Business and Technical Response Requirements Chart~2.xlsx
XLSX spreadsheet 69 KB Posted
- Attached to
- DMH ITS86 - Request for Quotation (RFQ) For Interpreter Services Scheduling Software as a Service
- Solicitation number
- BD-27-1022-DMH08-8210C-133851
- Issued by
- Worcester County, Massachusetts
About this file
This document is a Business and Technical Response Requirements Chart for a Request for Quotation (RFQ) issued by the Massachusetts Department of Mental Health (DMH) under the Statewide Contract ITS86 for Interpreter Services Scheduling Software as a Service (SaaS). The RFQ solicits a comprehensive cloud-based scheduling solution to manage interpreter appointment requests, vendor coordination, and related administrative functions for DMH staff and external interpreter vendors. The solution must be a commercial off-the-shelf (COTS) SaaS product hosted on servers located in the United States, with all protected health information (PHI) stored domestically. Bidders are required to demonstrate prior implementation experience with similar scheduling solutions within the past two years and must provide three customer references with go-live dates, user counts, and contact information. The RFQ establishes mandatory minimum requirements including vendor authorization from the original software publisher, ITS86 reseller certification or software publisher status, and willingness to execute a Statement of Work (SOW) with DMH upon contract award. Selected bidders must commence project activities within ten days of contract execution and complete the SOW within three weeks of the award announcement.
The requirements chart establishes detailed functional, technical, non-functional, and implementation specifications across multiple categories. Functional requirements encompass user access controls, alerts and notifications, backup and recovery capabilities, business process workflows, reporting and analytics, and financial tracking functionality. Technical requirements mandate HIPAA compliance, encryption of data in transit and at rest, secure authentication through OpenID Connect, Centrify SAML, or OAuth, 24/7 system availability with 99.9% uptime, support for unlimited concurrent users and records, and integration capabilities through REST/SOAP APIs and standard web services. The solution must operate on Windows 10 64-bit systems and all major browsers while supporting mobile device access. Implementation requirements include a phased pilot launch approach, comprehensive testing across unit, integration, accessibility, system, performance, and user acceptance phases, on-site training workshops, and detailed technical documentation. The bidder must provide audited financial statements demonstrating financial stability, key project personnel resumes, and project management using an Agile delivery methodology. Support obligations include 24/7 help desk availability, defined service level agreements with response times ranging from fifteen minutes for high-impact issues to four hours for resolution, and ongoing maintenance with scheduled downtime only during non-business hours with advance written approval.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Vendor Instructions
| Instructions for Completion of the Requirements Traceability Matrix |
| Bidders shall evaluate their ability to support specified requirements using the following criteria. |
| In the "Bidder Response" column input one of the following ratings: |
| 2 - Bidder Fully Supports |
| 1 - Bidder Partially Supports |
| 0 - Bidder Does Not Support |
| Additional notes to the vendor: |
| 1. When providing responses, this guide should be followed. |
| 2. Respondents should not reorder, resort or renumber the spreadsheet format in any way |
| 3. Columns expected to be used for respondent's responses are marked in yellow background; Where a scoring cell is blacked out, descriptive information about how the bidder will fulfill the requirement is to be provided. |
| 4. The column titled "Bidder Comment" is where the Bidder should include a description of how the it meets the requirement why it is differentiate . Links to documentation and screenshots to demonstrate the capability may be included for additional clarification when necessary. Where a bidder Fully Supports Requirement ( bidder scores a response 2), no additional descriptive information is necessary, unless the requirement statement explicitly indicates the bidder should provide additional description. If a bidder scores a response 1, use this space to explain how the SAAS solution can be configured or customized to meet the requirement. If a bidder scores a response 0, the section explain how, if at all the SAAS solution will in the future met the requirement. |
| 5. An omitted response will be assumed to be the same as a response code of “0 - Bidder Does Not Support”. |
| 6. Any deviation from the response codes will be re-coded at the discretion of DMH. |
| 5. An omitted response will be assumed to be the same as a response code of “0 - Bidder Does Not Support”. |
| 6. Any deviation from the response codes will be re-coded at the discretion of DMH. |
| 7.All documents that are asked for should be submitted as attachments and labeled with the Folder and Item number to which it is responsive. |
| 7 |
Minimum Mandatory
| Req Number | Description | Bidder Response | Bidder's Comments |
| 1 | Software Provider must be the original publisher or authorized by the publisher to provide all software, customizations, labor, materials, training, training manuals, training supplies, technical support and warranties. | ||
| If applicable, attach documentation from the original publisher acknowledging authorization. | |||
| 4 | Solution must be a COTS SaaS solution | ||
| 5 | Cloud Server -- all PHI must be stored in the United States | ||
| 6 | Bidder must be a ITS86 Reseller or Software Publisher with Reseller Certificate. Attach certificate if relevant. | ||
| 7 | Reseller and Software Provider agree to entering into a SOW agreement with DMH if award the contract under this RFQ. | ||
