C250211_RFP_Exhibit_A,_SOW_Attachment_A,_Business_Requirements.pdf

RFP 250211

EXHIBIT A

ATTACHMENT A

A1. BUSINESS REQUIREMENTS PRIORITY

A2. FUNCTIONAL REQUIREMENTS LIST

B1: TERMS DEFINITIONS

B2: APPLICATIONS

Table of Contents

VENDOR TO COMPLETE and or REVIEW

SYSTEM REFERENCE DOCUMENTS

ATTACHMENT A

OCTA's Priority Description 1 - Required Solution must have in core application.

2 - Nice to have Process that is neither manual or in OCTA's current solution but would be beneficial to OCTA.

3 - Out of Scope Not available.

A1. Business Requirements Priority

Functional Requirements List

TAB A2. FUNCTIONAL

Column E

A1

ATTACHMENT A

INFORMATION PROVIDED BY OCTA

Requirement Business Area Type OCTA's Priority

1.0 The assessment shall evaluate conformance with WCAG 2.1 Level A and AA success criteria (or the most current applicable standard). Compliance

Regulatory Alignment 1 - Required

2.0 The assessment shall align with ADA Title II requirements and applicable federal and California accessibility laws. Compliance

Regulatory Alignment 1 - Required

3.0 Identify and document accessibility barriers across all confirmed in-scope digital assets. Compliance Project Objectives 1 - Required

4.0 Evaluate accessibility using industry-recognized testing methodologies. Compliance Project Objectives 1 - Required

5.0 Categorize findings by severity (Critical, High, Medium, Low). Compliance Project Objectives 1 - Required

6.0 Document user impact, including affected disability groups and potential legal, operational, and reputational risks. Compliance Project Objectives 1 - Required

7.0 Provide defensible, evidence-based documentation suitable for public-sector compliance review. Compliance Project Objectives 1 - Required

8.0 Provide prioritized findings and high-level remediation guidance to inform future corrective action planning. Compliance Project Objectives 1 - Required

9.0 Collaborate with Agency stakeholders to confirm in-scope systems and platforms. Compliance Project Objectives 1 - Required

10.0 Document scope boundaries and exclusions. Compliance Project Objectives 1 - Required

11.0 Identify and document critical user workflows for testing. Compliance Project Objectives 1 - Required

12.0 Assess public-facing websites and subdomains. Compliance Digital Assets Covered 1 - Required

13.0 Assess secure portals and web-based applications. Compliance Digital Assets Covered 1 - Required

14.0 Assess online forms and transaction systems. Compliance Digital Assets Covered 1 - Required

15.0 Assess native mobile applications (iOS and Android), if applicable. Compliance Digital Assets Covered 1 - Required

16.0 Assess multimedia content (live and prerecorded). Compliance Digital Assets Covered 1 - Required

17.0 Assess a representative sample of digital documents (PDF, Word, Excel, PowerPoint), if included in scope. Compliance Digital Assets Covered 1 - Required

18.0 Perform manual functional accessibility testing. Compliance Required Testing Methods 1 - Required

19.0 Conduct keyboard-only navigation testing. Compliance Required Testing Methods 1 - Required

20.0 Conduct screen reader testing (e.g., NVDA, JAWS, VoiceOver; TalkBack for mobile). Compliance Required Testing Methods 1 - Required

21.0 Review semantic structure and ARIA implementation. Compliance Required Testing Methods 1 - Required

22.0 Perform color contrast and non-text contrast analysis. Compliance Required Testing Methods 1 - Required

23.0 Evaluate forms, error handling, and validation messaging. Compliance Required Testing Methods 1 - Required

24.0 Review media accessibility (captions, transcripts, audio descriptions where applicable). Compliance Required Testing Methods 1 - Required

25.0 Conduct automated accessibility scanning to supplement manual testing. Compliance Required Testing Methods 1 - Required

