DPO Exhibit 2 - Project Requirements - FINAL.xlsx

Company

PRP ITN Exhibit 2 Contractor Workbook ITN SJAA 2026-___ &P

Compliance

CONTRACTOR COMPLIANCE

(Technical Standards & Policies | Office of Information Technology)

* Production

* Training (scrubbed or cleansed data)

* Test (scrubbed or cleansed data)

* Sandbox (full copy of production code and data captured nightly)

* Development (if applicable)

The system must comply with the following security standards:

* NIST 800-122 - Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)

* NIST 800-95 - Guide to Secure Web Services

* NIST 800-53 - Recommended Security Controls for Federal Information Systems and Organizations

* The Open Web Application Security Project (OWASP) Development Guide

* Security Development Life-cycle (SDL)

* CIS Security Benchmarks.

PRP ITN Exhibit 2 Contractor Workbook ITN SJAA 2026-__Page | &P https://www.cisa.gov/https://oit.colorado.gov/standards-policies-guideshttps://oit.colorado.gov/standards-policies-guides/technical-standards-policieshttps://oit.colorado.gov/standards-policies-guides/technical-standards-policieshttps://coag.gov/office-sections/consumer-protection/consumer-credit-unit/uniform-consumer-credit-code/)https://osc.colorado.gov/financial-operations/ccshttps://www.ftc.gov/legal-library/browse/rules/fair-debt-collection-practices-act-texthttps://www.govinfo.gov/app/details/USCODE-2011-title15/USCODE-2011-title15-chap41https://csrc.nist.gov/projects/cprt/cataloghttps://oit.colorado.gov/standards-policies-guides/technical-standards-policieshttps://www.sos.state.co.us/pubs/info_center/recordRetentionPolicy.htmlhttps://www.justice.gov/crt/section-508-home-page-0 Architecture

CONTRACTOR ARCHITECTURE

* Two Factor Authentication, as a part of OIT technical standards

* Forgot My Password techniques used extensively on Internet sites

* Challenge questions and answers established during user setup

* If the user successfully answers the challenge question, provide a temporary complex password and require a new user password upon successful session sign-on

* Ability for the service desk or authorized designee to reset a password if necessary.

* by function: specific application functions, or groups of functions that may be performed

* by data content: specific records, or groups of records, upon which a function may perform (including View, Add, Delete, Edit and Refresh)

* by location: restricted access by IP address or MAC address.

ACCE.13 Describe how the application strategy utilizes user authorizations or profiles to determine application access to, but not limited to the following roles:

* “Read” access to any data

* “Add” access to any data

* “Modify” access to any data

* “Delete” access to any data

* Each function key for which access is granted

* Each command for which access is granted

* User classification or role

* Production (live) or training mode.

* By function – this refers to specific application functions, or groups of functions, that the user can or cannot perform

* By data content – the user can be restricted to access individual records, or groups of records, within an application function

* By location – access control can be granted only at specified locations (e.g., through static IP addresses or MAC address).

PRP ITN Exhibit 2 Contractor Workbook ITN SJAA 2026-__ Page | &P

Documentation

CONTRACTOR DOCUMENTATION

* Microsoft Office (examples Word, Excel, PowerPoint, Visio, and/or Project)

* Google supported formats (example Docs, Sheets, Forms, Slides, Sites, Drawings, etc.).

DOCU.2 The Contractor will describe how they will provide all documentation in the following editable formats, unless otherwise agreed upon in writing, the formats include:

* Microsoft Office (examples Word, Excel, PowerPoint, Visio, and/or Project), and

* Google supported formats (example Docs, Sheets, Forms, Drawings, etc.)

Submit documentation for review and recommended changes by designated customer stakeholders, and must be considered final by way of sign-off prior to being considered final for vendor payment. The State will specify the number of copies and format for each Deliverable.

* All modifications to documentation shall include version control and/or tracked changes.

* The Contractor shall support the designated customer stakeholders in tracking changes to any documentation and will not require the customer to track changes outside the original format unless requested by the customer.

* The following process shall be followed for any documentation creation, review, and acceptance cycle:

- The Contractor will gather and document requirements for the deliverable.

- The Contractor will create a draft in the customer-approved format for the individual deliverable.

- The Contractor will perform internal quality control review(s) of the deliverable including, but not limited to:

* Readability

* Spelling

* Grammar

* Completion

* Adherence to any required templates or development of templates as requested

* The Contractor shall submit the deliverable to the designated customer stakeholders for review and comments using the following schedule:

- The customer will have five (5) business days to provide comments and changes for every twenty (20) or portion of twenty (20) pages in the deliverable. Pages are defined as 8 ½” x 11” pieces of paper with readable content.

- The Contractor will have two (2) business days to incorporate changes for every twenty (20) or portion of twenty (20) pages in the deliverable.

- The Contractor will have one (1) business day to perform internal quality control reviews to changes for every twenty (20) or portion of twenty (20) pages in the deliverable.

- The Contractor will resubmit the deliverable to the customer for additional rounds of review and changes. All review cycles will be captured in version control.

- The Contractor will anticipate between three (3) and five (5) review cycles before the deliverable is ready to proceed to the deliverable acceptance/clearance process.

- The State will initiate the acceptance/clearance process upon agreement between the Customer and Contractor that the deliverable is ready for the deliverable acceptance/clearance process.

* The Customer will shepherd the deliverable through the deliverable acceptance/clearance process internal to the state, which may result in:

- Acceptance and Signature with no further modifications. If so, the process is anticipated to take approximately thirty (30) business days.

- Additional changes and/or clarification requests from one or many of the reviewers. If so, the process outlined above will be enacted and will extend the timeline above.

- The Customer, and all required stakeholders, will sign and date (either electronically or physically as agreed upon by the deliverable) the deliverable as final and it will be marked as version 1.0. This completes the sign-off process

* Contractor payments may be associated with deliverables finalized as 1.0 or higher.

* All planned tasks accomplished, planned tasks that are incomplete, or behind schedule in the previous week (with reasons given for those behind schedule);

* All tasks planned for the upcoming two weeks;

* An updated status of tasks (entered into the project plan and attached to the status report – e.g., percent completed, resources assigned to tasks, etc.);

* The status of any corrective actions undertaken.

* The report will also contain items such as the current status of the project’s technical progress and contractual obligations; achievements to date; risk management activities; unresolved issues; requirements to resolve unresolved issues; action items; problems; installation and maintenance results; and significant changes to the Contractor's organization or method of operation, to the project management team, or to the deliverable schedule, where applicable.

DOCU.11 Service Level Agreement (SLA) Report: The Contractor will describe how they will submit SLA Reports each month, no later than five business days after month’s end. The reports will contain no less than the following:

The description of if the Contractor met all Service Level requirements and all instances where a Service Level was not met. The Contractor’s Service Level Report should additionally describe: 1) the missed Service Level; 2) the specific cause of the problem; 3) the solution; and,4) how the offeror will avoid missing the Service Level in the future. The State may request a meeting or additional information to further assess Service Level issues upon delivery of the monthly Service Level Report. This report will be provided beginning with the first month after any production implementation.

DOCU.12 Metadata Directory: The Contractor will describe how they will submit a Metadata Directory containing no less than the following information for each data element:

* Description of the data element.

* Location where the data element is stored.

* The application programs that access the data element.

* The system of record for the data element.

* The entity relationship diagrams for the system database.

* The type of actions that can occur on each data element.

* Objectives

* Goals

* Stakeholder populations (Audiences) - both internal and external

* Modalities

* Strategic plan

* Administration strategy

* Templates

* Tools

* Communications schedule (timeline)

* Tracking mechanism

* Evaluations and results.

SYSM.3 Testing Management Plan: The Contractor will describe how they will provide a comprehensive Testing Management Plan that will include, but will not be limited to, the following:

* Define the activities associated with all testing aspects, when they begin and end, and the responsible parties;

* Describe the activities for which the various stakeholder groups are responsible (e.g., creating test scenarios, performing the test, and validating the results);

* Define Acceptance criteria;

* Define roles and responsibilities;

* Testing methods;

* Schedule (timeline);

* Templates and tools;

* Documentation; and

* Strategies.

SYSM.4 Project Management Plan: The Contractor will describe how they will develop and maintain a Project Management Plan agreed upon by the State project leadership team. The project plan will follow the guidelines of the Project Management Institute’s (“PMI”) Project Management Body of Knowledge (“PMBOK”) and address all management areas. The plan will include no less than the following within or by way of links:

* RACI Matrix;

* Project Schedule (timeline);

* Work Breakdown Structure (WBS);

* Project goals;

* Stakeholders;

* Deliverables;

* Risks and mitigation strategies;

* Roles and responsibilities;

* Scope;

* Governance;

* Key milestones and performance indicators;

* Assumptions, dependencies, and constraints;

* Change Management Plan;

* Schedule Management Plan;

* Scope Management Plan;

* Links to all supporting Management Plans; and

* Budget information.

The Contractor will routinely update the plan to reflect changes in the nature and timing of project activities, all changes being subject to the State Project Manager’s approval.

SYSM.5 System Security Management Plan: The Contractor will describe how they will provide a comprehensive System Security Management Plan based on the National Institute of Standards and Technology Special Publication that will include, but will not be limited to, the following:

* System Identification;

* General System Description;

* System Design Description & Security Architecture;

* Define roles and responsibilities;

* System Scans requested by Security Architecture Team, OIT;

* Schedule (timeline);

* Technical Specifications;

* Compliance Requirements;

* System Classification (Assessment Results);

* Security Controls; and

* Web-Based Applications OWASP Top 10, CSI Hardening, Web Application Firewalls, penewtration testing.

SYSM.6 Implementation Management Plan: The Contractor will describe how they will create and maintain a comprehensive Implementation Management Plan that will include, but will not be limited to, the following:

* Define the activities associated with all implementation aspects, when they begin and end, and the responsible parties;

* Introduction that includes the document’s purpose, suggested audience, and listing of key terms;

* Installation of Network and Hardware;

* Define roles and responsibilities;

* Software Installation;

* Schedule (timeline);

* Templates and tools;

* Documentation;

* Security and preparations needed for implementation;

* Training needed for implementation by location;

* Data Conversion (or a link to the Data Conversion Management Plan);

* Staff Transition to New System;

* Post Implementation Analysis;

* Operational Preparation;

* Site Preparation;

* Equipment and Supplies Needed;

* Personnel Requirements;

* Procedures; and

* Strategies.

SYSM.7 Data Migration Management Plan: The Contractor will describe how they will provide a comprehensive Data Migration Management Plan that will include, but will not be limited to, the following:

* Define the activities associated with all Data Migration aspects, when they begin and end, and the responsible parties;

* Describe the activities for which the various stakeholder groups are responsible;

* Introduction that includes the document’s purpose, suggested audience, and listing of key terms;

* Data Conversion Objectives;

* Define roles and responsibilities;

* Major Systems Involved;

* Conversion Method;

* Conversion Security;

* Conversion Control;

* Conversion Reporting;

* Conversion Reconciliation;

* Rollback;

* Error Handling;

* Conversion Reversal;

* Conversion Staffing;

* Source Specifications;

* Destination Specifications;

* Intermediate Processing Requirements;

* Data Element Mapping and Who Performs Mapping;

* Data Conversion Tools and Scripts;

* Testing;

* Legacy System Updates;

* Schedule (timeline);

* Templates and tools;

* Locations Involved;

* Documentation; and

* Data Conversion Strategy.

SYSM.8 Transition Management Plan: The Contractor will describe how they will create and maintain a comprehensive Transition Management Plan that will include, but will not be limited to, the following:

* Define the activities associated with all operations and maintenance aspects, when they begin and end, and the responsible parties;

* Define the support model that speaks to vendor support, Department/Division support, and OIT support;

* Describe the activities for which the various stakeholder groups are responsible;

* Introduction that includes the document’s purpose, suggested audience, and listing of key terms;

* How the Contractor will maintain and operate the system during the contractual period when the system is partially and fully in production;

* Define roles and responsibilities;

* Knowledge transfer activities that the Contractor will create to transfer system knowledge to the state technical staff for understanding, in operating, and in maintaining the new system;

* Knowledge transfer activities that the Contractor will create to transfer system knowledge to the Service Desk staff is necessary for providing support to system users;

* How equipment, configurations, software, and data stores will be transitioned into the State’s production environment;

* Processes for documenting and approving contingency plans for all significant risks;

* Coordination activities with the hosting provider that provides a clear definition of data center responsibilities and tasks;

* The process for an orderly closeout of the Contract to include at a minimum the following areas:

- Archiving project materials.

- Business processes and system migration.

- Post-mortem debriefings.

-…