EXHIBIT A - Statement of Work.pdf

Exhibit A Page 1 of 44

EXHIBIT A

STATEMENT OF WORK

Background

The Colorado Department of Public Safety (CDPS), Colorado State Patrol (CSP) is requesting proposals for an in-car digital evidence recording system that will function in a dispersed environment with varying connectivity conditions. At a minimum, any proposed solution will include (2) two in-vehicle cameras – (1) forward facing and

(1) cage mounted, (or one 360 degree camera), a remote microphone for the trooper, an in-vehicle microphone, with the ability to add additional cameras (exterior and body cameras) at a later date. Any solution will include the ability to use standard law enforcement methods for gathering evidence including, but not limited to, tagging the evidence for retrieval later, identification of the associated case number, and maintaining the chain of custody. The solution will be required to upload the recordings from the local storage device to a central location that is accessible from only authorized users in a variety of locations. The solution will be required to meet minimum standards for configurability, security, application redundancy and data storage and backup.

Statutory Compliance

The Proposal shall clearly state, with no exception, agreement to comply with, and to ensure personnel doing work for the State under any contract resulting from this RFP will comply with, the State of Colorado Information Security Policies (CISP) promulgated by the Colorado Chief Information Security Officer and available at http://oit.state.co.us/ois/policies. The Proposal shall clearly state that the Proposal shall be in compliance with the current OIT Technology Standards promulgated by the OIT Chief Technology Officer and available at http://www.oit.state.co.us/cto/ea/standards. The Proposal shall clearly state agreement to complete the assigned vendor portions of the System Security Plan as directed by the Office of Information Security and as reflected in Attachment II - System Security Plan Template.

Logistics The Colorado State Patrol operates approximately 500 vehicles outfitted with in-car evidence systems. The CSP deploys vehicles to offices around the state. A centralized maintenance facility in Golden, Colorado maintains and outfits the vehicles.

The Colorado State Patrol operates approximately 40 offices across the state with the need for patrol vehicle digital evidence upload capability.

Testing Period

The Colorado State Patrol will require a testing period of approximately 45-60 days to ensure the solution submitted is capable of meeting the needs of the agency. Testing will include both in-car and location infrastructure, equipment, software, web-based interface and final evidence product. Vendor(s) will be notified via email if chosen for the testing period.

The testing period may include up to the top two solutions selected by the evaluation committee, based on the scores achieved from the Scope of Work Requirement Assessment.

1. SCOPE OF WORK

1. Provide Colorado Department of Public Safety (CDPS), Colorado State Patrol (CSP), a complete functioning in-car digital evidence collection solution with cloud or better long term storage of digital evidence.

2. The awarded Contractor shall configure and maintain the solution for the life of the contract agreement, to include updates in technology, equipment and software.

3. The Contractor shall provide the CSP Vehicle Maintenance and the Evidence Personnel with holistic training on the installation and operation of the in-car equipment.

http://oit.state.co.us/ois/policies http://oit.state.co.us/ois/policies http://www.oit.state.co.us/cto/ea/standards

Exhibit A Page 2 of 44

4. The Contractor shall provide the CSP Evidence Personnel with the holistic training on the installation of any hardware needed at on-site locations throughout the state, as well as software configurations for the security, retrieval, forwarding as well as interface operations of the cloud solution.

5. Accessibility - The Proposal shall clearly state agreement to comply with Section 508 of the U.S.

Rehabilitation Act of 1973 and AA with the most current version of the Web Content Accessibility Guidelines (WCAG) available at https://www.w3.org/TR/WCAG21/. To the extent applicable to the Proposal, Offeror agrees that the Price Proposal includes all costs and expenses associated with compliance with these accessibility requirements. Any additional costs to add accessibility features will be the obligation of the Awarded Offeror, and any addition or change to the Price Proposal will be disallowed.

Exhibit B – Proposal Submission, please describe how the Proposal will comply with this accessibility requirements, or briefly explain why any requirement would be inapplicable. Will the solution(s) described in the Proposal require any exceptions from compliance with these requirements?

6. Background Checks

a. At the sole discretion of the State or State Entity, as applicable, employees of the

Contractor, and any subcontractor providing services under this Contract will be subject to background checks at the vendor’s expense. The contractor will fully cooperate with the State to ensure activities associated to any background checks being conducted can be carried out in a timely manner.

2. INSTRUCTIONS FOR THE SCOPE OF WORK REQUIREMENT ASSESSMENT

The Contractor will complete the following Scope of Work Requirement Assessment answering each category using one of the following criteria:

Response # Response Box Offer Capability

1 Current Capability

Specification will be met by the proposed future DVES solution that is installed and operational in other states and can be demonstrated to CSP/CDPS. The cost of specifications receiving this response must be included in the cost of the base package, and the specifications must be delivered with the baseline solution at installation.

2 Future Release

Specification will be met by a future release of the product. The cost of specifications receiving this response must be included in the cost of the base package, and the specifications must be delivered within 1 year of baseline solution installation.

3 Custom Development

Specification will be met by package software currently under development, in beta test, or not yet released. The cost of specifications receiving this response must be included in the cost of the base package, and the specifications must be delivered with the baseline solution at installation.

4 Not Available Specification cannot be provided either as part of the baseline solution or future enhancement.

Begin answering these requirements on the tables in the following pages. If more room is needed please use a separate sheet.

https://www.w3.org/TR/WCAG21/

Exhibit A Page 3 of 44

Req. ID Requirement Area Requirement Offer

Capability

Architecture Describe the proposed strategy for a clustered and load-balanced environment, where applicable. 1 2 3 4

Offeror Response:

Arc-2 Architecture

Describe how separate environments are established and maintained to obfuscate data, unless otherwise approved by the Department. At a minimum, environments shall include:

- Development

- Test

- Production -The solution environment management and code promotion shall be addressed in the Contractor’s Solution Promotion, Back-out and Rollback Guide

1 2 3 4

Offeror Response:

Arc-3 Architecture Describe how the data is stored in an industry recognized database solution.

1 2 3 4

Offeror Response:

Arc-1

Exhibit A Page 4 of 44

Arc-4 Architecture

Describe how the infrastructure is hardened consistent with the standards published on CISecurity.org, FBI CJIS Policy https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center, FBI Guidance on Cloud Computing https://www.fbi.gov/file-repository/cjis-cloud-computing-report_20121214.pdf/view, or a similar organization.