26.0 Automated testing shall not replace required manual evaluation. Compliance Required Testing Methods 1 - Required

27.0 Document exact location of each nonconformance (page, screen, component, workflow). Compliance Issue-Level

Documentation 1 - Required

28.0 Describe the accessibility defect clearly and specifically. Compliance Issue-Level Documentation 1 - Required

29.0 Reference applicable WCAG 2.1 Success Criterion (Level A or AA). Compliance Issue-Level Documentation 1 - Required

30.0 Assign severity rating (Critical, High, Medium, Low). Compliance Issue-Level Documentation 1 - Required

31.0 Provide clear explanation of user impact and affected disability groups. Compliance Issue-Level Documentation 1 - Required

32.0 Provide technical remediation guidance sufficient for corrective implementation. Compliance Issue-Level

Documentation 1 - Required

33.0 Include supporting evidence (annotated screenshots, code snippets, assistive technology test results, automated outputs). Compliance Issue-Level

Documentation 1 - Required

34.0 Provide an executive summary outlining overall accessibility posture and risk exposure. Compliance Reporting Requirements 1 - Required

35.0 Provide a detailed findings log mapped to WCAG 2.1 Level A and AA criteria. Compliance Reporting Requirements 1 - Required

36.0 Provide high-level remediation guidance to support planning. Compliance Reporting Requirements 1 - Required

37.0 Document testing tools utilized. Compliance Reporting Requirements 1 - Required

38.0 Document assistive technologies used. Compliance Reporting Requirements 1 - Required

39.0 Document browsers and environments tested. Compliance Reporting Requirements 1 - Required

40.0 Document assumptions, limitations, and exclusions. Compliance Reporting Requirements 1 - Required

41.0 The engagement shall be limited to assessment and reporting activities only. Compliance Engagement Limitation 1 - Required

42.0 Remediation, governance implementation, and ongoing monitoring services shall be defined separately following review of assessment findings.

Compliance Engagement Limitation 1 - Required

A2 Functional

ATTACHMENT A

Term Definition

Accessibility

The extent to which digital content, systems, and services are designed, developed, and maintained so they are usable by individuals with disabilities, including through compatibility with assistive technologies and conformance with applicable accessibility standards.

ADA Title II

Title II of the Americans with Disabilities Act of 1990, as amended, and its implementing regulations, which require state and local public entities to provide qualified individuals with disabilities an equal opportunity to benefit from programs, services, and activities and to avoid disability-based discrimination.

Agency stakeholders Authorized representatives of the Agency with decision-making, review, operational, legal, compliance, program, or technical responsibilities relevant to the assessed digital assets and deliverables.

ARIA implementation

Use of WAI-ARIA roles, states, and properties to provide additional semantics for dynamic content and custom user interface components where native HTML semantics are insufficient, implemented in accordance with ARIA specifications and authoring practices.

Automated accessibility scanning.

Use of software tools to automatically detect certain classes of accessibility issues by analyzing code, structure, and rendered output, producing reportable results that must be supplemented by manual testing and expert review.

Categorize severity (Critical, High, Medium, Low).

The classification of identified accessibility issues into ordered severity levels that reflect urgency and the degree to which the issue prevents, significantly impairs, or moderately affects a user’s ability to complete essential tasks.

Color contrast and non-text contrast analysis

Evaluation of contrast ratios for text and essential non-text visual information (e.g., UI component boundaries, focus indicators, and meaningful graphical objects) to confirm that foreground and background contrast meets applicable minimum thresholds.

Corrective action

A specific, assigned, and time-bound measure taken to eliminate the cause of an accessibility nonconformance and prevent recurrence, including required fixes, validation steps, and documentation of completion.

Digital assets

All electronic content and information resources, including websites, web and mobile applications, electronic documents, multimedia, and other digital materials that are created, stored, published, or otherwise made available through digital channels.

Disability groups

Categories of disabilities (e.g., visual, auditory, motor, speech, cognitive, neurological) whose access may be affected, including users who rely on assistive technologies or alternative input/output methods.

