DoIT_Technical_Questionnaire.xlsx

XLSX spreadsheet 93 KB Posted

Attached to
Audio-Visual Control Room Management State and local contract opportunity
Solicitation number
2026-RFP-0298
Issued by
Los Angeles County, California

About this file

Written by GovTribe AI ·

This is a Technical Assessment Questionnaire document issued by the City of Pasadena Department of Information Technology (DoIT) for evaluating IT solutions proposed for use by the City. The questionnaire is designed to assess business, security, and operational impacts of vendor-proposed technology solutions, including SaaS offerings, software, and hardware that will integrate with or reside on the City's existing infrastructure. Vendors must complete the questionnaire to enable DoIT to distinguish early in the evaluation process the potential roles and responsibilities of the City and the proposer. The document contains comprehensive sections for externally hosted/SaaS applications and city-hosted/on-premises solutions, with detailed questions addressing security, data management, integration capabilities, network requirements, operations, and endpoint systems.

The questionnaire requires vendors to provide extensive technical information across multiple categories, including identity and authentication mechanisms, data encryption protocols, application access methods, database requirements, Windows Server compatibility, storage considerations, and ongoing maintenance responsibilities. Vendors must acknowledge acceptance of the City's IT environment standards, which include mandatory patch compliance, Active Directory integration, least-privilege access controls, anti-malware protection, and enterprise-class backup operations. The document establishes that the City prefers virtual server and private cloud deployments on HP Proliant servers in data center environments and requires pre-deployment certification before production go-live. All proposed solutions must be fully documented with architecture diagrams in Visio format detailing network ports, protocols, systems involved, and dependencies, with vendor technical resources required to remain available during the certification and go-live phases to address any identified issues.

View the file

Other files for this state and local contract opportunity

Other files attached to Audio-Visual Control Room Management, newest first.
File Type Posted
Audio-Visual_Control_Room_Management_(Addendum_#3_Revision).pdf PDF
2026-27_RFP_Stadium_Investment_Deck.pdf PDF
Disclosure_of_Lobbying_Activities.pdf PDF
Exclusive_Negotiation_Agreement__TEMPLATE.pdf PDF
Pasadena_Taxpayer_Protection_Amendment_Disclosure_(2).pdf PDF
REQUIRED_FORMS_-_AAs_-_SIG-LEGAL-STATUS_-_DECLARATION_OF_NONCOLUSION_08022024_v2.pdf PDF
Unique_Entity_ID_(SAM).pdf PDF
CONFLICT_OF_INTEREST_(5).pdf PDF
DESIGNATED_REPRESENTATIVESdocx.pdf PDF
Emergency_FEMA_TC.pdf PDF
MASTER_SERVICES_FOR_OPENGOV.pdf PDF
RELEVANT_EXPERIENCE_FORM.pdf PDF
Federal_Required_Certification_(4).pdf PDF
DISQUALIFICATION_DISCLOSURE_(4).pdf PDF
Show all 14

On GovTribe

Work with this file on GovTribe

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file
Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

DoIT Technical Questionnaire

CITY OF PASADENA

Department of Information Technology (DoIT) Technical Assessment Questionnaire

Rev: 20210806

1.0 PURPOSE
The City of Pasadena Department of Information Technology (DoIT) is tasked with reviewing all IT solutions proposed for use by the City. DoIT uses this questionnaire to assess various business, security, and/or operational impacts of vendor proposed technology solutions, SaaS offerings, software or hardware that will reside on the City’s servers and/or network, that will integrate to the City’s existing applications, servers and/or network, or that may have an impact on the City’s ability to conduct business. This questionnaire is also used to identify and distinguish at an early stage in the evaluation process the potential roles and responsibilities of the City and the proposer.
2.0 INSTRUCTIONS
Complete Section 3.0, Vendor Contact Technical Information. If the proposed solution will be hosted externally, complete Section 4.0, Externally Hosted/SaaS Questionnaire; otherwise skip to Section 5.0, City Hosted/On-Premise Questionnaire for solutions that will be hosted on the City’s servers and/or network. Conclude the questionnaire by signing and dating Section 6.0, Signature Page.
3.0 VENDOR CONTACT TECHNICAL INFORMATION

Company Name:

Technical Contact Name:

Department/Group:

Telephone:

E-Mail:

4.0 EXTERNALLY HOSTED / SAAS APPLICATION QUESTIONNAIRE
The questions below assist DoIT in evaluating the security and operational aspects of potential hosted and SaaS solutions. The more questions that are answered the more DoIT is able to make an accurate assessment of the proposed solution and its impacts to the City’s existing and planned technology components. If clarification is needed, please contact the party from whom this questionnaire was provided.
4.1 Security
4.1.1 Identity and AuthenticationVendor Answer
1. What mechanisms are employed for user authentication?
2. Is Single-Sign On (SSO) to the City’s on-premises Active Directory supported? If so, how (e.g. ADFS, SAML, Azure AD Authentication etc.)?
3. Is RADIUS to the City’s on-premises or SaaS AAA service supported? If so, how?
4. Is Multi-Factor Authentication (MFA) to the City’s

on-premises or SaaS MFA service supported? If so, how?

4.1.2 Application and DataVendor Answer
5. Is security centrally controlled within the solution through automatically applied policies?
6. Is role-based security supported within the solution? If so, how?
7. Are customer-specific security policies supported?
8. Is data encrypted in transit, end-to-end, between the client/endpoint system the hosted / SaaS solution?
9. Is data encrypted at rest within the application service, including but not limited to the database?
10. Describe the encryption technologies used for protecting data storage or communications.
11. Are customer data co-located within the same database? If so, is there an option for single tenancy?
4.1.3 Server and DatacenterVendor Answer
12. Describe the security measures in place to vet employees and to control and audit employee access to customer data.
13. Describe the security measures in place for the solution’s infrastructure.
14. Describe the security procedures in place to protect the data center(s) and physical assets where the infrastructure and/or application(s) and/or data is hosted.
15. Describe the security audit and/or testing procedures in place for processes, infrastructure, code, etc.
16. Do you follow a documented SDLC process? If so, is that process regularly audited and is a recent audit report available for review?
17. Have you completed a recent SSAE18 SOC 2 or SOC 3, Type I or Type II audit report? If so, can a copy be provided as part of this assessment if requested?
18. Does the proposed solution meet the requirements of PCI DSS, HIPAA and CJIS standards where applicable? If so, please describe the ways in which you comply; for PCI, describe compliance with various sections of the DSS.
19. Is virtualization utilized within the proposed solution? If yes, where, why?
4.2 DataVendor Answer
20. Do customers have control over the geographic location(s) in which their data is stored? If so, list the countries to which customer may restrict their data.
21. What are the terms governing ownership of data?
22. How easy is it to export customer data from the service to move to a new service? Are there any charges for exporting data? What formats are supported in which to export data?
23. Is customer data stored in systems other than online databases (e.g. flat files, LDAP directories, etc.)?
24. Can data for a single customer be restored?
25. If data can be restored for a single customer, how and what impact is there to other customers and/or other customers’ data?
26. What terms and SLA have been defined around data restoration?
27. Are additional copies of customer data kept aside from the live online dataset? If so, how many copies of customer data are maintained and for what purpose?
28. If additional copies of customer data are maintained, are they stored in different geographic regions, and if so in which states or other countries would the data reside?
29. What are the implications for the customer that result from differences in local laws governing security and privacy of user data in those states or countries?
30. Does customer data ever leave your custody, such as for third-party backup or archival services or tape storage, etc.?
31. Describe the process for deleting customer data on request or upon termination of service.
32. Do you use customer’s data for any non-customer-driven purpose? Examples may include but are not limited to offering advertisements based on the data content, providing information (aggregate, demographic, behavioral or otherwise) for third-party marketing, content scanning to provide contextual services, etc.
33. What is policy when served with a subpoena that covers customer data or the systems upon which customer data is maintained (online or offline)?
4.3 IntegrationVendor Answer
34. Describe ways in which your application can or does integrate with customer-hosted systems, customer-licensed services, or other 3rd party applications, services or systems.
35. Is there a published API to support READ ONLY access to the service and/or data within the service? If so, please detail which fields are available and/or provide a link to API documentation.
36. Is there a published API to support WRITE access to the services and/or data within the services? If so, please detail which fields are available and/or provide a link to API documentation.
37. If either API is available, are there additional charges for use of either the READ ONLY or WRITE access? Is so, please detail these charges.
4.4 NetworkVendor Answer
38. Explain in detail and list all required TCP/UDP ports, source and destination and define the direction (inbound or outbound) in which communication is initiated between a client on the City network and the externally hosted solution.
39. What is the minimum bandwidth requirement for accessing the solution? What is the recommended bandwidth?
40. How many physical communication ports are required to connect the proposed solution to the City’s enterprise network? Please identify the number of ports needed as well as the minimum (and maximum, if applicable) speeds for each port.
41. Does the proposed solution require a direct fiber connection to the City’s fiber network backbone resources?

