ESBD_493470_1772482251538_Attachment 4_Technical Requirements.xlsx
XLSX spreadsheet 123 KB Posted
- Attached to
- Student Information System Solution
- Solicitation number
- RFP-01-CIO-26-261
- Issued by
- Brazos County, Texas
About this file
This is a Technical Requirements attachment for a Software Provider response to the Texas A&M System (A&M System) contract opportunity, specifically detailing mandatory and desired technical capabilities across multiple functional domains. The document serves as a standardized response template requiring respondents to assess their proposed solutions against detailed specifications organized into ten primary categories: Security, Identity, and Audit; Network; System Administration and Management; Storage; Application Architecture and Integration; Application Development and Configuration Management; Data and Reporting; and Support and Service Level Agreements. Respondents must indicate whether their solution meets each requirement as "Fully Met," "Partially Met," or "Not Met," and provide corresponding comments explaining their compliance approach. The attachment encompasses 62 security and identity requirements, 10 network requirements, 25 administration requirements, and additional specifications across remaining functional areas, establishing comprehensive baseline expectations for vendor solutions.
The technical requirements document emphasizes critical security capabilities including audit trail generation and retention, multifactor authentication implementation, Active Directory integration, encryption in transit and at rest, role-based access controls, and third-party security assessments such as SOC 2 or ISO 27001 certification. Network requirements address performance monitoring, firewall configuration management, bandwidth optimization, and zero-trust architecture support. Administration requirements mandate web-based management consoles, backup and disaster recovery capabilities with specified recovery time objectives of one hour, multi-environment support (development, test, QA, and production), and integration with the A&M System's IT Service Management system. The document does not specify pricing terms, award dates, contract duration, set-asides, or renewal options within the scope of this technical requirements attachment.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions Software Provider Attachment 4 - Technical Requirements
| Respondent |
| [Enter Respondent's Name Here] |
| Table of Contents |
| -Security, Identity, Audit |
-Network -System Admin-Mgmt.
-Storage -App Arch-Integration -App Dev-Config -Data, Reporting -Support, SLAs -Tech Proposal Response
INSTRUCTIONS:
This attachment/response template is comprised of multiple tabs. A description and expectations for completing each tab is described below:
1 - Tech Requirements: A series of tabs lists specific technical requirements in the areas of security/identity management/audit, network, system admin/management, storage, architecture and integration, app dev/config management, data/reporting, and support/SLAs. Indicate if your proposed solution/product version/release meets these requirements. Provide appropriate details in the Comments column.
2 - Tech Proposal Response: This tab lists questions requesting additional details on your technical solution(s). If you prefer, you can respond to these items in a consolidated Technical Response document as part of your proposal.
Acerno_Cache_XXXXX
Security, Identity, Audit
| Software Technical Requirements | ||||
| Security, Identity, and Audit | ||||
| # | Sub-Process / Topic | Requirement | Requirement Met? (Fully Met, Partially Met, or Not Met) | Comments |
| 1 | Audit | Ability to generate an audit record for all records and transactions including, but not limited to privileged accounts, User ID, date/time stamp, and old/new field value for changes | ||
| 2 | Audit | Ability to retain audit records for all records and transactions for a defined time period | ||
| 3 | Audit | Ability to provide user-defined audit features for all transactions in solution including, but not limited to all historical changes (ability to tie back what has been changed back to supporting change documentation) | ||
| 4 | Audit | Ability to prevent audit records from being deleted or altered, except as part of a system administration archival process | ||
| 5 | Audit | Ability for audit-tracking reports including, but not limited to user access, usage logs, and key organization data structures | ||
| 6 | Audit | Ability to archive and restore audit logs | ||
| 7 | Audit | Ability to log external access and tie to users, transactions, processes, interfaces, etc. | ||
| 8 | Audit | Ability to generate security/user access reports detailing user roles, associated permissions, workflow approval thresholds, etc. | ||
| 9 | Identity | Ability to provide administrative web interface for Application Administration | ||
| 10 | Identity | Ability to provide security Assertion Markup Language (SAML) support | ||
| 11 | Identity | Ability to provide user (staff, faculty, etc.) login credentials that are secured and encrypted at rest | ||
| 12 | Identity | Solution shall have directory synchronization | ||
| 13 | Identity | Ability to use JSON/REST user management API(s) | ||
| 14 | Identity | OAuth support - Ability to support authentication via OAuth 2.0 | ||
| 15 | Identity | Solution shall have authorization policy management | ||
| 16 | Identity | Solution shall have entitlement management | ||
| 17 | Identity | Solution shall have delegated administration | ||
| 18 | Identity | Solution shall have appropriate privacy policy | ||
| 19 | Identity | Solution shall have granular authorization support | ||
| 20 | Identity | Solution shall have proprietary access API | ||
| 21 | Identity | Solution shall have consumer login password reset capability secured by security measure like security questions and one time passcode to phone or email | ||
| 22 | Identity | Ability to implement and customize Multifactor authentication (MFA) | ||
| 23 | Identity | Solution shall have System for Cross-Domain Identity Management (SCIM) support | ||
| 24 | Identity | Ability to provide role-based security that limits access to subsets of records or data elements. The role-based permissions should deny all access unless specifically granted based on a permissions system | ||
| 25 | Identity | Ability to provide integration between various modules (e.g. Human Resources, Security, Finance, Payroll, Identity Access Management) to support the update of employee access and security profiles | ||
| 26 | Identity | Ability to map application layer user security roles/groups to AD groups for user provisioning | ||