Evidence-based documentation

Records of findings supported by verifiable evidence (e.g., reproduction steps, screenshots, code references, tool outputs, and standard citations) sufficient to substantiate conclusions and enable remediation and auditability.

In-scope systems and platforms.

The set of systems, applications, websites, platforms, and related components expressly included in the assessment and subject to evaluation and reporting under the governing statement of work.

Keyboard-only navigation testing.

Testing to confirm that all functionality and interactive elements can be reached, operated, and exited using only a keyboard (or keyboard-equivalent input), including logical focus order, visible focus indication, and absence of keyboard traps.

Manual functional accessibility testing

Human-performed testing that evaluates real user interactions, task completion, and assistive-technology compatibility beyond automated checks, including verification of behavior, usability, and conformance with relevant success criteria.

Media accessibility .

The provision of accessibility features for time-based media, such as captions, transcripts, and audio description where appropriate, and accessible media controls, to ensure users with disabilities can perceive and operate the media experience.

Multimedia content (live and prerecorded).

Time-based media, including audio-only, video-only, and synchronized audio-video content, whether live-streamed or prerecorded, together with associated players, controls, captions, transcripts, and descriptions as applicable.

Native mobile applications (iOS and Android)

Software applications installed and executed on iOS and/or Android devices, including user interfaces, navigation, content, and device integrations subject to accessibility requirements.

Online forms

Electronic forms, including input fields, controls, validation, error handling, confirmation messaging, and submission processes used to collect, transmit, or process user-provided information.

Operational, and Reputational risks.

Risks arising from accessibility nonconformance, including disruption to service delivery, increased support burden, delay or failure of program objectives, legal exposure, and damage to public trust and organizational reputation.

Public-facing websites and subdomain

Websites and web pages that are accessible to the general public without authentication, including all associated subdomains, pages, and templates that the Agency owns or controls and that fall within the defined scope.

Remediation

The process of correcting identified accessibility issues by implementing changes to content, design, code, configuration, or process so the affected digital asset conforms to the applicable requirements and is usable by individuals with disabilities.

Scope boundaries and exclusions.

The documented limits of the assessment, including what is not evaluated (e.g., third-party content outside control, legacy systems excluded by agreement, or non-production environments), and any assumptions or constraints affecting coverage.

Screen reader testing

Testing using one or more screen readers to verify that content structure, labels, roles, states, and instructions are conveyed programmatically and that users can efficiently navigate and complete tasks using assistive technology.

Secure portals and web-based applications

Authenticated or access-controlled web portals and web applications, including restricted content and functionality available to authorized users, that the Agency owns or controls and that fall within the defined scope.

Semantic structure

The meaningful, programmatic organization of content using appropriate structural elements (e.g., headings, lists, landmarks, regions, and form semantics) so assistive technologies can interpret and provide efficient navigation and comprehension.

Testing Tools The set of software applications, browser extensions, assistive technologies, and utilities used to perform accessibility evaluation and verification, including automated scanners, color contrast analyzers, and screen readers.

Transaction systems.

Systems that enable a user to complete a transaction or exchange of value or information (e.g., payments, fees, applications, requests, reservations), including workflows, confirmations, and related records.

User impact

The practical effect of an accessibility issue on a user’s ability to perceive, understand, navigate, interact with, or complete an intended task or workflow, including the likelihood and magnitude of harm or exclusion.

User workflows

End-to-end task sequences that users are expected to complete within a digital asset (e.g., account creation, authentication, form submission, payment, document retrieval), including the steps, pages, and components involved.

WCAG 2.1 Level AA

The Level AA conformance requirements of the Web Content Accessibility Guidelines (WCAG) Version 2.1, including all Level A and Level AA Success Criteria that must be satisfied for the applicable digital content or functionality to be deemed conforming.

WCAG 2.1 Level AA

The Level AA conformance requirements of the Web Content Accessibility Guidelines (WCAG) Version 2.1, including all Level A and Level AA Success Criteria that must be satisfied for the applicable digital content or functionality to be deemed conforming.

