Exhibit A Requirements FINAL.xlsx
XLSX spreadsheet 45 KB Posted
- Attached to
- Bank Reconciliation Services
- Solicitation number
- RFP-124435
- Issued by
- Richmond City, Roanoke City, Virginia
About this file
Summary
This is an Exhibit A Requirements document for Virginia Department of the Treasury's RFP BPM087898 for Bank Reconciliation Services. The document establishes evaluation criteria organized into five primary sections: Prerequisites, General Security Requirements, Artificial Intelligence Requirements, Cloud Requirements, and COV Technology Roadmaps, along with supplementary requirements and business/functional specifications. The RFP seeks a cloud-hosted Software as a Service (SaaS) solution capable of managing multiple companies, banks, bank pools, and ledger accounts with support for 75+ configurable fields across more than 70 bank pools. The solution must include an integrated scheduler for sequential task management, secure cloud-based file repository functionality, automated matching of 5,000+ daily transactions using rule-based criteria, integrated reporting capabilities, and preprocessing engine capabilities to replace existing macros and stored procedures. The Commonwealth encourages alliances among suppliers but prefers a single point of interface where possible. Suppliers must complete the Exhibit A requirements workbook by indicating whether they "Meet" or "Does Not Meet" each requirement and providing detailed explanations in the response column; blank responses will be interpreted as "Does Not Meet" and may impact proposal evaluation.
The requirements encompass comprehensive technical, security, and functional specifications including COV Information Technology Resource Management (ITRM) policy compliance, Section 508 accessibility compliance with a completed Voluntary Product Accessibility Template (VPAT), compliance with applicable federal standards (FedRAMP, CJIS, FISMA, PCI, ISO27001, FERPA, HIPAA-HITECH), and adherence to Commonwealth Technology Roadmaps using approved technology versions. The solution must provide role-based access controls, encryption, authentication, audit logging, and data archiving capabilities consistent with COV Ramp requirements. Additionally, suppliers must address integration with existing Commonwealth systems including the Treasury Accounting System (TAS) and Cardinal, provide NACHA file generation for ACH processing, support data migration from the current Frontier/Recon Plus environment with parallel processing capability, and deliver comprehensive training, documentation, and ongoing maintenance with defined Service Level Agreements. The document specifies that no pricing information is contained herein; pricing responses are addressed in Exhibit B of the RFP.
View the file
Other files
Show all 14
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions RFP [insert # and name]
EXHIBIT A REQUIREMENTS
Instructions
| This Excel workbook has multiple tabs that set forth requirements to which Supplier is required to provide a response indicating its capability to fulfill each specific requirement. Supplier’s response will be reviewed in accordance with the stated requirements within each section in order to determine the best solution for Agency. |
| The Prerequisites tab, which will be evaluated as Pass/Fail, will determine whether the Supplier moves on to the next phase of evaluation. |
| For each requirement, Supplier is asked to enter in the space provided in Column C a response (Meets, Does Not Meet) that best corresponds to its intended response for the requirement listed. In cases where VITA has pre-filled Column C for certain requirements with "N/A," Supplier must provide sufficient information in its response in Column D to allow VITA to properly evaluate its proposal. |
| The acceptable responses are as follows: |
| "Meets" = Supplier can fully meet the requirement as documented with its current application or proposed solution. Supplier shall provide an explanation in Column D of how it will fulfill the requirement. This may include use of alliances with other suppliers. Supplier's detailed response should NOT be an affirmative reiteration of the requirement, but should explain how the requirement will be met. |
| "Does Not Meet" - Supplier cannot meet the requirement as written. Supplier should provide an explanation of why it cannot be met OR whether it has an alternative approach (with description). |
| Supplier should review all responses for completeness before submitting its proposal. Ensure that all applicable sections of the questionnaire are answered, as incomplete answers may impact the evaluation of your proposal. A blank response in Column C will be interpreted as a "Does Not Meet" response. |
| Supplier must respond to all tabs in this workbook. Do not reformat or revise the tabs as this may cause Supplier to be removed from being considered for award of this contract. |
Prerequisites RFP BPM087898 Bank Reconciliation Services
EXHIBIT A REQUIREMENTS
Prerequisites
| Add Prerequisites in this column. Procurement to remove this tab if particular procurement has no Prerequisites | ||
| **(Supplier Name Here)** | ||
| Meets/Does Not Meet |
Agency Requirements RFP BPM087898 Bank Reconciliation Services
EXHIBIT A
VITA Requirements
Section A General Security Requirements Section B Artificial Intelligence Requirements Section C Cloud Requirements Section D COV Technology Roadmaps Section E Other Requirements
| **(Add Supplier Name Here)** | |||
| Section A | General Security Requirements | Meets/Does Not Meet | Additional Detail |
| 1A | Supplier's proposed solution shall comply with all current COV ITRM Policies and Standards, including those pertaining to: |
1. Information Security
2. Data Standards
3. Prohibited Hardware and Software Services
4. Artificial Intelligence
Policies are located at: https://www.vita.virginia.gov/policy--governance/policies-standards--guidelines/
If proposed solution does not, please provide details that specify the Standard/Policy and how Supplier's solution does not comply.
