Attachment+A+-+Enterprise+Specifications.docx
DOCX document 35 KB Posted
- Attached to
- Hematology Analyzer
- Solicitation number
- 325-24-900-041
- Issued by
- Stutsman County, North Dakota
About this file
This document is an Attachment A - Enterprise Specifications for a state and local contract opportunity. The proposed solution must authenticate state users through the state's Azure Active Directory or Active Directory, and external users through the state's Azure B2C federated identity provider service. All publicly accessible services must be served under the state's nd.gov domain. The solution must comply with the state's enterprise IT standards and describe the architecture, data management, artificial intelligence, and security controls. For non-state hosted solutions, the offeror must provide details on hosting locations, operational controls, backup procedures, and business continuity measures.
The related state and local contract opportunity is for a new benchtop hematology analyzer with a closed mode sampler and 6-part automated differential for the North Dakota State Hospital. The contract requires the offeror to provide details on the solution's technical capabilities and compliance with the state's enterprise standards.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| IFB+325-24-900-041+(Final).docx | DOCX document | |
| Section+5+REVISED+Bid+Response+Form.docx | DOCX document | |
| Attachment+B+-+Saas+Service+Level+Agreement.docx | DOCX document | |
| Solicitation+Amendment+1.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ATTACHMENT A
ENTERPRISE SPECIFICATIONS
Offerors shall provide answers to each question.
Offerors must provide a full response to each item number without cross referencing other sections of the proposal. Offerors must use the table format and maintain numbering provided by the STATE to respond to each item number. Attachments, documents, or samples must be clearly referenced where in the response they can be found in the applicable item number.
A. Enterprise IT Standards
| 1 |
| The solution will only authenticate state users by integrating with the STATE's Azure Active Directory and/or Active Directory. A state user is any state official, state employee or other person authorized to act on behalf of the state. |
Offeror must describe how the proposed solution will comply with the STATE's State Entity Authentication standard.
Offeror Response:
| 2 |
| The solution will only authenticate external users by integrating with the STATE’s Azure B2C federated identity provider service via OpenID Connect. An external user is any non-state user entity, including but not limited to citizens, private businesses, non-profit organizations, etc. |
Offeror must describe how the proposed solution will comply with the STATE's Public Authentication standard.
Offeror Response:
| 3 |
| All publicly accessible services provided by the solution will be served under the STATE's nd.gov domain name. |
Offeror must describe how the proposed solution will comply with the STATE's Domain Name standard.
Offeror Response:
| 4 |
| Offeror must describe in detail if the proposed solution will utilize or provide conflicting capabilities with any of the following business capabilities and standardized solutions listed in section 3.4 Enterprise Capabilities. |
Offeror Response:
B. Architecture
| 5 |
| Offeror must describe in detail the architecture of the proposed solution and supporting infrastructure. |
a. Include the technology stack, including the software products used to create the solution
b. Include the network architecture, including security levels, connectivity points, and capacity
c. Include the storage architecture, including security controls (i.e. encryption)
d. Include related architectural diagrams
Offeror Response:
a.
b.
c.
d.
| 6 |
| Offeror must describe the solution’s integration points with other applications or datasets, and other external dependencies. |
Offeror Response:
| 7 |
| Offeror must describe the solution’s ability to provide high availability. |
Offeror Response:
| 8 |
| Offeror must describe the solution’s ability to be enhanced to implement changing business and technical requirements. |
Offeror Response:
| 9 |
| Offeror must describe the solution’s ability or limitations for migrating solution elsewhere in the future with regard to either party terminating services. |
Offeror Response:
C. Data
| 10 |
| Any DATA provided by the STATE must be accessible to the STATE at any time. |
Offeror must describe how the proposed solution ensures the STATE can access all provided data anytime (API, SQL, batch export, etc.) and detail data export options (formats, ETL, encryption, required software) for portability evaluation by the STATE.
