with administrative permissions to log, track, and manage security and privacy issues in accordance with State and Agency requirements. |
| NFR2.83 | Administrative & Privileged Access Controls | Restrict and monitor elevated administrative access and maintain logs of privileged activities. |
| NFR2.84 | Administrative & Privileged Access Controls | Allow the Agency to maintain an administrator-configurable parameter for requiring the user to change their password. |
| NFR2.85 | Administrative & Privileged Access Controls | Enforce account locking based on administrator-configurable parameters. |
| NFR2.86 | Administrative & Privileged Access Controls | Allow Authorized Users with administrative permissions, through role-based access controls, to suspend and reactivate user accounts in accordance with applicable security policies. |
| NFR2.87 | Data Protection, Encryption & Privacy | Hash or encrypt stored passwords using Federal Information Processing Standards FIPS 140-3 validated algorithms. |
| NFR2.88 | Data Protection, Encryption & Privacy | Securely manage encryption keys, including generation, storage, rotation, and revocation. |
| NFR2.89 | Data Protection, Encryption & Privacy | Provide confidentiality labeling on reports. |
| NFR2.90 | Data Protection, Encryption & Privacy | Conform to all applicable Federal and State confidentiality laws, rules, and regulations. |
| NFR2.91 | Data Protection, Encryption & Privacy | Encrypt all data in transit using secure, industry-standard encryption protocols to protect data from unauthorized access or interception. |
| NFR2.92 | Data Protection, Encryption & Privacy | Support encryption of personally identifiable information (PII) on portable devices using Advanced Encryption Standard (AES). Encrypt all data at rest and in transit. |
| NFR2.93 | Data Protection, Encryption & Privacy | Ensure email with sensitive data is encrypted. |
| NFR2.94 | Data Protection, Encryption & Privacy | Support Internet Protocol Security (Ipsec) for secure, encrypted network communications. |
| NFR2.95 | Data Protection, Encryption & Privacy | Encrypt all personally identifiable information (PII) stored or processed within the System. |
| NFR2.96 | Data Protection, Encryption & Privacy | Store passwords only in hashed or encrypted form. |
NFR3-Audit & Compliance
| Req # | Requirement Subcategory | Requirement Description | Response Code | |
| (Y,N) | Responder Notes |
(for N responses)
| NFR3.1 | Audit Trail Capture & Retention | Maintain traceability of transactions and data exchanges across integrated systems to support audits, assessments, and investigations. |
| NFR3.2 | Audit Trail Capture & Retention | Allow Authorized Users to configure and manage audit trail functionality in compliance with applicable Agency, State, and Federal policies. |
| NFR3.3 | Audit Trail Capture & Retention | Adhere to the standards and guidelines defined in Administration for Children and Families (ACF) Technical Bulletin #7, ensuring compliance with applicable federal technical and reporting requirements. |
| NFR3.4 | Audit Trail Capture & Retention | Maintain a complete audit trail of a work item from creation through closure. |
| NFR3.5 | Migration, Rule & Configuration Auditability | Maintain an audit trail of business rule changes that is protected from modification once recorded. |
| NFR3.6 | Migration, Rule & Configuration Auditability | Provide the ability for Authorized Users to configure archive period settings and record audit information for such configurations, including the date and time of the configuration and the identity of the individual or system performing the action. |
| NFR3.7 | Migration, Rule & Configuration Auditability | Retain all State-defined business rules associated with State reports and maintain a historical record of any changes that impact claiming logic. |
| NFR3.8 | Migration, Rule & Configuration Auditability | Provide robust audit logging of administrative activities, including configuration and user management changes. |
| NFR3.9 | Migration, Rule & Configuration Auditability | Allow Authorized Users with administrative permissions to trace transactions end-to-end across multiple system interfaces, providing visibility necessary for troubleshooting, diagnostics, and root-cause analysis. |
| NFR3.10 | Migration, Rule & Configuration Auditability | Maintain complete audit logs for all data migration activities, including data transformations, source-to-target data-mapping rules between the legacy system and the new System, and any data corrections performed. |
| NFR3.11 | Record History, Versioning & Data Integrity | Maintain and make accessible a complete historical record of all original records after they have been merged, in accordance with State data retention and audit requirements. |