B1. Terms and Definitions

ATTACHMENT A

Application IS App Owner Business Owner Vendor/Application

Provider (If Applicable)

Deployment Model (Select from Dropdown)

User Type (Select from dropdown)

Domain Host Desktop Application URL / System Location (If Applicable)

OCTA Business Area (Select from dropdown)

ADA Compliance Cost (Select from dropdown)

OCTA ADA

Responsible

Est. ADA Compliance Cost

App Availability/Usage

Comments Update Required

Status

Adobe Sign Sarath Babu Adobe Cloud/SaaS Both Web Application Included 24/7 https://helpx.adobe.com/sign/config/compliance-issues/accessibility/us-section-508.html 24/7 24/7

Azure/Endpoint Manager – Auto-Pilot feature Ryan Puchahes Cloud/SaaS Both Web Application Operations/ IT Included 24/7 9/2/2026 Submitted Azure/Endpoint Manager – Encryption feature Ryan Puchahes Cloud/SaaS Both Web Application Operations/ IT Included 24/7 9/2/2026 Submitted Abnormal Security Jonathan Rosales Dylan Hack Abnormal AI Cloud/SaaS Public Facing Web Application https://abnormal.ai/ Other Included None 24/7 24/7 24/7 blog.octa.net Gordon Chu Marketing Umbraco On-Prem Public Facing Web Application https://blog.octa.net Other None 24/7 1/9/2027 Draft Citrix Ryan Puchahes On-Prem Both Desktop Application Operations/ IT Extra Cost 24/7 9/2/2026 Submitted eSignage: Papercast Content Management System (CMS) Minh Nguyen; Jeffrey Tatro Jeffery Tatro Urban Solar, Papercast Cloud/SaaS Both Web Application https://urbansolar-octa.papercast.net/#/ Operations Included 24/7 11/24/2026 Submitted Exchange Long Leu; Jason Hoogeveen Long Leu, Jason Hoogeveen Microsoft Hybrid Both Web Application email.octa.net Operations/ IT Included 24/7 12/30/2026 Submitted GOVQA Uriah Williamson Mike Henry Granicus Cloud/SaaS Public Facing Web Application https://octa.govqa.us/WEBAPP/_rs/(S(lifmlezsy4z4xzv1uwczrjaa))/supporthome.aspx IT / Customer Experience 24/7 9/4/2025 Update Overdue KnowBe4 Cloud portal Joshua Gilman Dylan Hack KnowBe4 Cloud/SaaS Public Facing Web Application https://www.knowbe4.com/ Other Included None 24/7 10/13/2026 Submitted Microsoft Windows Security Ryan Puchahes; Dylan Hack; Teodor Dinicu Hybrid Both Web Application Operations/ IT Included 24/7 10/13/2026 Submitted Legistar Uriah Williamson Mike Henry Granicus Cloud/SaaS Public Facing Web Application Orange County Transportation Authority - Calendar Operations/ IT 24/7 9/4/2025 Update Overdue OCTA Blog Jacqueline Moon Microsoft Web Advanced https://blog.octa.net/ Microsoft Defender for Endpoint Teodor Dinicu Dylan Hack Microsoft Cloud/SaaS Public Facing Web Application https://www.microsoft.com Other Included None 24/7 2/3/2026 Submitted OCTA Main Site Jacqueline Moon Microsoft Web Advanced https://octa.net/ OCTA Public APIs Bang Pham Operation Bang Pham On-Prem Public Facing Web Application https://api.octa.net/ 24/7 9/9/2026 Submitted Pacific Surfliner Jacqueline Moon LOSSAN Web Advanced https://www.pacificsurfliner.com/ Phish Firewall Joshua Gilman Dylan Hack PhishFirewall Cloud/SaaS Public Facing Web Application https://www.phishfirewall.com/ Other Included None 24/7 9/29/2026 Submitted Privily Joshua Gilman Dylan Hack Privily Cloud/SaaS Public Facing Web Application https://www.privily.io/ Other Included None 24/7 10/2/2026 Submitted Salesform Form Jacqueline Moon https://wave.octa.net/help/contact-us/ Secureworks Taegis XDR Jonathan Rosales Dylan Hack Sophos Cloud/SaaS Public Facing Web Application https://www.sophos.com/en-us Other Included None 24/7 10/14/2026 Submitted Spirion Jonathan Rosales Dylan Hack Archtis Cloud/SaaS Public Facing Web Application https://www.spirion.com/ Other Included None 24/7 6/4/2026 Submitted Trapeze - RidePro Alex Truong Cloud/SaaS Public Facing Web Application https://ocvanpool.rideproweb.com/rp2/Home/Home 24/7 10/6/2026 Submitted Trapeze PASS Alex Truong Trapeze On-Prem Public Facing Desktop Application https://ocaccessonline.octa.net/ 24/7 9/4/2025 Update Overdue Vanta Joshua Gilman Dylan Hack Vanta Cloud/SaaS Public Facing Web Application https://www.vanta.com/ Other Included None 24/7 10/1/2026 Submitted Wave Institutional Login Jacqueline Moon https://wave.octa.net/en/institution/login/?returnUrl=/institution/administration/mana Wave Website Jacqueline Moon https://wave.octa.net/ wave.octa.net Isaac Herrera/Jacqueline Moon/Gordon Chu Umbraco/ INITUSA Hybrid Public Facing Web Application https://wave.octa.net Other Included None 24/7 1/9/2027 Draft www.405expresslanes.com Gordon Chu/Ellen Lee Ellen Lee/Marketing Umbraco Cloud Hybrid Public Facing Web Application https://405expresslanes.com Other None 24/7 1/9/2027 Draft www.91expresslanes.com Gordon Chu/Anthony Rodriguez Anthony Rodriguez/Marketing Cofiroute/Umbraco Hybrid Public Facing Web Application https://91expresslanes.com Other None 24/7 1/9/2027 Draft www.octa.net Gordon Chu Marketing Umbraco On-Prem Public Facing Web Application https://octa.net Other None 24/7 1/9/2027 Draft Zoom Morgan Levar Morgan Levar Tekistry, Inc Cloud/SaaS Both Desktop Application https://www.zoom.us IT / Customer Experience 24/7 10/21/2026 Submitted 405 Express Lanes Jacqueline Moon Toll Vendor Web Advanced https://www.405expresslanes.com/ 91 Express Lanes Jacqueline Moon Toll Vendor Web Advanced https://www.91expresslanes.com/