| 8 | Bidder must have implemented the software solution, or have experience implementing a similar scheduling solution, in the past two years. Bidders must provide in the Bidder's Comment space an overview of this experience. | ||
| 9 | Provide three examples in which the proposed solution has been deployed by the bidder for a customer similar to DMH. At a minimum, each example must include the go-live date for each customer, and approximate count of internal and external users of the system and overview of the solution provided. | ||
| 10 | For each of the examples listed in 9, provide, for reference purposes, the name and contact information for an individual employed by the entity where the software was deployed. | ||
| 11 | Describe experience working with the a state agency, a large health care organization or other HIPAA Covered entity |
&F &A
Functional Requirements
| Requirements | ||||
| Number | Requirements Section | Requirement Description | Bidder Response | Bidder Comment |
| 1 | Access | Ability for the solution to have different levels of access: | ||
| 1. Information Security access | ||||
| 2. DMH/DMH Interpreter Vendor Access | ||||
| a. Upload documents | ||||
| b. Add/Edit/Remove Documents | ||||
| 2 | Access | Deliver an intuitive, approachable and consumer-like service experience for all users across the system. Provide and explanation in Bidder's Comment. | ||
| 3 | Access | Allow for the following types of users: (1) DMH staff who need to request appointments and check on status of appointments; (2) Super Users OREI staff who establish and modify user permissions, refer appointment request to vendors; check on scheduling status of appointments, and preform reporting and other administrative functions; and (3) External Users: Vendors that accept or deny appointment requests and can only access the appointments that are referred to them by OREI. | ||
| 4 | Access | Ability to configure and restrict access to appointments (all of which will contain PHI) by user role and DMH Location. | ||
| 5 | Access | Ability for OREI to control which menus screens and functions within screens and data are available in read only or edit capacities based on role. | ||
| 6 | Access | Ability for the solution to allow DMH user to create unique passwords for accessing the system | ||
| 7 | Alerts | Ability for the solution to notify users their password should be changed at certain time intervals | ||
| 8 | Alerts | Ability for the solution to send automated, regular reminders to DMH interpreter vendors to add and update questionnaires and vendor profiles and to respond to appointment requests. | ||
| 9 | Backup | Ability for the solution to provide notification of DMH and DMH interpreter vendors of potential security breaches | ||
| 10 | Branding | Ability for the solution to backup and archive data, with the capability to retrieve and restore that data | ||
| 11 | Business Process | Ability for the solution to provide branding for logos | ||
| 12 | Business Process | Solution needs to support business process as described in the RFQ: need to have built-in-workflows and templates specifically for scheduling appointments. OREI must have ability to adapt workforce as needed to support business rules and procedure. Provide an overview how this is met in the Bidder Comment section. | ||
| 13 | Business Process | Ability for OREI to easily add to and otherwise modify data points that frequently change, including, but not limited to, languages, locations, vendors, and contact information. | ||
| 14 | Business Process | Scheduling form/data must have selection boxes or drop down menus whenever applicable. OREI must have the ability to customize data collection fields and visual layout. | ||
| 15 | Business Process | Includes a date picker calendar or similar functionality | ||
| 16 | Business Process | Have automatic checks to catch scheduling conflicts before an request for interpreter can be entered. | ||
| 17 | Business Process | Allows for data validation checks for data entry fields. | ||
| 18 | Business Process | Allow for DMH interpreter vendors to log-in and accept or decline appointments and to log-in and confirm appointment by providing the name of the interpreter who will attend the appointment. | ||
| 19 | Business Process | Provide DMH staff and OREI staff to submit changes to previously requested appointments and for all scheduling changes to be sent to appropriate vendor for confirmation. | ||
| 20 | Business Process | Ability to "clone" or "duplicate" existing appointments to create new requests as well as ability to schedule reoccurring appointments. | ||
| 21 | Business Process | Allow OREI and/or DMH staff to access each request or schedule appointment to record additional information such as interpreter late and interpreter no-show. | ||
| 22 | Communications | Create an audit trail showing all activity for each request for interpreter services including which user submitted, changed, cancelled, and confirmed the appointment. | ||
| 23 | Communications | Automatic notices: • | Automatically informs DMH staff after they submit an appointment request that their request is received. | |
| • | Automatically sends an email to DMH staff to inform them when their appointment is confirmed or when there is no interpreter availability. DMH staff who choose not to receive these notifications may disable these automated emails for their requests. | |||
| • | Automatically notify vendors when OREI refers an appointment to them. | |||
| • | Automatically notify vendors when one of their appointments is cancelled or modified by DMH staff or OREI staff . | |||
| Communications | Ability for the solution to provide customization of email content | |||
| 24 | Communications | Emails sent and received must be secured | ||
| 25 | Compliance | Ability for the solution to send automated reminders and notifications via email | ||
| 26 | Compliance | Ability for the solution to be ADA compliant, WCAG 2.0 AA | ||
| Ability for the solution to encrypt and protect user information, if using PII/PCI | ||||
| 27 | Compliance | https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards | ||