Offeror Response:
| 11 |
| Offeror must describe the controls used to insure data is properly classified and how sensitive/confidential data is safeguarded. |
Offeror Response:
| 12 |
| Offeror must describe the practices and procedures used to provide Electronic Discovery of specific records or data, and any legal positions regarding subpoenas, jurisdiction and potential confiscation of data. |
Offeror Response:
D. Artificial Intelligence
| 13 |
| Offeror must indicate if the proposed soltution uses GenAI technology, model, or service. If yes, answer the remaining questions in this section. |
Offeror Response:
| 13.1 |
| Offeror must indicate GenAI model name. |
Offeror Response:
| 13.2 |
| Offeror must indicate model owner. |
Offeror Response:
| 13.3 |
| Offeror must describe in detail the purpose. |
Offeror Response:
| 13.4 |
| Offeror must describe in detail the intended domain. |
Offeror Response:
| 13.5 |
| Offeror must describe in detail the model training data. |
Offeror Response:
| 13.6 |
| Offeror must describe in detail the model information. |
Offeror Response:
| 13.7 |
| Offeror must describe in detail the inputs and outputs. |
Offeror Response:
| 13.8 |
| Offeror must describe in detail the performance metrics. |
Offeror Response:
| 13.9 |
| Offeror must describe in detail the optimal conditions. |
Offeror Response:
| 13.10 |
| Offeror must describe in detail the poor conditions. |
Offeror Response:
| 13.11 |
| Offeror must describe in detail the bias. |
Offeror Response:
| 13.12 |
| Offeror must describe in detail the test data. |
Offeror Response:
E. Security
| 14 |
| Offeror must describe if the proposed solution is FedRAMP, HITRUST, or StateRAMP authorized. |
If no, are there plans to seek authorization?
SaaS solutions containing Federal Tax Information, Social Security Administration, or Criminal Justice Information must be FedRAMP authorized.
Offeror Response:
| 15 |
| Offeror must describe the controls used to measure and meet regulatory requirements and certifications. Include any Application Scanning reports, Vulnerability Scanning reports, and Penetration Testing reports. Include schedules for recurring/updated reports. |
Offeror Response:
| 16 |
| Offeror must describe the controls used to manage operational logs for troubleshooting and regulatory compliance. |
Offeror Response:
| 17 |
| Offeror must describe the controls used to ensure that privileged users cannot perform unauthorized or unlawful activities. |
Offeror Response:
| 18 |
| Offeror must describe in detail the ability to configure and implement a session timeout due to inactivity. |
Offeror Response:
| 19 |
| Offeror must describe in detail the proposed solution's privacy and consent controls. |
Offeror Response:
F. Non-State Hosted Solutions
| 20 |
| Offeror must describe in detail : |
a. The hosting location
b. If the hosting locations distributed geographically
c. If hosted by a third party list the name of hosting party
Offeror Response:
a.
b.
c.
| 21 |
| Offeror must describe the data center operational controls and policies, and provide any relevant audit reports, including Statement on Standards for Attestation Engagements (SSAE) Service Organization Control (SOC) 2 Type II audit or equivalent, such as ISO 27001 for the primary vendor and any third party providers/partners. Include any options for the STATE to access the vendor datacenter(s). Include any “Right to Audit” clauses available to the STATE. |
Offeror Response:
| 22 |
| Offeror must describe the backup procedures, including off-site storage, encryption, and the frequency of restore testing. |
Offeror Response:
| 23 |
| Offeror must describe the practices and procedures used to manage/monitor data retention schedules and the purging or archival of data when retention schedules are met. |
Offeror Response:
| 24 |
| Offeror must describe any options for the STATE to run application security scanning software against the hosted solution. |
Offeror Response:
| 25 |
| Offeror must describe the controls, tools, and procedures in place to handle natural disasters and maintain business continuity. Include the Recovery Point Objective (RPO) and Recovery Time Objective (RTO). |
Offeror Response:
File details come from the government source that posted it. Updated .