If so, please provide full details on this requirement.

42. List any network-related hardware that the City is required to provide for this solution.
43. Does the proposed solution require QoS or multicast support? Are there maximum latency requirements? If so, please provide full details.
44. Does the proposed solution require and/or support encryption of the network communication (e.g. IPSec or SSL)?
45. Is there a VPN component to the proposed solution?
46. If a VPN component is involved, what type of VPN solutions are proposed (site to site, IPSec, SSL/TLS, etc.)? Please describe VPN requirements in details.
47. If a VPN component is involved, is it compatible with two-factor authentication? If so, describe the different two-factor implementations supported.
48. Does the proposed solution require any wireless connection (WiFi, 4G LTE, Microwave broadband network)?

If so, please provide full details of the requirement and all encryption, authentication and standards supported.

49. Does the proposed solution utilize telephone connectivity of any type? If so, please list all telephone line requirements including equipment, line types and (e.g. modems, T1s, POTS lines, etc.).
50. Who is expected to provide ongoing monitoring, maintenance and support for the network and/or telephone components of the solution?
4.5 OperationsVendor Answer
51. How is the application/service accessed (e.g. via web browser, locally installed “fat” client, Microsoft Office, etc.)?
52. If access is via a web browser, are there additional client-side components requirements? For example, is Java or ActiveX required at the client, does the web application utilize AJAX technologies, etc.?
53. If access is via a web browser, which browsers versions and platforms are supported? For example, Microsoft Internet Explorer v11 or Microsoft Edge (EdgeHTML v13+); Mozilla Firefox v40+ for Windows, Macintosh, or Linux; Google Chrome v47+ for Windows, Macintosh, or Linux; Apple Safari v9+ for Macintosh; etc.
54. Is the application fully supported when accessed via Citrix XenApp, Microsoft Terminal Services/RDS, VDI, or other application or desktop virtualization platform? If not, what are the known compatibility issues?
55. Do you offer mobile device access to the application/service? If mobile access is via a mobile device’s web browser, what are the minimum mobile browser versions that are supported? If mobile access is via an “app,” what specific mobile device hardware, OS and software platforms are supported?
56. What additional user interfaces are planned for the application/service?
57. How is versioning of the application/service managed? How often are minor version updates released? How often are major version updates released?
58. Can versions vary for each customer who utilizes the application/service? If so, how? If not, why not?
59. Describe the lifecycle of the service and client pieces of the application. How are updates/patches and upgrades carried out and when are they mandatory versus optional?
5.0 CITY HOSTED/ON-PREMISES ENTERPRISE SOFTWARE QUESTIONNAIRE
Section 5.1 describes the server environment for the City and the minimum specifications that are required of all applications, IT services, systems, and equipment hosted on City servers and/or hosted within City data center operating environments. Sections 5.3 through 5.7 ask questions that assist DoIT in evaluating proposed technology solutions. The more questions you are able to answer the more accurate DoIT’s technology evaluation will be. If clarification is needed, please contact the party that supplied this questionnaire for assistance.
5.1 Description of City IT Environment
City IT resources are maintained by DoIT and provided as services to the enterprise or one or more Departments of the City. The City’s standard hardware platform is rack mounted servers from the HP Proliant DL product line deployed in highly available, environmentally controlled data center environments owned by the City or appropriate 3rd party colocation facilities. The City maintains a virtual server and private cloud preference to meet its compute and storage needs, and aggressively pursues opportunities to deploy all services on the City’s cloud infrastructure. Servers hosting the City’s applications are maintained patch compliant, and for those using Microsoft Windows operating systems, are patched monthly according to Microsoft patch update schedules. All applications, services, systems and hardware are fully documented in architecture, application, networking and service dependency diagrams where applicable. Vendor-supplied solutions must include relevant diagrams in electronic form (Visio format preferred) detailing the solution’s architecture including all network ports (one-way or two-way), protocols, systems involved, and known dependencies.
In addition, City servers:

• Are running anti-malware/anti-virus software.