| 27 | Identity | Ability to support Active Directory integration for user provisioning/deprovisioning, rights assignment and authentication | ||
| 28 | Identity | Ability to support SAML2.0 | ||
| 29 | Identity | Ability to pass AD groups in the assertion for rights assignments | ||
| 30 | Identity | Ability to support automated user deprovisioning for terminations | ||
| 31 | Security | Ability to provide privileged and administrative access controls | ||
| 32 | Security | Ability to provide physical security to safeguard the underlying digital infrastructure | ||
| 33 | Security | Ability to provide published breach disclosure policy | ||
| 34 | Security | Ability to provide published screening and hiring practices for employees who access enterprise data and user information | ||
| 35 | Security | Ability to provide APIs/open interfaces that are secured and encrypted using both user-authentication/role (for individuals) and bearer-token capability (for system-to-system). Ability to administratively assign, revoke, authorize permissions for these APIs/open interfaces. | ||
| 36 | Security | System shall have data encrypted in transit | ||
| 37 | Security | Ability to have customer-configurable data loss prevention (DLP) | ||
| 38 | Security | Ability to have application layer vulnerability scans permitted/conducted/reported | ||
| 39 | Security | Ability to have multitenant controls for separation of users and data within the service | ||
| 40 | Security | Ability to have access control support on files and content | ||
| 41 | Security | Ability to have proactive auditing and notification on incidents of inappropriate management activity | ||
| 42 | Security | Ability to have permitted "right to audit" (vulnerability scan) or vendor supplied 3rd party assessment | ||
| 43 | Security | Vendor to supply high level results of regular penetration tests | ||
| 44 | Security | Ability to have documented intrusion prevention and detection capabilities | ||
| 45 | Security | Ability to provide documented distributed denial of service (DDoS) prevention capabilities | ||
| 46 | Security | Vendor shows services align to Cloud Security Alliance (CSA) framework as well as certifications, if any | ||
| 47 | Security | Ability to have configurable content hygiene (for example, antivirus and anti-spam [AV/AS]) | ||
| 48 | Security | Ability to run network penetration tests against the service, or arrange for independent third parties to conduct periodic network penetration tests and report the results | ||
| 49 | Security | Ability to have, in case of breach or compromise of data or users, notification of A&M System impact within 48-72 hours and third-party investigation support | ||
| 50 | Security | Ability to have PCI compliance | ||
| 51 | Security | System shall test for, and mitigate, OWASP top 10 risks | ||
| 52 | Security | Ability to configure and enforce strong/complex passwords for customer and provide support for Multi-factor authentication | ||
| 53 | Security | Ability to mask any data element based upon configurable rules and elements including Name, Address, etc. | ||
| 54 | Security | Ability to have advanced anti-fraud features (detecting and alerting) - suspicious connections and suspicious account activity | ||
| 55 | Security | Ability to produce real-time reports detailing the data sets and end-to-end flow according to personal data limitations | ||
| 56 | Security | Ability to respond to, capture, and erase personal data according to data subject rights request | ||
| 57 | Security | Ability to use a single user sign-on for all modules with security configured for each module (i.e., user to gain access to the database associated with the application without re-entering the user ID and password) | ||
| 58 | Security | Ability to link the user logon ID to the employee or contractor Information including, but not limited to identification number, assigned locations, etc. | ||
| 59 | Security | Ability to have immutable backups | ||
| 60 | Security | Ability to provide independent third party assessment (SOC 2 or ISO27001 Certification or equivalent) | ||
| 61 | Security | Ability to suspend or revoke user/API access in real time | ||
| 62 | Security | Ability to provide published hardware disposal/destruction policy (e.g., hard drives, backups, data storage media) | ||
| 63 | Security | Ability to log and audit direct (e.g., administrative, DBA) access to the data store and related high-privilege administration functions, regardless of access method and forward to third-party reviewer (SOX compliance) |
Network
| Software Technical Requirements | ||||
| Network | ||||
| # | Sub-Process / Topic | Requirement | Requirement Met? (Fully Met, Partially Met, or Not Met) | Comments |
| 1 | Network | System shall support average + std. deviation + % of requests above defined maximum or SLA of performance and latency of the service are tested and published annually | ||
| 2 | Network | Ability to provide real-time performance network monitoring service | ||
| 3 | Network - Security | Vendor shall have partnership(s) with cloud security gateway or cloud access security broker(s) | ||
| 4 | Network - Security | Ability to provide documented firewall considerations and required configurations. Including restrictions on who is able to access the service, limits on types of traffic, and traffic inspection | ||
| 5 | Network - Capacity | Vendor shall have partnership(s) with WAN optimization service vendor(s) | ||
| 6 | Network - Capacity | Ability to provide a network sizing tool (bandwidth, latency, etc.) for remote locations based on user counts, business functions, etc. | ||
| 7 | Network-Security | Ability to track user/system access at firewall | ||
| 8 | Network | Ability to whitelist and configure user/system access without network engineering (via admin console), at least for commonplace scenarios. Ability to export these rules | ||
| 9 | Network | System shall have tolerance for relatively low bandwidth, high latency user or device connections (or mode to support these) as may be found in more remote locations or remote points within a site location (e.g., satellite, low speed cellular or intermittent Wi-Fi) | ||
| 10 | Network | Architecture of the app does not demand high back-end interaction (AJAX, logic "chattiness") which impede or create latency in user/UI operation | ||
| 11 | Network | Ability to segment and or microsegment enterprise data to meet zero trust requirements |
System Admin-Mgmt
| Software Technical Requirements | ||||
| Application Administration | ||||
