DoIT_Technical_Questionnaire_1_(1)_(2).pdf

Rev: 20210806

Company Name:

Technical Contact Name:

Department/Group:

Telephone:

E-Mail:

4.1.1 Identity and Authentication

1. What mechanisms are employed for user authentication?

2. Is Single-Sign On (SSO) to the City’s on-premises Active Directory supported? If so, how (e.g. ADFS, SAML, Azure AD Authentication etc.)?

3. Is RADIUS to the City’s on-premises or SaaS AAA service supported? If so, how?4. Is Multi-Factor Authentication (MFA) to the City’s on-premises or SaaS MFA service supported? If so, how?

4.1.2 Application and Data

5. Is security centrally controlled within the solution through automatically applied policies?6. Is role-based security supported within the solution? If so, how?7. Are customer-specific security policies supported?

8. Is data encrypted in transit, end-to-end, between the client/endpoint system the hosted / SaaS solution?9. Is data encrypted at rest within the application service, including but not limited to the database?10. Describe the encryption technologies used for protecting data storage or communications.11. Are customer data co-located within the same database? If so, is there an option for single tenancy?

4.1.3 Server and Datacenter

12. Describe the security measures in place to vet employees and to control and audit employee access to customer data.

13. Describe the security measures in place for the solution’s infrastructure.14. Describe the security procedures in place to protect the data center(s) and physical assets where the infrastructure and/or application(s) and/or data is hosted.

15. Describe the security audit and/or testing procedures in place for processes, infrastructure, code, etc.

16. Do you follow a documented SDLC process? If so, is that process regularly audited and is a recent audit report available for review?17. Have you completed a recent SSAE18 SOC 2 or SOC 3, Type I or

Type II audit report? If so, can a copy be provided as part of this

18. Does the proposed solution meet the requirements of PCI DSS, HIPAA and CJIS standards where applicable? If so, please describe the ways in which you comply; for PCI, describe compliance with various sections of the DSS.

19. Is virtualization utilized within the proposed solution? If yes, where, why?

4.2 Data

20. Do customers have control over the geographic location(s) in which their data is stored? If so, list the countries to which customer may restrict their data.

21. What are the terms governing ownership of data?

22. How easy is it to export customer data from the service to move to a new service? Are there any charges for exporting data? What formats are supported in which to export data?

23. Is customer data stored in systems other than online databases

(e.g. flat files, LDAP directories, etc.)?

24. Can data for a single customer be restored?

25. If data can be restored for a single customer, how and what impact is there to other customers and/or other customers’ data?26. What terms and SLA have been defined around data restoration?

27. Are additional copies of customer data kept aside from the live online dataset? If so, how many copies of customer data are 28. If additional copies of customer data are maintained, are they stored in different geographic regions, and if so in which states or 29. What are the implications for the customer that result from differences in local laws governing security and privacy of user data in those states or countries?

30. Does customer data ever leave your custody, such as for third-party backup or archival services or tape storage, etc.?

31. Describe the process for deleting customer data on request or upon termination of service.

32. Do you use customer’s data for any non-customer-driven purpose? Examples may include but are not limited to offering advertisements based on the data content, providing information

(aggregate, demographic, behavioral or otherwise) for third-party marketing, content scanning to provide contextual services, etc.

33. What is policy when served with a subpoena that covers customer data or the systems upon which customer data is

4.3 Integration

34. Describe ways in which your application can or does integrate with customer-hosted systems, customer-licensed services, or other

3rd party applications, services or systems.

35. Is there a published API to support READ ONLY access to the service and/or data within the service? If so, please detail which 36. Is there a published API to support WRITE access to the services and/or data within the services? If so, please detail which fields are 37. If either API is available, are there additional charges for use of either the READ ONLY or WRITE access? Is so, please detail these

4.4 Network

38. Explain in detail and list all required TCP/UDP ports, source and destination and define the direction (inbound or outbound) in which communication is initiated between a client on the City network and the externally hosted solution.

39. What is the minimum bandwidth requirement for accessing the solution? What is the recommended bandwidth?

40. How many physical communication ports are required to connect the proposed solution to the City’s enterprise network?