• Are backed up for disaster recovery by enterprise-class backup application(s) that may include locally installed agents for bare metal, file, and/or database backup.

• Utilize Microsoft licenses obtained under the City’s Enterprise Agreement, where applicable.

• Have unnecessary services removed, if not expressly required by the application or system.

• Use least privilege permissions, authentication, and authorization applied, as applicable.

• Are joined to and managed by the City’s Active Directory domains and Group Policy will be applied.

• Utilize Active Directory domain accounts by default for system access, application access, and running Windows services. Non-domain account usage in the implementation of any system must have a clear requirement documented and explained.

The City operates IT resources and provides access to IT services in line with the principle of least privilege. Applications, services and systems operated or hosted by the City will only be given the rights appropriate, necessary and required to provide expected functionality.

If the proposed solution requires “network shares” explicit and detailed ACL-based permission must be defined and configured on the share(s). Access to network shares by EVERYONE, DOMAIN USERS or ANONYMOUS are by default not acceptable configurations and any exception must be clearly documented as to how solution functionality would be impacted by using a discrete access control list model.

During a project's development phase, DoIT will arrange remote access for the vendor, when necessary, using a web-based SSL VPN. The vendor must comply with the City's security policies for VPN access, acceptable use, server security, etc. Once a system is in "production," vendor access will be handled via DoIT’s Service Center following standard internal processes for establishing vendor/contractor access accounts, and in full compliance with the City’s IT Change Management as applicable. All remote access will be logged and monitored.

Vendor permissions during development are granted based on the principle of least privilege.

During the development/deployment cycle any system or service may be required to only be physically powered on for installation, changes, testing and/or code development/deployment. At all other times during development/deployment cycle the system will be powered off until the formal GO LIVE production date.

5.1.1 Pre-Deployment Certification
DoIT operates a Pre-Deployment Certification for systems being put into production. Pre-Deployment Certification happens after the application or service is fully installed and tested. The process may require up to 30 days to complete and Pre-Deployment Certification is to be factored into the project schedule. Any GO LIVE date must be coordinated with DoIT and account for the Pre-Deployment Certification scheduling. The vendor must plan for their technical resources to be available after the installation of system and before the production GO LIVE date to deliver timely technical assistance and remediate any issue(s) discovered during the Certification phase as needed.
The Pre-Deployment Certification phase may include but is not limited to:
Verification that all unnecessary services have been identified and removed or disabled. Services upon which the vendor solution has a necessary dependency must be fully documented as part of the solution’s documentation deliverables.

Verification of least privilege NTFS permissions, authentication, and authorization have been appropriately applied.

System(s), service(s) and application(s) monitoring has been appropriately documented, configured, tuned and tested as part of development/deployment.

Appropriate levels of system(s), service(s) and/or application(s) auditing have been documented, configured, tuned and tested as part of development/deployment.

Necessary and appropriate exclusions have been documented, configured and tested for server and/or client anti-malware/anti-virus applications.

Necessary and appropriate backup configurations and exclusions have been documented, configured, and tested. Extra time for systems with SQL databases should be taken into account in the project schedule.

Associated security template configurations and Group Policies for the server(s), system(s), service(s) and/or application(s) are properly applied and functioning as expected.

All server(s), system(s), service(s) and application(s) documentation is complete, archived for reference with associated project files, and published as appropriate for support and/or end user reference.

