Deliverables .xlsx

This is a Deliverables document for the West Virginia Immunization Information System (IIS) contract, outlining mandatory requirements and vendor responsibilities for delivering a cloud-based immunization management platform. The contract specifies that the IIS must be cloud-hosted by the vendor, compatible with major browsers, and operationally efficient on standard desktop and laptop computers. Key deliverables include hosting architecture documentation at proposal submission and implementation, browser compatibility test results prior to go-live with annual updates, performance testing reports, accessibility verification confirming browser-only access, and comprehensive maintenance and support services including help desk, patch management, monitoring, upgrades, and documentation. The vendor must establish a dedicated project manager within 15 days of contract award, conduct an initial planning session within 30 days of contract execution, and submit a finalized Project Plan and Schedule within 10 days following that session. Training requirements include digital training videos and user guides to be completed prior to system go-live, and the vendor must provide a staffing plan at contract execution with updates as staffing changes occur.

The contract imposes extensive security and compliance requirements, including FedRAMP Moderate or High authorization, FIPS 140-2/3 validated cryptography, TLS compliance per NIST standards, SOC 2 Type II audit reports due within 60 days of contract execution with annual renewals, annual penetration testing with remediation plans, and continuous SAST/DAST scanning with findings remediated within 30 days. Additional mandatory deliverables include business continuity and disaster recovery plans aligned with NIST SP 800-34, annual BCP/DR testing and certification, data residency certification confirming all data storage in the United States, an incident response plan aligned with OMIS procedures per NIST SP 800-61, documented Secure Software Development Lifecycle processes, third-party component tracking, and a completed Vendor Attestation Form. All deliverables require Agency approval or verification, with ongoing monitoring and annual compliance certifications throughout the contract period.