Please identify the number of ports needed as well as the minimum

(and maximum, if applicable) speeds for each port.

41. Does the proposed solution require a direct fiber connection to the City’s fiber network backbone resources? 42. List any network-related hardware that the City is required to provide for this solution.43. Does the proposed solution require QoS or multicast support?

Are there maximum latency requirements? If so, please provide full

44. Does the proposed solution require and/or support encryption of the network communication (e.g. IPSec or SSL)?

45. Is there a VPN component to the proposed solution?

46. If a VPN component is involved, what type of VPN solutions are proposed (site to site, IPSec, SSL/TLS, etc.)? Please describe VPN 47. If a VPN component is involved, is it compatible with two-factor authentication? If so, describe the different two-factor implementations supported.

48. Does the proposed solution require any wireless connection

(WiFi, 4G LTE, Microwave broadband network)?49. Does the proposed solution utilize telephone connectivity of any type? If so, please list all telephone line requirements including equipment, line types and (e.g. modems, T1s, POTS lines, etc.).

CITY OF PASADENA

Department of Information Technology (DoIT)

Technical Assessment Questionnaire

1.0 PURPOSE

The City of Pasadena Department of Information Technology (DoIT) is tasked with reviewing all IT solutions proposed for use by the City. DoIT uses this questionnaire to assess various business, security, and/or operational impacts of vendor proposed technology solutions, SaaS offerings, software or hardware that will reside on the City’s servers and/or network, that will integrate to the City’s existing applications, servers and/or network, or that may have an impact on the

City’s ability to conduct business. This questionnaire is also used to identify and distinguish at an early stage in the evaluation process the potential roles and responsibilities of the City and the proposer.

2.0 INSTRUCTIONS

Complete Section 3.0, Vendor Contact Technical Information. If the proposed solution will be hosted externally, complete Section 4.0, Externally Hosted/SaaS Questionnaire; otherwise skip to Section 5.0, City

Hosted/On-Premise Questionnaire for solutions that will be hosted on the City’s servers and/or network. Conclude the questionnaire by signing and dating Section 6.0, Signature Page.

3.0 VENDOR CONTACT TECHNICAL INFORMATION

Monarch Information Systems

Cynthia Guardado

Estimator

(213) 773-1525 cynthiag@monarchus.net

4.0 EXTERNALLY HOSTED / SAAS APPLICATION QUESTIONNAIRE

The questions below assist DoIT in evaluating the security and operational aspects of potential hosted and SaaS solutions. The more questions that are answered the more DoIT is able to make an accurate assessment of the proposed solution and its impacts to the City’s existing and planned technology components. If clarification is needed, please contact the party from whom this questionnaire was provided.

4.1 Security

Vendor Answer

IAM with SSO via Google Workplace

NO

NO

NO

Vendor Answer

All Employee based applications are cloud based and accessed via IAM yes not applicable

Yes via VPN encryption not applicable

For employee based devicess all data is encrypted via EFS and Bitlocker for windows and APFS for apple.

not applicable

Vendor Answer

We use Google Workplace audit tools

Our office uses Palo Alto Firewall and VPN connections to the outside (majority of all our applications are cloud based)

We do not host any data locally

We review Cortex XDR and Google Workplace logs monthly. Both of these systems provide real-time alarms and protection.

no no no

Vendor Answer we do not store customer data not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable

Vendor Answer not applicable not applicable not applicable not applicable

Vendor Answer

Secure Web/VPN, Citrix (External) TCP - 443, Citrix (Internal) TCP- 1494 / 2598, Remote Deskto TCP/UDP 3389. These would be all outbound to us. We do not provide any services that would require inbound to our network.

not applicable not applicable no not applicable not applicable not applicable not applicable not applicable not applicable not applicable

50. Who is expected to provide ongoing monitoring, maintenance and support for the network and/or telephone components of the

4.5 Operations

51. How is the application/service accessed (e.g. via web browser, locally installed “fat” client, Microsoft Office, etc.)?

52. If access is via a web browser, are there additional client-side components requirements? For example, is Java or ActiveX 53. If access is via a web browser, which browsers versions and platforms are supported? For example, Microsoft Internet Explorer v11 or Microsoft Edge (EdgeHTML v13+); Mozilla Firefox v40+ for

Windows, Macintosh, or Linux; Google Chrome v47+ for Windows, Macintosh, or Linux; Apple Safari v9+ for Macintosh; etc.