1 2 3 4

Offeror Response:

Arc-5 Architecture Describe how the recordings are stored and archived in a central repository. 1 2 3 4

Offeror Response:

Arc-6 Architecture Describe how the solution automatically parses discrete data elements within received data. 1 2 3 4

Offeror Response:

https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center https://www.fbi.gov/file-repository/cjis-cloud-computing-report_20121214.pdf/view https://www.fbi.gov/file-repository/cjis-cloud-computing-report_20121214.pdf/view

Exhibit A Page 5 of 44

Arc-7 Architecture Describe how the solution does not utilize a system architecture that is proprietary to the vendor, is portable, and will use published APIs, unless no published API exists in that specific instance.

1 2 3 4

Offeror Response:

Arc-8 Architecture

Describe how the solution follows all applicable OIT policies and standards as directed and approved by OIT including:

A. The OIT “Cloud First” Initiative:

http://www.oit.state.co.us/cto/ea/cloud-and-mobile-strategy B. OIT Standards and Policies:

http://www.oit.state.co.us/about/policies C. OIT Web Services standard 2012v1:

https://data.colorado.gov/State/OIT-Standards-Web-Services- 2012v1/hjsj-hgp2 D. OIT Gate Process, including producing and revising all required deliverables: http://oit.state.co.us/cco/governance/policies E. Colorado Information Security Policies:

http://www.oit.state.co.us/ois/policies F. And other key OIT Policies such as enforcing security controls based on data classification, secure login, provide security events handling, ongoing patching (applications, databases, & systems), utilize secure protocols and services, and support an OIT host-based endpoint security solution

1 2 3 4

Offeror Response:

http://www.oit.state.co.us/cto/ea/cloud-and-mobile-strategy http://www.oit.state.co.us/about/policies https://data.colorado.gov/State/OIT-Standards-Web-Services-2012v1/hjsj-hgp2 https://data.colorado.gov/State/OIT-Standards-Web-Services-2012v1/hjsj-hgp2 http://oit.state.co.us/cco/governance/policies http://www.oit.state.co.us/ois/policies

Exhibit A Page 6 of 44

Arc-9 Architecture Describe how the solution is be capable of creating new interfaces using the established application architecture. 1 2 3 4

Offeror Response:

Arc-10 Architecture

Provide an architectural overview detailing the necessary components of the solution, from critical to periphery, with third-party components demarked and identified. The proposed architectural overview shall describe previous experience, performance characteristics, and the approach to a service oriented architecture (both target and present day, if available).

1 2 3 4

Offeror Response:

Arc-11 Architecture Describe how the solution is compatible with current networking standards for OIT. Identify networking standards within the approved standards located at: http://www.oit.state.co.us/about/policies.

1 2 3 4

Offeror

Exhibit A Page 7 of 44

Arc-12 Architecture

Describe how the solution shall use an open architecture and follow industry standards and best practices for future expansion and scalability without the need for major modifications, including adaptability and an extensible architecture.

1 2 3 4

Offeror Response:

Arc-13 Architecture

Describe how the solution uses standard TCP/IP protocols;

specifically it shall be compliant with the following Internet Engineering Task Force RFCs: 768, 783, 791-793, 816, 826, 854, 862-865, 867, 894, 919, 922, 950, 959, 1001, 1002, 1009, 1034, 1035, 1042, 1055, 1065, 1112, 1122, 1123, 1144, 1157, 1179, 1188, 1191, 1201, 1256, 1323, 1332, 1518, 1519, 1534, 1542, 1552, 1661, 1662, 1748, 1749, 1812, 1828, 1829, 1851, 1852, 1878, 1886, 1994-1996, 2018, 2085, 2104, 2131, 2136, 2181, 2236, 2308, 2401, 2402, 2406, and 2581.

1 2 3 4

Offeror Response:

Arc-14 Architecture Describe the environment for the deployment of servers and other equipment to local troop offices if needed.

1 2 3 4

Exhibit A Page 8 of 44

Arc-15 Architecture Describe the long-term storage solution of data, including local and cloud capabilities.

1 2 3 4

Offeror Response:

Arc-16 Architecture Describe the proposed technical specifications for network & bandwidth requirements to support the solution. 1 2 3 4

Offeror Response:

Arc-17 Architecture

Describe the solution's architecture. Identify and justify the classification of, the following (except as otherwise indicated, generally available at: http://www.oit.state.co.us/about/policies):

Software as a Service (SaaS) Platform as a Service (PaaS) Infrastructure as a Service (IaaS) Private Cloud (IaaS) Hybrid Cloud (private and public) Hosted Application or Architecture Physical Infrastructure Architecture Commercial Off-the-shelf (COTS) Modified Off-the-shelf (MOTS) Custom architecture, with an understanding that architectures more in compliance with OIT’s “Cloud First” initiative are preferred (available at: http://www.oit.state.co.us/cto/ea/cloud-and-mobile-strategy) OIT Web Services (available at: https://data.colorado.gov/State/OIT- Standards-Web-Services-2012v1/hjsj-hgp2) OIT Gating (available at:

http://oit.state.co.us/cco/governance/policies) Information Security Policies and Standards, including OIT Password Policies (available at: http://www.oit.state.co.us/ois/policies) Identification and justification shall be included with the proposal.

1 2 3 4

Exhibit A Page 9 of 44

Response:

Arc-18 Architecture

Describe the solution's network architecture. Include hosting locations and independent compliance verification of the following standards or similar:

FEDRAMP

SOC2

SSAE18

FISMA

PCI/DSS

ISO

Describe the standard artifacts used if achieving the prescribed standard is not possible.

1 2 3 4

Offeror Response:

Arc-19 Architecture Document how the design of the solution supports the capacity requirements to accommodate increases in throughput and workload over the lifetime of the solution.

1 2 3 4

Exhibit A Page 10 of 44

Arc-20 Architecture

Document how the organization supports OIT’s IT Lifecycle Management Process as published in C.R.S. 24-37.5-106 (1) (e). The IT lifecycle management process is comprised of stages and gates to promote multi-level business and technical review of each IT project at appropriate gates. At a minimum, provide the following support:

Work with the Department to identify project artifacts and reports to support OIT’s technical gate review process (e.g., Project Management Plan, Risk Management Plan, Security Plan, Change Management Plan, etc.)