2A Supplier's solution, training material and communications plans shall provide effective, interactive control and use with nonvisual means and provide 508 Compliance in accordance with the following standard regarding IT Accessibility and 508 Compliance:
https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/ETAITAccessibilityTopicReportGOV103.pdf
(Refer to https://www.section508.gov/ and www.access-board.gov for further information)
Describe how this functionality is achieved and include a completed Voluntary Product Accessibility Template (VPAT) with the proposal. The VPAT template can be accessed at the following URL: https://www.section508.gov/sell/vpat
If the solution provides alternate accessibility functionality, please describe.
3A Supplier's proposed equipment shall meet the current U.S. Environmental Protection Agency's and Department of Energy's Energy Star guidelines.
| If not applicable to this procurement, mark “N/A” in Column D and provide an explanation. | Note to procurement: This is not considered a security question and is optional. Delete if not applicable. | ||
| 4A | TBD | Note to procurement: This is a placeholder for any new security requirements that may need to be added to address data breaches. Delete if not applicable. | |
| 5A | Supplier shall ensure all appropriate staff have read the Commonwealth’s security policies, standards and guidelines, applicable to the proposed solution, located at the following URL. https://www.vita.virginia.gov/policy--governance/policies-standards--guidelines/ |
Please state yes or no and explain the top 5 concerns you identify, if any.
| Section B | Artificial Intelligence | Meets/Does Not Meet | Additional Detail |
| 1B | In compliance with 2024 Executive Order 30, regarding the Implementation of Standards for the Safe Use of Artificial Intelligence Across the Commonwealth (EO 30), Supplier shall indicate and describe in detail whether any aspect of the proposed Solution and/or Service contain Artificial Intelligence (AI), as defined in EO 30, the Utilization of Artificial Intelligence by COV Policy Standard and VITA's Artificial Intelligence Standards. |
Additional information regarding VITA's Artificial Intelligence Standards is available at the following URL:
https://www.vita.virginia.gov/artificial-intelligence/ 2B If any aspect of Supplier's proposed Solution or performance of the proposed Services contain AI as defined in EO 30 and VITA’s Artificial Intelligence Standards, then describe the process that Supplier will follow to ensure that Customers, as applicable, have registered the Solution/Services with VITA before a purchase order is fulfilled.
Additional information regarding VITA's Artificial Intelligence Standards is available at the following URL:
https://www.vita.virginia.gov/artificial-intelligence/
| Section C | Cloud Requirements | Meets/Does Not Meet | Additional Detail |
| 1C | Numerous solutions are offered as cloud platforms/services or have cloud options. Executive branch agency procurement of solutions with cloud elements require that the agency seek VITA cloud approval before procurement, including potential COVRamp assessment, agreed Cloud Terms and ongoing oversight. |
Describe the process for ensuring that VITA cloud approval has been obtained before a purchase order has been placed.
| 2C | Describe whether the proposed cloud solution is a Software as a Service (SaaS) delivery model or a Platform as a Service (PaaS) delivery model. |
| 3C | Describe whether the proposed solution is a public, private, government, or hybrid cloud model. Describe all available models and ensure pricing response in Exhibit B includes offered options. |
| 4C | Describe whether the proposed solution allows for agency hosting. Elaborate on the advantages and disadvantages of offsite and onsite hosting that the solution offers. |
| 5C | Describe whether the proposed cloud solution is FedRamp authorized. If so, describe the FedRamp level of certification (low, moderate, or high). |
| 6C | The proposed Solution shall comply with all Customers’ individual Information Security Policies and applicable Federal standards (e.g., FedRAMP, CJIS, FISMA,PCI, ISO27001, FERPA, FTI (IRS PUB-1075), SSA, HIPAA-HITECH). |
If proposed solution does not comply, please provide details that specify the Standard/Policy and how Supplier's solution does not comply.