54. Is the application fully supported when accessed via Citrix

XenApp, Microsoft Terminal Services/RDS, VDI, or other application 55. Do you offer mobile device access to the application/service? If mobile access is via a mobile device’s web browser, what are the

56. What additional user interfaces are planned for the application/service?57. How is versioning of the application/service managed? How often are minor version updates released? How often are major 58. Can versions vary for each customer who utilizes the application/service? If so, how? If not, why not?59. Describe the lifecycle of the service and client pieces of the application. How are updates/patches and upgrades carried out

5.1.1 Pre-Deployment Certification

5.2 Acknowledgement

I have read, understand and accept the above statements:

Explanation:

5.3 Application and Database Questions

1. Does the proposed solution require a database? If so, which database server software is required (e.g. Microsoft SQL, Oracle, 2. If there are multiple editions of the database server software, which edition is required (e.g. Express, Standard, Enterprise, etc.)?3. If required, can the database server software be patched to current (as of the date of response to this questionnaire) Service 4. How is database security handled?

5. What is the maintenance lifecycle of the application, server and client pieces as applicable? Please describe each in the context of 6. Does the application require or otherwise make use of the

Microsoft .NET framework? If so, which specific version of the .NET framework is required?

7. Is the application forward compatible with all versions of the

.NET framework supported by Microsoft? See Microsoft .NET 8. Is the application supported at the most current (as of the date of response to this questionnaire) .NET Service Pack, patch and public

.NET 3.5 SP1:

.NET 4.5.2:

.NET 4.6:

9. Are there specific requirements for integration to existing City systems such as Tyler Munis, Tyler EnerGov, ESRI ArcGIS, Microsoft

Exchange, etc.? If so, please list all that apply and explain the necessary integration points or features.

10. Does the solution require access to an SMTP mail relay?

11. Does the solution support SSL or TLS encrypted connections to the relay?12. Please describe what type of information is relayed, how often it occurs, and what process, workflow or action is the trigger for 13. Are other e-mail or Message Queuing services required? If so, please explain the requirements in detail.14. Once deployed into production at the City, who will be responsible for administration and support of the following Service/Application:

Database:

Operating System:

System Hardware:

15. Is Active Directory (AD) integration supported for authentication and authorization? Which forms of AD integration are supported? Direct domain (aka native Windows authentication):

LDAP:

ADFS:

SAML:

16. If AD integration is not supported, how is authentication handled? How is authorization handled?17. Is a web server required as part of the solution?

18. If a web server is required, is Microsoft Internet Information

Services supported? What specific versions of IIS are supported and/or required for particular functionality?

19. If a web server is required, can the web server/IIS be located on a remote system?20. Does the solution need an interface accessible to or from the internet? If so, is SSL encryption supported for web-based internet 21. Is it expected that the solution be accessible by the general public on the internet? 22. Is the solution compatible with end-to-end SSL encryption for such access?

23. Is the solution compatible with deployment to 3rd party hosting environments or public cloud providers?24. Does the application run as a service on the server?

25. If the application does not run as a service, how is the application instantiated and run at the server?26. In what form are application updates distributed (web download, FTP, physical media, etc.)? How are application updates not applicable

Vendor Answer not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable

5.0 CITY HOSTED/ON-PREMISES ENTERPRISE SOFTWARE QUESTIONNAIRE

Section 5.1 describes the server environment for the City and the minimum specifications that are required of all applications, IT services, systems, and equipment hosted on City servers and/or hosted within

5.1 Description of City IT Environment

City IT resources are maintained by DoIT and provided as services to the enterprise or one or more Departments of the City. The City’s standard hardware platform is rack mounted servers from the HP Proliant

DL product line deployed in highly available, environmentally controlled data center environments owned by the City or appropriate 3rd party colocation facilities. The City maintains a virtual server and private cloud preference to meet its compute and storage needs, and aggressively pursues opportunities to deploy all services on the City’s cloud infrastructure. Servers hosting the City’s applications are maintained patch compliant, and for those using Microsoft Windows operating systems, are patched monthly according to Microsoft patch update schedules. All applications, services, systems and hardware are fully documented in architecture, application, networking and service dependency diagrams where applicable. Vendor-supplied solutions must include relevant diagrams in electronic form (Visio format preferred) detailing the solution’s architecture including all network ports (one-way or two-way), protocols, systems involved, and known dependencies.

