ESBD_484604_1769182434036_EXHIBIT C_Requirement Workbook.xlsx
XLSX spreadsheet 34 KB Posted
- Attached to
- OCA's Judicial Information Security Project
- Solicitation number
- 212-26-0281
- Issued by
- Travis County, Austin City, Texas
About this file
This is a Requirement Workbook exhibit for the Texas Office of Court Administration (OCA) soliciting a statewide technology system to automate the removal of confidential information of protected persons as mandated by House Bill 5081. The system must enable authorized users—including OCA-paid and self-paid participants—to enter and update their confidential information, trigger automated searches across multiple online locations including public websites, search engines, government records, social media, forums, and dark web platforms, and manage removal requests from data brokers and websites. Core functional requirements include mandatory quarterly searches, customized search parameters for name variations, creation and submission of removal requests with statutory authority citations, email notifications of removal requests exceeding statutory timelines, real-time secure dashboards accessible 24/7 for both authorized users and the Court Security Division, threat identification and notification within one hour, custom removal request submission with three-business-day contractor response, account transition capabilities between OCA-paid and self-paid licenses, and secure account deletion with data purging.
The system must operate on vendor-provided and vendor-maintained cloud infrastructure accessible through standard browsers without plug-ins, support multi-factor authentication, comply with Texas Administrative Code Chapters 202, 206, and 213 and WCAG 2.1 accessibility standards, encrypt data in transit and at rest, maintain role-based access controls, and host all servers within the United States. The contractor must create and maintain authorized user accounts, provide live customer support Monday-Friday 8:00 AM to 6:00 PM CT and 24/7/365 support to the Court Security Division, deliver initial training and onboarding materials, maintain a complete list of covered data brokers, track and preserve all removal requests for litigation purposes, and respond within 24 hours to threat-based or emergency removal requests. The workbook establishes response codes for offerors indicating whether functionality is provided out-of-the-box, through configuration, customization, third-party integration, or future release, with detailed comments required for non-standard implementations.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
| Requirements Response Workbook | |||
| Workbook Instructions and Legend | |||
| Offerors are to follow the instructions below to allow a uniform evaluation of the offers. Insert the appropriate response code within the ‘Offeror Response’ column for each requirement. Additionally note: | |||
| An omitted response will be assumed to be the same as a response code of “N”. | |||
| Only one (1) response per requirement will be accepted. | |||
| Offerors must insert an explanation for how a requirement will be met in the Offeror Comment column when responding with a code of G, C, 3, or F, or if the requirement explicitly requests the Offeror to provide a comment. If Offerors do not provide a comment when explicitly requested, the requirement will be given the lowest evaluation score. Offerors must provide a comment for cells highlighted in yellow in Column G (Offeror Comment). Offeror responses with code O or N do not require explanation. | |||
| Response Option | Offeror Functionality | Definition | Additional Notes |
| O (OOTB) | Functionality provided as standard | The Offeror provides the functionality from its own code base (i.e., ‘out of the box’). No customizing, working around, or configuration is required. The functionality must be installed and operational at other sites and be able to be demonstrated to OCA. | N/A |
| N (No) | Functionality not proposed | Not included in the proposed solution. | N/A |
| G (ConfiGuration) | Functionality provided by the Offeror, but requires configuration | The functionality can be accomplished with the Offeror's solution, but some configuration is required (e.g., the requirement will be met through configuration changes to settings of tables, switches, rules, user experience, etc. without modification or customization to the source code). | For this response option, Offeror must indicate the following in the comments column next to this response: |
| 1. Description of configuration | |||
| 2. Party who will perform the work (Offeror or Client/Other) | |||
| 3. Estimated level of complexity (Very Complex, Somewhat Complex, Not Complex) | |||
| C (Customization) | Functionality provided by the Offeror, but requires customization | The functionality can be accomplished with the Offeror's solution, but some customizing or work around is required. This would include custom code developed to perform specific functions or validations outside the standard code. | For this response option, Offeror must indicate the following in the comments column next to this response: |
| 1. Description of customization | |||
| 2. Party who will perform the work (Offeror or Client/Other) | |||
| 3. Estimated level of complexity (Very Complex, Somewhat Complex, Not Complex) | |||
| 3 (3rd Party Integration) | Functionality provided, but requires integration with third-party solution | The Offeror has established a relationship with a business partner to provide this functionality, which is fully integrated (data, process, application) with the proposed solution. If the proposed solution includes a third party component, the Offeror as the prime must include all initial and on-going costs in its bid. | For this response option, Offeror must indicate the following in the comments column next to this response: |
| 1. Name of the proposed third-party software package | |||
| 2. Interface/integration services being proposed, including if it requires customization or custom integration development. | |||
| F (Future Release) | Functionality provided by the Offeror, but in a future release | The functionality will be met with a particular feature that is in development. | For this response option, Offeror must indicate the following in the comments column next to this response: |
| 1. Explanation of the new feature. | |||
| 2. Expected date that such a feature will be made available. | |||
| 3. If the feature will be included within the scope of this project. |
Overview The Texas Office of Court Administration (OCA) is interested in securing a statewide technology system to automate the removal of confidential information of certain persons, as contemplated by House Bill 5081 from the 89th Legislative Session.