5.1.2 GO LIVE and Production
Once the system is live and passed production-ready checks all changes must go through DoIT’s Change Management process, including coordination with other scheduled IT changes. Once a system is in production, vendor access will be handled via DoIT’s Service Center following standard internal processes for establishing vendor/contractor access accounts, and in full compliance with the City’s IT Change Management as applicable. All remote access will be logged and monitored.
5.1.3 Server Lifecycle and Retirement
DoIT’s standard server lifecycle management operations include a server retirement process. Solution vendors must identify the expected lifecycle of their solution and when the retirement of an existing system needs to be considered.
5.2 Acknowledgement
Please indicate your acceptance of the above statements within section 5.1. If any statement is unacceptable and/or unsupportable for the development or deployment of the proposed solution, please explain below with an appropriate level of detail. Non-acceptance of any statement does not automatically disqualify proposal from consideration, however DoIT reserves the right to use compatibility with the City’s existing operating environment in its evaluation and recommendation of any proposal.
Vendor Answer
I have read, understand and accept the above statements:YES / NO
Explanation:
5.3 Application and Database QuestionsVendor Answer
1. Does the proposed solution require a database? If so, which database server software is required (e.g. Microsoft SQL, Oracle, PostgreSQL, MySQL, etc.)?
2. If there are multiple editions of the database server software, which edition is required (e.g. Express, Standard, Enterprise, etc.)?
3. If required, can the database server software be patched to current (as of the date of response to this questionnaire) Service Pack, Patch and public hotfix levels? If not, explain to what level is supported, why it cannot be supported at current levels, and when current patch level compatibility is expected.
4. How is database security handled?
5. What is the maintenance lifecycle of the application, server and client pieces as applicable? Please describe each in the context of updates or upgrades, when they apply, and generally how often such updates are released.
6. Does the application require or otherwise make use of the Microsoft .NET framework? If so, which specific version of the .NET framework is required?
7. Is the application forward compatible with all versions of the .NET framework supported by Microsoft? See Microsoft .NET lifecycle reference at https://support.microsoft.com/enus/lifecycle#gp/Framework_FAQ.
8. Is the application supported at the most current (as of the date of response to this questionnaire) .NET Service Pack, patch and public hotfix levels? If not, explain to what level is supported, why it cannot be supported at current levels, and when current patch level compatibility is expected. Please be specific and explain for each version of .NET for which the application can run.
.NET 3.5 SP1:
.NET 4.5.2:
.NET 4.6:
9. Are there specific requirements for integration to existing City systems such as Tyler Munis, Tyler EnerGov, ESRI ArcGIS, Microsoft Exchange, etc.? If so, please list all that apply and explain the necessary integration points or features.
10. Does the solution require access to an SMTP mail relay?
11. Does the solution support SSL or TLS encrypted connections to the relay?
12. Please describe what type of information is relayed, how often it occurs, and what process, workflow or action is the trigger for email.
13. Are other e-mail or Message Queuing services required? If so, please explain the requirements in detail.
14. Once deployed into production at the City, who will be responsible for administration and support of the following components?
Service/Application:
Database:
Operating System:
System Hardware:
15. Is Active Directory (AD) integration supported for authentication and authorization? Which forms of AD integration are supported? (e.g. Azure Active Directory)
Direct domain (aka native Windows authentication):
LDAP:
ADFS:
SAML:
16. If AD integration is not supported, how is authentication handled? How is authorization handled?
17. Is a web server required as part of the solution?
18. If a web server is required, is Microsoft Internet Information Services supported? What specific versions of IIS are supported and/or required for particular functionality?
19. If a web server is required, can the web server/IIS be located on a remote system?
20. Does the solution need an interface accessible to or from the internet? If so, is SSL encryption supported for web-based internet access?
21. Is it expected that the solution be accessible by the general public on the internet?
22. Is the solution compatible with end-to-end SSL encryption for such access?
23. Is the solution compatible with deployment to 3rd party hosting environments or public cloud providers?
24. Does the application run as a service on the server?
25. If the application does not run as a service, how is the application instantiated and run at the server?
26. In what form are application updates distributed (web download, FTP, physical media, etc.)? How are application updates communicated to the customer when made available?
28. What, if any, third party software is required to enable or support the solution (e.g. Java runtime, Adobe Flash, etc.)? For each requirement which edition(s) and/or version(s) of the software are required?