In addition, City servers:

• Are running anti-malware/anti-virus software.

• Are backed up for disaster recovery by enterprise-class backup application(s) that may include locally installed agents for bare metal, file, and/or database backup.

• Utilize Microsoft licenses obtained under the City’s Enterprise Agreement, where applicable.

• Have unnecessary services removed, if not expressly required by the application or system.

• Use least privilege permissions, authentication, and authorization applied, as applicable.

• Are joined to and managed by the City’s Active Directory domains and Group Policy will be applied.

• Utilize Active Directory domain accounts by default for system access, application access, and running Windows services. Non-domain account usage in the implementation of any system must have a clear requirement documented and explained.

The City operates IT resources and provides access to IT services in line with the principle of least privilege. Applications, services and systems operated or hosted by the City will only be given the rights appropriate, necessary and required to provide expected functionality.

If the proposed solution requires “network shares” explicit and detailed ACL-based permission must be defined and configured on the share(s). Access to network shares by EVERYONE, DOMAIN USERS or

ANONYMOUS are by default not acceptable configurations and any exception must be clearly documented as to how solution functionality would be impacted by using a discrete access control list model.

During a project's development phase, DoIT will arrange remote access for the vendor, when necessary, using a web-based SSL VPN. The vendor must comply with the City's security policies for VPN access, acceptable use, server security, etc. Once a system is in "production," vendor access will be handled via DoIT’s Service Center following standard internal processes for establishing vendor/contractor access accounts, and in full compliance with the City’s IT Change Management as applicable. All remote access will be logged and monitored.

Vendor permissions during development are granted based on the principle of least privilege.

During the development/deployment cycle any system or service may be required to only be physically powered on for installation, changes, testing and/or code development/deployment. At all other times during development/deployment cycle the system will be powered off until the formal GO LIVE production date.

DoIT operates a Pre-Deployment Certification for systems being put into production. Pre-Deployment Certification happens after the application or service is fully installed and tested. The process may require up to 30 days to complete and Pre-Deployment Certification is to be factored into the project schedule. Any GO LIVE date must be coordinated with DoIT and account for the Pre-Deployment Certification scheduling. The vendor must plan for their technical resources to be available after the installation of system and before the production GO LIVE date to deliver timely technical assistance and remediate any issue(s) discovered during the Certification phase as needed.

The Pre-Deployment Certification phase may include but is not limited to:

Verification that all unnecessary services have been identified and removed or disabled. Services upon which the vendor solution has a necessary dependency must be fully documented as part of the solution’s documentation deliverables.

Verification of least privilege NTFS permissions, authentication, and authorization have been appropriately applied.

System(s), service(s) and application(s) monitoring has been appropriately documented, configured, tuned and tested as part of development/deployment.

Appropriate levels of system(s), service(s) and/or application(s) auditing have been documented, configured, tuned and tested as part of development/deployment.

Necessary and appropriate exclusions have been documented, configured and tested for server and/or client anti-malware/anti-virus applications.

Necessary and appropriate backup configurations and exclusions have been documented, configured, and tested. Extra time for systems with SQL databases should be taken into account in the project schedule.

Associated security template configurations and Group Policies for the server(s), system(s), service(s) and/or application(s) are properly applied and functioning as expected.

All server(s), system(s), service(s) and application(s) documentation is complete, archived for reference with associated project files, and published as appropriate for support and/or end user reference.

5.1.2 GO LIVE and Production

Once the system is live and passed production-ready checks all changes must go through DoIT’s Change Management process, including coordination with other scheduled IT changes. Once a system is in production, vendor access will be handled via DoIT’s Service Center following standard internal processes for establishing vendor/contractor access accounts, and in full compliance with the City’s IT Change

Management as applicable. All remote access will be logged and monitored.