| # | Sub-Process / Topic | Requirement | Requirement Met? (Fully Met, Partially Met, or Not Met) | Comments |
| 1 | Administration | System shall have web-based management console support to manage users and data | ||
| 2 | Administration | System shall have single-console management of cloud services | ||
| 3 | Administration | System shall have usage and data tracking tools | ||
| 4 | Administration | Ability to bulk export and import users and permissions | ||
| 5 | Administration | System shall support defined real-time thresholds and alerts | ||
| 6 | Administration | System shall have customer-defined real-time thresholds and alerts | ||
| 7 | Administration | System shall have change management logging with six or more months of history | ||
| 8 | Administration | Ability to provide extensibility via scripting without impacting ability to upgrade | ||
| 9 | Administration | Ability to clone/copy production data to a non-production instance for the purpose of supporting testing and/or replication of support issues | ||
| 10 | Administration | Able to support cluster environment with multiple nodes or servers using soft and physical load balancer | ||
| 11 | Administration | Ability to take full backups of the database without incurring additional cost | ||
| 12 | Administration | Ability for system to offload impact of large voluminous batch processes so as not to impact user experience and degrade performance | ||
| 13 | Administration | Ability to restore a production backup to a non-production database and roll it forward or backward to a specific time | ||
| 14 | Administration | Ability to keep a number of consistent immutable backups in an off-site location | ||
| 15 | Administration | Ability to perform a full consistent database backup with no or minimal system outage | ||
| 16 | Administration | Ability to have training, development, test/QA, and production environments | ||
| 17 | Administration | Ability to add or remove non-production environments with minimal notice/duration and no production outage | ||
| 18 | Administration | Ability to move code, configuration and/or data between environments (scheduled and unscheduled) | ||
| 19 | Administration | Ability to schedule regular data refreshes from production to a non-production clone environment | ||
| 20 | Administration | Ability to integrate with enterprise scheduling systems to manage dependencies and processes between systems | ||
| 21 | Administration | Ability to bring system up in a restricted mode for administrative-only access | ||
| 22 | Administration | Ability to use A&M System ITSM system for incident, problem, change and configuration management | ||
| 23 | Administration | Ability to manage, reconfigure, change or otherwise alter integration points as part of scheduled production -> non-production data refresh | ||
| 24 | Administration | Ability for business location/site to perform local resource install/configuration/management (of printers, print jobs, cash drawers, time clocks, scanners, payment terminals, signature pads, etc.) with minimum additional requests to corporate support teams | ||
| 25 | Business Continuity and Disaster Recovery | Ability to provide full recovery and system backup capabilities for all online and batch transactions according to A&M System-specified timeframes (currently 1 hour RTO and <15 minute RPO). Active/Active architecture of primary and backup (DR) data centers would be acceptable as well | ||
| 26 | Business Continuity and Disaster Recovery | Ability to restore transactions from the database transaction log | ||
| 27 | Business Continuity and Disaster Recovery | System shall have software crash tolerance (i.e., server and A&M System software shall maintain its integrity in case of power failures and abrupt shutdowns) | ||
| 28 | Business Continuity and Disaster Recovery | System shall have redundancy in the application server tier | ||
| 29 | Business Continuity and Disaster Recovery | System shall have redundancy in the database server tier | ||
| 30 | Business Continuity and Disaster Recovery | System shall have restart and recovery capability after system failure with no loss of data or software components | ||
| 31 | Business Continuity and Disaster Recovery | System shall have roll-back capability of data (e.g., corruption, invalid data) | ||
| 32 | Business Continuity and Disaster Recovery | System shall have roll-back capability of software / system updates | ||
| 33 | Business Continuity and Disaster Recovery | System shall have integrity checking capability to identify the existence of program and/or system discrepancies and issue an alert to the appropriate systems operations team | ||
| 34 | Business Continuity and Disaster Recovery | System shall have file protection capability to limit the types of operations (e.g. read, write, delete, data dictionary modification) that can be performed by individual users on given data or program files | ||
| 35 | Business Continuity and Disaster Recovery | System shall have incremental, differential, and full backups and restores of the database, core and customized software, software and database configuration options, and user preferences and rights | ||
| 36 | Business Continuity and Disaster Recovery | Ability to bring system up within a predefined RTO time with a data loss not to exceed a predefined RPO in a remote location in the event of a disaster | ||
| 37 | Business Continuity and Disaster Recovery | Ability to perform regular (example: annual) disaster recovery tests without interference or risk to production environment | ||
| 38 | Business Continuity and Disaster Recovery | Ability to restore and roll forward immutable backups at DR location | ||
| 39 | Business Continuity and Disaster Recovery | Ability for A&M System to declare disaster | ||
| 40 | Business Continuity and Disaster Recovery | Ability to return to production site at the end of a disaster and restore DR capability | ||
| 41 | Business Continuity and Disaster Recovery | Ability to perform backups and all other administrative functions at DR location | ||
| 42 | System Capacity & Performance | Ability to track and log system uptime and transaction response times in order to provide information for SLA monitoring | ||
| 43 | System Capacity & Performance | Ability to the meet SLAs during the Deployment and Go-Live Support Phase | ||
| 44 | System Capacity & Performance | Ability to integrate system alerts into A&M System ITSM system |
Storage
| Software Technical Requirements | ||||
| Storage | ||||
| # | Sub-Process / Topic | Requirement | Requirement Met? (Fully Met, Partially Met, or Not Met) | Comments |