Produce artifacts and reports at each lifecycle review stage and gate as requested by the Department.

At a minimum, provide DVES solution project reports to address cost, size, and technical alignment with the Departments plans and existing architecture, risk, and sourcing of common/shared services.

Attend and present at OIT gate review meetings, information about the DVES solution as requested by the Department

1 2 3 4

Offeror Response:

Arc-21 Architecture

Document how the solution meets the minimum performance specifications from the International Association of Chiefs of Police for in-vehicle recording and storage. Details are available at http://forensicvideoexpert.com/pdf/IACP_In-Car_v14.pdf

1 2 3 4

Offeror http://forensicvideoexpert.com/pdf/IACP_In-Car_v14.pdf

Exhibit A Page 11 of 44

Arc-22 Architecture

Document how the solution provides or supports a robust system backup/archiving tools and strategies, including the capability to execute scheduled, unattended online system database backups without affecting system performance and the ability to restore from system backups.

1 2 3 4

Offeror Response:

Arc-23 Architecture Document how the solution stores parsed and structured data elements within a repeatable, documented data architecture. 1 2 3 4

Offeror Response:

Arc-24 Architecture Document the business continuity and disaster recovery planning, including defined recovery time and recovery point objectives.

1 2 3 4

Exhibit A Page 12 of 44

Arc-25 Architecture Document the network ports and protocols utilized by the solution in the Detailed System Documentation (DSD), including capacity (bandwidth), purpose, criticality, and NIST protocols.

1 2 3 4

Offeror Response:

Arc-26 Architecture Explain how your solution is scalable to integrate body cameras during a later phase. 1 2 3 4

Offeror Response:

Arc-27 Architecture

If the State of Colorado requires the use of an Enterprise Service Bus (ESB), describe how the solution is capable of interfacing to OIT’s Enterprise Service Bus standard, Mulesoft, through various methods, such as Mulesoft collectors, custom published APIs, and others.

1 2 3 4

Exhibit A Page 13 of 44

Arc-28 Architecture Please detail your data storage. 1 2 3 4

Offeror Response:

Arc-29 Architecture

Provide a description of each solution configuration and its ability to meet the requirements described in this statement of work. Include a system diagram, previous experience achieving the performance specifications as described in this statement of work. Attach a separate page if needed.

1 2 3 4

Offeror Response:

Arc-30 Architecture

Describe, in addition to the digital evidence solution, your secure network to transmit data from vehicles to the centralized storage. If you do not provide a secure network, then provide the requirements for a secure network that the state needs to build and deploy to allow your solution to transmit data from vehicles to the centralized storage.

1 2 3 4

Offeror Response:

Arc-31 Architecture Describe how your solution utilizes a secure VPN to transmit over public Wi-Fi.

1 2 3 4

Offeror Response:

Arc-32 Architecture Detail if your solution uses JAVA or Flash. 1 2 3 4

Exhibit A Page 14 of 44

Eqp-1

Equipment Describe how the delivery of new and updated (non-refurbished) replacement equipment is within three to five business days. 1 2 3 4

Offeror Response:

Eqp-2 Equipment Describe how the installation of the in-vehicle equipment does not increase the risk of injury to occupants during events relating to a vehicle crash.

1 2 3 4

Offeror Response:

Eqp-3 Equipment

Describe how the in-vehicle setup does not interfere with the occupants’ ability to operate the vehicle's onboard components, the equipment control center, safety equipment or any other in-car system.

1 2 3 4

Exhibit A Page 15 of 44

Eqp-4 Equipment Describe the various installation options of mounting the hardware and equipment within the vehicle. 1 2 3 4

Offeror Response:

Eqp-5 Equipment Describe the specifications of equipment that will deploy during the life of the project. 1 2 3 4

Offeror Response:

Eqp-6 Equipment Describe the technologies incorporated in the proposed solution. 1 2 3 4

Exhibit A Page 16 of 44

Eqp-7 Equipment

Detail all required hardware for a full collection and transfer cycle, from recording to long-term storage by the solution. Please differentiate between equipment used in the vehicle and at the troop offices.

1 2 3 4

Offeror Response:

Eqp-8 Equipment Verify that the recordings are viewer agnostic and can be reviewed using any digital viewer. 1 2 3 4

Offeror Response:

Eqp-9 Equipment Verify the cabling equipment deployed during vehicle installation does not use proprietary connections. 1 2 3 4

Offeror Response:

Fct-1 Functional

Chronicle a primary method using secure wireless technology and a back-up method not using wireless technology for how the evidence recordings will transfer from the storage device in the vehicle to a central repository.

1 2 3 4

Exhibit A Page 17 of 44

Fct-2 Functional Chronicle how a trooper can access the digital evidence system from within the vehicle, prior to uploading to the central repository, with and without the use of the Mobile Device Computer (MDC).

1 2 3 4

Offeror Response:

Fct-3 Functional Chronicle how the solution associates computer aided dispatch (CAD) incident numbers and troop case numbers with each recording during the categorization process.

1 2 3 4

Offeror Response:

Fct-4 Functional Chronicle how the trooper is able to view the real-time feed of the recording from any camera. 1 2 3 4

Exhibit A Page 18 of 44

Fct-5 Functional Describe all methods how users are able access recordings after uploading and storing the recordings in a central repository. 1 2 3 4

Offeror Response:

Fct-6 Functional Describe how a trooper classifies the recorded evidence. 1 2 3 4

Offeror Response:

Fct-7 Functional Describe how multiple cameras (minimum of dash mounted and cage mounted cameras) are able to record simultaneously with the option of scaling to additional cameras.

1 2 3 4

Offeror Response:

Fct-8 Functional Describe how supervisors can change the classification of a recording and maintain the chain of custody. 1 2 3 4

Exhibit A Page 19 of 44

Fct-9 Functional Describe how the equipment functions when the vehicle is running and shut off, to include but not limited to file transfer and recording. 1 2 3 4

Offeror Response:

Fct-10 Functional Describe how the picture-in-picture playback functions. 1 2 3 4

Offeror Response:

Fct-11 Functional Describe how the solution stores GPS data in the recordings. 1 2 3 4

Offeror Response:

Fct-12 Functional Describe how the user can configure the solution to automatically shut down or continue recording when vehicle motor is running or not.