| Ability for the solution to comply with DMH Business Associate Agreement | ||||
| 28 | Compliance | https://www.mass.gov/handbook/enterprise-information-security-policies-and-standards | ||
| Ability for the vendor to comply with the Terms and Conditions of the contract closeout, i.e.: | ||||
| 1. Account Cleanup | ||||
| 29 | Compliance | 2. MA General Law 93I – Data Destruction | ||
| 30 | Dashboards | Ability for the solution to have out of the box dashboard functionality | ||
| 31 | Dashboards | Ability for the solution to have DMH users create/modify and customize dashboards | ||
| 32 | Dashboards | Calendar or listing must be searchable by multiple parameters including but not limited to : language, location of appointment, date, patient name, DMH staff name and appointment status. | ||
| 33 | Dashboards | Ability to export and print dashboard as PDF, word Document and Excel Spread sheet | ||
| 34 | Storage | Ability for the solution to store all the information provided to and produced by the system | ||
| 35 | Libraries | Ability for the solution to have the default language in English | ||
| 36 | Libraries | Ability for the solution to segregate vendor information into individual storage folders/libraries | ||
| 37 | Reporting | Ability for the solution to allow DMH users to generate the criteria for automated alerts to be sent to e-mail or system accounts | ||
| 37 | Reporting | Ability for the solution to have DMH users create/modify custom reports | ||
| 39 | Reporting | Ability for the solution to export into various industry outputs, i.e., PDF, XPS, Word, Excel or TXT | ||
| 40 | Reporting | Ability for the solution to provide an API for DMH to programmatically extract any stored information | ||
| 41 | Reporting | Ability for the solution to report on historical data for trend analysis | ||
| 42 | Reporting | Ability for the solution to drill down into reports for data analysis, including, but not limited to based on client name, location language, interpreter, vendor, etc. | ||
| 43 | Reporting | Ability to store reports in a fixed location in the application | ||
| 44 | Search | Ability for the solution to have a search capability for extracting any solution-generated or vendor-provided data | ||
| 45 | Solution | Ability to track financial information related to services provided (hours, hourly rates, additional costs for travel time) to allow OREI to manage budget; forecast costs and track payments made to vendors). | ||
| 46 | Solution | Allow OREI to modify hourly rates and to set minimum billable hours for each interpreter appointment. | ||
| 47 | Support | Ability for the solution to be available 24/7 | ||
| 48 | System Features | Ability for the solution to be accessed from anywhere in the United States | ||
| 49 | System Features | Ability for the solution to have import function for multiple types of industry standard documents, i.e., PDF, XPS, Word, Excel or TXT | ||
| 50 | System Features | Ability for the solution to work for all industry standard supported browsers and operating systems | ||
| 51 | System Features | Ability for software upgrades with minimal interruption of services to DMH | ||
| 52 | System Features | Ability for the solution to hold an unlimited number of records, documents, files, and other digital information | ||
| 53 | System Features | Ability for the solution provider to provide training and training materials to DMH as required in the RFQ. Provide explanation in the Bidder Comment section | ||
| System Features | Ability to track workflow matters from an administrative view from request for an appointment, the scheduling to the appoint, the appointment and the billing for services. |
&A
Page &P of &N https://www.mass.gov/handbook/enterprise-information-security-policies-and-standardshttps://www.mass.gov/handbook/enterprise-information-security-policies-and-standards Technical Requirements
| Requirements Number | Bidder Response | Bidder Comments | ||
| 1 | An affirmative statement that the Software and Bidder comply with requirement in Subsection III.D Enterprise Standards and Policies , including (1) an express agreement to the Commonwealth's Enterprise Information Security Policies and Standards; (2) agreement to the Sass Terms outlined in Attachment C; and (3) agreement and compliance with the accessibility requirements in Attachment F. Bidders must submit copies of accessibility supporting materials, for example VPATs to other testing results. | |||
| 2 | The user interface must be simple and intuitive | |||
| 3 | Capacity of simultaneously access by all authorized Users | |||
| 4 | Ability to allow for minimum of 100 users | |||
| 5 | Allow for future enhancements | |||
| 6 | Does the proposed solution support services and data access through an industry - standard REST/SOAP interface. This is a preference of DMH, please indicate in the Bidder's comment how this applies to the proposed solution | |||
| 7 | Secure login required: | |||
| • | Configurable role-based security authorization | |||
| • | Ability for information to be encrypted in transit and at rest | |||
| • | Compliance with DMH, EHS, Commonwealth of Massachusetts, and all other applicable security requirements. | |||
| 8 | Security: Current applicable state policies regarding authorization of user accounts must be followed, including authentication requirements: Application must be able to utilize one of three preferred methods for authentication: (1) | Open ID Connect ; (2) Centrify SAML Toolkits for SSO; and (3) OAUTH Clients https://developer.centrify.com/docs/oauth. | ||
| 9 | System Management: Discuss all features needed to manage, control, administer, maintain and support the system (i. e. automated deploys, builds, utilities, backups, operator involvement levels, performance monitoring and operational analysis). | |||
| Monitoring: | ||||
| 10 | What tools are in place to monitor the performance of the application? | |||
| 11 | Are performance metrics published via a standard API (WMI, SNMP, JMX, etc.)? | |||
| 12 | When something goes wrong, what is the process for conducting a post-mortem? | |||