| 7C | Describe whether the proposed cloud solution relies on third-party partners or subcontractors and elaborate on the third-party partners/subcontractors required as applicable. | ||
| 8C | Describe whether the proposed cloud solution allows a customer to solely manage its own encryption keys or if the function must remain with the solution provider. | ||
| 9C | Describe whether the proposed solution has a documented encryption key management process. | ||
| 10C | Describe whether the proposed solution uses standard data encryption techniques. If so, define in detail at all levels. Include, if applicable, what additional options may be added. | ||
| 11C | Describe how the proposed solution addresses security. Provide an attachment to detail the levels of security inherent in your application and what options can be added to support unique customer requirements to ensure confidentiality. | ||
| 12C | Given the desire for electronic payment, with approval from DOA, please describe in detail how this process will work and what safeguards and security measures will be employed to ensure audit compliance. | ||
| Section D | COV Technology Roadmaps | Meets/Does Not Meet | Additional Detail |
| 1D | The proposed solution should only use Approved versions of the technologies covered within the COV Technology Roadmaps. |
https://www.vita.virginia.gov/policy--governance/architecture/cov-technology-roadmaps/
If proposed solution does not only use Approved versions of COV technologies, please provide details on the technologies utilized.
2D For IT solutions and technologies that are not covered within COV Technology Roadmaps, describe if the proposed solution only uses versions or models of IT solutions and technologies that are current (N and N-1) and have vendor or equivalent support.
Example: an IT management utility that only works with a EOL database or N-2 operating system
Note 3: many N and N-1 versions are defined in the COV Technology Roadmaps 3D Describe if the proposed Solution ensures IT solutions and services as well as everything supporting supplier provided or managed technologies, IT solutions, and services shall comply with VITA Policies, Standards, and Guidelines for all supplier provided and managed technologies.
Note: This includes processes, IT solutions, technologies, devices, personnel, etc.
4D Describe if the proposed solution produces a documented lifecycle including information on currency, general availability, and support (end of service life and end of support) for all supplier provided or managed IT solutions and technologies. Note: See COV Technology Roadmaps for more information.
Supplier shall document all versions of software that their services consume or provide. This includes all software that the service providers will be using to host, develop, support, test, and deploy their IT solutions (operating systems, languages, databases, editors, etc.).
Supplier shall produce and maintain defined and VITA-approved baselines for all supported technologies for all IT solution and technologies provided or managed by Supplier.
| Note: Examples of baselines are Center for Internet Security (CIS) and Department of Defense (DoD) Security Technical Implementation Guides (STIGs). | Note to procurement: this requirement applies to non-SaaS only. Delete for RFPs that involve SaaS. | |||
| Section E | Other VITA Requirements | Meets/Does Not Meet | Additional Detail | |
| 1E | Describe whether the solution incorporates security and privacy recommendations and best practices from the National Institute Standards and Technology (“NIST”). | |||
| 2E | Supplier, upon contract award, shall ensure its line item contract pricing is uploaded in eVA: |
https://eva.virginia.gov/eva-catalog.html 3E Supplier's solution shall have the ability to produce custom financial information and reporting as required to ensure proper accounting and financial management by VITA and Authorized Users, in compliance with the pronouncements of the Governmental Accounting Standards Board (GASB), with particular emphasis on Statements No. 87 "Leases" and No. 96 "Subscription-Based Information Technology Arrangements." Examples may include but are not limited to, asset/inventory management for leased equipment, discount/interest rates for leases, inventory management for software licenses including coverage terms, etc. For more information see:
https://www.gasb.org/standards-and-guidance/pronouncements 4E Supplier's proposed solution conforms with the accessibility requirements of Virginia Code §2.2-3502, as the term "accessibility" is defined in Virginia Code §2.2-3501.