29. How will the installation, development and deployment of the proposed solution take place (e.g.locally onsite, via shared remote display such as Webex, GoToMeeting, etc.)?
5.4 Server and Storage Systems QuestionsVendor Answer
30. On what versions of Microsoft Windows Server is the service/application supported? Be specific and include full release notation as appropriate. (The City follows a Microsoft Operating System Lifecycle and currently utilizing Server 2016 or greater)
31. Can Windows Server be patched to current (as of the date of response to this questionnaire) Service Pack, Patch and public hotfix levels? If not, explain to what level it is supported, why it cannot be supported at current levels, and when current patch level compatibility is expected.
32. Is the service or application supported as a virtualized server running on Nutanix AHV? If not, explain in detail what about the service or application does not make it compatible with virtualization.
33. As part of the release to GO LIVE/production all vendor-specific access and system permissions are removed. Are there vendor-specific access requirements or system permission that are necessary for the City to successfully host the proposed solution moving forward? If so, detail what access and/or system permissions must be retained for the vendor and provide a full explanation for why that is so.
34. All service, application, and access accounts for City systems are domain-based. Is the service/application compatible with domain-based accounts? If not, explain.
35. Identify the full set of accounts necessary for installation, operation and administration of the solution. Include a detailed listing of the permission requirements for each account. Where supported by the service/application separate service accounts will be created for separate functions, modules, components, and services, etc.
36. Please list any systems-related hardware that the City is required to provide for this project.
37. Is the client application web-based or a thick client?
38. If web-based, does the client rely upon any additional components or libraries other than HTML and Javascript (e.g. ActiveX, Flash, Java, etc.)?
39. If web-based, what browser platforms on what operating systems are supported? Please be specific and inclusive (for example, Microsoft Internet Explorer v11 or Microsoft Edge (EdgeHTML v13+); Mozilla Firefox v40+ for Windows, Macintosh, or Linux; Google Chrome v47+ for Windows, Macintosh, or Linux; Apple Safari v9+ for Macintosh; etc.).
40. If web-based, is the user experience conducive to use on mobile devices? If so, which devices and operating systems have been tested for compatibility (e.g. Apple devices running iOS v7+, Android based devices running Android 4.2+, Windows-based devices running Windows Phone 8+, etc.)?
41. Who is responsible for providing ongoing administration and maintenance support for the system?
42. Anti-malware software is required on all City server systems. Please detail any file-level exclusions that must be made with the real-time or on-demand scanners to ensure proper functioning of the solution.
43. Enterprise-class backup operations are required on all City server systems. Please detail any necessary considerations that must be made for files and/or directories that are part of the service or application to avoid negatively impacting either the backup operations or the uninterrupted function of the service or application.
44. Please detail any 3rd party or non-server-standard hardware that must be attached to the system (e.g. license dongles, telephone line interface cards such as Dialogic boards, etc.).
45. The City utilizes a SAN, and we primarily use Hyper-Converged Resources. Is the proposed solution compatible with SAN-based storage?
46. If the solution is not compatible with a SAN or Hyper-Converged Resources, please explain the known compatibility issues with using SAN storage and when it is expected that the solution will support SANs.
47. If the solution is not compatible with a SAN, please detail the direct attached storage disk configuration recommended for the solution (RAID 0, 1, 5, 10, etc.)?
48. Based upon how the City expects to utilize the proposed solution, please provide an estimated growth trend to cover the next 5 years; how much storage space, memory expansion, processor expansion, etc. is expected for maintaining the system?
49. All non-essential Windows services will be disabled by default. Clearly identify all Windows services that are required by the solution to deliver the proposed functionality.
5.5 Network Systems Infrastructure QuestionsVendor Answer
50. Does the proposed solution require access to the Internet? If yes, explain in detail and list all required TCP/UDP ports, source and destination and define the direction (inbound or outbound) in which communication is initiated.
51. What is the minimum bandwidth requirement? What is the recommended bandwidth?
52. How many physical communication ports are required to connect the proposed solution to the City’s enterprise network? Please identify the number of ports needed as well as the minimum (and maximum, if applicable) speeds for each port.
53. Does the proposed solution require a direct fiber connection to the City’s fiber network backbone resources? If so, please provide full details on this requirement.
54. Please list any network-related hardware that the City is required to provide for this solution.
55. Is the proposed solution compatible with the assignment of a private IP address segment to the solution?
