Request for Information D-27-DC-91626-Diversion Control Divisions (DC) Information Technology (IT) Systems.pdf

Request for Information (RFI) – Enterprise Modernization of the Drug Enforcement Administration Diversion Control Division’s (DC) Information Technology (IT) Systems

1. Overview

The Drug Enforcement Administration (DEA), a component of the U.S. Department of Justice (DOJ), is conducting market research to identify a modern solution, such as SaaS and COTS, to facilitate the Diversion Control Division’s (DC) transformation of decentralized, siloed applications. Solutions must provide DEA with centralized, secure, and easily scalable capabilities.

This Request for Information (RFI) is issued solely for information gathering and acquisition planning under FAR 15.201(e) and does not constitute a solicitation.

The DEA is seeking industry feedback on single sign-on (SSO) solutions that can provide a secure, scalable, compliant, and modern platform that improves operational efficiency, data quality, interoperability, cybersecurity, and mission support. The desired solution should also provide a flexible foundation for automation, analytics, mobile access, and future capabilities.

Interested parties are encouraged to describe their solution approach, implementation strategy, relevant federal experience, technical architecture, artificial intelligence capabilities, security and compliance capabilities, performance measures, and available ordering vehicles that may be leveraged.

2. Background and Mission Need

DEA’s Diversion Control Division (DC) serves as the regulatory and enforcement authority responsible for preventing, detecting, and investigating the diversion of pharmaceutical controlled substances and listed chemicals while ensuring an adequate and uninterrupted supply for legitimate medical, scientific, and commercial purposes. In support of this mission, DEA acts as the central authority for issuing registrations that authorize the handling of controlled substances and listed chemicals for approximately 2.2 million registrants. The Diversion Control program also:

• Enables vital data sharing with internal and external partners

• Supports enforcement of the Controlled Substances Act (CSA) through criminal, civil, and administrative actions

• Establishes national drug production quotas for domestic and international use

• Automates monitoring and tracking of the distribution of certain controlled substances

• Oversees the importation and exportation of controlled substances and listed chemicals

• Performs activities related to drug scheduling and compliance with international treaty obligations.

To support these mission requirements, DEA relies on a suite of applications and other systems to manage registrant data, regulatory workflows, reporting, operational oversight, and mission-support activities. The current environment, however, is siloed and constrained by manual processes, limited interoperability, and growing demands for secure, timely, and data-driven operations. DEA therefore seeks a modern, unified, solution capable of supporting current mission requirements while providing the flexibility to accommodate future needs. The modernized environment should improve efficiency, strengthen data quality (leveraging data catalogs, watermarking, metadata tagging, and lineage tracking to support best practices and advanced analytics) and auditability, enhance user experience, enable secure interoperability and mobile access, and provide a scalable foundation for compliance, oversight, analytics, automation, and future mission needs.

3. Current Systems and Integration Environment

RICS – Registrant Information Consolidated System (RICS), the cornerstone of the Diversion Control Division’s IT system, is a suite of 20+ applications, with varied infrastructure, limited interoperability, and no data sharing, is available online and serves as the centrally housed Registrant record to include registration information, history of registration, enter and track administrative actions taken against registrant, and allows for comments to be entered by Field or HQ personnel after communicating with Registrant.

Assigns workload to both Field and HQ Users for investigation purposes and tracking.

Serves as a tool for management to ensure personnel are completing taskings assigned in a timely manner.

RICS ingests and processes more than 3 million transactions per year (including new applications, renewal requests, and modifications to existing registrations). More than 3.5 million mailed communications are printed and sent to DEA registrants annually through its Print-On-Demand (POD) environment.

• Permits registrants to apply for a DEA registration, renew or modify their registration, or validate others’ registration information.

• Provides a platform for registrants and regulated persons to make required reports to DEA (theft and loss reports, suspicious order reports, inventory reports, etc.).

• Enables registrants to report the import or export of controlled substances and listed chemicals, and the import, export, or domestic sale of regulated machines.

• Enables authorized DEA personnel to approve import and export requests, and to perform analysis on import and export data.

• Permits DEA personnel to manage registration actions and workload, to view and analyze registrant-reported data, and to enforce the CSA and other laws and regulations.

• Provides high volume printing services through its Print-On-Demand (POD) environment,

• Permits geographic tagging and analysis through the Diversion Control Geographic Information System (DCGIS).

• Allows the public to submit tips to DEA regarding suspicious activity involving controlled substances, listed chemicals, or registrants

• Permits the public, registrants, partners and others to register for special Diversion Control Division events, and for DEA to track specialized training provided to registrants and others.

• Allows for the collection, analysis, and reporting of overdose information provided by toxicology labs.

• Allows DEA to publish the locations and contact information of DEA offices, partners, and other stakeholders.

• Enables Diversion Control Division sections to use the data collected in RICS to populate analytical dashboards providing aggregated and summary information for management and targeting.

• Includes the Diversion Control Division website (www.deadiversion.usdoj.gov)

ARCOS – Automated Reports and Consolidated Orders System (ARCOS) ingests millions of registrant-reported transactions per year. Transaction information includes buyer, seller, date of purchase, and drug code information, all of which need to be verified by the system, generating alerts on errors. Registrants can report to ARCOS by EDI, or through an online application. DEA personnel use ARCOS to validate registrant reporting against federal requirements, and to analyze the movement of controlled substances through all distribution channels, across the United States.

CTRANS - Chemical Transactions Analysis System (CTRANS) is a suite of applications permitting registrants to provide mandatory reports of the import or export of controlled substances or listed chemicals, and the import, export, or domestic sale of regulated machines. It permits DEA personnel to manage and approve transaction and interfaces with the Customs and Border Protection’s (CBP) Automated Customs Environment (ACE) http://www.deadiversion.usdoj.gov/ https://www.deadiversion.usdoj.gov/arcos/arcos.html to facilitate transactions at the port. CTRANS applications process about 33,000 transactions per year.

Diversion Control Call Center (DC3)– DC3 is a Salesforce-based Customer Relationship Management (CRM) application and supports DEA Registrant and customer service professional communication and workflow. DC3 supports web case, chat, email, and phone interactions. On average, DC3 handles about 21,500 telephone calls and 7000 email tickets per month.

In addition, the DC3 environment hosts the DC4 Artificial Intelligence chatbot, which automatically helps answer registrant inquiries using resources pulled directly from the Diversion Control Division website.

CSOS – The Controlled Substance Ordering System (CSOS) allows for a secure electronic transmission of controlled substance orders without the supporting DEA-222 paper form.

CSOS distributes digital certificates to validated, authenticated participants for use with drug purchasing software. It provides registration authority and certificate authority workload for the creation and management of certificates, and certificate revocation lists (CRL) that are updated daily. CSOS ingests registrant reports of electronic purchases similar to what’s done with ARCOS (see above).

CSOS issues around 300,000 certificates per year.

Other DEA Systems – Including but not limited to those which support information used in DEA investigative and enforcement activities, support investigative, reporting and operational activities that may require access to or reuse of registrant information.

State Licensing and Other Authoritative Sources – May be used to validate registrant information, including applicable professional licenses.

The systems above are provided for context and represent the anticipated integration environment, not an exhaustive list. Respondents should identify recommended integration methods, dependencies, assumptions, and potential challenges.

4. Core Functional Requirements

Registration Lifecycle Management

• Support new registrations, renewals, modifications, transfers, surrenders, and other registration transactions.

• Apply configurable requirements, business rules, fees, documentation, and workflows based on transaction type, with integration to Pay.gov to facilitate secure fee collection and payment processing.

• Provide end-to-end processing from submission through DEA review, adjudication, and notification.

• Maintain a complete, auditable history of registration activity and administrative actions.

Registrant Portal and Self-Service

• Provide a secure, accessible, user-friendly portal for registrants to manage registration activities throughout the lifecycle.

• Support electronic submission, modification, renewal, documentation, payment, correspondence, and status tracking.

• Provide self-service capabilities, including guided applications, saved transactions, deficiency responses, and access to registration history.

• Support roles and delegated access for organizations with multiple authorized users.

• Support tracking, analysis, and reporting of specialized training provided to registrants and other participants, including attendance and completion status.

Website Management

• Provide comprehensive website administration services (i.e. development, content updates, etc.)

• Monitor and secure the website, pages, applications, and artifacts

• Integrate the website and developed applications to improve communication and customer satisfaction

• Perform website maintenance including security, usability reviews, patching/updating, and backups.

Application Processing and Workflow

• Provide configurable forms, validation, business rules, workflow, routing, task management, and deficiency resolution.

• Automate routine processing, notifications, and routing to improve consistency and reduce manual effort.

• Enable authorized DEA users to modify routine workflows, rules, forms, and notifications without extensive custom development.

• Provide testing capabilities before configuration changes are deployed to production.

Status, Notifications, and Correspondence

• Provide registrants with timely visibility into application and transaction status, outstanding actions, deficiencies, and deadlines.

• Deliver configurable electronic notifications, correspondence, confirmations, and reminders.

• Maintain a consolidated history of registrant communications and transactions.

• Provide transparency while protecting sensitive DEA information.

Document and Data Management

• Securely manage registrant, registration, application, transaction, and supporting documentation.

• Provide data validation, standardization, duplicate identification, historical data preservation, and auditability.

• Support secure retrieval, authorized data updates, and document versioning.

• Support migration, reconciliation, and validation of data from the existing RICS environment.

• Utilize a data catalog, metadata tagging and watermarking, and data lineage tracking to implement data management best practices, and enable advanced analytics, reporting, and data-driven decision making.

Search, Reporting, and Analytics

• Provide comprehensive search and retrieval of registrant, registration, transaction, document, and historical information.

• Support the collection, analysis, and reporting of overdose information provided by toxicology laboratories.

• Provide aggregated data to authorized regulatory and law enforcement partners in accordance with legal, privacy, security, and disclosure requirements.

• Provide configurable dashboards and reports for registration volumes, workload, processing, renewals, administrative and civil actions, and performance.

• Support ad hoc reporting, analytics, and authorized data export.

• Integrate with enterprise analytics platforms and data environments, leveraging trend analysis and machine learning to identify trends, patterns, anomalies, and insights to support data-driven decision making.

Payments and Financial Transactions

• Serve as the primary collection mechanism for transaction and payment information, utilizing pay.gov to securely process and collect applicable fees and payments.

• Calculate registration fees using configurable business rules.

• Support secure electronic payment and provide confirmations and receipts.

• Maintain payment history and identify payment issues or outstanding amounts.

• Support reconciliation with financial systems.

Administration, Configuration, and Extensibility

• Provide authorized DEA administrators with configurable capabilities for users, roles, forms, rules, workflows, notifications, reference data, and reporting.

• Support quality assurance and validation of configuration changes before deployment.

• Minimize reliance on custom development for routine business and regulatory changes.

• Provide a scalable and extensible architecture capable of adapting to future mission, regulatory, technology, and volume requirements

Integration and Interoperability

• Integrate internal and external applications and systems to support registrant management, oversight, reporting, and related mission functions.

• Support secure data exchange and interoperability across the broader application and partner ecosystems.

• Support integration with external datasets to include, but not limited to:

• First Databank National Drug Code Dictionary

• Custom and Border Protection Automated Commercial Environment

• Social Security Administration Death Master File

• DEA’s Case Management System

• State Licensing Sources

• DEA Personnel Dataset (e.g., FFFSR)

• Federal Personnel Datasets (NFC)

• HHS-OIG Exclusions List

• pay.gov

Public-Facing, Print, and Geospatial Support

• Support public-facing applications by:

• Supporting registration by the public, registrants, partners, and other authorized participants for special DC events.

• Supporting public-facing submission of tips regarding suspicious activity involving controlled substances, listed chemicals, or registrants.

• Providing the capability to publish, manage, and maintain DEA office location and contact information for authorized public and internal stakeholder access.

• Support high-volume print-on-demand capabilities.

• Support geographic tagging, mapping, and analysis functions.

Mobility and Modern Platform Support

• Support secure mobile access for authorized users and registrants.

• Provide scalable infrastructure, resilient operations, and maintainable application architecture.

• Support configurable and extensible capabilities that can accommodate future mission and technology requirements.

Artificial Intelligence (AI) -Ready Architecture

Any proposed use of AI capabilities under this requirement shall be subject to applicable DEA and Department of Justice (DOJ) approval processes. The contractor will not implement, activate, or deploy AI until documentation is submitted for review and receive the required DEA and DOJ approval.

• Provide an architecture capable of integrating future AI-enabled capabilities without requiring AI functionality as a prerequisite for core system operations.

• Support transparency, fairness, explainability, and auditability for any future AI or algorithmic capabilities used within the solution.

• Enable governance, human oversight, and controls for AI-enabled functions.

Technical and Regulatory Standards

• FedRAMP High (baseline requirement, not an optional capability)

• Federal, DOJ/DEA cybersecurity policy-compliant architecture (e.g., FISMA, EO

14028)

• Section 508 accessibility

• NIST Special Publication 800-53

• NIST Cybersecurity Framework

• Criminal Justice Information Services (CJIS) Security Policy

• Office of Management and Budget (OMB) Circular A-130

The resulting solution should meet all required Federal, DOJ, and DEA cybersecurity and privacy requirements prior to any deployment. The solution should also support responsible, transparent and explainable use of AI capabilities, consistent with applicable federal policies and requirements.

Outcomes-Based Contracting and Performance Alignment

DEA intends to structure any resulting acquisition under an outcomes-based contracting (OBC) framework. Vendors should propose how their platform will help DEA:

• Recommended performance measures and metrics for evaluating operational improvement, including processing time, throughput, backlog reduction, workflow cycle time, and user adoption.

• Methods for establishing baseline performance measures and measuring improvement following implementation.

• Recommended service-level agreements (SLAs) and performance thresholds for system availability, response time, API performance, incident resolution, and other critical services.

• Methods for measuring and maintaining data quality, integrity, accuracy, and auditability.

• Approaches for tying contractor performance to measurable operational, technical, compliance, and mission outcomes.

Respondents are encouraged to share examples of how their solution has supported outcome-based performance models in other federal environments, particularly those involving regulatory operations, case management, law enforcement, compliance oversight, or high-volume public-facing services.

5. System Goals and Objectives

The DEA field community has specifically identified the need to reduce duplicate data entry between Diversion IT systems and the case management system, connect Diversion IT systems to relevant internal DEA systems, link registrations and related registrants, provide access to administrative actions and related information, automate state-license checks, and provide a unified view of registrant information and associated Diversion data.

DEA Diversion Control requires a modern IT platform that integrates disparate IT applications into a single, modern system connecting it to a wider DEA ecosystem. The system should improve mission delivery while protecting sensitive information and preserving the integrity, availability, and reliability of registrant data.

DEA seeks to implement a solution that:

• Provide a secure, intuitive, accessible, and user-friendly system that enables registrants to complete registration-related activities electronically and obtain timely visibility into the status of their submissions and required actions.

• Enable registrants and DEA personnel to manage the complete registration lifecycle, including new registrations, renewals, modifications, transfers, changes to registration information, correspondence, administrative and civil actions, payments, and surrender or retirement of registrations.

• Reduce reliance on manual or staff-assisted processes by enabling registrants to securely access registration information, submit requests, respond to deficiencies, provide supporting documentation, receive correspondence, and track pending actions.

• Establish mechanisms for validation, data standardization, duplicate detection, data reuse, and integration with authoritative sources to improve the accuracy, completeness, consistency, and reliability of registration data.

• Leverage configurable business rules, workflow automation, validation, notifications, and routing to reduce manual processing and improve consistency and timeliness.

• Provide registrants with visibility into the status of applications, renewals, modifications, deficiencies, and other requests while maintaining the confidentiality and security of DEA’s internal processes.

• Provide authorized DEA users with the ability to configure forms, workflows, routing, business rules, notifications, and other operational elements as requirements and policies evolve, without requiring extensive vendor redevelopment.

• Protect sensitive registrant and DEA information through appropriate identity and access management, encryption, auditing, logging, privacy protections, accessibility, and applicable federal security and compliance requirements.

• Provide DEA with reliable, timely data and configurable reporting and dashboards to support workload management, program oversight, performance measurement, operational decision-making, and identification of trends.

• Establish a modern architecture capable of securely integrating with applicable DEA, DOJ, Federal Government, and external systems and authoritative data sources.

• Provide a modern, scalable, and maintainable solution capable of supporting changes in registration volumes, business processes, regulatory requirements, technology standards, and future mission needs.

• Provide an extensible platform that can incorporate emerging technologies, including artificial intelligence and advanced analytics, while ensuring such capabilities are transparent, explainable, auditable, governance, and subject to DEA control.

6. Industry Questions

1. Provide your Company’s North American Industry Classification System (NAICS)

Codes.

2. Does your company (or teaming partnerships) have an existing contract for a system or services like the ones described in this Request for Information? If so, can you share contract information.

a. Please provide a point of contact for the agency’s requirement.

b. Does the other agency permit ordering from their contract vehicle?

3. Describe Data Rights Clauses that are generally applied to this type of requirement.

Please indicate one of the following:

Federal Acquisition Regulation (FAR) 52.227-14 Rights in Data-General - May 2014

• Unlimited rights

• Limited rights

• Restricted rights

4. How do you ensure that DEA data used to train, fine-tune, or prompt the AI remains strictly within the agency's data boundary?

5. What is your approach to managing data flow and API agreements between custom microservices and third-party SaaS platforms?

6. What is your recommended approach (SaaS/COTS, customized, etc.)? If hybrid, identify which capabilities would be delivered through SaaS, which would be customized/configured, and which legacy capabilities would be modernized or replaced?

7. What SLAs would you recommend (e.g., system uptime, API response, ticket resolution)?

8. Have you deployed similar systems in other federal agencies, to include supporting the submission of online reports from the public in multiple formats, with resulting data centralized within a single database or data repository? How could DEA leverage those deployments to accelerate implementation?

9. Implementation Timeline: Based on your current platform maturity, what is your estimated implementation timeline for a fully functional system?

10. Contract Structure: What acquisition and licensing structures (e.g., FFP, modular CLINs, enterprise license, per applicant) have you used for similar projects, and which would you recommend for DEA? Do you currently have a BPA with DOJ?

11. Data & Hosting:

a. What hosting models do you recommend for the proposed solution and why?

b. What hosting models do you support (SaaS/cloud, government cloud, on-premises, hybrid)?

c. Can your solution support a hybrid architecture, if required?

12. Compliance & Security:

a. Confirm your current FedRAMP authorization level and hosting model. How do you ensure DOJ/DEA/FISMA and Section 508 compliance?

b. Has any agency or FedRAMP revoked an Authority to Operate (ATO)? If so, why?

c. Has your solution ever been the victim of a significant cybersecurity incident? If so, please provide all non-proprietary information.

7. Response Instructions

Interested parties are requested to submit their responses electronically NLT October 20, 2026. All communications shall be submitted via email. Telephone calls with not be entertained. Please submit responses to the following POCs:

• Alicia Thomas at Alicia.n.thomas@dea.gov

• FAC.Proposal.Submission@dea.gov

Any questions to this RFI should be submitted to the above referenced emails no later than Wednesday, September 30, 2026.

Vendors should limit their substantive responses to no more than 40 (8.5 x 11 sheet) pages, excluding the cover page, table of contents, requested appendices, and product literature or other supplemental materials specifically identified by the respondent.

Include the following:

• Company Information

• Company Name

• CAGE Code

• POC (Name/Phone/Email)

• UEI

mailto:Alicia.n.thomas@dea.gov mailto:FAC.Proposal.Submission@dea.gov

• FedRAMP #

• ROM Pricing (additional information below)

In addition, vendors should respond to each item in #6, and limit responses to no more than two 8.5 x 11 sheets per question/item, with font size no less than 12-point.

8. Rough Order of Magnitude (ROM) Request

Interested parties must provide as detailed as possible, rough order of magnitude outlining, at a minimum, the following anticipated cost factors:

1. Licensing Costs

a. Provide Average Annual Cost for this experience

b. Provide Licensing Structure (i.e. per user, per core, etc.)

c. Provide Pricing Tiers, if applicable

d. Additional/Add-on Licenses, if applicable

e. Additional Fees, if applicable

i. What the fees are derived from

2. Cloud/Software Costs

a. Identify the Hosting CSP and Environments (i.e. GovCloud vs Vendor Cloud or Hybrid)

b. Provide Average Annual Storage Costs for this experience

c. Provide Annual Compute Costs for this experience

d. Provide Software version and license counts, if applicable

3. Implementation/Integration Labor Costs

a. Provide Average Annual Development Costs

i. Provide number of Full-Time Employees (Labor categories, if possible)

b. Provide Average Annual Operation and Maintenance Costs

i. Provide the number of Full-Time Employees (Labor categories, if possible)

4. Training and Documentation

5. Data Migration or egress costs

6. Costs between different FedRAMP environments

7. AI related costs

Reference materials and counts:

User Count:

*INTERNAL USERS *EXTERNAL USERS

9,028 2,603,659

* The table reflects user accounts across Diversion Control Division applications. Because one user may have accounts in multiple applications, totals do not represent unique users and underscore the need for integrated account and application management.

Database and table sizes:

TABLE NAME SUM OF STORAGE (GB)

TABLE 1 4635.8

TABLE 2 1422.47

TABLE 3 449.79

TABLE 4 107.56

TABLE 5 1810.6

TABLE 6 36.6

TABLE IN GB 8463

TABLE IN TB 8

9. Terms & Definitions

Term Definition

Artificial Intelligence (AI) The capability of a machine-based system to perform tasks that typically require human intelligence, such as learning, reasoning, pattern recognition, prediction, or decision support.

AI-Enabled Capability A system function that uses artificial intelligence or machine-learning techniques to perform, augment, or support a business or operational function.

AI-Ready Architecture A system architecture capable of supporting future AI-enabled capabilities without requiring AI functionality for core system operations.

Application Programming Interface (API) A defined mechanism that enables software applications or systems to securely exchange data or invoke functionality.

Authority to Operate (ATO) The formal authorization for a system to operate within an identified operational environment based on an assessment of applicable security and privacy requirements.

Authoritative Data Source A designated source of data recognized by the Government as the authoritative source for a specific data element or data set.

Configuration

The use of existing platform functionality, settings, rules, workflows, or administrative capabilities to meet business requirements without modifying the underlying application source code.

Customization Development or modification of software functionality beyond the standard capabilities of the proposed commercial or SaaS platform to satisfy a specific Government requirement.

Data Accuracy The degree to which data correctly represents the underlying person, transaction, event, or other entity it is intended to represent.

Data Completeness The degree to which required data elements are present and populated in accordance with established requirements.

Data Integrity The preservation of data accuracy, consistency, completeness, and reliability throughout its lifecycle.

Data Migration The process of extracting, transforming, validating, reconciling, and loading data from existing systems into the modernized solution.

Data Quality The degree to which data is accurate, complete, consistent, timely, valid, and fit for its intended use.

Data Repository A centralized or logically integrated location in which data is stored, managed, and made available to authorized users or systems.

FedRAMP

The Federal Risk and Authorization Management Program, which provides a standardized approach to security assessment, authorization, and continuous monitoring of cloud products and services used by the Federal Government.

Hybrid Architecture An architecture that combines two or more deployment or technology models, such as SaaS/cloud, Government cloud, on-premises, or other approved environments.

Integration The technical connection and exchange of data or functionality between two or more applications, systems, services, or data sources.

Interoperability The ability of systems, applications, and data sources to exchange, interpret, and use information consistently and securely.

Outcomes-Based Contracting (OBC) An acquisition approach that establishes measurable outcomes or performance objectives and aligns contractor performance with achievement of those outcomes.

Performance Measure A quantitative or objectively verifiable indicator used to evaluate achievement of a specified operational, technical, compliance, or mission outcome.

Performance Threshold A defined minimum or maximum level of performance that must be achieved for a specified measure.

Registrant An individual or entity authorized or seeking authorization to handle controlled substances or listed chemicals under applicable DEA requirements.

Rough Order of Magnitude (ROM) A preliminary, non-binding estimate of anticipated costs provided for acquisition planning and market research purposes.

Scalability

The ability of a solution to accommodate changes in users, transaction volumes, data volumes, integrations, processing demands, or other defined workload requirements while maintaining established performance levels.

Service Level Agreement (SLA) A defined service-performance commitment establishing measurable service levels, measurement methods, and applicable performance thresholds.

Single Sign-On (SSO) An authentication capability that allows an authorized user to access multiple approved applications or services using a single authentication event or credential set.

Software as a Service (SaaS) A software delivery model in which the provider hosts and operates the software and makes it available to authorized users over a network.

System Availability The percentage of defined operating time during which a system or service is operational and accessible in accordance with established availability criteria.

System of Record A system designated as the authoritative source for maintaining a specific category of official records or data.

Throughput The volume of transactions, requests, records, or other defined workload that a system can process within a specified period while meeting applicable performance requirements.

Transaction A discrete business or system activity that creates, modifies, retrieves, validates, processes, or otherwise acts upon data within the solution.

User An individual, system, or service authorized to access or interact with the solution.

Workflow A defined sequence of business activities, tasks, decisions, routing, approvals, or notifications used to process a transaction or business function.

Appendix A: Application Descriptions

DC_Applications_A ppendix.xlsx