Business-Functional Rqrmnts RFP BPM087898 Bank Reconciliation Services
EXHIBIT A
Business/Functional Requirements
| Note to procurement: regarding business requirements, add on as many tabs as needed based on facts of the procurement. | **(Add Supplier Name Here)** | ||
| Business/Functional Requirements | Meets/Does Not Meet | Additional Detail | |
| 1 | The system must allow creation and administration of multiple companies, multiple banks, bank pools, bank-side accounts, and ledger-side accounts. | ||
| 2 | The system must enable authorized users to perform self-service setup and administration of new and existing banks, associated bank accounts, ledger accounts, lookup tables, and related account structures. | ||
| 3 | The system must support multiple (75+) configurable fields with customized display names for more than 70 bank pools and associated accounts, including fields such as department number, agency number, location code, accounting class type, ledger date, deposit date, system date, merchant ID, bank descriptions, and other agreed fields. | ||
| 4 | The system must provide an integrated scheduler or scheduler module that tracks all daily sequential tasks, jobs, and processes required to complete import, export, verification, reporting, and reconciliation tasks. | ||
| 5 | The scheduler must indicate the status of each task, including pending, complete, failed, missing, loaded, released, deferred, or other agreed status values, according to an established date and time-based order. | ||
| 6 | The scheduler must allow for tasks and jobs to be set to a paused or run status (manually triggered) from a console to ensure a directed, sequential progression. | ||
| 7 | The solution must store bank BAI files, ePay files, lookup tables, and required daily external files in a secure cloud-based directory or repository by date, accessible to authorized users for review, modification, correction, and research as required. | ||
| 8 | The system must provide verbose status and exception logging, including missing file names, failure-to-load errors, success and failed-to-load item counts, completed jobs, descriptive error messages, information sufficient to support escalation, research, correction, and processing, and ability to deport items from system. | ||
| 9 | The system must enable direct upload and immediate processing of prior-day BAI files and associated ePay files transmitted each morning by approximately eight to ten banks within Treasury's required morning processing window for daily reconciliation. | ||
| 10 | The Supplier shall provide preprocessing for daily batch uploads of receipts and disbursements in established formats, including Excel, DAT, CSV, PRN, TXT, and other agreed formats, based on triggers or manual scheduler execution. | ||
| 11 | The Supplier shall reformat, import, and process batch or single corrections and adjustments from external spreadsheets and other agreed file sources. | ||
| 12 | The Supplier shall replace special job stored procedures and macro-dependent preprocessing with vendor-provided external preprocessing or integrated ETL functionality that provides comparable or improved matching and data import accuracy. | ||
| 13 | The Supplier shall preprocess daily ledger files for direct import into the bank reconciliation system, including transformations for files received from internal departments and state agencies. | ||
| 14 | The Supplier shall preprocess daily manual and special batch entries, including bank-side and ledger-side transactions. | ||
| 15 | The Supplier shall replace existing special handling processes for ledger entries such as internal same-bank transfers and auto sweep entries, including generation or import of required files for Cardinal or other applicable Commonwealth systems. | ||
| 16 | The Supplier shall convert spreadsheets containing ledger-side keying errors, including transposition errors, amounts, and bank codes, into an agreed import file format for the bank reconciliation system. | ||
| 17 | The Supplier shall replace existing Treasury voucher macros, directory folder monitoring, and job triggers with comparable or improved preprocessing functionality for Treasury voucher and ledger-side ACH disbursement activity. | ||
| 18 | The Supplier shall support cash concentration processing, including extraction of data from the reconciliation system to create NACHA files or other agreed files necessary to support ACH debit records for regional bank accounts. | ||
| 19 | The system must perform daily high-volume automated matching of 5,000 or more bank-side transactions to ledger-side offset entries based on configurable, rule-based matching criteria. | ||
| 20 | The system must support saved global matching criteria and user-customized matching parameters, including preprocessing functionality that improves matching quality and success rates. | ||
| 21 | The system must provide sortable, filterable, tabular exception views of unmatched items based on dynamic, user-defined global, public, and private queries. | ||
| 22 | The system must allow authorized users to inspect, research, correct, improve, and document matches and exceptions, including the ability to attach notes and comments to individual items. | ||
| 23 | The system must enable manual matching and dissolution of matched items. | ||
| 24 | The system must enable the processing of special accounting entries (Suspense, Write-off, Banking Fees) based on configurable rule-based options and ability to export data to Treasury Accounting System (TAS). | ||
| 25 | The system must perform monthly detailed item-level reconciliations of all accounts, bank-side to ledger-side. | ||
| 26 | End-of-month account reconciliations must reflect all entries associated with the month's activity, including adjusting entries entered in the current open accounting period. | ||
| 27 | Monthly reconciliations must identify outstanding reconciling items and display attached notes, comments, and status information. | ||
| 28 | The system must support soft fiscal month closing six to seven days following month-end based on preloaded key dates from an integrated annual calendar lookup table of state holidays, month-end and year-end closing dates, and accounting periods aligned with the Commonwealth fiscal year of July 1 through June 30. | ||
| 29 | The system must include an integrated reporting solution with direct access to system tables, views, reconciliation data, and approved external data sources. | ||
| 30 | The reporting solution must allow authorized users to create, format, schedule, export, and share reports, including pixel-perfect or formatted reports required for internal and external reporting. | ||
| 31 | The Supplier shall replicate essential existing bank reconciliation reports and replace existing macros and ETL tasks currently used for report production. | ||
| 32 | The system must provide verbose, time-stamped audit logs for user-initiated transactions and system activities, including notes and comments. | ||
| 33 | The system must provide role-based access controls, segregation of duties, secure authentication, encryption, logging, monitoring, and administrative controls consistent with applicable Commonwealth and COV Ramp requirements. | ||
| 34 | The system must support systematic archiving and permanent deletion of data based on designated date-driven timeframes, retention policies, legal holds, and authorized administrative controls. | ||
| 35 | The Supplier shall provide requirements validation, solution design, configuration, integration, testing, user acceptance testing, production deployment, go-live support, and post-production stabilization. | ||
| 36 | The Supplier shall provide a detailed migration plan from the current Frontier/Recon Plus-related environment, including data conversion, historical data strategy, report conversion, ETL replacement, validation controls, cutover approach, fallback planning, and parallel processing where feasible. | ||
| 37 | The Supplier shall provide end-user, administrator, technical, and reporting training, along with complete system documentation, configuration documentation, operations guides, and knowledge transfer. | ||
| 38 | The Supplier shall provide ongoing software maintenance, patches, upgrades, help desk support, technical support, defined Service Level Agreements, and continuous performance monitoring. |
Technical Requirements RFP BPM087898 Bank Reconciliation Services
EXHIBIT A
Technical Requirements
| Note to procurement: regarding technical requirements, add on as many tabs as needed based on facts of the procurement. | **(Add Supplier Name Here)** | ||
| Technical Requirements | Meets/Does Not Meet | Additional Detail | |
| 1 | Cloud-hosted SaaS solution | ||
| 2 | Multi-company architecture | ||
| 3 | Multi-bank support | ||
| 4 | Multiple bank pools | ||
| 5 | Multiple bank-side accounts | ||
| 6 | Multiple ledger-side accounts | ||
| 7 | Self-service administration of banks/accounts | ||
| 8 | Support 75+ configurable fields | ||
| 9 | Custom field names | ||
| 10 | Built-in workflow/job scheduler | ||
| 11 | Sequential job execution | ||
| 12 | Job status monitoring | ||
| 13 | Manual pause/run capability | ||
| 14 | Secure cloud file repository | ||
| 15 | Store BAI files | ||
| 16 | Store ePay files | ||
| 17 | Store lookup tables | ||
| 18 | Date-based file storage | ||
| 19 | Detailed processing logs | ||
| 20 | Error logging | ||
| 21 | Success/failure counts | ||
| 22 | Descriptive error messages | ||
| 23 | Direct BAI file processing | ||
| 24 | Support Excel import | ||
| 25 | Support CSV import | ||
| 26 | Support DAT import | ||
| 27 | Support TXT import | ||
| 28 | Support PRN import | ||
| 29 | Built-in preprocessing engine | ||
| 30 | Replace existing macros | ||
| 31 | Replace stored procedures | ||
| 32 | Replace external ETL jobs | ||
| 33 | Import correction spreadsheets | ||
| 34 | Treasury Accounting System export | ||
| 35 | Cardinal integration support | ||
| 36 | NACHA file generation | ||
| 37 | Rule-based matching engine | ||
| 38 | Process 5,000+ transactions/day | ||
| 39 | Configurable matching rules | ||
| 40 | Integrated reporting platform | ||
| 41 | Direct database reporting | ||
| 42 | Scheduled reports | ||
| 43 | Export reports | ||
| 44 | Replace Crystal Reports | ||
| 45 | Replace Excel macro reporting | ||
| 46 | Role-based security | ||
| 47 | Segregation of duties | ||
| 48 | Encryption | ||
| 49 | Authentication controls | ||
| 50 | Monitoring | ||
| 51 | COV Ramp compliance | ||
| 52 | Data archiving | ||
| 53 | Time-stamped audit logs | ||
| 54 | Data deletion policies | ||
| 55 | Legal hold capability | ||
| 56 | Historical data migration | ||
| 57 | Report migration | ||
| 58 | Configuration migration | ||
| 59 | Parallel processing support | ||
| 60 | Production deployment | ||
| 61 | Software maintenance | ||
| 62 | Software upgrades | ||
| 63 | Help Desk | ||
| 64 | SLA support |
Sheet2
| Meets |
| Does Not Meet |
File details come from the government source that posted it. Updated .