House Bill 5081 prohibits the dissemination or display of Covered Information (CI) of a protected person (judges, clerks, court and judicial branch personnel, and immediate family members) if the protected person has submitted a written request that the information not be displayed or disseminated by a person (which includes individuals, businesses, and data brokers). The law requires the removal of CI if displayed online within 10 business days. The bill creates civil and criminal remedies for violations.
OCA seeks a system that will automate as much of this process as possible, and intends to make it available to certain persons whose use of this system will be paid-for by OCA ("Authorized User-OCA Paid."). Other persons who will have the abililty to access/use this system will be able to do so at the same cost, but at their own expense ("Authorized User-Self-Paid"). In this document, all requirements should be read to apply to both groups, unless specified otherwise.
Functional Requirements
| Functional Requirements | |||||
| ID | Requirement | Function Category | Priority | Offeror Response | |
| (O, etc.) | Offeror Comment |
(Required when response is either G, C, 3, or F, or when specified in the requirement)
| 10 | System must allow a user to enter or update their CI. Any update of CI (ex. address, phone, new relative, etc.) will trigger an off-schedule (not-quarterly) search. | Core Function | Required |
| 20 | The System must require only minimal information provided by the Authorized User (e.g.- name, date of birth, address) to begin searching and removing data. All other information should be optional and should not be a barrier to begin utilizing the System. | Preferred Function | Preferred-High |
| 30 | The System must search online locations where the CI is displayed including but not limited to the following: |
- Public websites
- Search engines
- Online government public records
- Social media
- Public forums
- Dark Web (optional)
- Online directories
| - Artificial intelligence platforms | Core Function | Required | ||
| 40 | The searches for CI must take place at least once every state fiscal quarter. | Core Function | Required | |
| 50 | The System must provide customized search parameters including but not limited to the following examples: |
- Variations on names such as maiden, hyphenated, compound, or blended surnames.
| - Secondary residence. | Preferred Function | Preferred-High | ||
| 60 | The System must create and submit requests to remove Authorized Users' CI from a publicly accessible internet website | Core Function | Required | |
| 70 | Removal requests should differentiate if the Authorized User is requesting to stop the display and/or dissemination of covered information (CI). | Core Function | Preferred-High | |
| 80 | Manual removal requests must cite statutory authority and provide civil/criminal penalties and timelines for the removal. | Core Function | Required | |
| 90 | Contractor must notify the Authorized User via email of removal requests that have not resulted in removals within the statutory timelines. | Core Function | Preferred-High | |
| 100 | System must offer a quarterly email report to the Authorized User summarizing removals, highlighting removals and removal requests exceeding statutory timelines, or other threats such as displayed information on Dark Web. | Preferred Function | Preferred-High | |
| 110 | System must provide a real-time, secure data that can be accessed 24/7 by the Authorized User which must include the following information: | |||
| 1. | Site and Date CI located | |||
| 2. | Date written removal request sent | |||
| 3. | Date and type of alternative removal request type (phone, portal) | |||
| 4. | Date removal completed | |||
| 5. | View historical removal request | |||
| 6. | Request documentation of removal request | |||
| 7. | Highlight requests exceeding statutory timeline | |||
| 8. | Allow for submission of new CI removal request | |||
| 9. | Summary of information where a removal request would have no effect, such as the Dark Web (optional) | |||
| 10. | Next date of a scheduled search audit | Core Function | Required | |
| 120 | System must provide a real-time, secure online user interface that can be accessed 24/7 by the Court Security Division to oversee the program including the following information: | |||
| 1. | Ability to generate a Program Summary Report. | |||
| 2. | Ability to review information 1-10 listed above. | Core Function | Required | |
| 130 | Ability to identify threats posted on the internet regarding Authorized Users and to notify the Court Security Division within an hour of identification. | Preferred Function | Preferred-Medium | |
| 140 | The System must allow Authorized Users to submit custom removal requests in the online user interface and Contractor must send those removal requests within 3 business days. | Preferred Function | Preferred-High | |
| 150 | System must allow for the transition to/from an Authorized User - OCA paid to/from an Authorized User - self paid while maintaining the profile’s records. Licenses must be transferrable when employees retire or resign. | Core Function | Required | |
| 160 | The System must include a process for account deletion that ensures secure purging of user data. | Core Function | Required | |
| 170 | System may include the ability to search and request redaction from the Wayback Machine, a digital archive of websites which includes CI of protected individuals. | Preferred Function | Preferred-High | |
| 180 | System should have the ability to provide prevention Systems to minimize exposure, including providing anonymous VPNs, alias phone numbers, alias email addresses, password managers, and Dark Web mitigation tactics. | Preferred Function | Preferred-Medium |
Non-Functional Requirements
| Non-Functional Requirements | |||||
| ID | Requirement | Specification Category | Priority | Offeror Response | |
| (O, etc.) | Offeror Comment |
(Required when response is either G, C, 3, or F, or when specified in the requirement)
| 10 | Must be hosted in a vendor provided and vendor-maintained cloud platform. | Core Specification | Required |