| 1 | Storage | Ability to provide documented high-availability and disaster recovery capabilities and procedures | ||
| 2 | Storage | Ability to Support bulk data import and export/extraction to/from service(s) | ||
| 3 | Storage | Ability to provide assurance that when the enterprise deletes data, the data is not resident on storage within the service (i.e., data is eradicated) | ||
| 4 | Storage | Ability to provide storage limits defined and reasonable per service, group, and user | ||
| 5 | Storage | Ability to surpass service storage limits without impacting service delivery | ||
| 6 | Storage | Ability to publish/provide locations of data centers storing data | ||
| 7 | Storage | Ability to accommodate Enterprise dictating data locale residency | ||
| 8 | Storage | Ability to provide archive/e-discovery as a service offering | ||
| 9 | Storage | System shall have real-time data layer performance monitoring service providing metrics (e.g., database, any data serving components such as MQ). This consists of both "Storage" and "Database/Data Access" | ||
| 10 | Storage | Please discuss the storage architecture of structured vs unstructured data, also please include how large binary objects (Image, Video) are stored | ||
| 11 | Storage | System shall have data replication services that are database-aware, and maintain transactional integrity | ||
| 12 | Storage | Ability to perform flash copies of production and non-production systems | ||
| 13 | Storage | Ability to remotely replicate live data to other data centers and maintain transactional integrity | ||
| 14 | Storage | Ability to make storage changes (add, move, rebalance, remove, etc.) without a system outage |
App Arch-Integration
| Software Technical Requirements | ||||
| Architecture and Integration | ||||
| # | Sub-Process / Topic | Requirement | Requirement Met? (Fully Met, Partially Met, or Not Met) | Comments |
| 1 | Application Architecture | Extent to which the solution is based on proven state-of-the-art technologies including browser-based, server-side architecture, configurability, and a range of industry-standard database, operating systems, and programming platforms | ||
| 2 | Application Architecture | Ability to establish connectivity with application and data structure types via a variety of protocols, such as MQ, JSON, XML, SOAP/XML, HTTPS, etc. | ||
| 3 | Application Architecture | Ability to establish connectivity with application and data structure types via a variety of Transports, such as Rest over HTTPS, MQ, direct DB connection/ODBC/JDBC, etc. | ||
| 4 | Application Architecture | System shall have platform-initiated events and notifications | ||
| 5 | Application Architecture | Ability to support the capability for data extraction, encryption and transmission (ODBC, xml, web services, flat files, PDF documents, etc.) | ||
| 6 | Application Architecture | Specify browsers and minimum versions supported. Must support mobile/tablet specific scenarios such as Safari | ||
| 7 | Application Architecture | Ability to automate the deployment of software and updates to user workstations and mobile devices including, but not limited to web-based deployment tools | ||
| 8 | Application Architecture | Ability to automatically detect and resolve user workstation and mobile device application version incompatibilities with server applications | ||
| 9 | Application Architecture | Ability to provide built-in application and system configuration tables accessible by all modules | ||
| 10 | Application Architecture | Ability to provide customizable user portals including, but not limited to the ability to customize menus and forms, by user | ||
| 11 | Application Architecture | Ability to manage automatic job scheduling (e.g., batch jobs, billing) including, but not limited to the interface with external job schedulers and automatic notification capabilities when a job abnormally terminates | ||
| 12 | Application Architecture | Ability to define job sequences and dependencies (i.e., run job B just after job A, only run if A is successful). Configurable notification (e.g., email, SMS). Configurable duration thresholds triggering notification | ||
| 13 | Application Architecture | Ability to accommodate background (e.g. batch) jobs 24/7 concurrently with online updates | ||
| 14 | Application Architecture | Ability to drill down from a transaction view to the supporting source document or record, regardless of the module source | ||
| 15 | Application Architecture | Ability to facilitate upgrades to future operating systems, databases and other software upgrades | ||
| 16 | Application Architecture | Ability to generate process flow diagrams for system or a subset | ||
| 17 | Application Architecture | Ability to generate data flow diagrams for system or a subset | ||
| 18 | Application Architecture | Ability to distribute workload horizontally | ||
| 19 | Application Architecture | Ability to deploy into an Active/Active model | ||
| 20 | Integration | Ability to deploy updates through an automation pipeline, e.g., Jenkins | ||
| 21 | Integration | Ability to integrate with current and future applications from both A&M System and external parties including, but not limited to the ability to interface data in standard formats, upload of transactions in batch mode | ||
| 22 | Integration | Ability to exchange information and support services with external SaaS solutions | ||
| 23 | Integration | Ability to exchange information and support services with external on premise solutions | ||
| 24 | Integration | Ability to integrate workflow capabilities with the A&M System-specified system inbound and outbound interfaces | ||
| 25 | Integration | Ability to set up appropriate approval, audit trail, and reconciliation procedures for all inbound and outbound interfaces | ||
| 26 | Integration | Ability to provide documentation, definition, endpoint specification + example calls + dev/test regions for all APIs based on standard interface technologies, such as REST and SOAP to allow for development and integration | ||
| 27 | Integration | Ability to support integration with a 3rd party Master Data Management solution for both pull, push transactions | ||
| 28 | Integration | System shall have data access APIs (including support for BI tooling integration/connectivity) | ||
| 29 | Integration | Ability to support business function APIs | ||
| 30 | Integration | Ability to support operational APIs | ||
| 31 | Integration | Ability to support bulk import/export API | ||
| 32 | Integration | Ability to support messaging-based APIs | ||
| 33 | Integration | Ability to create a mocking service to test the API contract | ||