5.1.3 Server Lifecycle and Retirement

DoIT’s standard server lifecycle management operations include a server retirement process. Solution vendors must identify the expected lifecycle of their solution and when the retirement of an existing system needs to be considered.

Please indicate your acceptance of the above statements within section 5.1. If any statement is unacceptable and/or unsupportable for the development or deployment of the proposed solution, please explain below with an appropriate level of detail. Non-acceptance of any statement does not automatically disqualify proposal from consideration, however DoIT reserves the right to use compatibility with the City’s existing operating environment in its evaluation and recommendation of any proposal.

Vendor Answer

YES

Vendor Answer not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable

28. What, if any, third party software is required to enable or support the solution (e.g. Java runtime, Adobe Flash, etc.)? For each requirement which edition(s) and/or version(s) of the software are required?

29. How will the installation, development and deployment of the proposed solution take place (e.g.locally onsite, via shared remote

5.4 Server and Storage Systems Questions

30. On what versions of Microsoft Windows Server is the service/application supported? Be specific and include full release notation as appropriate. (The City follows a Microsoft Operating

System Lifecycle and currently utilizing Server 2016 or greater)

31. Can Windows Server be patched to current (as of the date of response to this questionnaire) Service Pack, Patch and public hotfix 32. Is the service or application supported as a virtualized server running on Nutanix AHV? If not, explain in detail what about the 33. As part of the release to GO LIVE/production all vendor-specific access and system permissions are removed. Are there vendor-specific access requirements or system permission that are necessary for the City to successfully host the proposed solution moving forward? If so, detail what access and/or system permissions must be retained for the vendor and provide a full explanation for why that is so.

34. All service, application, and access accounts for City systems are domain-based. Is the service/application compatible with domain-

35. Identify the full set of accounts necessary for installation, operation and administration of the solution. Include a detailed listing of the permission requirements for each account. Where supported by the service/application separate service accounts will be created for separate functions, modules, components, and services, etc.

36. Please list any systems-related hardware that the City is required to provide for this project.37. Is the client application web-based or a thick client?

38. If web-based, does the client rely upon any additional components or libraries other than HTML and Javascript (e.g. 39. If web-based, what browser platforms on what operating systems are supported? Please be specific and inclusive (for example, Microsoft Internet Explorer v11 or Microsoft Edge

(EdgeHTML v13+); Mozilla Firefox v40+ for Windows, Macintosh, or

Linux; Google Chrome v47+ for Windows, Macintosh, or Linux;

Apple Safari v9+ for Macintosh; etc.).

40. If web-based, is the user experience conducive to use on mobile devices? If so, which devices and operating systems have been tested for compatibility (e.g. Apple devices running iOS v7+, Android based devices running Android 4.2+, Windows-based devices running Windows Phone 8+, etc.)?

41. Who is responsible for providing ongoing administration and maintenance support for the system?42. Anti-malware software is required on all City server systems.

Please detail any file-level exclusions that must be made with the 43. Enterprise-class backup operations are required on all City server systems. Please detail any necessary considerations that must be made for files and/or directories that are part of the service or application to avoid negatively impacting either the backup operations or the uninterrupted function of the service or application.

44. Please detail any 3rd party or non-server-standard hardware that must be attached to the system (e.g. license dongles, telephone 45. The City utilizes a SAN, and we primarily use Hyper-Converged

Resources. Is the proposed solution compatible with SAN-based 46. If the solution is not compatible with a SAN or Hyper-Converged

Resources, please explain the known compatibility issues with using

SAN storage and when it is expected that the solution will support

SANs.

47. If the solution is not compatible with a SAN, please detail the direct attached storage disk configuration recommended for the 48. Based upon how the City expects to utilize the proposed solution, please provide an estimated growth trend to cover the 49. All non-essential Windows services will be disabled by default.

Clearly identify all Windows services that are required by the solution to deliver the proposed functionality.

5.5 Network Systems Infrastructure Questions

50. Does the proposed solution require access to the Internet? If yes, explain in detail and list all required TCP/UDP ports, source and 51. What is the minimum bandwidth requirement? What is the recommended bandwidth?52. How many physical communication ports are required to connect the proposed solution to the City’s enterprise network? 53. Does the proposed solution require a direct fiber connection to the City’s fiber network backbone resources? If so, please provide full details on this requirement.

