Attachment+4+-+Enterprise+Specs.pdf

ATTACHMENT 4

ENTERPRISE SPECIFICATIONS

Offeror shall provide answers to each question.

Offerors must provide a full response to each item number without cross referencing other sections of the proposal. Offerors must use the table format and maintain numbering provided by the STATE to respond to each item number. Attachments, documents, or samples must be clearly referenced where in the response they can be found in the applicable item number.

A. Enterprise IT Standards

The solution will only authenticate state users by integrating with the STATE's Azure Active Directory and/or Active Directory. A state user is any state official, state employee or other person authorized to act on behalf of the state.

Offeror must describe how the proposed solution will comply with the STATE's State Entity Authentication standard.

Offeror Response:

The solution will only authenticate external users by integrating with the STATE’s Azure B2C federated identity provider service via OpenID Connect.

An external user is any non-state user entity, including but not limited to citizens, private businesses, non-profit organizations, etc.

Offeror must describe how the proposed solution will comply with the STATE's Public Authentication standard.

Offeror Response:

All publicly accessible services provided by the solution will be served under the STATE's nd.gov domain name.

Offeror must describe how the proposed solution will comply with the STATE's Domain Name standard.

Offeror Response:

B. Architecture

Offeror must describe in detail the architecture of the proposed solution and supporting infrastructure.

a. Include the technology stack, including the software products used to create the solution

b. Include the network architecture, including security levels, connectivity points, and capacity

c. Include the storage architecture, including security controls (i.e.

encryption)

d. Include related architectural diagrams

Offeror Response:

a.

b.

c.

d.

Offeror must describe the solution’s integration points with other applications or datasets, and other external dependencies.

Offeror Response:

Offeror must describe the solution’s ability to provide high availability.

Offeror Response:

Offeror must describe the solution’s ability to be enhanced to implement changing business and technical requirements.

Offeror Response:

Offeror must describe the solution’s ability or limitations for migrating solution elsewhere in the future with regard to either party terminating services.

Offeror Response:

C. Data

Any DATA provided by the STATE must be accessible to the STATE at any time.

Offeror must describe how the proposed solution ensures the STATE can access all provided data anytime (API, SQL, batch export, etc.) and detail data export options (formats, ETL, encryption, required software) for portability evaluation by the STATE.

Offeror Response:

Offeror must describe the controls used to insure data is properly classified and how sensitive/confidential data is safeguarded.

Offeror Response:

Offeror must describe the practices and procedures used to provide Electronic Discovery of specific records or data, and any legal positions regarding subpoenas, jurisdiction and potential confiscation of data.

D. Artificial Intelligence

Offeror must indicate if the proposed solution uses Artificial Intelligence (AI) and Machine Learning (ML) technology, model, or service. If yes, answer the remaining questions in this section.

Offeror Response:

Offeror must indicate AI and/or ML model name.

Offeror Response:

Offeror must indicate model owner.

Offeror Response:

Offeror must describe in detail the purpose.

Offeror Response:

Offeror must describe in detail the intended domain.

Offeror Response:

Offeror must describe in detail the model training data.

Offeror Response:

Offeror must describe in detail the model information.

Offeror Response:

Offeror must describe in detail the inputs and outputs.

Offeror Response:

Offeror must describe in detail the performance metrics.

Offeror Response:

Offeror must describe in detail the optimal conditions.

Offeror Response:

Offeror must describe in detail the poor conditions.

23 Offeror must describe in detail the bias.

Offeror must describe in detail the test data.

Offeror Response:

E. Security

Offeror must describe if the proposed solution is FedRAMP, HITRUST, or StateRAMP authorized.

If no, are there plans to seek authorization?

SaaS solutions containing Federal Tax Information, Social Security Administration, or Criminal Justice Information must be FedRAMP authorized.

Offeror Response:

Offeror must describe the controls used to measure and meet regulatory requirements and certifications. Include any Application Scanning reports, Vulnerability Scanning reports, and Penetration Testing reports. Include schedules for recurring/updated reports.

Offeror Response:

Offeror must describe the controls used to manage operational logs for troubleshooting and regulatory compliance.

Offeror Response:

Offeror must describe the controls used to ensure that privileged users cannot perform unauthorized or unlawful activities.

Offeror Response:

Offeror must describe in detail the ability to configure and implement a session timeout due to inactivity.

Offeror Response:

Offeror must describe in detail the proposed solution's privacy and consent controls.

F. Non-State Hosted Solutions. State law, N.D.C.C. § 54-59-22 requires ITD or an ITD approved vendor host all information technology systems unless a hosting exemption is granted. If the hosting exemption is not approved, the STATE will reject the proposal as being not responsive to this hosting approval requirement.

Offeror must describe in detail :

a. The hosting location

b. If the hosting locations distributed geographically

c. If hosted by a third party list the name of hosting party Offeror Response:

a.

b.

c.

Offeror must describe the data center operational controls and policies, and provide any relevant audit reports, including Statement on Standards for Attestation Engagements (SSAE) Service Organization Control (SOC) 2 Type II audit or equivalent such as ISO 27001 for the primary vendor and any 3rd party providers/partners. Include any options for the STATE to access the vendor datacenter(s). Include any “Right to Audit” clauses available to the

STATE.

Offeror Response:

Offeror must describe the backup procedures, including off-site storage, encryption, and the frequency of restore testing.

Offeror Response:

Offeror must describe the practices and procedures used to manage/monitor data retention schedules and the purging or archival of data when retention schedules are met.

Offeror Response:

Offeror must describe any options for the STATE to run application security scanning software against the hosted solution.

Offeror Response:

Offeror must describe the controls, tools, and procedures in place to handle natural disasters and maintain business continuity. Include the Recovery Point Objective (RPO) and Recovery Time Objective (RTO).