| 34 | Integration | Availability of native application connectors or common integration platforms (on-premises/iPaaS) | ||
| 35 | Integration | Ability to utilize XML technologies, XML Data Type Definitions (DTDs),and XML Schemas to describe data elements | ||
| 36 | Integration | Embedded integration platform (Provide/Consumer API's) | ||
| 37 | Integration | Ability to set up appropriate approval, audit trail, and reconciliation procedures for all inbound and outbound interfaces | ||
| 38 | Integration | Ability to provide marketplace for extensions and preconfigured integrations | ||
| 39 | Integration | Ability to support integration with third-party integration (e.g. MuleSoft) solutions for both pull, push transactions | ||
| 40 | Integration | Ability to integrate with cloud services providers (e.g., Azure, AWS) | ||
| 41 | Integration | Ability to Integrate with API Management systems with the industry standard security practices (ex. OIDC, OAUTH, SAML2) | ||
| 42 | Integration | Must support Duplicate Data Detection for the Inbound data feeds | ||
| 43 | Integration | Ability to provide support for Sequential/Concurrent/Parallel processing | ||
| 44 | Integration | Ability to provide support for configurable call retry, queuing, failure notification either internally or via third-party layer, for outbound APIs | ||
| 45 | Integration | Ability to provide support for field configuration and security of IoT, telematics, or other remote API data sources, for inbound APIs | ||
| 46 | Integration | Ability to provide access to API logging and ability to view all incoming and outgoing API messages/payloads and responses (i.e., response code/payload for our server services, remote system response/payload for our client services). Enable configurable retention policy for the API logs. | ||
| 47 | Integration | Ability to customize error responses (similar to Usability request, but referring to API responses) |
App Dev-Config
| Software Technical Requirements | ||||
| Application Development and Configuration | ||||
| # | Sub-Process / Topic | Requirement | Requirement Met? (Fully Met, Partially Met, or Not Met) | Comments |
| 1 | Application Development/Configuration | Overarching tenant of solution architecture is to configure not customize, but would like to understand the following about the solution: | ||
| 2 | Application Development/Configuration | Ability to support a hosted integrated development solution (e.g., Platform as a Service - PaaS) to support the ability to develop, test, and deploy integrated SIS SaaS extensions to the core cloud solution, with coordinating development and test environments maintained with compliant versions of all related software layers | ||
| 3 | Application Development/Configuration | Ability of PaaS solution to support one integrated data architecture (data model) to be supported, visualized, imported, exported, and managed as a whole across the PaaS extensions and the core SIS SaaS solution | ||
| 4 | Application Development/Configuration | Ability of PaaS solution to support one unified/integrated configuration management model and process to be supported, visualized, and managed as a whole across the PaaS extensions and the core SIS SaaS solution | ||
| 5 | Application Development/Configuration | Ability of PaaS solution to support the use and promotion of consistent and shared usability standards (same look & feel) across the PaaS extensions and the core SIS SaaS solution | ||
| 6 | Application Development/Configuration | Ability of PaaS solution to support live, real-time create/update/delete access and use of the core SaaS solution data between the PaaS extensions and the core SIS SaaS solution, so that the PaaS extensions can integrate into the existing core SaaS application flow (include information on the integration techniques - API's, services, etc.) | ||
| 7 | Application Development/Configuration | Ability to perform workflow management, including configurable workflows, automatic approval and review processes, business rule enforcement, etc. | ||
| 8 | Application Development/Configuration | Ability to provide best practice workflow templates | ||
| 9 | Application Development/Configuration | Ability to provide software development kits (SDKs) including command line interfaces (CLIs) and wrappers for programmatic interfaces | ||
| 10 | Application Development/Configuration | Ability to support extensibility via scripting. Provide a list of open source or proprietary scripting languages that are supported | ||
| 11 | Application Development/Configuration | Ability to support vendor provided Professional developers program (e.g., training) | ||
| 12 | Application Development/Configuration | Ability to configure auto-escalation, notification, approval rules for workflow items/hierarchies Auto-escalation: timeouts/out-of-office. Notification: multiple paths (email, SMS, application push, mobile push). Approval: multiple approvers per step (one required, all required). Ability to delegate workflow roles | ||
| 13 | Application Development/Configuration | Ability to automate approval notifications | ||
| 14 | Application Development/Configuration | Ability to designate multiple approvers for a particular workflow step | ||
| 15 | Application Development/Configuration | Ability to provide configurable workflow alerts and escalation capabilities | ||
| 16 | Application Development/Configuration | Ability to incorporate "checklists" into the workflow process based on the transaction type and/or business process (e.g. on-boarding), including status notifications | ||
| 17 | Application Development/Configuration | Ability to perform internal real-time message routing to broadcast information to a user-defined group of users | ||
| 18 | Application Development/Configuration | Ability to track documents submitted for approval and review including, but not limited to a time/date stamp and user identification | ||
| 19 | Application Development/Configuration | Ability to provide documented development, source control, test, deploy process and tools to develop custom extensions (screens, reports, etc.). Approved training sequence for these activities | ||
| 21 | Application Development/Configuration | Ability to define custom data attributes to core entities within the system, accessible/referenceable by screen, report, API, etc. Definition includes prompt label, data type/resolution, input method/widget, tooltip, help link, validation constraints, etc. |
"Entity" means data entity such as Student, College, Campus, Instructor, etc. Supports the inevitable need for customization and extension. See also TECH-APPDEV-08 in "Tech Proposal Response" tab.