56. If compatible with private IPs, does the proposed solution require and/or support NAT?
57. If the solution is NAT compatible, please define if that is one-to-one or one-to-many.
58. Does the proposed solution require QoS or multicast support? Are there maximum latency requirements? If so, please provide full details.
59. Does the proposed solution require and/or support encryption of the network communication (e.g. IPSec or SSL)?
60. Is there a VPN component to the proposed solution?
61. If a VPN component is involved, what type of VPN solutions are proposed (site to site, IPSec, SSL/TLS, etc.)? Please describe VPN requirements in details.
62. If a VPN component is involved, is it compatible with two-factor authentication? If so, describe the different two-factor implementations supported.
63. Does the proposed solution require any wireless connection (WiFi, 4G LTE, Microwave broadband network)? If so, please provide full details of the requirement and all encryption, authentication and standards supported.
64. Does the proposed solution utilize telephone connectivity of any type? If so, please list all telephone line requirements including equipment, line types and (e.g. modems, T1s, POTS lines, etc.).
65. Who is expected to provide ongoing monitoring, maintenance and support for the network and/or telephone components of the solution?
5.6 Operations and Maintenance QuestionsVendor Answer
66. The City patches all server and client operating systems according to the OS manufacturer’s release cycle. Please detail any known issues with performing regular OS-related patch updates such as those released on a monthly schedule by Microsoft.
67. Please detail the specifics of the backup operations and schedule that must be maintained for the specifics of this solution.
68. During regular enterprise-based backups are there services or devices that must be stopped/shutdown to ensure a successful and clean backup of the solution and its associated data?
69. Are there specific operating system services which must be monitored to ensure full application availability? If so, please identify the services and detail the impact on the solution if the service stopped/failed.
70. What documentation – help, training, troubleshooting, administration, etc. – is included upon delivery of solution/application/service?
71. What training opportunities exist for administering and maintaining the solution? Please detail them including location, duration, and type (online, classroom, etc.).
72. How are the installation files made available (download, optical media, etc.)?
73. Microsoft product licenses used by the City are purchased under existing agreements between Microsoft and the City. Please identify all Microsoft licenses necessary for the proposed solution, including quantity, editions, types and CALs as necessary.
74. Are there any recurring license fees associated with the proposed solutions? If so, please detail all recurring licenses, frequency, and expectations of recurring costs.
5.7 Endpoint Client System QuestionsVendor Answer
75. How is the application/service accessed (e.g., via web, locally installed “fat” client, Microsoft Office, etc.)?
76. If access is via a web browser, are there additional client-side components requirements? For example, is Java or ActiveX required at the client, does the web application utilize AJAX technologies, etc.?
77. If access is via a web browser, which browsers versions and platforms are supported? For example, Microsoft Internet Explorer v11 or Microsoft Edge (EdgeHTML v13+); Mozilla Firefox v40+ for Windows, Macintosh, or Linux; Google Chrome v47+ for Windows, Macintosh, or Linux; Apple Safari v9+ for Macintosh; etc.
78. Is the application fully supported when accessed via Citrix XenApp, Microsoft Terminal Services/RDS, VDI, or other application or desktop virtualization platform? If not, what are the known compatibility issues?
79. Do you offer mobile device access to the application/service? If mobile access is via a mobile device’s web browser, what are the minimum mobile browser versions that are supported? If mobile access is via an “app”, what specific mobile device hardware, OS and software platforms are supported?
80. What additional user interfaces are planned for the application/service?
81. The City operates Microsoft Windows 10+ as the standard desktop environment. If an endpoint client application installation is required, is the application compatible with Windows 10+? If not, when will such compatibility be available?
82. What are the minimum hardware requirements on the client systems? Are there additional hardware peripherals required on the client (e.g. license dongles, DVD-RW, dual monitor, sound card, etc.)?
83. If an endpoint client application installation is required, is the installation deployable through Microsoft’s System Center Configuration Manager (SCCM) and/or Microsoft Active Directory Group Policy?
84. The City operates all IT resources, including endpoint clients, in line with the principle of least privilege. If an endpoint client application installation is required, is the client application fully compatible with a standard, non-administrator user account? If not, please explain in detail what the application does that requires elevated user rights on the client.
6.0 SIGNATURE PAGE
The responses above are true and accurate as of the date below representing:

Company Name

Company Representative Name

Company Representative Title

Signature

Date image1.jpg image2.jpeg

File details come from the government source that posted it. Updated .