| 13 | Are tools in place to capture relevant data from all tiers at the moment the error took place? | |||
| Technical Support and Maintenance: | ||||
| 14 | How often are releases generated? Minor, major, patches? | |||
| 15 | Describe the support structure at your organization including number of staff, makeup, philosophy, escalation levels and process. Include any standard service level agreements. | |||
| 16 | How do you track technical support requests, problems, resolutions, etc. and how do you facilitate communication to customers? Include any reporting sent to or available to the customer. | |||
| 17 | How is this different from what your competitors offer? | |||
| 18 | Describe your support SLA’s during business hours, off hours and during enhancement and releases. | |||
| 19 | Describe your company’s support procedures for prior releases of software. | |||
| Cloud | ||||
| 20 | Identify the cloud service provider (vendor self-hosted service vs commercial service such as AWS, Azure or other) and the structuring of the service (public cloud, private cloud, government cloud (i.e. .GOV) and tenancy (single or multi). Also indicate location of server and storage of data. | |||
| 21 | Provide a description of ongoing support/maintenance responsibilities (security patches, security oversight and monitoring, network maintenance, recovery, back-up) | |||
| 22 | Data must remain within the United States. DMH must be informed and approve any proposed changes to third-party host and hosting location. | |||
| 23 | The Cloud Solution provider (CSP) must comply with all applicable laws related to data privacy and security, including, but not limited to The DMH Business associate Agreement | |||
| 24 | CSP will provide a secure environment for DMH data, and any hardware and software, including servers, network and data components provided by the solution provider as part of its performance, to protect, prevent unauthorized access to and use modification of, the cloud solution or DMH data. | |||
| 25 | DMH may export DMH data at any time during the Term of the Contract or for up to three (3) months after the Term in agreed-upon file format and medium. | |||
| 26 | DMH data must be partition from other data in such a manner that access to it will not be impacted or forfeited due to e-discovery search and seizure or other actions taken by third parties obtaining or attempting to obtain solution provider's record information or data for reasons or activities not related to DMH's business |
&A page &P of &N
Non Functional Requirements
| Requirement Number | Requirement Section | Requirement Description | Bidder Response | Bidder Comments | |
| 1 | General Non-Functional | All hardware and software shall include monitoring capabilities to alert technical support staff of failures and errors. | |||
| 2 | Proposed solution shall support the current and future releases of supported versions of the browsers (e.g. Internet Explorer, Firefox, Chrome & Safari) by the originating vendors (e.g. Microsoft, Mozilla & Apple). The presentation tier shall not be dependent upon application, applet, or plug-in delivered to the user. | ||||
| 3 | The proposed solution shall be capable of operating on existing DMH workstations running Windows 10 64-bit or higher. | ||||
| 4 | The proposed solution shall support mobile devices. | ||||
| 5 | System should have scalability to grow in its capacity to meet the rising demand of services offered. System scalability criteria could include the ability to accommodate increasing number of users, transactions per millisecond and number of SQL statements that can run and provide results simultaneously. | ||||
| 6 | Solution should be configurable using business rule components as the primary means for specifying system behavior and widely-used static data. | ||||
| 7 | DMH requires that the solution incorporate an architectural component that supports encapsulation of business rules and promotes flexibility by separating business rules and static data from the tiers that depend on them. The use of this component must be supported across all tiers of this solution. If multiple components are proposed to support this requirement, then a single integrated view must be provided. Please describe solution architectural approach and supply technical architecture diagram (including software architecture diagrams, integration points/interfaces, network diagram) with descriptions. | ||||
| 8 | For packaged solutions, please describe all required licenses and the version update process | ||||
| 9 | Performance | The database server (or SaaS service) shall be capable of supporting concurrent connections without any impact to system performance. | |||
| 10 | The proposed solution shall be able to process an unlimited number of records at peak activity. | ||||
| 11 | The proposed solution shall enable ad-hoc reports to be generated using real-time data, without adverse impact to the system performance. DMH requires that the solution accommodate reporting and inquiry-only application components without impact or dependence on the availability of the operational/transactional database. | ||||
| 12 | The system, in production, shall be available twenty-fours (24) hours per day, seven (7) days per week, fifty-two (52) weeks per year, except during the authorized maintenance period, for a total of 99.9% availability. Test versions do not require 99.9% availability, but do require to be available during normal operating hours for development. | ||||
| 13 | Security | The Bidder, in conjunction with DMH, shall configure system rights and security roles during the design & configuration phase of the project. | |||
| 14 | DMH will be responsible for all application level end user security (Roles, Permission Lists, and User Profiles defined with Application provided functionality and role-based assignments. .) | ||||
| 15 | DMH system administrators shall be able to maintain the configure roles and access controls for all system components without bidder assistance after implementation and hand over of the system. | ||||