| NFR3.12 | Record History, Versioning & Data Integrity | Maintain data integrity for all retained records to ensure accuracy, completeness, and reliability for operational, legal, and audit purposes. |
| NFR3.13 | Record History, Versioning & Data Integrity | Allow Authorized Users to restore a prior version of a record within a State-defined recovery timeframe and log the restoration event, including the date and time of recovery and the identity of the individual or system performing the action. |
| NFR3.14 | Record History, Versioning & Data Integrity | Protect audit logs from modification or deletion and record any attempt to alter audit records. |
| NFR3.15 | Compliance, Retention & Legal Hold | Archive records and data per Federal and State record-retention policies. For the purpose of this requirement, “archive” means the secure retention of records and data in a non-production state for the duration specified by applicable Federal and State record-retention policies, while remaining accessible to Authorized Users for audit, legal hold, and retrieval purposes. |
| NFR3.16 | Compliance, Retention & Legal Hold | Maintain data integrity for records until they are purged and preserve the integrity, accuracy, and completeness of all purge audit logs and metadata after purging. For the purpose of this requirement, “Purge” means the permanent and secure deletion or destruction of records and data, after expiration of the applicable retention period, in a manner that prevents reconstruction or recovery and complies with applicable Federal and State disposal requirements. |
| NFR3.17 | Compliance, Retention & Legal Hold | Allow Authorized Users to place, manage, and release legal holds on records to prevent alteration or deletion while litigation, audits, or assessments and investigations are pending as allowable by program areas. |
| NFR3.18 | Compliance, Retention & Legal Hold | Support configurable retention schedules by record type and automatically archive or dispose of records per Federal and State policy. |
| NFR3.19 | Compliance, Retention & Legal Hold | Provide the ability to archive reporting data per applicable retention policies. |
| NFR3.20 | Compliance, Retention & Legal Hold | Provide reporting on data scheduled for purge within a defined time period. |
| NFR3.21 | Compliance, Retention & Legal Hold | Provide Authorized Users with the ability to export archived data to State-approved external media while preserving data integrity, security controls, and auditability. |
| NFR3.22 | Compliance, Retention & Legal Hold | Retain a history of audit data in accordance with applicable State data retention policies. |
| NFR3.23 | Compliance, Retention & Legal Hold | Prevent unauthorized users or entities from accessing archived data. |
| NFR3.24 | Compliance, Retention & Legal Hold | Prevent unauthorized users or entities from deleting archived data. |
| NFR3.25 | Compliance, Retention & Legal Hold | Retain a history of payment data per applicable retention policies. |
| NFR3.26 | Compliance, Retention & Legal Hold | Retain a history of overpayment data per applicable retention policies. |
| NFR3.27 | Compliance, Retention & Legal Hold | Retain a history of program-specific data per applicable retention policies. |
| NFR3.28 | Compliance, Retention & Legal Hold | Provide the ability to archive program-specific data per applicable retention policies. |
| NFR3.29 | Compliance, Retention & Legal Hold | Provide the ability to define exceptions for data that is not to be purged. |
| NFR3.30 | Compliance, Retention & Legal Hold | Support native copying of archived data to external repositories, such as Azure Data Lake Storage, using Azure Data Factory (ADF)-compatible connectors. Transmit data in open, non-proprietary formats. |
| NFR3.31 | Audit Search, Reporting & Export | Allow Authorized Users to search and filter audit trail information. |
| NFR3.32 | Audit Search, Reporting & Export | Allow Authorized Users, based on role-based security permissions, to display, export, and print audit information in standard formats, including Portable Document Format (PDF) and Comma-Separated Values (CSV). |
| NFR3.33 | User, Access & Administrative Audit Logging | Support real-time tracking and auditing of user access and privileges, including user identity, privilege level, date and time of access or change, and the individual or system performing the action. |
| NFR3.34 | User, Access & Administrative Audit Logging | Log security events in accordance with Agency, State, and Federal policies and provide reports and dashboards to display security event activity to Authorized Users. |
| NFR3.35 | User, Access & Administrative Audit Logging | Monitor, log, and report access to sensitive data in accordance with Agency, State, and Federal security and privacy policies. |
| NFR3.36 | User, Access & Administrative Audit Logging | Prevent Authorized Users from disabling core audit functionality mandated by Agency, State, or Federal policies. |
| NFR3.37 | User, Access & Administrative Audit Logging | Automatically log audit information for the currently logged-in Authorized User in accordance with Agency, State, and Federal policies. |
| NFR3.38 | User, Access & Administrative Audit Logging | Log all changes to user rights, including additions, modifications, and removals. |
| NFR3.39 | User, Access & Administrative Audit Logging | Log all failed logon attempts, including the user identifier, date and time, and source of the attempt. |
| NFR3.40 | User, Access & Administrative Audit Logging | Log all user account additions, modifications, and removals, including the user ID affected, date and time of the event, and the identity of the individual or system performing the action. |
| NFR3.41 | User, Access & Administrative Audit Logging | Maintain error logs with timestamps, user IDs, transaction details, and context. |
NFR4-Backup & Recovery
| Req # | Requirement Subcategory | Requirement Description | Response Code | |
| (Y,N) | Responder Notes |
(for N responses)
| NFR4.1 | Data Export & Portability | Provide full and incremental data backup and recovery capabilities and allow the State to export backup data in open, machine-readable formats without requiring vendor intervention or proprietary restoration software. |
| NFR4.2 | Recovery, Restoration & Continuity | Ensure that State-designated critical Comprehensive Child Welfare Information System (CCWIS) functions, such as core case management, Title IV-E eligibility and claiming, federally required reporting, security and audit logging, and required data exchanges, can operate independently of non-critical System functions. |
| NFR4.3 | Recovery, Restoration & Continuity | Design, implement, and operate infrastructure that supports backup execution, retention, recovery, and administrative management. |
| NFR4.4 | Recovery, Restoration & Continuity | Provide disaster recovery capabilities that follow an Agency-approved disaster recovery plan. |
| NFR4.5 | Recovery, Restoration & Continuity | Provide State- and Agency-defined notifications of outages or unusual circumstances across all user interfaces, including web applications, mobile applications, administrative and support interfaces, user portals, and any other current or future user-accessible interfaces provided by the System. |
| NFR4.6 | Recovery, Restoration & Continuity | Support selective backup and recovery to enable targeted restoration of System components or data with minimal impact to other System operations. |
| NFR4.7 | Recovery, Restoration & Continuity | Support automatic offsite backup and recovery. |
| NFR4.8 | Recovery, Restoration & Continuity | Provide recovery procedures for all backups including steps, roles, responsibilities, tools, and validation methods necessary to restore backed-up data in the event of data loss, corruption, or System failure. |
| NFR4.9 | Recovery, Restoration & Continuity | Support back up and restore application functional data groups from production to non-production environments. |
| NFR4.10 | Recovery, Restoration & Continuity | Support initiation of data restoration within one hour for any restoration initiated from an onsite backup. |
| NFR4.11 | Recovery, Restoration & Continuity | Restore and maintain data integrity without data loss, regardless of whether Authorized Users were online or offline at the time of backup. |
| NFR4.12 | Recovery, Restoration & Continuity | Provide backup and recovery capabilities that adhere to Federal and State service-level requirements. |
| NFR4.13 | Recovery, Restoration & Continuity | Design, implement, and operate backup and recovery processes that restore data and System functionality within State-defined recovery objectives. |
| NFR4.14 | Recovery, Restoration & Continuity | Support disaster recovery procedures defined by Federal and State authorities and meet the Minnesota IT Services (MNIT) security, continuity, and disaster recovery policies, standards, and operational expectations. |
| NFR4.15 | Recovery, Restoration & Continuity | Provide secure remote administrative access to disaster recovery plans and procedures. |
| NFR4.16 | Recovery, Restoration & Continuity | Provide autosave and restoration mechanisms to prevent loss of in-process data entry in the event of application errors or System failures. |
| NFR4.17 | Backup Storage, Segregation & Protection | Provide secure offsite storage for media devices containing the State's data and include the option to route automated full and incremental backups directly into the State's Azure Data Lake Storage (ADLS) tenant. |