| 20 | Provide a System that can run on an internet connected device utilizing any commonly utilized browsers (Chrome, Safari, Edge - versions back to n-2) without any browser plug-ins, extensions, or add-ons. Ensure System stays compatible with browser updates/versions. | Core Specification | Required |
| 30 | Must not require any additional hardware components or device setting changes that require elevated user permissions. Any device configurations must be able to be done by a regular user. | Core Specification | Required |
| 40 | The System must support multi-factor authentication (MFA). | Core Specification | Required |
| 50 | Must provide monitoring tools accessible to OCA that can report metrics to ensure compliance with established service levels and generate reports reflecting user activity, metrics, and audit trails of system actions. | Core Specification | Required |
| 60 | Comply and maintain compliance with Texas Administrative Code (TAC) Chapter 202 (security standards), Chapter 206 (accessibility standards for websites), Chapter 213 (accessibility standards for anything else), and WCAG 2.1. This includes the implementation of standard security controls as outlined in the DIR Security Control Catalog (see https://dir.texas.gov/sites/default/files/2022-01/DIR%20Security%20Control%20Standards%20Catalog%202.0.pdf). | Core Specification | Required |
| 70 | Must use responsive design principles to properly render on various devices and form factors (desktop monitor, laptop screen, phone, tablet) | Core Specification | Required |
| 80 | Must encrypt data during transit and at rest using a supported secure protocol. Expressly disallow security protocols that are no longer supported or secure. | Core Specification | Required |
| 90 | The Contractor will create and maintain the Authorized User accounts. | Core Specification | Required |
| 100 | The System should alert the user that their credentials have already logged into the system through another session. | Preferred Specification | Preferred-High |
| 110 | Provide monitoring services to detect, prevent, and report unauthorized access attempts to the system. | Core Specification | Required |
| 120 | When an Authorized User adds or modifies email addresses via the online user interface, the System must validate that the email addresses added are valid and link to the end-user. | Preferred Specification | Preferred-High |
| 130 | Allow system to permit/restrict access to components, system functions, reports, and data based on role based access control. | Core Specification | Required |
| 140 | Prevent errors or repetitive requests from inadvertent multiple clicks by a user. | Core Specification | Required |
| 150 | Highlight errors and prompt user for correction. Highlight fields which must be completed and prevent users from proceeding to the next screen until valid information is entered. | Core Specification | Required |
| 160 | Display visual indicators to denote that a transaction is in progress or complete. | Core Specification | Required |
| 170 | Place common information in a consistent location on each screen. | Preferred Specification | Preferred-High |
| 180 | When using the mouse, the scroll-wheel must be interpreted as scrolling up/down on the screen. | Preferred Specification | Preferred-High |
| 190 | When presenting a page, the cursor should automatically be positioned in the first editable field. The next field should be presented upon hitting the tab key. | Preferred Specification | Preferred-High |
| 200 | When data is shown on the screen in a tabular format, the data must be sortable and groupable on columns. Columns must be resizable to fit the data. | Preferred Specification | Preferred-High |
| 210 | Service should monitor for leaked passwords and compromised credentials | Core Specification | Required |
| 220 | All servers with access to user data must be hosted within the United States of America. | Core Specification | Required |
| 230 | Provide on-screen help for users to assist with standard system usage and functions. | Preferred Specification | Preferred-High |
| 240 | Contractor must provide and maintain a complete list of all data brokers covered. | Core Specification | Required |
| 250 | Any authorized user that transfers to a self-paid license will be charged the same price as an authorized user for the remaining contract term. | Core Specification | Required |
| 260 | Contractor must provide an expedited response within 24 hours for threat-based or emergency requests for removals as identified by and coordinated with the Court Security Division. | Preferred Specification | Preferred-High |
| 270 | Contractor must track and preserve all removal requests for future litigation needs. | Core Specification | Required |
| 280 | If an alternative to a written or electronically automated removal request is used, a written removal request must supplement the alternative request method. | Core Specification | Required |
| 290 | Contractor should have the ability to send notices of removal requests for CI on governmental entities' websites, as provided by OCA. | Preferred Specification | Preferred-High |
| 300 | Contractor must provide Live Customer Support from 8:00 AM - 6:00 PM CT Monday-Friday, excluding national holidays. | Core Specification | Required |
| 310 | Contractor must provide Live Customer Support to Court Security Division 24/7/365. | Preferred Specification | Preferred-High |
| 320 | Contractor must provide initial training and onboarding materials for each participant enrolled, including an explanation of capabilities and limitations of the System and process. | Core Specification | Required |
| 330 | Contractor must assist the Court Security Division in development of training materials covering online safety, minimizing personally identifiable information in the public realm, and best practices in judicial threat mitigation. | Preferred Specification | Preferred-High |
Lookup
| Vendor Response |
| O (OOTB) |
| N (No) |
| G (ConfiGuration) |
| C (Customization) |
| 3 (3rd Party Integration) |
| F (Future Release) |
File details come from the government source that posted it. Updated .