1 2 3 4

Exhibit A Page 20 of 44

Fct-13 Functional Describe how to configure pre-event recording periods for all deployed cameras to record prior to an event trigger. 1 2 3 4

Offeror Response:

Fct-14 Functional Describe how to index recordings from the same incident from multiple vehicles for ease of retrieval. 1 2 3 4

Offeror Response:

Fct-15 Functional Describe how troopers are able to categorize recordings through a user interface. 1 2 3 4

Offeror Response:

Fct-16 Functional Describe how your solution allows administrators to configure settings including but not limited to recording classification, retention policy, and triggers.

1 2 3 4

Exhibit A Page 21 of 44

Fct-17 Functional Describe how your solution securely stores and archives digital evidence in accordance with CJIS requirements. 1 2 3 4

Offeror Response:

Fct-18 Functional Describe the solution's capacity to export all data with full referential integrity in accordance with the approved requirements. 1 2 3 4

Offeror Response:

Fct-19 Functional

Describe the triggers that activate the recordings. Minimum of:

- Pressing the record button

- Activation of emergency/ pursuit lights

- Vehicle speed

- 360 degree crash sensor

- Activation of the microphone

1 2 3 4

Offeror Response:

Fct-20 Functional Document the recorded field of view from all deployed cameras as well their ability to rotate. How many degrees are in the field of view?

1 2 3 4

Exhibit A Page 22 of 44

Fct-21 Functional

Document the specifications for the equipment to be deployed including but not limited to cameras, monitors, storage devices and microphones.

Minimum of 50 hours of recording at 30 frames per second.

Minimum acceptable operating range shall be -35 to +65 C or -31to +149 F.

900 MHz or greater bi-directional digital wireless microphone with in-car & home charger, if an out of range alarm activates must be able to silence it.

Covert secondary hard-wired microphone inside the patrol car Digital Video Recorder- DVR .

The digital video recorder (DVR) offered shall be in full commercial production.

Prototypes will not receive consideration.

1 2 3 4

Offeror Response:

Fct-22 Functional Explain how the control center adjusts the backlighting within the vehicle. 1 2 3 4

Offeror Response:

Fct-23 Functional

Explain how the in-vehicle setup does not interfere with or adversely affect any other electronics within the vehicle (such as by UHF, VHF, or HF radio transmission) including the vehicle's voltage. All wiring must meet standards set forth by the Underwriters Laboratory (UL) as well as the Society of Automotive Engineers (SAE). FCC type accepted for operation under Part 1515.

1 2 3 4

Exhibit A Page 23 of 44

Fct-24 Functional

Please describe how your solution records in high definition. What is the recording resolution? A minimum of 1280 x 720 resolution for high definition is required. Document the file size for one hour of HD recording.

1 2 3 4

Offeror Response:

Fct-25 Functional Please describe how the recorded data will automatically upload from the vehicle to a storage repository using available wireless or cellular signals.

1 2 3 4

Offeror Response:

Fct-26 Functional Please describe how your microphones provide noise canceling to capture audio between troopers and contacts vs. passing traffic and other exterior environmental noise.

1 2 3 4

Offeror Response:

Fct-27 Functional Please describe how your solution records in high definition. What is the recording resolution? Minimum 1280 x 720 resolution for high definition

1 2 3 4

Exhibit A Page 24 of 44

Fct-28 Functional Please relate how the officer microphone integrates with the video system. 1 2 3 4

Offeror Response:

Fct-29 Functional Verify that all equipment is capable of installation in the following vehicles: Dodge Charger, Dodge Durango, Chevy Tahoe, Ford/Chevrolet/Dodge Trucks, and motorcycles.

1 2 3 4

Offeror Response:

Fct-30 Functional

Describe how the solution is reliably able to push digital media over cellular services as well as through broadband access points without compromise to security or integrity while ensuring the final location receives all data in whole.

1 2 3 4

Offeror Response:

Maintenance

Performance of all associated work, including Maintenance and Support, shall be within the United States. Management meetings and/or "hands on" the system may be required at the Fleet Management Building in Golden, Colorado.

Vendor to provide their own transportation, lodging, meals etc., this shall be all-inclusive and considered in the bid proposal.

Exhibit A Page 25 of 44

Mnt-1 Maintenance

Chronicle how the solution complies with version control capabilities in accordance with the approved solution configuration management plan. At a minimum, the solution shall support multiple versions of business rule sets, which can be concurrently deployed and retroactively apply past business rules where needed.

1 2 3 4

Offeror Response:

Mnt-2 Maintenance

Chronicle how to maintain the integrity of the solution through configuration management including control of all configurable elements, including auditing, back-out, rollback, and change transactions with the ability to both import and export changes in accordance with the approved solution promotion, back-out and rollback guide.

1 2 3 4

Offeror Response:

Mnt-3 Maintenance Chronicle how, in a load-balanced environment, the solution provides for software upgrades and maintenance that does not affect the production system (no downtime).

1 2 3 4

Exhibit A Page 26 of 44

Mnt-4 Maintenance Describe the training for the Colorado Department of Public Safety (CDPS) fleet maintenance office staff will need to install the solution in the vehicles.

1 2 3 4

Offeror Response:

Mnt-5 Maintenance Describe the process for the distribution of software and firmware updates to equipment deployed in a vehicle. 1 2 3 4

Offeror Response:

Mnt-6 Maintenance Describe the expected lifecycle for each piece of equipment listed.

The lifecycle of equipment should match the average lifespan of a patrol vehicle, which is five years.

1 2 3 4

Offeror Response:

Mnt-7 Maintenance Describe the patch management process that ensures deployment of only tested patches into production. 1 2 3 4

Exhibit A Page 27 of 44

Mnt-8 Maintenance Describe the testing and installation process for the required equipment. 1 2 3 4

Offeror Response:

Mnt-9 Maintenance Detail the warranty information, including maintenance and replacement, for the equipment listed above. 1 2 3 4

Offer Response:

Mnt-10 Maintenance Document the various warranties for all of the deployed equipment. 1 2 3 4

Offeror Response:

Mnt-11 Maintenance

Document the warranty from the point of delivery through 12 months.

The warranty should include provisions against known viruses, malicious software and backdoor access. There shall be no ability for the offeror or the offeror’s agents to access data without authorization from the State of Colorado subsequent to the delivery of solution.

1 2 3 4

Exhibit A Page 28 of 44

Mnt-12 Maintenance Document your technical support model including availability and location. Technical support must be located within the United States. 1 2 3 4

Offeror Response:

Mnt-13 Maintenance Explain the service and support philosophy, how the organization carries out the philosophy, and how success is measured. 1 2 3 4

Offeror Response:

Mnt-14 Maintenance

For solutions including custom software development, document ownership, maintenance and liability boundaries with respect to the code. For example, if the solution uses a ‘base-code’ or ‘core’ solution to which ‘extensions’ as ‘site code’ are added (as in the case of MOTS), the relationship of all code regions with respect to development and support shall be detailed.

1 2 3 4

Exhibit A Page 29 of 44

Mnt-15 Maintenance

If applicable, describe the web services required to support the solution. The Contractor shall comply with the OIT Web Services (available at: https://data.colorado.gov/State/OIT-Standards-Web- Services-2012v1/hjsj-hgp2).

1 2 3 4

Offeror Response:

Mnt-16 Maintenance In accordance with the approved change management plan, describe how you manage and approve change requests. This list will be the basis for all application enhancements and updates.

1 2 3 4

Offeror Response:

Mnt-17 Maintenance Provide an explanation of ownership, maintenance, and liability with respect to the solution and code. 1 2 3 4

Offeror Response:

https://data.colorado.gov/State/OIT-Standards-Web-Services-2012v1/hjsj-hgp2 https://data.colorado.gov/State/OIT-Standards-Web-Services-2012v1/hjsj-hgp2

Exhibit A Page 30 of 44

Op-1 Operational Chronicle the documentation you provide with your solution. 1 2 3 4

Offeror Response:

Op-2 Operational

Chronicle the plan for testing and deploying updates to the solution in a limited number of CSP selected vehicles prior CSP acceptance of the upgrade leading to subsequent rollout of the upgrade to the remainder of the fleet.

1 2 3 4

Offeror Response:

Op-3 Operational Chronicle the warranty information and maintenance agreement for deployed equipment. 1 2 3 4

Offeror Response:

Op-4 Operational Describe how the solution uses configurable collection schedules. 1 2 3 4

Exhibit A Page 31 of 44

Op-5 Operational Describe how the solution uses data marts for individualized analysis and reporting. 1 2 3 4

Offeror Response:

Op-6 Operational Describe how your solution allows for the secure submission/ distribution of digital evidence. 1 2 3 4

Offeror Response:

Op-7 Operational Describe how your solution would eliminate accidental recordings. As an example, accidental activation of the camera by a maintenance group causing the cameras to record a wall.

1 2 3 4

Exhibit A Page 32 of 44

Op-8 Operational Describe the captured metadata in a recording. Include evidentiary information relevant to the recording as well as how it is configurable by the user.

1 2 3 4

Offeror Response:

Op-9 Operational Detail how a trooper will interface with the recordings from inside the vehicle with the use of standalone viewing hardware. 1 2 3 4

Offeror Response:

Op-10 Operational Detail how to add digital still photos to the evidence solution. 1 2 3 4

Offeror Response:

Op-11 Operational Document how a trooper confirms the solution is recording from outside of the vehicle. 1 2 3 4

Exhibit A Page 33 of 44

Op-12 Operational

Document how the operational production availability, including maintenance windows for the solution is no less than 99.XX% on a 24x7 basis. A description and/or justification of how the solution will meet these requirements shall be included in the proposal response.

1 2 3 4

Offeror Response:

Op-13 Operational Document how the solution will collect data from recording devices utilizing State of Colorado approved methods. 1 2 3 4

Offeror Response:

Op-14 Operational Please describe how the solution associates multiple digital recordings (audio and video) into one case file. 1 2 3 4

Offeror Response:

Op-15 Operational Please describe transfer steps needed to convert captured video to court acceptable evidence without the need for a server based infrastructure.

1 2 3 4

Exhibit A Page 34 of 44

Op-16 Operational Provide documentation on the training for troopers, administrative staff, and any other users of the solution. 1 2 3 4

Offeror Response:

Sec-1

Security

Chronicle how the solution complies with all security and privacy laws, regulations, and policies, including:

Federal Information Security Management Act (FISMA) Criminal Justice Information Services (CJIS)

1 2 3 4

Offeror Response:

Sec-2 Security Chronicle how the solution maintains criminal justice information system (CJIS) compliance. 1 2 3 4

Offeror Response:

Sec-3 Security

Chronicle how the solution will follow OIT standards and support electronic data access to third-party systems for query/exchange. (e.g., secure electronic access, web services, ODBC, data warehouse/flat file, API, and SFTP).

1 2 3 4

Exhibit A Page 35 of 44

Sec-4 Security Chronicle how your solution is compliant with industry standards for evidence chain of custody. 1 2 3 4

Offeror Response:

Sec-5 Security Describe how auditable logs/ trails can track successful and attempted access to the application/system, administrative actions such as add/delete/modify user permissions, and/or other auditable events.

1 2 3 4

Offeror Response:

Sec-6 Security

Describe how the organization responds to a security breach in either application code or hosted environment, and shall integrate with applicable state-operated facilities, datacenter or security policies in accordance with the approved DVES Solution Security Breach Response Plan.

1 2 3 4

Exhibit A Page 36 of 44

Sec-7 Security

Describe how the solution complies with the NIST security framework to protect the assets and related data if using an as-a-service model.

Provide necessary assurances of accountability in protecting assets.

Examples include, but are not limited to:

Employee background checks, acceptable use policies, job descriptions, cyber incident insurance policy, and physical security.

Conduct and/ or provide security scans and remediation plans.

NIST Security Framework and OIT policies are available at:

http://www.oit.state.co.us/ois/policies https://www.nist.gov/cyberframework https://8bbcd643-a-da9b1a34-s-sites.googlegroups.com/a/state.co.us/oit-template-dev/Information%20Security%20Planning.pdf?attachauth=ANoY7crH

OQKT-

Br5txvoo4Cemp5L2pzcaqbxMUCtzFV2o7fWK16k15GmBR3eXDxpI -FnHCnJtuqHV_oci7dYiyjcPWc8PZLs7b2qtGymjAp-vrGW3AiWcKF- JKm6s_lA4NnWWZT2VzoBf3Oe0DKpdA2aNGNJCLBNw_46Inzt7 W6yLtfvz5WRI9BSsvEX6ZceE9dov- IMqdR2VISMqFu5tzwbZkvwlb0GHC4Rk2KkiSwxqz_bIYQCo50%3 D&attredirects=2

1 2 3 4

Offeror Response:

Sec-8 Security Describe how the solution is capable of securely segmenting data as needed based on consent, policy, and regulatory requirements. 1 2 3 4

Offeror Response:

http://www.oit.state.co.us/ois/policies https://www.nist.gov/cyberframework https://8bbcd643-a-da9b1a34-s-sites.googlegroups.com/a/state.co.us/oit-template-dev/Information%20Security%20Planning.pdf?attachauth=ANoY7crHOQKT-Br5txvoo4Cemp5L2pzcaqbxMUCtzFV2o7fWK16k15GmBR3eXDxpI-FnHCnJtuqHV_oci7dYiyjcPWc8PZLs7b2qtGymjAp-vrGW3AiWcKF-JKm6s_lA4NnWWZT2VzoBf3Oe0DKpdA2aNGNJCLBNw_46Inzt7W6yLtfvz5WRI9BSsvEX6ZceE9dov-IMqdR2VISMqFu5tzwbZkvwlb0GHC4Rk2KkiSwxqz_bIYQCo50%3D&attredirects=2%20 https://8bbcd643-a-da9b1a34-s-sites.googlegroups.com/a/state.co.us/oit-template-dev/Information%20Security%20Planning.pdf?attachauth=ANoY7crHOQKT-Br5txvoo4Cemp5L2pzcaqbxMUCtzFV2o7fWK16k15GmBR3eXDxpI-FnHCnJtuqHV_oci7dYiyjcPWc8PZLs7b2qtGymjAp-vrGW3AiWcKF-JKm6s_lA4NnWWZT2VzoBf3Oe0DKpdA2aNGNJCLBNw_46Inzt7W6yLtfvz5WRI9BSsvEX6ZceE9dov-IMqdR2VISMqFu5tzwbZkvwlb0GHC4Rk2KkiSwxqz_bIYQCo50%3D&attredirects=2%20 https://8bbcd643-a-da9b1a34-s-sites.googlegroups.com/a/state.co.us/oit-template-dev/Information%20Security%20Planning.pdf?attachauth=ANoY7crHOQKT-Br5txvoo4Cemp5L2pzcaqbxMUCtzFV2o7fWK16k15GmBR3eXDxpI-FnHCnJtuqHV_oci7dYiyjcPWc8PZLs7b2qtGymjAp-vrGW3AiWcKF-JKm6s_lA4NnWWZT2VzoBf3Oe0DKpdA2aNGNJCLBNw_46Inzt7W6yLtfvz5WRI9BSsvEX6ZceE9dov-IMqdR2VISMqFu5tzwbZkvwlb0GHC4Rk2KkiSwxqz_bIYQCo50%3D&attredirects=2%20 https://8bbcd643-a-da9b1a34-s-sites.googlegroups.com/a/state.co.us/oit-template-dev/Information%20Security%20Planning.pdf?attachauth=ANoY7crHOQKT-Br5txvoo4Cemp5L2pzcaqbxMUCtzFV2o7fWK16k15GmBR3eXDxpI-FnHCnJtuqHV_oci7dYiyjcPWc8PZLs7b2qtGymjAp-vrGW3AiWcKF-JKm6s_lA4NnWWZT2VzoBf3Oe0DKpdA2aNGNJCLBNw_46Inzt7W6yLtfvz5WRI9BSsvEX6ZceE9dov-IMqdR2VISMqFu5tzwbZkvwlb0GHC4Rk2KkiSwxqz_bIYQCo50%3D&attredirects=2%20 https://8bbcd643-a-da9b1a34-s-sites.googlegroups.com/a/state.co.us/oit-template-dev/Information%20Security%20Planning.pdf?attachauth=ANoY7crHOQKT-Br5txvoo4Cemp5L2pzcaqbxMUCtzFV2o7fWK16k15GmBR3eXDxpI-FnHCnJtuqHV_oci7dYiyjcPWc8PZLs7b2qtGymjAp-vrGW3AiWcKF-JKm6s_lA4NnWWZT2VzoBf3Oe0DKpdA2aNGNJCLBNw_46Inzt7W6yLtfvz5WRI9BSsvEX6ZceE9dov-IMqdR2VISMqFu5tzwbZkvwlb0GHC4Rk2KkiSwxqz_bIYQCo50%3D&attredirects=2%20 https://8bbcd643-a-da9b1a34-s-sites.googlegroups.com/a/state.co.us/oit-template-dev/Information%20Security%20Planning.pdf?attachauth=ANoY7crHOQKT-Br5txvoo4Cemp5L2pzcaqbxMUCtzFV2o7fWK16k15GmBR3eXDxpI-FnHCnJtuqHV_oci7dYiyjcPWc8PZLs7b2qtGymjAp-vrGW3AiWcKF-JKm6s_lA4NnWWZT2VzoBf3Oe0DKpdA2aNGNJCLBNw_46Inzt7W6yLtfvz5WRI9BSsvEX6ZceE9dov-IMqdR2VISMqFu5tzwbZkvwlb0GHC4Rk2KkiSwxqz_bIYQCo50%3D&attredirects=2%20 https://8bbcd643-a-da9b1a34-s-sites.googlegroups.com/a/state.co.us/oit-template-dev/Information%20Security%20Planning.pdf?attachauth=ANoY7crHOQKT-Br5txvoo4Cemp5L2pzcaqbxMUCtzFV2o7fWK16k15GmBR3eXDxpI-FnHCnJtuqHV_oci7dYiyjcPWc8PZLs7b2qtGymjAp-vrGW3AiWcKF-JKm6s_lA4NnWWZT2VzoBf3Oe0DKpdA2aNGNJCLBNw_46Inzt7W6yLtfvz5WRI9BSsvEX6ZceE9dov-IMqdR2VISMqFu5tzwbZkvwlb0GHC4Rk2KkiSwxqz_bIYQCo50%3D&attredirects=2%20 https://8bbcd643-a-da9b1a34-s-sites.googlegroups.com/a/state.co.us/oit-template-dev/Information%20Security%20Planning.pdf?attachauth=ANoY7crHOQKT-Br5txvoo4Cemp5L2pzcaqbxMUCtzFV2o7fWK16k15GmBR3eXDxpI-FnHCnJtuqHV_oci7dYiyjcPWc8PZLs7b2qtGymjAp-vrGW3AiWcKF-JKm6s_lA4NnWWZT2VzoBf3Oe0DKpdA2aNGNJCLBNw_46Inzt7W6yLtfvz5WRI9BSsvEX6ZceE9dov-IMqdR2VISMqFu5tzwbZkvwlb0GHC4Rk2KkiSwxqz_bIYQCo50%3D&attredirects=2%20 https://8bbcd643-a-da9b1a34-s-sites.googlegroups.com/a/state.co.us/oit-template-dev/Information%20Security%20Planning.pdf?attachauth=ANoY7crHOQKT-Br5txvoo4Cemp5L2pzcaqbxMUCtzFV2o7fWK16k15GmBR3eXDxpI-FnHCnJtuqHV_oci7dYiyjcPWc8PZLs7b2qtGymjAp-vrGW3AiWcKF-JKm6s_lA4NnWWZT2VzoBf3Oe0DKpdA2aNGNJCLBNw_46Inzt7W6yLtfvz5WRI9BSsvEX6ZceE9dov-IMqdR2VISMqFu5tzwbZkvwlb0GHC4Rk2KkiSwxqz_bIYQCo50%3D&attredirects=2%20 https://8bbcd643-a-da9b1a34-s-sites.googlegroups.com/a/state.co.us/oit-template-dev/Information%20Security%20Planning.pdf?attachauth=ANoY7crHOQKT-Br5txvoo4Cemp5L2pzcaqbxMUCtzFV2o7fWK16k15GmBR3eXDxpI-FnHCnJtuqHV_oci7dYiyjcPWc8PZLs7b2qtGymjAp-vrGW3AiWcKF-JKm6s_lA4NnWWZT2VzoBf3Oe0DKpdA2aNGNJCLBNw_46Inzt7W6yLtfvz5WRI9BSsvEX6ZceE9dov-IMqdR2VISMqFu5tzwbZkvwlb0GHC4Rk2KkiSwxqz_bIYQCo50%3D&attredirects=2%20 https://8bbcd643-a-da9b1a34-s-sites.googlegroups.com/a/state.co.us/oit-template-dev/Information%20Security%20Planning.pdf?attachauth=ANoY7crHOQKT-Br5txvoo4Cemp5L2pzcaqbxMUCtzFV2o7fWK16k15GmBR3eXDxpI-FnHCnJtuqHV_oci7dYiyjcPWc8PZLs7b2qtGymjAp-vrGW3AiWcKF-JKm6s_lA4NnWWZT2VzoBf3Oe0DKpdA2aNGNJCLBNw_46Inzt7W6yLtfvz5WRI9BSsvEX6ZceE9dov-IMqdR2VISMqFu5tzwbZkvwlb0GHC4Rk2KkiSwxqz_bIYQCo50%3D&attredirects=2%20

Exhibit A Page 37 of 44

Sec-9 Security Describe how the solution meets storage, delivery and transmittal requirements for Criminal Justice Information Standards (CJIS). 1 2 3 4

Offeror Response:

Sec-10 Security Describe how the solution supports authentication of an electronic interface data source. 1 2 3 4

Offeror Response:

Sec-11 Security

Describe the certificates and documentation that industry or best practice standards (e.g., OWASP, NIST, or similar standards) that are used throughout the system development lifecycle Assurances include but are not limited to scan reports, remediation plans for discovered vulnerabilities, penetration tests, documented adherence to the providers internal secure system development lifecycle (S-

SDLC).

1 2 3 4

Exhibit A Page 38 of 44

Sec-12 Security Describe the performance of regular auditing of security controls, including any third-party components or vendor services.

Independently verified security controls are preferred.

1 2 3 4

Offeror Response:

Sec-13 Security Describe the security protocols that are in place to restrict track and ensure that only authorized personnel are able to access or modify a recording system.

1 2 3 4

Offeror Response:

Sec-14 Security

Describe the use of standard Internet encryption techniques, including the use of Secure Socket Layer (SSL), 128-bit encryption or better, TLS (Transport Layer Security), and digital certificates through recognized Certificate Authorities.

1 2 3 4

Exhibit A Page 39 of 44

Sec-15 Security Describe what, if any, web services are required to support the solution, standard Web-based protocols, including HTTPS, shall be utilized for all Web-based traffic.

1 2 3 4

Offeror Response:

Sec-16 Security Detail how role-based access control functions for any logical interactive access to applications and/or supporting systems (e.g., user-interface, maintenance)

1 2 3 4

Offeror Response:

Sec-17 Security

Detail the third-party certification or audit results that fully covers the scope of the work included in the proposal, such as a SOC 2 Type II report, FISMA compliance certification, or similar information security assurance certification, or agreement to allow the performance of security audit and penetration tests as requested by OIS or its designee.

1 2 3 4

Offeror Response:

Sec-18 Security Document any additional policy, procedure, practice, or evidence not described above related to compliance with the Colorado Information Security Policies or the NIST Cybersecurity Framework.

1 2 3 4

Exhibit A Page 40 of 44

Sec-19 Security Document how the solution complies with department and State of Colorado technology standards and policies throughout the term of the contract found here: http://www.oit.state.co.us/cto/ea/standards

1 2 3 4

Offeror Response:

Sec-20 Security Document how the solution provides appropriate access to data sets stored for analysis, linking, reporting, and any additional purposes identified by customer.

1 2 3 4

Offeror Response:

Sec-21 Security Document how the solution provides the appropriate levels of system and file security while data is at rest or when the system is responsible for data in transit.

1 2 3 4

Offeror Response:

Sec-22 Security Document the detection and mitigation strategies for security mechanism failure (such as an SSL certification expiration, account lockout during session).

1 2 3 4

Offeror

Exhibit A Page 41 of 44

Sec-23 Security If the solution scope includes vendor-provided infrastructure, provide documentation confirming the use of currently recognized configuration hardening standards as published on CISecurity.org.

1 2 3 4

Offeror Response:

Sec-24 Security

Provide documentation of an industry-standard secure system development lifecycle (S-SDLC), including written policies and procedures, documented results of vulnerability scans and/or penetration testing, evidence of and/or plans for remediation of known vulnerabilities, etc. employed by your organization.

1 2 3 4

3. LEGACY SOLUTION/NEW SOLUTION

Please describe how the Colorado State Patrol might run both the legacy solution and the new solution together in parallel over an extended implementation period? Will running two solutions in parallel be a concern as a potential challenge with risks? How can the State reduce dual entry, having to go to two separate databases to retrieve information, or keeping track on which solution specific data resides in will be time consuming for users. How will the Offeror reduce the impact to CSP and their end users?

4. TIMELINE FOR SYSTEM DELIVERY and OFFICE INSTALLATION

ITEM DATE QUANTITY

Up to 170 Complete Digital Evidence In-Car Camera Systems.

Appx. 40 delivered to CSP Fleet Facility for installation by appx. Sept. 1, 2019 with the remaining amount to be ordered as needed through January 2020.

40 Office Locations (see table 1. on following page)

All offices infrastructure to be completed by:

January 2, 2020

40 Locations

Warranty to begin upon successful tested and confirmed implementation

To be started when each piece of equipment is installed, on-line and confirmed operational, per Fleet Manager approval

TABLE 1 – 40 OFFICE LOCATIONS IN COLORADO

Address City Bandwidth District 1:

1096 McIntyre St. Golden 100 Mbps ME 4600 Castleton Court Castle Rock 50 Mbps ME 8200 N. Hwy 85 Commerce City 20 Mbps ME 6230 Lookout Road Boulder 0 Mbps District 2:

601 W. 3rd Street - Suite C Florence 20 Mbps ME 505 Antero Circle Buena Vista 0 Mbps 10350 CR 1230 Salida/Poncha Springs 0 Mbps MPLS 308 Weaverville Road – Building D Divide 30 Mbps ME 1180 Park County Road 16 Fairplay 3.0 Mbps MPLS 1480 Quail Lake Loop Colorado Springs 20 Mbps ME 310 E. Washington St. Lamar 3.0 Mbps MPLS 5615 Will Blvd. Pueblo 200 Mbps ME 617 Raton Ave La Junta 3.0 Mbps MPLS 10201 County Rd. 69.3/10 Trinidad 20 Mbps ME District 3:

10601 W. 10th Street Greeley 50 Mbps ME 118 Riverview Rd. – Suite 200 Sterling 20 Mbps ME 3832 S. Interstate 25 Ft. Collins 50 Mbps ME 131 C Avenue Limon 20 Mbps ME 13360 W. I-76 Frontage Rd. Ft. Morgan 40 Mbps ME 5126 Front Range Pkwy Watkins 20 Mbps ME 484 15th St. Burlington 0 Mbps MPLS 910 S. Main St. Yuma 0 Mbps MPLS District 4:

554 Jurassic Court Fruita 50 Mbps ME 800 W. First Street – Suite 400 Craig 200 Mbps ME 202 Centennial Street Glenwood Springs 49.5 Mpbs ME 0201 Peak One Blvd. Frisco 20 Mbps ME 714 Castle Drive Eagle 1.5 Mbps MPLS 403 N. 9th Street Kremmling 20 Mbps ME 2032 Lincoln Avenue Steamboat Springs 20 Mbps ME 41413 Hwy 6 & 24 Avon/Vail 20 Mbps ME District 5:

20591 Hwy 160 W Durango 20 Mbps ME 3110 1st Street Alamosa 200 Mbps ME 2420 N. Townsend Avenue Montrose 180 Mbps ME 501 Palmer Street - Suite 227 Delta 20 Mbps ME 33053 Hwy 160 Cortez/Mancos 50 Mbps ME 234 N. Main Street – Suite 2E100 Gunnison 20 Mbps ME 46 Easton Drive – Suite 1-A Pagosa Springs 3.0 Mbps MPLS 401 Monroe Street Monte Vista 0 Mbps MPLS 15055 S. Golden Road Golden 100 Mbps ME 7701 W. 120th Avenue Broomfield 100 Mbps ME

Exhibit A Page 44 of 44

Background Checks At the sole discretion of the State or State Entity, as applicable, employees of the Contractor and any subcontractor providing services under this Contract will be subject to background checks at the vendor’s expense. The contractor will fully cooperate with the State to ensure activities associated to any background checks being conducted can be carried out in a timely manner.

Glossary of Terms

Abbreviation Definition API Application Programming Interface CAD Computer Aided Dispatch CDPS Colorado Department of Public Safety CSP Colorado State Patrol CJIS Federal Criminal Justice Information System COTS Commercial off-the-shelf CSN Colorado State Network DBA Database Administrator DMV Department of Motor Vehicles DNA [placeholder] DR Disaster Recovery LEA Law Enforcement Agency MDC Mobile Data Computer MOTS Modified Off The Shelf NCIC National Crime Information Center NIBRS National Incident Based Reporting System NICS National Instant Background Check System Nlets National Law Enforcement Telecommunications System OCS Colorado Office of Cyber Security OIT Governor’s Office of Information Technology OFML OpenFox Markup Language PMI Project Management Institute PMP Project Management Professional POST Police Officer Standards and Training PSU Program Support Unit QA Quality Assurance RISSNET Regional Information Sharing System Network RMS Records Management System SAN Storage Area Network SDDS Secured Document Delivery System SDLC Software development life cycle SDVOSB Service Disabled Veteran Owned Small Business SOA Service-Oriented Architecture SOW Statement of Work TID Terminal ID UI User Interface VPN Virtual Private Network VSS Vendor Self Service System