| 16 | The system shall identify, authorize and authenticate each user or host that has access to the system with an audit trail. | ||||
| 17 | The proposed browser based solution shall use TLS for encrypting all connections between the browser and the host environment. | ||||
| 18 | All confidential, personal and/or sensitive data, as classified by DMH, shall be encrypted both in-transit and at-rest using DMH encryption standards | ||||
| 19 | No network, system or application access to external personnel or entities shall be granted without DMH approval. | ||||
| 20 | Solution shall incorporate best practices as described by the relevant publications of ISO 27000 series ,OWASP, NIST and the SANS Institute. | ||||
| 21 | The solution must be HIPAA compliant | ||||
| 22 | Solution shall provide for and manage accounts and authorizations for all database users, all server and operating system accounts, all service accounts, and all application accounts, as required by hardware and software installed to support this solution. | ||||
| 23 | Bidder will not use default passwords created during installation and shall assign strong/complex passwords according to industry best practices | ||||
| 24 | Solution shall maintain an auditable change log of all account credential (User Id and password) and authorization changes (additions, modifications, deactivations, and deletions) for all accounts types (e.g., user, server, database, service) at the operating system and application level. | ||||
| 25 | Bidder shall ensure a seamless integration with DMH’s established identity management system, enabling hosted applications to authenticate end users without requiring additional credentials to gain access. | ||||
| 26 | Secure authentication shall be primarily performed in such hosted applications using LDAP against an identity repository located at DMH’s datacenter or using an SSO identity provider Microsoft Azure Active Directory. | ||||
| 27 | Bidder shall coordinate and modify the authentication methods in the event that the Authority implements a new Identity management system. | ||||
| 28 | Bidder will comply with the notification and reporting structures for “breach of security” and “privacy loss incident” as defined in the Business Assosciate Agreement. | ||||
| 30 | DR / HA | For SaaS offerings the Bidder is required to maintain operations in the event that the Primary Data Center becomes unavailable. Data Center shall provide Disaster Recovery capabilities to fail over and fall back to a second Data Center. The Bidder shall submit and describe Disaster Recovery and Business Continuity operational plans. | |||
| 31 | Describe if and how the users could potentially continue to work with the system off-line in the event of a service disruption. | ||||
| 33 | The solution design shall incorporate data validation whenever possible to limit the possibility of data entry or manual update errors (e.g. foreign keys, date checks, and telephone number and zip code masks). | ||||
| 34 | The solution shall allow for DMH to retain full control and ownership of data during and upon the expiration and termination of the Contract. | ||||
| 35 | Data stored within the solution shall be made available to DMH systems for downloading/ extract into in-house data warehouse and analysis systems. DMH is looking for a flexible data access in a web services/XML based interface for data retrieval. Describe options for data integration with other DMH applications. | ||||
| 36 | Currency fields will be in US Dollars and have two decimal points unless otherwise stated | ||||
| 37 | Alpha and numeric data will be provided in English | ||||
| 38 | Integration | ||||
| Requirements | Describe how Solution utilizes standards-based API technology and an open architecture environment, including web services, to enable integration with other web service based applications across the DMH network. | ||||
| 39 | Describe Bidder's system integration experiences regarding standard APIs and establishment as a “source” within an enterprise class data integration layer. | ||||
| 40 | Describe Bidder's system integration experiences regarding real time and batch integration capabilities. 1. Describe any experience you have had with service bus integration (primarily for SAAS candidates) |
2. Describe any service buses that you support today
| 41 | Describe Bidder's its system integration experiences regarding file formats supported (e.g., CSV, XML, etc.) for S/FTP. |
| 42 | Solution must be capable of integration to DMH Systems through web services. |
| 43 | Requires that all system processes defined for the solution, including asynchronous activities, support reliable messaging and transactional processing in order to ensure process and data integrity, including timely restoration of service after technology failure. Solution supports reliable messaging. |
| 44 | Describe Solution use of asynchronous messaging and Bidder’s experience with these technologies. |
1. Describe your asynchronous messaging approach (e.g. queuing, direct programming, publish-subscribe, etc.)
2. Describe the protocols used for your asynchronous messaging
| 45 | Data Storage Requirements | All customer and transactional data shall be accessible in text and/or graphics format available in real-time, with no manual action required to refresh. | |
| 46 | All DMH data shall be maintained in the system and available to DMH personnel. | ||
| 47 | Each category and statistic captured by the system shall be archived in a central database and accessible through viewable, query able, and printable reports. DMH requires the capability to download archived data using industry standard protocols and formats. | ||
| 48 | All archival parameters shall be configurable. DMH requires that the Solution fully support non-disruptive rules-based data archival and subsequent retrieval. | ||
| 49 | Solution shall fully support non-disruptive rules-based data purge. | ||
| 50 | Hosted | ||
| (SaaS or non-SaaS) Requirements (Optional) | The Bidder shall provide an estimated up time or system availability guarantee of 99.9% (or better), including full system redundancy to ensure the availability requirement. | ||