NOTE* This list is not an all inclusive list of digital assets

B2. Applications https://helpx.adobe.com/sign/config/compliance-issues/accessibility/us-section-508.html https://helpx.adobe.com/sign/config/compliance-issues/accessibility/us-section-508.html https://abnormal.ai/ https://blog.octa.net/ https://urbansolar-octa.papercast.net/#/ https://octa.govqa.us/WEBAPP/_rs/(S(lifmlezsy4z4xzv1uwczrjaa))/supporthome.aspx https://www.knowbe4.com/ https://octa.legistar.com/Calendar.aspx https://blog.octa.net/?utm_source=chatgpt.com https://www.microsoft.com/ https://octa.net/ https://api.octa.net/ https://www.pacificsurfliner.com/ https://www.phishfirewall.com/ https://www.privily.io/ https://wave.octa.net/help/contact-us/ https://www.sophos.com/en-us https://www.spirion.com/ https://ocvanpool.rideproweb.com/rp2/Home/Home https://ocaccessonline.octa.net/ https://www.vanta.com/ https://wave.octa.net/en/institution/login/?returnUrl=/institution/administration/manage-admins/ https://wave.octa.net/ https://www.405expresslanes.com/ https://405expresslanes.com/ https://www.91expresslanes.com/ https://91expresslanes.com/ https://octa.net/ https://www.zoom.us/ https://www.405expresslanes.com/ https://www.91expresslanes.com/