54. Please list any network-related hardware that the City is required to provide for this solution.55. Is the proposed solution compatible with the assignment of a private IP address segment to the solution? 56. If compatible with private IPs, does the proposed solution require and/or support NAT?57. If the solution is NAT compatible, please define if that is one-to-one or one-to-many.58. Does the proposed solution require QoS or multicast support?

Are there maximum latency requirements? If so, please provide full 59. Does the proposed solution require and/or support encryption of the network communication (e.g. IPSec or SSL)?

60. Is there a VPN component to the proposed solution?

61. If a VPN component is involved, what type of VPN solutions are proposed (site to site, IPSec, SSL/TLS, etc.)? Please describe VPN

62. If a VPN component is involved, is it compatible with two-factor authentication? If so, describe the different two-factor 63. Does the proposed solution require any wireless connection

(WiFi, 4G LTE, Microwave broadband network)? If so, please 64. Does the proposed solution utilize telephone connectivity of any type? If so, please list all telephone line requirements including equipment, line types and (e.g. modems, T1s, POTS lines, etc.).

65. Who is expected to provide ongoing monitoring, maintenance and support for the network and/or telephone components of the

5.6 Operations and Maintenance Questions

66. The City patches all server and client operating systems according to the OS manufacturer’s release cycle. Please detail any 67. Please detail the specifics of the backup operations and schedule that must be maintained for the specifics of this solution.68. During regular enterprise-based backups are there services or devices that must be stopped/shutdown to ensure a successful and 69. Are there specific operating system services which must be monitored to ensure full application availability? If so, please 70. What documentation – help, training, troubleshooting, administration, etc. – is included upon delivery of 71. What training opportunities exist for administering and maintaining the solution? Please detail them including location, 72. How are the installation files made available (download, optical media, etc.)? 73. Microsoft product licenses used by the City are purchased under existing agreements between Microsoft and the City. Please identify 74. Are there any recurring license fees associated with the proposed solutions? If so, please detail all recurring licenses,

5.7 Endpoint Client System Questions

75. How is the application/service accessed (e.g., via web, locally installed “fat” client, Microsoft Office, etc.)?76. If access is via a web browser, are there additional client-side components requirements? For example, is Java or ActiveX 77. If access is via a web browser, which browsers versions and platforms are supported? For example, Microsoft Internet Explorer v11 or Microsoft Edge (EdgeHTML v13+); Mozilla Firefox v40+ for

Windows, Macintosh, or Linux; Google Chrome v47+ for Windows, Macintosh, or Linux; Apple Safari v9+ for Macintosh; etc.

78. Is the application fully supported when accessed via Citrix

XenApp, Microsoft Terminal Services/RDS, VDI, or other application 79. Do you offer mobile device access to the application/service? If mobile access is via a mobile device’s web browser, what are the 80. What additional user interfaces are planned for the application/service?81. The City operates Microsoft Windows 10+ as the standard desktop environment. If an endpoint client application installation is required, is the application compatible with Windows 10+? If not, when will such compatibility be available?

82. What are the minimum hardware requirements on the client systems? Are there additional hardware peripherals required on the client (e.g. license dongles, DVD-RW, dual monitor, sound card, etc.)?

83. If an endpoint client application installation is required, is the installation deployable through Microsoft’s System Center 84. The City operates all IT resources, including endpoint clients, in line with the principle of least privilege. If an endpoint client application installation is required, is the client application fully compatible with a standard, non-administrator user account? If not, please explain in detail what the application does that requires elevated user rights on the client.

Company Name

Company Representative Name

Company Representative Title

Signature

Date not applicable not applicable not applicable not applicable not applicable not applicable

Vendor Answer not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable

Regional Manager

5/18/2025 not applicable not applicable not applicable

6.0 SIGNATURE PAGE

The responses above are true and accurate as of the date below representing:

Monarch Information Systems

Christina Saldana not applicable not applicable not applicable not applicable not applicable not applicable

Vendor Answer not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable not applicable

Vendor Answer not applicable not applicable not applicable not applicable not applicable

Vendor Answer not applicable