| 51 | The Bidder shall submit a plan for vulnerability scanning for DMH approval on all system components and shall perform initial vulnerability scanning and validate mitigation actions prior to placing any new or modified system or component in production. | ||
| 52 | The Data Center provider shall manage at least two Tier-III data center facilities and provide documentation to substantiate this. |
• Multiple independent distribution paths serving the IT equipment
• All IT equipment must be dual-powered and fully compatible with the topology of a site’s architecture
• Concurrently maintainable site infrastructure guaranteeing 99.9% (or better) availability
| 53 | Data Center shall be ISO 9000 (process) & ISO 27000 (security) Certified |
| 54 | Data Center shall have industry certified on-site staff for Administration, Management and Monitoring or available 7/24/365. |
| 55 | Data Center shall utilize load balancing technologies to ensure that requests for services may be balanced across several servers. |
| 56 | Data Center shall have procedures and software/hardware available to back up all systems on a regular basis. |
| 57 | Backup and recovery services shall be provided to recover failed systems or to retrieve data for other purposes. The frequency and type of backup performed will be defined by DMH. |
| 58 | Data Center shall be capable of providing physical and virtual tape backup and recovery services. All backup and recovery activities shall be logged. The Data Center shall be capable of providing exports of the log data to DMH on demand. All backup, recovery and media logs shall be available upon request to DMH and identified auditors. |
| 59 | Data Center shall have in place provisions for off premise media storage and shall provide retrieval times. |
| 60 | Data Center shall provide service level agreement (SLA) offerings for backup, restore and recovery services (including RTO and RPO values) to be approved by DMH. Please provide copy of SLA being proposed as part of bid. |
| 61 | The Bidder shall notify DMH Legal counsel immediately upon discovery or suspicion of security incidents, unauthorized access to system components and/or customer record disclosure in the SaaS environment. |
| 62 | The Bidder shall report malicious code incidents experienced in relation to the system immediately to DMH. |
| 63 | The Bidder agrees that all application data is and remains the sole property of DMH and can be transferred to DMH at any time. |
| 64 | In the event of any system failure the Bidder shall immediately notify DMH of any loss of service and the estimated time to restore full service. |
| 65 | Audit logs shall be protected from modification or deletion and provided to DMH upon request. |
| 66 | Bidder shall provide an overview of DR / Business Continuity approach and how they would meet our system availability requirements |
| 67 | Outline the Bidder's standard Response Time Objective (RTO) /Recovery Point Objective (RPO) values provided as part of the proposal cost and provide examples of alternative RTO/RPO values and associated costs. |
| 68 | The Bidder shall provide a comprehensive Disaster Recovery/Business Continuity plan detailing the process for continued operations and performance of critical business functions in the event of an unscheduled service disruption regardless of the duration. |
| 69 | The Bidder shall be responsible for ensuring that operating systems and databases are up to date with the latest security patches in a timely basis (i.e. critical security patches must be applied immediately while medium-risk security patches must be applied within 30 days of release). |
| 70 | Provide a definition of the cloud delivery model being proposed. The definitions must follow guidelines set forth in http://www.nist.gov/itl/cloud/ |
| 72 | Bidder shall be responsible for providing, implementing, utilizing, and managing a complete network security implementation (e.g., providing firewalls, web application firewalls, intrusion detection/prevention systems, and denial of service mitigation) and associated monitoring services to prevent unauthorized access to the network environment hosting the equipment, the hardware, and any data or meta data used by the application environment. |
| 73 | Bidder shall be responsible for providing, implementing, utilizing, and managing a complete server security implementation (e.g., providing secure server configurations, file integrity monitoring, and antivirus and antimalware software) and associated monitoring services to prevent unauthorized access to the server systems hosting the operating systems, applications, and databases, and any data or meta data used by the application environment. |
Bidder shall be responsible for ensuring monitoring if possible active threats to the application take place and that alerts are sent out to designated system and security administrators.
| 74 | Bidder shall provide a Security Assessment Report from a qualified 3rd party security assessor stipulating that the Bidder’s established policies, procedures, and controls are adequate to ensure a secure operating environment. Acceptable assessment standards include Fed RAMP, ISO27000, SSAE 16, NIST 800-53 Rev 4 Moderate. |
| 75 | Security Assessment Reports shall be current (within the previous 24 months) and attested to by an identifiable and qualified security assessor. |
| 76 | Bidder shall certify that the controls in place as documented in the Bidder’s Proposal will be sustained for the life of any Awarded Contract. |
| 77 | Bidder, at their expense, shall provide an annual statement re-certifying their status as it relates to the above policies, procedures, and controls in use throughout their operations. |
| 78 | Bidder shall provide a detailed System Security Plan, using NIST Special Publication 800-18 Revision 1 as a suitable framework, providing security measures for: |
Physical Facilities Security, System Security, Data Security, Administrative Security and Personnel Security.
Bidder must refer to NIST Special Publication 800-18 Revision 1 expectations.