| 22 | Application Development/Configuration | Ability to optionally modify user-facing labeling (screen field labels, report field names, etc.) for off-the-shelf entity attributes to use custom wording, tooltip, help, etc. (as applicable) |
| 23 | Application Development/Configuration | Ability to support concurrent enhancement development (ability to merge and deconflict independently developed modifications if necessary). Ability to deploy and roll back per-module |
| 24 | Application Development/Configuration | Ability to support web-based and local IDE development of modifications (local IDE offering greater functionality and/or a degree of "off-line" development capability) |
| 25 | Application Development/Configuration | Ability to provide CI/CD process support during development, testing |
| 26 | Application Development/Configuration | Ability to provide body of existing automated regression tests for core system. Ability to add custom regression test suites and tests and run on-demand or automated. Reporting capability for automated tests (e.g., success, logs, duration, coverage) |
| 27 | Application Development/Configuration | Ability to support easily created, modified, and grouping of unit tests (logic-based) and user-interaction (functional) tests. Ability to easily incorporate these into CI/CD |
| 28 | Application Development/Configuration | Ability to provide documented customization 'hooks' and customizable event callouts/"user exits" allow customization of core processes. Allow access to internal API (curated by vendor) to reuse core functionality within these extensions. Describe the extent and granularity of such customization hooks (in the "Comments" column) |
| 29 | Application Development/Configuration | Ability to provide generation of, access to system event logs and execution logs, searchable to user, date/time range, type of action, etc. Standardized logging framework available for custom development activity |
| 30 | Application Development/Configuration | Ability to control development roles with appropriate security (develop, test, deploy to environments, etc.) to support SOD compliance |
| 31 | Usability | Ability for implementing A&M System custom branding (logo, colors) on all portals and/or entry points whether they be from inside or outside the A&M System network (e.g., site/location, applicants, incoming students) |
| 32 | Usability | Ability to configure (optional) custom branding (logo, colors) by college, campus, site, or location (for notifications, prospecting, admission emails, etc.) |
| 33 | Usability | Ability to have a clear context mechanism (similar to bread crumb trail of menus) that shows the user where they are at all times in context to the overall system |
| 34 | Usability | Ability to support differences in users’ knowledge and abilities, by providing shortcuts and fast paths for experienced users, while also having clear step by step intuitive solutions for novice users, in addition to key word searching of the entire menu/functional taxonomy of the software |
| 35 | Usability | Ability to provide application Upgrade Frequency and backward compatibility |
| 36 | Usability | Ability to manage versions |
| 37 | Usability | Ability to provide Mobile user experience |
| 38 | Usability | Ability to support Heavy reliance on fast keyboard entry at sites using keyboard-centric UI/UX mode (e.g., UI can be fully driven by keyboard, not reliant on mouse or alternate input device). Support 'jump-to" functionality (access to functions/screens by keyword/code if known), breadcrumb navigation |
| 39 | Usability | Ability to support "auto-save" or "partial save and return" for key functions where applicable (e.g., entering grades, creating classes, schedules) |
| 40 | Usability | Ability to support customization, augmentation of inline/screen-level help (i.e., links to "how to" documentation and videos that can be custom developed) |
| 41 | Usability | Ability to customize user-facing error messages |
| 42 | Usability | Ability to support inline "submit support ticket" functionality which will initiate support request with key information about the ticket (e.g., user, client state, system state, any error logs, stack traces). Support for definable automated problem report submission |
| 43 | Usability | Ability to perform trace logging and user session recording on a user session, initiated either by user or support team |
| 44 | Usability | Ability to record navigation sequence (sequence of screens, functions, reports called) by user |
| 45 | Usability | Ability to support asynchronous submission of long-running tasks, with in-app asynchronous progress and completion/error notification |
| 46 | Usability | Ability to support defining automated trouble report submission on abend/untrapped error condition(s) |
| 47 | Usability | Ability to provide robust/fault tolerant handling of concurrent edit/modification (e.g., class creation, registration), such as thru screen warnings/updates, while minimizing low-level data locking or failures due to out-of-date updates |
| 48 | Usability | Ability to extract data natively to Word and Excel templates |
| 49 | Usability | Ability to define "favorites", "bookmarks" or "history" for quick UI access |
| 50 | Usability | Ability for user to define dashboard of items requiring attention by the user (workflow, time-sensitive items, etc.) |
| 51 |
Data, Reporting
| Software Technical Requirements | ||||
| Network | ||||
| # | Sub-Process / Topic | Requirement | Requirement Met? (Fully Met, Partially Met, or Not Met) | Comments |
| 1 | Reporting / Analytics / Data Mgmt. | Ability to utilize third-party reporting tools | ||
| 2 | Reporting / Analytics / Data Mgmt. | Ability to use the same security profile as the transactional environment when accessing the report environment | ||
| 3 | Reporting / Analytics / Data Mgmt. | Ability for reports generated from batch processes/scheduled report jobs to automatically be pushed to designated recipients' dashboards | ||
| 4 | Reporting / Analytics / Data Mgmt. | Ability to provide an ad hoc reporting tool with the ability to access any standard delivered or user-defined fields/ tables in the database | ||
| 5 | Reporting / Analytics / Data Mgmt. | Standard APIs to extract data and load it to external data warehouses | ||
| 6 | Reporting / Analytics / Data Mgmt. | Ability to expose native table data from the SIS solution to allow for easy data access to any BI or reporting tool | ||
| 7 | Reporting / Analytics / Data Mgmt. | Ability to target multiple recipients/users of data and reporting, including internal users as well as external users/students/other partners. Ability to provide secure and authorized access and maintenance capabilities as required | ||
| 8 | Reporting / Analytics / Data Mgmt. | Ability to enable users to ask their own questions of the data, without relying on IT to create a report. In particular, the tools must have a robust semantic layer to enable users to navigate available data sources | ||
| 9 | Reporting / Analytics / Data Mgmt. | Ability to provide dashboard capability to disseminate real-time data from operational applications, or in conjunction with a complex-event processing engine | ||
| 10 | Reporting / Analytics / Data Mgmt. | Ability to provide integration with Microsoft Office (particularly Excel), including support for document and presentation formats, formulas, data "refreshes" and pivot tables. Advanced integration includes cell locking, write-back, inherited data validation | ||
| 11 | Reporting / Analytics / Data Mgmt. | Ability to create formatted and interactive reports, with or without parameters, with highly scalable distribution and scheduling capabilities | ||
| 12 | Reporting / Analytics / Data Mgmt. | Ability to apply a search index to structured and unstructured data sources and maps them into a classification structure of dimensions and measures that users can easily navigate and explore using a search interface | ||