| NFR4.18 | Backup Storage, Segregation & Protection | Logically segregate each State backup in accordance with State-defined backup policies. |
| NFR4.19 | Backup Storage, Segregation & Protection | Support all backed-up data to be encrypted using industry-standard encryption methods, ensuring protection of data at rest and in transit. |
| NFR4.20 | Backup Storage, Segregation & Protection | Protect backup data from alteration or deletion through secure, immutable storage mechanisms. |
| NFR4.21 | Backup Strategy & Scheduling | Securely back up interface transaction data to protect against loss, corruption, or unauthorized modification. |
| NFR4.22 | Backup Strategy & Scheduling | Schedule and perform data backups using automated tools. |
| NFR4.23 | Backup Strategy & Scheduling | Provide the capability to throttle or regulate backup operations to prevent excessive network bandwidth usage. |
| NFR4.24 | Testing, Validation & Compliance | Validate backup restoration on a State-defined recurring cadence by restoring representative data, configurations, and System components in a non-production environment. |
| NFR4.25 | Testing, Validation & Compliance | Document restore test results, exceptions, and corrective actions, and provide them to the State upon request. |
| NFR4.26 | Testing, Validation & Compliance | Support testing the Agency-approved disaster recovery plan without disrupting business functions. |
NFR5-Solution Architecture
| Req # | Requirement Subcategory | Requirement Description | Response Code | |
| (Y,N) | Responder Notes |
(for N responses)
| NFR5.1 | Modularity, Configurability & Maintainability | Allow staff to create, modify, enable, and disable rules without vendor intervention. |
| NFR5.2 | Modularity, Configurability & Maintainability | Validate bulk transactions prior to processing and allow all or part of the transaction to abort if validation fails, in accordance with State-defined business rules. |
| NFR5.3 | Modularity, Configurability & Maintainability | Support configuration management tools to enable version control, automated deployment, and environment consistency. |
| NFR5.4 | Modularity, Configurability & Maintainability | Provide the ability to configure a bulk transaction to abort and restore state on error. |
| NFR5.5 | Modularity, Configurability & Maintainability | Define and enforce configurable State-defined business rules to verify compliance with applicable State and federal policies. |
| NFR5.6 | Modularity, Configurability & Maintainability | Define exception handling during business rule execution. |
| NFR5.7 | Modularity, Configurability & Maintainability | Allow Authorized Users to enable and disable individual State-defined business rules at configurable hierarchy levels (e.g., State, Agency, Program, Module, or User) to support flexible rule governance. |
| NFR5.8 | Modularity, Configurability & Maintainability | Maintain and execute State-defined business rules at defined hierarchy levels, including but not limited to State, Agency, Program, Module, and User levels. |
| NFR5.9 | Modularity, Configurability & Maintainability | Support time-based rule parameters, allowing business rules to be defined, scheduled, activated, or expired based on specific dates, times, or time intervals. |
| NFR5.10 | Modularity, Configurability & Maintainability | Utilize configurable rule parameters, allowing administrators to modify business logic, thresholds, and operational rules without requiring code changes. |
| NFR5.11 | Modularity, Configurability & Maintainability | Support a modular design for its components, enabling individual modules to be developed, deployed, updated, and maintained independently. |
| NFR5.12 | Modularity, Configurability & Maintainability | Ensure that all interactions between internal System components use open-standard protocols to promote interoperability, maintainability, and vendor neutrality. |
| NFR5.13 | Modularity, Configurability & Maintainability | Ensure all System components comply with established industry standards and protocols to support interoperability, security, and long-term maintainability. |
| NFR5.14 | Modularity, Configurability & Maintainability | Standardize on a common, well-defined platform or technology stack to promote security, consistency, maintainability, and efficient operations. |
| NFR5.15 | Modularity, Configurability & Maintainability | Apply object-oriented principles and modern design patterns to promote modularity, reuse, and ease of maintenance. |
| NFR5.16 | Modularity, Configurability & Maintainability | Provide configurable support for bulk transactions to automatically abort and restore the prior System state when an error occurs. |
| NFR5.17 | Modularity, Configurability & Maintainability | Provide guidance and navigation to the appropriate source when corrective action is required by State-defined business rules. |