79 Compliance The solution must comply with ADA compliance requirements.
&A
Page &P of &N
Implementation and Project Mgmt
| Requirement Number | Requirement Section | Requirement Description | Bidder Response | Bidder Comments |
| 1 | Engagement and Release Planning Requirements | Provide an overview of your approach for engaging with a client and the management structure used to align with the client management and project team. | ||
| 2 | Describe your recommended approach for implementing the solution and related dependencies Describe your rationale for this approach, key deliverables, assumptions, risks, and the milestone plan to deploy the solution into production. | |||
| 3 | Describe recommended approach for implementing solutions for the business processes enabled after implementation, in terms of product releases and their scope, dependencies, risks, assumptions, and rationale for recommendations. | |||
| 4 | Attach a high-level project plan and implementation Roadmap for successful launch of their Scheduling Solution. | |||
| 5 | Phase Launch | DMH expects a phased launch of the Scheduling solution, which includes a Pilot launch of the Software to ensure process flow and business rules. Bidder must explain how they will be able to meet this requirement, or otherwise provide to DMH an acceptable alternative of this system. | ||
| 6 | Software go-live should be approached in a manner that minimizes disruption to the field of internal and external stakeholders. Describe you proposed approach. | |||
| 7 | Debarment | Bidder and Solution Provider are not subject to a State or Federal Debarment order. | ||
| 8 | Financial Stability | The Bidder shall demonstrate financial stability by including most current audited annual financial statements, gross annual revenue for the most recent completed fiscal year, last bankruptcy and any current or pending litigation and any defaults on contracts or legal debarments. | ||
| 9 | Project Management and Resource Requirements | Provide a description of recommended project management and delivery approach and methods, and Bidder’s ability to manage and deliver using an Agile delivery approach. | ||
| 10 | Within 15 days of receiving the Notice of Intent to Award, the Bidder will deliver a detailed project plan that identifies the work, timing and DMH resources needed to support creation of deliverables and set expectations for a successful roll-out. The Bidder will then oversee and deliver implementation and project management services, including managing the relationship with the Product Vendor (if Bidder isn’t also the Product Vendor) on DMH’s behalf, to implement a fully functional, integrated solution for DMH in compliance with the agreed upon Scope of Work. | |||
| 11 | Attach resumes for key project personnel that you are proposing on this engagement, including, but not limited to, your Vendor Account Manager, vendor Project Manager and Vendor Technical Lead. | |||
| 12 | N/A | |||
| 13 | N/A | |||
| 14 | Bidder project staff shall be on-site periodically during project activities. Bidder must plan to be on-site at key points during this engagement. | |||
| 15 | The Bidder shall be responsible for contract performance and management of sub-contractors they use. However, when sub-contractors are used, they must abide by all terms and conditions of the Contract. If Bidders are to be used, the Bidder must clearly explain their participation. | |||
| 16 | The Bidder shall separate development work and costs needed for integration work from that necessary for solution configuration or development. | |||
| 17 | The Bidder shall notify DMH immediately upon identifying the need to replace any Key Project Personnel and shall submit the names and qualifications of the proposed replacement(s) to DMH for prior written approval. | |||
| 18 | Specifically named support staff shall be readily available remotely and on-call throughout the roll-out. | |||
| 19 | The bidder shall identify and recommend business process improvements based upon their experience in implementation of a like solution at other sites. | |||
| 20 | QA Requirements | Provide an overview of recommended testing strategy and how Bidder will coordinate and work with DMH QA organization and testing methods. | ||
| 21 | The Bidder shall be responsible for managing and staffing comprehensive testing, related to their solution components and integrations, to validate functionality, accessibility, usability and performance throughout Unit, System, Interface, Security, Performance, and Regression testing. | |||
| 22 | DMH shall be responsible for providing end users and subject matter experts to perform the user acceptance testing. The Bidder will assist DMH to schedule, coordinate, monitor, and manage all user acceptance testing activities. | |||
| 23 | The test plan(s) shall describe the testing process and for each of the following required phases: |
1. Unit Testing
2. Integration Testing
3. Accessibility
4. System Testing and User Interface Testing
5. Performance/Load/Stress Testing
6. Regression Testing
7. User Acceptance Testing
8. Security Compliance Testing
| 24 | The Bidder shall submit test plan(s) and test cases with test scripts to DMH in advance for review and comment. | |
| 25 | The Bidder shall incorporate, within 3 business days of their provision, comments and revisions to the all deliverables received from DMH. | |
| 26 | The Bidder shall be responsible for implementing changes and/or corrective action upon error identification during all testing as to not impact the overall project schedule without prior approval from DMH project manager. | |
| 27 | The Bidder shall work with DMH to schedule each phase of testing so that DMH staff, representatives and partners may observe and/or participate in all testing. | |
| 28 | Within ten (10) calendar days of the completion of each test phase, the Bidder shall provide, for DMH approval, a Test Results Report containing results of each test script, a summary of the test results and a punch list of failed items. The Bidder shall maintain all test results, notes, and observations and these documents shall be available to DMH for review. Statistics to assess testing progress- open, severity, trends, etc. are also required. | |
| 29 | The Bidder shall be responsible for fixing and retesting identified defects including necessary regression testing subject to DMH’s approval. | |
| 30 | The Bidder and DMH shall agree on a schedule and plan for fixing and retesting components that do not meet testing success criteria. | |
| 31 | All exit criteria in a testing phase shall be met, prior to transitioning to subsequent phases. | |
| 32 | Training and Documentation Requirements | |
| The Bidder shall ensure all manuals, training materials, web-based curriculum and workshops have been updated to reflect any and all standard operating procedure, configuration and customization changes that were implemented specific to DMH's solution that differ from the Bidder's standard documentation and training deliverables. | ||
| 33 | The Bidder shall provide a sufficient number of on-site training workshops to designated DMH personnel with a thorough understanding of the system, applications, programming, and other related system requirements necessary for DMH to use and maintain the system. | |
| 34 | The Bidder shall provide a comprehensive web-based training curriculum that can be accessed at any time by DMH employees. | |
| 35 | The Bidder shall develop and implement a training program plan containing the techniques and tools, training requirements, schedule, curriculum, and materials and equipment required for the training effort. The plan shall be approved by the DMH personnel lead on this project prior to implementation. | |
| 36 | The Bidder shall provide DMH technical and support staff necessary training and knowledge transfer as may be needed to operate and support the solution on the part of DMH. | |
| 37 | The Bidder shall provide a sufficient number of training material and documentation for system users, system administrators and supervisors and support staff, and maintain updates to these materials through the life of the contract. Documentation should include, but not limited to: |
• Administration guides for system administrator staff.
• End-User manuals and documentation.
• Documentation for technical staff assuming support following contract closure, of detailed system components as built, configured and delivered to DMH, including configuration performed and a comprehensive troubleshooting manual.
• Database user manual or similar documentation
• Data schema diagram of database and data dictionary
• How to guide for delivered and ad-hoc reporting
• Level 1 helpdesk trouble shooting guide
• These guides will be specific to the DMH workflow and business process needs
| 38 | The Bidder shall provide updated documentation throughout the life of the contract for any components that change due to system upgrades or patch releases. |
| 39 | The Bidder shall make all documentation available to DMH in hard and electronic copy format. Electronic versions shall be in the original format in which the document was created (e.g., Microsoft Word) and in a PDF version. |
| 40 | Bidder is jointly responsible with DMH personnel for preparing technical and user support documentation, conducting onsite go-live system training and go-live support at each facility. |
| 41 | Bidder shall support various levels of user support from end-user, to operational, to technical. Describe the various support levels as well as Bidder's incident categorization approach (e.g. – Critical, Major, etc.) and SLAs for specific categories. |
| 42 | Bidder shall provision, maintain, and support environments for Production, QA/Test, and Development, and have defined Production metrics and SLAs for assessing performance. |
Incident Survey Response Time Resolution Time Escalation Procedure High Impact 15 minutes Final resolution within 4 hours <Describe escalation procedure> Medium Impact 2 hours Final resolution within 8 hours <Describe escalation procedure> Low Impact 4 hour Final resolution within 40 hours <Describe escalation procedure>
High Impact = System unusable Medium Impact = System useable with severely restricted functionality or performance Low Impact = System useable with minor impact on functionality or performance
| 43 | Describe Bidder’s “Managed Services” capabilities to provide a turnkey, fully managed, solution where all operations (end to end), support, and maintenance for all components (on-premises and off) are included. | |
| 44 | All scheduled system maintenance/downtime shall only be performed during non-business hours on a DMH-approved specific day and time period, in writing, in advance, by authorized DMH personnel. Scheduled maintenance will not be count as down time. | |
| 45 | During the ongoing maintenance and support period(s), the Bidder shall notify DMH in advance of the availability of enhancements, releases, and newer versions of the software. The Bidder shall consult with DMH concerning the advisability of incorporating such enhancements and newer versions within the system and shall provide reasonable supporting materials for implementing the enhancement, release, or new version. | |
| 46 | The Bidder shall monitor and track software versions, to ensure proper version control and hardware compatibility. | |
| 47 | The Bidder shall continue to support all configurations and supported customizations made in earlier versions of the product while providing ongoing maintenance and support to DMH. | |
| 48 | The Bidder shall not make any changes the Production System without prior approval by DMH. | |
| 49 | The Bidder Project Manager shall be present on site during each roll out in order to coordinate and troubleshoot issues that arise. | |
| 50 | The Bidder shall provide ongoing maintenance and support for the term of the contract on any and all Bidder provided hardware and software. By way of clarifying example and not by way of limitation, such maintenance and support shall include providing preventative maintenance, corrective maintenance, and troubleshooting failures that are necessary to maintain Performance Standards. | |
| 51 | All proposed system upgrades and updates should be included at no additional cost throughout the life of the contract. | |
| 52 | The Bidder shall provide a single point of notification for all maintenance problems 24 hours a day, 7 days per week. A telephone number that operates 24 hours a day, 365 days a year contact shall be provided. | |
| 53 | The Bidder shall provide full-service support for all hardware equipment and software purchased under this contract for at least the initial term of the contract. For the purpose of this contract, full service means all service, repair, parts, and maintenance necessary to keep the equipment operating in a manner that meets the manufacturer’s published performance specifications and the requirements of this contract. | |
| 54 | Please describe anything that may fall outside of the maintenance contract and would incur additional costs while under contract. | |
| 55 | Explain methods for addressing problems in the delivered solution, with specific reference to: how problems are reported, how problems are escalated, and the notification process to inform all customers of the problem and its resolution. | |
| 56 | Describe typical metrics and SLAs used as part of Bidder operations. | |
| 57 | Start Date | DMH expects that the Statement Of Work (SOW), created in partnership with DMH and the selected Bidder, will be completed within 3 weeks after the announcement of the selection of the apparent awarded bidder. |
| 58 | DMH expects that the selected Bidder will be able to commence project activities within 10 days of the execution of the contract (signing of the SOW and Standard Contract Form by designated DMH and Bidder authorized signees). |
&F &A
Page &P of &N
File details come from the government source that posted it. Updated .