| 13 | Reporting / Analytics / Data Mgmt. | Ability to provide a platform with a set of programmatic and visual tools, coupled with a software developer's kit, for creating analytic applications, integrating them into a business process, and/or embedding them in another application | ||
| 14 | Reporting / Analytics / Data Mgmt. | Ability to provide tools which leverage the same metadata and provide a robust way to search, capture, store, reuse and publish metadata objects, such as dimensions, hierarchies, measures, performance metrics and report layout objects | ||
| 15 | Reporting / Analytics / Data Mgmt. | Ability to combine structured and unstructured data for pattern and predictive analysis capabilities | ||
| 16 | Reporting / Analytics / Data Mgmt. | Ability to easily combine data from multiple sources, not just the SIS solution | ||
| 17 | Reporting / Analytics / Data Mgmt. | Ability to easily handle dynamic changes or multiple views in master data hierarchies due to program, college, campus, or other analytic requirements | ||
| 18 | Reporting / Analytics / Data Mgmt. | Ability to easily handle the addition of new data elements and attributes that are required to drive new business rules and/or reporting needs. New attributes should have the same audit, security, and configuration capabilities as existing elements/attributes | ||
| 19 | Reporting / Analytics / Data Mgmt. | Ability to use vendor BI platform independent of vendor SIS solution | ||
| 20 | Reporting / Analytics / Data Mgmt. | Ability to use vendor MDM platform independent of vendor SIS solution | ||
| 21 | Reporting / Analytics / Data Mgmt. | Ability to support high volume and high usage analytics without degradation of the SIS transaction processing and online user performance | ||
| 22 | Reporting / Analytics / Data Mgmt. | Ability to configure role-based security for authorized data inquiry and maintenance for certain fields, functions, channels, businesses, regions, etc. | ||
| 23 | Reporting / Analytics / Data Mgmt. | Ability to support non-relational or noSQL data queries | ||
| 24 | Reporting / Analytics / Data Mgmt. | Ability to purge data by functional area based on data retention policies | ||
| 25 | Data Archiving | Ability to provide online access to the current year plus unlimited previous years of all types of data retained in the system, and ability to provide archive capabilities for a defined period thereafter | ||
| 26 | Data Archiving | Ability to archive data to external storage media and support partitions, based on user-defined criteria including, but not limited to number of years | ||
| 27 | Data Archiving | Ability to purge data by functional area based on data retention policies | ||
| 28 | Artificial Intelligence | Ability for bi-directional integration with external AI agents (e.g., conversational AI, virtual assistants, workflow AI, security AI) | ||
| 29 | Artificial Intelligence | Ability to leverage embedded AI capabilities with customizations in the solution (e.g., custom data objects and elements) |
Support, SLAs
| Software Technical Requirements | ||||
| Support and SLAs | ||||
| # | Sub-Process / Topic | Requirement | Requirement Met? (Fully Met, Partially Met, or Not Met) | Comments |
| 1 | Support Model | Ability to provide online self-service support that is free or included with standard service | ||
| 2 | Support Model | Ability to provide incident management system for identifying, submitting and tracking service incidents | ||
| 3 | Support Model | Vendor shall have customer advisory panel that is able to provide self-service suggestions | ||
| 4 | Support Model | Ability to provide trial or proof-of-concept and test options | ||
| 5 | Support Model | Ability to provide application upgrades that are included in the license or subscription agreement | ||
| 6 | Support Model | Ability to provide 24/7 Tier 2 support with a 15-minute response via email and telephone available | ||
| 7 | Support Model | Ability to provide live-human-support offering in English | ||
| 8 | Support Model | Ability to provide listing of established cloud service partners curated via website or customer portal | ||
| 9 | Support Model | Ability to provide documented change management procedures | ||
| 10 | Support Model | Ability to provide documented incident prioritization procedures | ||
| 11 | Support Model | Ability to provide documented incident response plans | ||
| 12 | Support Model | Ability to provide migration support to and from services | ||
| 13 | Support Model | Ability to assign support manager and account representative | ||
| 14 | Support Model | Ability to provide premium support model option | ||
| 15 | Support Model | Ability to provide documented support for third-party application integration | ||
| 16 | Support Model | Ability to provide professional services for implementation, support, and deployment available | ||
| 17 | Support Model | Ability to provide customer controls for the application of new releases, patches, upgrades, and changes to the service | ||
| 18 | Support Model | Ability to provide Tier 1 support | ||
| 19 | Service Levels | Ability to provide 99.99% (four 9s) or better uptime guarantee | ||
| 20 | Service Levels | Ability to provide no downtime exceptions in the SLA | ||
| 21 | Service Levels | Ability to provide service credits/refunds for outages equal to or greater than the cost of service during outage with no limits | ||
| 22 | Service Levels | Ability to define downtime start as when service is degraded | ||
| 23 | Service Levels | Ability to provide scheduled maintenance that is limited and communicated in advance | ||
| 24 | Service Levels | Ability to define and provide said definition of RTO and RPO for the services (provide in the "Comments" column) | ||
| 25 | Service Levels | Ability to confirm all ownership rights to data, inputs and outputs remain with the customer | ||
| 26 | Service Levels | Ability to automatically notify customers of an SLA miss | ||
| 27 | Service Levels | Ability to support a notification window, for customer to submit SLA miss claim, that is equal to or greater than two billing cycles | ||
| 28 | Service Levels | Ability to support regular review with SaaS provider of SLA, issues, and requests | ||
| 29 | Service Levels | Ability to provide SLA that protects customers against data loss and data integrity issues | ||
| 30 | Service Levels | Ability to provide SLAs that include performance, issue resolution, request, and audit metrics | ||
| 31 | Service Levels | Ability to provide documented procedure for escalation if SLAs are not met | ||
| 32 | Service Levels | Ability to provide advance notice of SLA change to customers of at least 90 days | ||
| 33 | Service Levels | Ability to provide publicly accessible and downloadable terms of service | ||
| 34 | Service Levels | Ability to support terms and conditions of the contract are tied to the SLAs | ||
| 35 | Service Levels | Ability to offer negotiation for custom terms of service/cloud-hosting agreement | ||
| 36 | Service Levels | Ability to provide publicly accessible SLA definition for all cloud services with versioning and revision history | ||
| 37 | Service Levels | Ability to provide liability for impacts when failing to meet SLAs | ||
| 38 | Service Levels | Ability to provide dashboard of service health and SLA status | ||
| 39 | Service Levels | Ability to provide End User Training material |
Tech Proposal Response
| Software Technical Requirements |
| Tech Proposal Questions |
Instructions: Please provide responses to the below questions. Include drawings/diagrams or attach documents where appropriate. It is acceptable if you prefer to cover all of this in one Technical Response document as part of your proposal.