| NFR5.18 | Architecture Standards & Technology Stack | Maintain System environment documentation in source control and hosted at a State-managed site to ensure State ownership, access, and governance. |
| NFR5.19 | Architecture Standards & Technology Stack | Allow asynchronous validation, enabling validation processes to run independently of user interactions or real-time workflows. |
| NFR5.20 | Architecture Standards & Technology Stack | Support a maintenance mode that temporarily blocks Authorized User access during System updates, patches, or administrative tasks and notify Authorized Users before and during maintenance periods. |
| NFR5.21 | Architecture Standards & Technology Stack | Support initiation of background processes and transactions. |
| NFR5.22 | Architecture Standards & Technology Stack | Remain flexible and adaptable to evolving technologies, industry standards, and regulatory requirements, ensuring that updates can be incorporated with minimal disruption. |
| NFR5.23 | Architecture Standards & Technology Stack | Design, implement, and operate the System in compliance with all applicable State and Federal technical standards. |
| NFR5.24 | Architecture Standards & Technology Stack | Allow for plug-in components that can be added, removed, or replaced without requiring major changes to the System. |
| NFR5.25 | Architecture Standards & Technology Stack | Function consistently across operating systems and device types, ensuring a fully platform-agnostic experience. |
| NFR5.26 | Architecture Standards & Technology Stack | Comply with applicable State and Federal Enterprise Architecture (EA) standards, Agency EA standards, and reference architectures. |
| NFR5.27 | Architecture Standards & Technology Stack | Provide a fully web-based System accessible through a standard web browser without requiring thick-client software installation. |
| NFR5.28 | Architecture Standards & Technology Stack | Support deployment portability to allow the System to be deployed consistently across multiple environments or hosting platforms. |
| NFR5.29 | Architecture Standards & Technology Stack | Adhere to all applicable State technical and security standards, policies, and guidelines, regardless of whether the System is hosted within State infrastructure or in a vendor-hosted cloud environment. |
| NFR5.30 | Architecture Standards & Technology Stack | Support regular updates of underlying technologies without disrupting operations. |
| NFR5.31 | Integration Architecture & Interoperability | Support the use and integration of issue tracking tools to log, track, and manage System issues. |
| NFR5.32 | Integration Architecture & Interoperability | Ensure loosely coupled internal interfaces to support modularity, scalability, independent deployment, and long-term maintainability across System components, and support seamless integration with the State's target Hub-and-Spoke Data Lakehouse architecture. |
| NFR5.33 | Integration Architecture & Interoperability | Support standardized, interoperable data exchange with external systems using approved formats and protocols. |
| NFR5.34 | Integration Architecture & Interoperability | Support configurable, user-defined mappings to standard file formats for transaction file generation and exchange. |
| NFR5.35 | Integration Architecture & Interoperability | Support Continuous Integration and Continuous Deployment (CI/CD) pipelines. |
| NFR5.36 | Integration Architecture & Interoperability | Follow widely accepted technical standards (e.g., RESTful Application Programming Interface (API) conventions, standardized data formats, security protocols) to support interoperability and long-term maintainability. |
| NFR5.37 | Performance, Scalability & Availability | Define State-approved response-time thresholds for common Authorized User actions, including page loads, searches, saves, submissions, and workflow navigation, under normal and peak operating conditions. |
| NFR5.38 | Performance, Scalability & Availability | Measure and report response-time performance against those thresholds using State-defined test scenarios and production monitoring data. |
| NFR5.39 | Performance, Scalability & Availability | Provide availability 24 hours per day, seven days per week, except during approved and scheduled maintenance periods. |
| NFR5.40 | Performance, Scalability & Availability | Provide scale capacity to meet projected growth, ensuring that System performance, availability, and responsiveness remain consistent as data volumes, user counts, and transaction loads increase. |
| NFR5.41 | Performance, Scalability & Availability | Support auto scaling to accommodate fluctuating workloads without degradation of performance, availability, or responsiveness. |
| NFR5.42 | Performance, Scalability & Availability | Support horizontal scaling by enabling additional computing resources or instances to be added seamlessly to meet increased demand and maintain consistent performance. |
| NFR5.43 | Performance, Scalability & Availability | Ensure that all batch processes are completed within acceptable and predefined time frames. |
| NFR5.44 | Performance, Scalability & Availability | Support load-balancing and failover for high availability. |
| NFR5.45 | Performance, Scalability & Availability | Apply capacity planning practices to evaluate resource consumption trends and support timely infrastructure and service scaling. |
| NFR5.46 | Performance, Scalability & Availability | Minimize latency and optimize performance in distributed environments to support efficient communication and workload distribution. |
| NFR5.47 | Performance, Scalability & Availability | Provide adequate bandwidth to support System performance and availability needs. |
| NFR5.48 | Performance, Scalability & Availability | Support elastic scaling of computing resources to accommodate changes in usage demands. |
| NFR5.49 | Vulnerability, Isolation & Operational Resilience | Monitor processing failures, infrastructure issues, and service degradation affecting System operations and generate alerts when those conditions occur. |
| NFR5.50 | Vulnerability, Isolation & Operational Resilience | Allow emergency shutdown and isolation for critical vulnerabilities in accordance with State-defined security policies. |
| NFR5.51 | Data Architecture, Synchronization & Consistency | Meet all applicable Federal data validation rules and standards for Comprehensive Child Welfare Information System (CCWIS) and associated Federal reporting programs, including Adoption and Foster Care Analysis and Reporting System (AFCARS), National Child Abuse and Neglect Data System (NCANDS), Title IV-E, and Child and Family Services Reviews (CFSR). |
| NFR5.52 | Data Architecture, Synchronization & Consistency | Publish transformed and curated CCWIS data in a State-defined structure to support reporting and analytics. |
| NFR5.53 | Data Architecture, Synchronization & Consistency | Provide real-time validation to immediately verify user inputs, data entries, and transactions, preventing errors before they are submitted or processed. |
| NFR5.54 | Data Architecture, Synchronization & Consistency | Prevent automatic defaulting of data values unless explicitly defined by approved State-defined business rules. |
| NFR5.55 | Data Architecture, Synchronization & Consistency | Ensure uniform and consistent data collection across all System components. |
| NFR5.56 | Data Architecture, Synchronization & Consistency | Support automated validation of data against authorized external systems to ensure accuracy, consistency, and authenticity. |
| NFR5.57 | Data Architecture, Synchronization & Consistency | Allow data deletion, retrieval, and update within acceptable timeframe. |
| NFR5.58 | Data Architecture, Synchronization & Consistency | Publish raw CCWIS data in a State-defined format to support downstream ingestion, auditability, and traceability. |
| NFR5.59 | Data Architecture, Synchronization & Consistency | Ensure that any data update made in one module is automatically and immediately reflected across all dependent and integrated modules without requiring manual intervention. |
| NFR5.60 | User-Entered Language, Characters & Localization Support | Support foreign addresses, including support for international address formats, country-specific postal structures, non-U.S. character sets, and varying address line lengths. |
| NFR5.61 | User-Entered Language, Characters & Localization Support | Store, display, and preserve Authorized User-entered language, characters, and special symbols to support a consistent and accurate Authorized User experience. |
NFR6-Solution Monitoring
| Req # | Requirement Subcategory | Requirement Description | Response Code | |
| (Y,N) | Responder Notes |
(for N responses)
| NFR6.1 | Monitoring Reports, Dashboards & Auditability | Capture, categorize, and report data-related errors separately from System errors. |
| NFR6.2 | Monitoring Reports, Dashboards & Auditability | Capture, log, and report all System-level exceptions and errors. |
| NFR6.3 | Monitoring Reports, Dashboards & Auditability | Monitor and log System errors, including application errors, interface and integration failures, data connectivity and processing errors, infrastructure and platform faults, and security-related errors, and automatically notify designated State administrators via dashboards, email, or other State-approved notification mechanisms when error volumes or rates exceed State-defined thresholds. |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .