Deliverables .xlsx

This is a Deliverables spreadsheet for West Virginia's Immunization Information System (IIS) procurement, detailing mandatory requirements and acceptance criteria for the vendor-managed cloud-based system. The IIS must be cloud-hosted by the vendor, compatible with major browsers, and operational on standard desktops and laptops without elevated user permissions. The vendor is responsible for delivering hosting architecture documentation at proposal and implementation stages, browser compatibility test results prior to go-live and annually thereafter, performance test results prior to go-live, and accessibility verification reports prior to system launch. Additional deliverables include a comprehensive maintenance and support plan covering help desk services, patches, monitoring, upgrades, and documentation at contract execution with ongoing updates, plus a data residency certification at contract execution and annually to ensure all data is stored exclusively in the United States.

The vendor must provide Business Continuity/Disaster Recovery (BCP/DR) plans within 60 days of contract execution, including a statement of alignment with NIST SP 800-34 standards, annual testing with summary reports and corrective actions due within 30 days of test completion, and annual BCP/DR certifications. Security-related deliverables include FedRAMP Moderate or High authorization proof, FIPS 140-2/3 validated cryptography documentation, TLS compliance per NIST SP 800-52 with configuration documentation and test results, SOC 2 Type II audit reports within 60 days of contract execution and annually thereafter, annual penetration testing and vulnerability management reports, secure software development lifecycle documentation, and Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) scan reports on an ongoing basis. The vendor must also provide staffing plans within 15 days of contract award identifying assigned resources, a named Project Manager within 15 days of award, a finalized Project Plan and Schedule within 10 days of the initial planning session, digital training videos and user guides prior to go-live, third-party component inventory tracking, continuous monitoring reports, and incident response plans aligned with NIST SP 800-61 with annual exercise reports, all subject to Agency approval and verification.