| # | Topic | Question | Response |
| TECH-ARCH-01 | Deployment Architecture | Describe your proposed deployment approach for A&M System (e.g., private hosting, single tenant vs. multi-tenant, hosting provider, etc.) | |
| TECH-ARCH-02 | Deployment Architecture | Provide an overall architecture diagram depicting the components of your proposed solution and the primary purpose of each. This should be consistent with the BOM and pricing provided in your response | |
| TECH-ARCH-03 | Deployment Architecture | Please provide specific detail on where A&M System data will be stored geographically and architecturally, and how the data will be segregated from other non-A&M System customer data the solution may store if applicable | |
| TECH-ARCH-04 | Deployment Architecture | Please describe any known considerations (applicability of local law, political risk, civil/tort risk, etc.) stemming from your geographic compute and data storage environment above and beyond those of US penal and civil law. If applicable, what mitigations have you introduced related to these? | |
| TECH-ARCH-05 | Deployment Architecture | Are hosting facilities fully owned and supported or is this a 3rd party co-location facility? If owned by one or multiple 3rd parties, please provide the names of the 3rd parties | |
| TECH-ARCH-06 | Deployment Architecture | Provide technical details on which ports and protocols this solution will utilize to transfer data and how each is secured | |
| TECH-ARCH-07 | Deployment Architecture | Explain if / how any A&M System data may come in contact with any 3rd parties, outsourced, or sub-contracted work and how those interactions are secured and monitored | |
| TECH-DATA-01 | Data Management | Provide information on any data conversion tools and services that you support as A&M System migrates data from several legacy solutions? | |
| TECH-DATA-02 | Data Management | How does the system support self-service analytics for business users while maintaining governance? | |
| TECH-DATA-03 | Data Management | How does the system support a modern data architecture, including cloud-based data platforms (e.g., Red Shift, Snowflake, AWS, Azure, etc.)? | |
| TECH-DATA-04 | Data Management | What data models and schemas does the system use, and how flexible are they for customization? | |
| TECH-DATA-05 | Data Management | Does the SIS support event-driven architectures and real-time data streaming? | |
| TECH-INTEG-01 | Integration | Describe your specific experience with integrating with other CRM solutions. How many out of the box integrations do you currently have with other CRM solutions? | |
| TECH-INTEG-02 | Integration | Describe your specific experience with integrating with other LMS solutions. How many out of the box integrations do you currently have with other LMS solutions? | |
| TECH-INTEG-03 | Integration | Describe your specific experience with integrating with HCM solutions (whether owned by vendor or a third-party). How many out of the box integrations do you currently have with HCM solutions? | |
| TECH-INTEG-04 | Integration | Describe your specific experience with integrating with custom financial management solutions? | |
| TECH-INTEG-05 | Integration | Describe your proposed integration approach. Include a diagram showing integration points (A&M System, student portals, LMS, and other 3rd party ecosystem software providers | |
| TECH-INTEG-06 | Integration | Describe how your solution will handle integration failures both on the data it receives via integration and data it sends on integration | |
| TECH-INTEG-07 | Integration | List at least two integration middleware technologies you partner with and would recommend and your rationale/experiences with each | |
| TECH-INTEG-08 | Integration | What is your approach for integrating with other SISs? (e.g., if A&M System acquires another university/college that has a different SIS or if A&M System decides to go with a 2-tier SIS architecture) | |
| TECH-INTEG-10 | Integration | What is your approach to tax calculation and presentation? External service? What level of customization and extensibility are supported? | |
| TECH-INTEG-11 | Integration | What is your approach to definition, enforcement, and reporting of custom fees or other elements of a transaction (delivery fees, special tax situations, etc.) which may derive from local rules, business practices, or laws? | |
| TECH-INTEG-12 | Integration | Describe application architecture support for image, video, PDF , or other unstructured data attachments within transactions | |
| TECH-INTEG-13 | Integration | Describe application architecture support for geocoding, geocoded information and geographic data capabilities within transactions (location or geo-fencing) | |
| TECH-INTEG-14 | Integration | Describe application architecture support for advanced accessibility features, fonts, colors, sizes, text-to-speech, OCR, PDF scanning, etc. | |
| TECH-INTEG-15 | Integration | Please provide available documentation on authentication and data integration methods/frameworks | |
| TECH-SLA-01 | Service Level | Provide service level agreement (SLA) for availability | |
| TECH-SLA-02 | Service Level | Describe service level for disaster recovery | |
| TECH-SLA-03 | Service Level | Explain application support structure. Provide service level agreement for incidents, problems, and enhancements. (Both response and resolution SLAs) | |
| TECH-SLA-04 | Service Level | Provide an example of contract languages for service credits/refunds for outages. Describe the time frame A&M System has to submit SLA miss claims | |
| TECH-SLA-05 | Service Level | Provide an example of dashboard that demonstrates service health and SLA status | |
| TECH-SLA-06 | Service Level | Explain the reliability of your solution in the event of an integration connection loss | |
| TECH-SLA-07 | Service Level | Explain the reliability of your solution in the event of degraded performance caused by uploads/downloads | |
| TECH-ENCRYPT-01 | Encryption | Provide a list of all configurable encryption options and the levels of encryption capable by the solution | |
| TECH-ENCRYPT-02 | Encryption | Explain the technical details of how A&M System user credentials and data will be secured both in-transit and at rest | |
| TECH-IDENTITY-01 | Identity | Explain the relevant authentication security features available in the solution such as Password Complexity, Password Re-Use, Session Timeout, Account Lockout, Password Reset, Multi-Factor, etc. |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .