Exhibit 3 - Travel System Requirements Technical Integration.pdf
PDF 40 KB Posted
- Attached to
- Request for Information - Travel System
- Solicitation number
- ORNLTravelRFI2026
- Issued by
-
Department of Energy
About this file
This document is Exhibit 3 of a federal contract opportunity detailing technical integration and system requirements for a Travel System solution to be implemented at Oak Ridge National Laboratory (ORNL).
The Travel System must integrate bi-directionally with SAP S/4HANA 2023 ERP using modern APIs (REST, OData) with no rate limits. Identity and access management requirements include SSO with SAML 2.0 and/or OAuth 2.0, role-based access control (RBAC), and user provisioning. External service integrations are required for airline support, per diem programs (domestic, non-foreign, and foreign), GovTravel lodging programs, risk/safety tools including travel tracking and duty-of-care providers, and corporate credit card providers. Security and compliance mandates include FedRAMP certification (preferably) or explanation of alternatives, TLS 1.2+ encryption in transit and at rest, multi-factor authentication capabilities, secure mobile access, and device permissions management. All data storage facilities, including disaster recovery locations, must be located in the continental United States. The solution must comply with FISMA requirements, include PII handling protocols for traveler passport/ID information, and establish incident response policies with defined breach notification timelines.
The system must be cloud-hosted SaaS (or on-premise if applicable) with 99.9% uptime availability and a comprehensive disaster recovery plan. Technical capabilities include open APIs for BI/reporting tools, SFTP flat-file integration, custom fields and metadata support, modern responsive UI across desktop/mobile/tablet platforms, a mobile application for booking and expenses, and accessibility compliance. Reporting and analytics must provide standard dashboards for spend, policy compliance, and trip volumes, with custom report building and API-based data extraction without rate limits. Policy and compliance features include configurable travel and expense policies, automatic pre-trip authorization workflows, hard/soft policy rules with alerts, audit queues for expense review, and risk/safety vendor integration. Vendor support requirements include implementation timeline specifications, 24/7 support with ticketing and response SLAs, training materials and video tutorials, data migration capabilities for profiles and historical data, and customer success manager availability.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Exhibit 3 – Travel System Requirements Technical Integration
ERP
Bi-directional integration (modern APIs such as REST, OData with no rate limits) with ERP system – SAP S/4HANA On Premise (SAP S/4HANA 2023).
Identity and Access Management
SSO with SAML 2.0 and/or OAuth 2.
Role-based access control (RBAC).
User provisioning.
External Services
Airline support.
Per diem programs (domestic, non-foreign, foreign).
GovTravel lodging programs.
Integration with risk/safety tools (e.g., travel tracking / duty-of-care providers).
Corporate credit card provider integration.
Security and Compliance Requirements
Security Standards
Preferably FedRAMP. Describe whether FedRAMP is an option or not.
Data encryption in transit (TLS 1.2+) and at rest.
MFA capabilities.
Secure mobile access and device permissions.
Data Protection
The Travel Solution and all of its data storage facilities where ORNL data will reside, including those for Disaster Recovery, MUST be located in the continental United States. Data retention and purge options. ORNL is subject to the Federal Information Security Management Act (FISMA) requirements.
PII handling, including traveler passport/ID information.
Incident response policy and breach notification timelines.
Audit and Governance
Detailed system audit logs.
Access audit reporting.
Change tracking for travel and expense documents.
Technical and Architectural Requirements
System Architecture
Cloud-hosted SaaS (or on-premise options if applicable).
High availability (99.9% uptime or better).
Disaster recovery plan.
APIs and Data Access
Open APIs for pulling data into BI/reporting tools for al data points (workflow, change tracking, audit logs, etc.)
Flat-file integration capability (SFTP).
Support for custom fields and metadata.
Performance
Page load performance expectations.
Usability and User Experience
Modern, responsive UI (desktop/mobile/tablet).
Mobile application for booking and expenses.
Accessibility compliance.
Traveler profile storage, including preferences.
Reporting and Analytics
Standard dashboards for spend, policy compliance, trip volumes.
Ability to build custom reports.
Export to Excel/CSV and API-based (with no rate limits) data extraction.
Policy and Compliance Requests
Configurable travel and expense policies.
Automatic pre-trip authorization workflows.
Hard/soft policy rules with alerts.
Audit queue for expense review.
Risk and safety vendor integration (travel alerts, location tracking).
Vendor Support and Implementation Requirements
Implementation timeline expectations.
Support model (24/7, ticketing, response SLAs).
Training materials, video tutorials, helpdesk tools.
Data migration capabilities (profiles, historical data).
Customer success manager availability.
File details come from the government source that posted it. Updated .