G_Solution Technology RTM.xlsx
XLSX spreadsheet 139 KB Posted
- Attached to
- DCYF Enterprise Payment Solution
- Solicitation number
- 24-DCYF-CS-081
- Issued by
- Adams County, Asotin County, Benton County, Chelan County, Clallam County, Clark County, Columbia County, Cowlitz County, Douglas County, Ferry County, Franklin County, Garfield County, Grant County, Grays Harbor County, Island County, Jefferson County, King County, Kitsap County, Kittitas County, Klickitat County, Lewis County, Lincoln County, Mason County, Okanogan County, Pacific County, Pend Oreille County, Pierce County, San Juan County, Skagit County, Skamania County, Snohomish County, Spokane County, Stevens County, Thurston County, Wahkiakum County, Walla Walla County, Whatcom County, Whitman County, Yakima County, Asotin City, Clarkston City, Clarkston Heights-Vineland CDP, West Clarkston-Highland CDP, Benton City, Chelan City, Chelan Falls CDP, Clallam Bay CDP, Lewisville CDP, Rock Island City, Pacific Beach CDP, Whidbey Island Station CDP, Mercer Island City, Pacific City, Bainbridge Island City, Kingston CDP, Kitsap Lake CDP, Kittitas City, Klickitat CDP, Okanogan City, Anderson Island CDP, Fort Lewis CDP, Fox Island CDP, Herron Island CDP, Ketron Island CDP, North Fort Lewis CDP, Raft Island CDP, Stevenson City, Hat Island CDP, Lake Stevens City, Snohomish City, Spokane City, Spokane Valley City, Puget Island CDP, Garfield Town, Yakima City, Washington
About this file
This is a Solution Technology Requirements Traceability Matrix (RTM) document for the Washington State Department of Children, Youth & Families (DCYF) Enterprise Payment Solution (DEPS) project, RFP No. 24-DCYF-CW-081. The document outlines extensive technical requirements across multiple categories including usability, audit compliance, performance, interfaces, cloud hosting, security, business continuity, and system management. The requirements are organized into sections covering areas such as multi-device support, audit trails, system availability, integration capabilities, disaster recovery, SaaS platform requirements, and monitoring capabilities.
The RTM requires vendors to indicate whether each requirement will be met (Y/N) and specify how it will be met through out-of-box functionality, configuration, customization, third-party products, or future releases. Key technical specifications include 99.9% uptime, support for 3,000 internal users and 15,000 external users, handling 150,000 monthly service authorizations and payments, and 2TB initial data capacity with 22GB monthly growth. The system must integrate with multiple state systems including ACES, FamLink, and OneWA Workday, while meeting strict security standards including NIST 800-53 controls and FedRAMP Moderate certification. The solution must support Azure Active Directory for internal users and Secure Access Washington (SAW) for external authentication.
View the file
Other files
Show all 31
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Introduction
| State of Washington Department of Children, Youth, and Families (DCYF) |
| DCYF Enterprise Payment Solution (DEPS) |
| Attachment G: Solution Technology-Related Requirements Traceability Matrix (RTM) |
| RFP No. 24-DCYF-CW-081 |
| Introduction |
| This document captures the Technology-related Non-Functional Requirements\ for the Department of Children Youth and Families' (DCYF's) DEPS Project. This document should be used in conjunction with the General System Design (GSD) report which documents the principles and guidelines for the DEPS future solution architecture. |
The Technology-related Non-Functional Requirements document contains the following sections:
1) Introduction Worksheet
2) Instructions Worksheet
3) Technology Non-Functional Requirements Worksheets
Within the Technology Non-Functional Requirements, the requirements are categorized by area as detailed below. Each category has its own tab in this workbook.
| ID | Section Title | Tab # |
| T | Non-Functional Requirement Section | # |
| TG1 | Usability and Multi-Device Support | 3 |
| TG2 | Audit and Compliance | 4 |
| TG3 | Performance and Availability | 5 |
| TG4 | Interface List | 6 |
| T1 | Cloud & Remote Hosting | 7 |
| T2 | Interoperability and Integration | 8 |
| T3 | Scalability and Extensibility | 9 |
| T4 | Privacy, Security & Access Controls | 10 |
| T5 | Businesss Continuity & Disaster Recovery | 11 |
| T6 | SaaS as a Platform | 12 |
| T7 | Solution Mgmt & Monitoring | 13 |
| T8 | Technology Mandates and Preferences | 14 |
&"Arial,Regular"&A
&"Arial,Regular"&9&F &"Arial,Regular"&9&P of &N
Respondent Instructions
| State of Washington Department of Children, Youth, and Families (DCYF) |
| DCYF Enterprise Payment Solution (DEPS) |
| Attachment F: Solution Technology-Related Requirements Traceability Matrix (RTM) |
| RFP No. 24-DCYF-CW-081 |
| Respondent Instructions |
| This workbook contains Requirements for the DEPS system. The response codes below should be used by Vendors to indicate the fit of its solution to the State Requirements specified in this workbook. |
This template must be completed and submitted as an MS Excel file as part of the response to this RFP.
| Responses | Definition |
| Response Code: Y or N -- Will this Non-Functional Requirement be met by your solution? | Indicate whether the requirement, as currently written, will be met by the Respondent's proposal. Respond Y=Yes or N=No. |
| Response Code: O, C, D, F, T, N -- How will this Non-Functional Requirement be met by your solution? | Indicate how the requirement will be met by selecting either: |
O= Out of the Box, C = Configuration, D = Customization, T = Third Party Product, F = Future Release, N = Not Available
| O = Available Out of the Box. The Requirement will be met by leveraging existing out of the box application functionality available through the Vendor's existing solution to meet DCYF's requirements. | |
| C = Configuration. Configuration means the activation, arrangement or adjustment of software features and functionality that is part of the normal set-up of the software, such as establishing parameters, fields, and workflows. | |
| D = Customization. Customization means a change or addition to software program code to update the default capabilities or extend or modify existing features and functionality. | |
| T = Third Party Product. The Requirement will be met by commercially available third party software. The Vendor will integrate these third party products into their proposed DEPS architecture. In the Vendor Response column, indicate the name of the proposed third party software vendors and products and indicate its compliance with DCYF's technology or architecture standards. | |
| F = Future Release. The Requirement will be met by a future code development update to the application functionality of the Vendor's existing solution to meet DCYF's requirements | |
| N = Not Available. Requirement cannot be met. | |
| Vendor Proposed Release Date -- By what date will this requirement be met? | If the Vendor Response Code is "F" Indicate by which date the requirement will be met. If not applicable, the Vendor may leave the cell blank. |
| Vendor Justification for Not Meeting Requirement, if applicable | If the Vendor Response Code is "N," the Vendor is required to provide an explanation for not meeting the requirement. |
| Additional Comments | Additional comments. (Not Required). The Vendor may include additional comments at their discretion. |
Do not edit this worksheet.
TG1 Usability
| State of Washington Department of Children, Youth, and Families (DCYF) |
| DCYF Enterprise Payment Solution (DEPS) |
| Attachment F: Solution Technology-Related Requirements Traceability Matrix (RTM) |
| RFP No. 24-DCYF-CW-081 |
Usability and Multi-Device Support
| Req # | Requirement Description | Requirement Priority | Vendor Response: | |
| Y or N | Vendor Response: | |||
| O, C, D, T, F, N | Vendor Proposed Release Date | |||
| (If selecting F) | Vendor Justification for Not Meeting Requirement, if applicable | |||
| (If selecting N) | Additional Comments (Not Required) | |||
| TG1.1 | The System will provide a suitable user interface based on device type (i.e., desktop, tablet, smart phone, IVR, etc.) that shall be simple, consistent, and aligned with business process throughout all areas and functions of the System. | Required | ||
| TG1.2 | The System will minimize the number of mouse clicks / user interactions to complete any task, aligned with business process. | Required | ||
| TG1.3 | The System will use a streamlined Graphical User Interface (GUI) across all devices and experiences to help the user navigate to the next logical step in the workflow, or freely navigate to other parts of the System functionality, and then allow the user to return to complete the in-process task aligned with business process. | Required | ||
| TG1.4 | The System User Interfaces will speak the users' language, with words, phrases and concepts familiar to the user, rather than System-oriented terms consistent with business process. | Required | ||
| TG1.5 | The System will accommodate diverse populations of users including those with disabilities and limited English proficiency as defined in section 504 of the Rehabilitation Act of 1973. | Required | ||
| TG1.6 | The System will follow real-world as well as Washington State financial management terminology and conventions, making information appear in a natural and logical order. | Required | ||
| TG1.7 | The System will allow the users to easily navigate to a variety of functions available to them without having to move sequentially through excessive menus and screens, aligned with business process. | Required | ||
| TG1.8 | The System desktop interface will include, at minimum, the following features and capabilities: |
a. Drill down and look up functionality to minimize time required for access to more detailed information
b. Multi-tasking and multiple window capability, including split screens
c. Search capabilities to allow retrieval by name, DOB, case identifier or other parameters as defined by the State and utilize phoenetic matching where applicable
| d. Ability to tab and mouse through data fields and screens | Required | ||
| TG1.9 | The System will support undo and redo, or provide onscreen confirmation / acceptance to the user to confirm a change that is permanent and cannot be "undone". | Required | |
| TG1.10 | The System will provide users with a clearly marked "emergency exit" for the instances when a user mistakenly chooses a function and such "emergency exit" must be simple with minimal dialogue, and leave all data unchanged. | Required | |
| TG1.11 | The System will follow standardized conventions and limit the use of words, situations, or actions that have multiple meanings. | Required | |
| TG1.12 | The System will eliminate error-prone conditions or check for them and present users with a confirmation option before they commit to the action, while ensuring the integrity of data. | Required | |
| TG1.13 | The System will minimize the need for users to memorize system values by making available options visible. | Required | |
| TG1.14 | The System will provide the option to have rollover / tooltip help or context messages and provide the option to turn off this option in the user preferences profile. | Required | |
| TG1.15 | The System will provide all user instructions in a visible or easily retrievable location, when appropriate. | Required | |
| TG1.16 | The System will cater to both inexperienced and experienced users and shall provide accelerators (e.g. onscreen short cuts, hot-keys, alternate workflows, etc.) to speed up the interaction for the expert user, aligned with business process. | Required | |
| TG1.17 | The System will allow users to create shortcuts (e.g. onscreen short cuts, hot-keys, etc.) for frequent actions, aligned with business process. | Preferred | |
| TG1.18 | The System will express its error messages in plain language, precisely indicate the problem, and constructively suggest a solution, aligned with business process. | Required | |
| TG1.19 | The System will use colors to enhance user experience and System usability while complying with all disability requirements notated elsewhere in these requirements, aligned with business process. | Required | |
| TG1.20 | The System will allow the user to navigate to any functional component from a client landing page, aligned with business process and intended in-context device experience. | Required | |
| TG1.21 | The System desktop User Interface will provide drop downs, list boxes and multi-selection for all key entry, and text entry shall display existing values for selection (system based auto fill) (but specifically disallow client browser based auto fill). | Required | |
| TG1.22 | The System will accommodate point and click selection and check box entry for all relevant data entries to ensure that the user does not have to enter textual data that may already be available to the System, aligned with business process. | Required | |
| TG1.23 | The System will facilitate data entry and shall contain pop-up list boxes for all code fields in all processing windows and allow selection of the entry with use of hot keys, aligned with business process. | Required | |
| TG1.24 | The System will provide field level on-screen edits with limited user override capabilities, aligned with business process. | Required | |
| TG1.25 | The System will provide the ability to make fields visible / invisible depending on parameters, user rights, consent, and access controls, aligned with business process. | Required | |
| TG1.26 | The System will hide fields not accessible to a given user based on access rights, member consent, and fields not in use, aligned with business process. | Required | |
| TG1.27 | The System will have a cursor that shall automatically advance to the next logical input field when the maximum allowed numbers of characters have been entered for the keyed field or when the user presses the "Enter" key, aligned with business process. | Preferred | |
| TG1.28 | The System will provide the option of having a selection from the drop down boxes automatically and take the user to the next input field, aligned with business process. | Preferred | |
| TG1.29 | The System will provide validation checks at the time of each field entry as the default mechanism, aligned with business process. Such validation checks to use existing known structures such as for phone number, address and email validation. | Required | |
| TG1.30 | The System will identify invalid entries to the user as immediately as possible, aligned with business process. | Required | |
| TG1.31 | The System will provide the ability to suggest or automatically change entries that do not conform to data entry standards, to be defined in the detailed System design and meta data models in collaboration with the State, aligned with business process. | Required | |
| TG1.32 | The System will be designed to include only the necessary information and functionality on screens and shall be based on the user's access level and the user's configuration, aligned with business process. | Required | |
| TG1.33 | The System will be designed to include logical transitions between screens and level of detail during navigation, aligned with business process. | Required | |
| TG1.34 | The System will provide templates for data entry with identified mandatory and optional data fields, aligned with business process. | Required | |
| TG1.35 | The System will allow incomplete data sets to be saved for completion of the workflow at a later time, aligned with business process. | Required | |
| TG1.36 | The System will highlight and flag required and incomplete data fields, aligned with business process. | Required | |
| TG1.37 | The System will include a graduated system of alert levels to allow users to determine urgency and relevancy, aligned with business process. | Required | |
| TG1.38 | The System will allow configuration of alerts by a user, for a user by a supervisor, and for a user by a System administrator, aligned with business process. | Required | |
| TG1.39 | The System will allow for the request or entry of data from mobile devices (e.g. tablets, smart phones, etc.), aligned with business process. | Required | |
| TG1.40 | The System will notify the user when a source system is unavailable / inoperable and notify user that any available information about the subject being viewed is as of certain time and date, aligned with business process. | Required | |
| TG1.41 | The System will not require users to re-enter data due to validation errors if the system can auto-correct based on the entered data, or the user can navigate to the entry error to correct the entry, aligned with business process. | Preferred | |
| TG1.42 | The System will enable central workflow alerts and transactional status. The System will centralize pending work items in a centralized queues and allow grouping by attributes including, but not limited to, location, type (phone, email) and System defined priority, aligned with business process. | Required | |
| TG1.43 | The System will have the capability to push messages to the intended workers without requiring them to specifically inquire for the data, aligned with business process. | Required | |
| TG1.44 | The System will provide a mouse-over option over unique fields that temporarily displays a description of the data element for the user, aligned with business process. | Preferred | |
| TG1.45 | The System will provide linked access to help functions that contain the appropriate information and search of all help information from every window, based on user profiles, aligned with business process. | Preferred | |
| TG1.46 | The System will push or link alerts / notifications to mobile devices, aligned with business process. | Preferred | |
| TG1.47 | The System will utilize standard web browser-based Thin-Client technology that supports centralized software distribution and implementation. This must be available on commonly used browsers including, but not limited to Microsoft Edge, Google Chrome, and MaaS360 browser on iPhones. | Required | |
| TG1.48 | The System will maintain compatibility with the three (3) most current versions of each browser, provide data over a web browser interface (i.e., HTML over HTTP) and shall include the capability to encrypt the data communicated over the network via SSL (HTML over HTTPS) which is preferred by the state. | Required | |
| TG1.49 | The System will provide the ability for on-line access by any site connected to the organization Wide Area Network (WAN) based on users' role and responsibilities. | Required | |
| TG1.50 | The System will provide the capability for remote access in compliance with existing State / Federal connectivity / security policies based on users' role and responsibilities. | Required | |
| TG1.51 | The System will provide on-line system documentation that is accessible at all times including, but not limited to: |
a. On-line policy and procedures
b. User guides
| c. System help | Required | ||
| TG1.52 | The System will allow an authorized user to modify / edit on-line system documentation. | Required | |
| TG1.53 | The System will provide office automation tools available based on user role. Tools include, but are not limited to: |
a. Word processing capabilities
b. Ticklers
c. Alerts / notifications
d. Calendaring
| e. Electronic messaging | Required | |
| TG1.54 | The System will support uploading and attaching multiple file types to a financial record as well as importing them from other systems. File formats include, but is not limited to: |
a. jpg
b. tif
c. gif
d. png
e. pdf
f. doc
g. xls
h. csv
i. eICR
j. xml
k. HEIC
| l. Audio and Video formats including AVI, MP4, MP3, MOV, WAV etc. | Required | ||
| TG1.55 | The System will comply with the Web Content Accessibility Guidelines (WCAG) Standard (2.1 or later) | Required | |
| TG1.56 | The System will ensure that all new or updated customer facing web-based access requires no desktop software except the State-standard version web browser and complies with recognized usability standards, including, but not limited to: the Americans with Disabilities Act Amendments Act (ADAAA), Older Americans Act, and the Rehabilitation Act Section 508 Subpart B Section 1194.21. | Required | |
| TG1.57 | The System will comply with any DCYF branding standards as defined by the State. | Required | |
| TG1.58 | The System will provide the ability for concurrent users to simultaneously view the same sample, record, documentation and/or template. | Required | |
| TG1.59 | The vendor will use best practices with respect to Design Thinking and Human Centered Design as it designs, configures, and deployes the UI/UX for the new system. | Required | |
| TG1.60 | System will have a consistent syntax for error messages across all system modules for both batch and online processing. Specifically, error messages have common codes, text and screen locations. | Required | |
| TG1.61 | System will have the ability to block the full display of sensitive data, for example, display only the last four digits of SSNs both online or on a hard copy report. | Required | |
| TG1.62 | System will minimize the number of mouse clicks / user interactions to complete any task, aligned with business process. | Required | |
| TG1.63 | System will use a Graphical User Interface (GUI) to help the user navigate to the next logical step in the workflow, or freely navigate to other parts of the System functionality, and then allow the user to return to complete the in-process task aligned with business process. | Required | |
| TG1.64 | System will speak the users' language, with words, phrases and concepts familiar to the user, rather than System-oriented terms consistent with business process. | Required | |
| TG1.65 | System will accommodate diverse populations of users including those with disabilities and limited English proficiency as defined in section 504 of the Rehabilitation Act of 1973. | Required | |
| TG1.66 | System will follow real-world Washington State Child Welfare terminology and conventions, making information appear in a natural and logical order. | Required | |
| TG1.67 | System will allow the users to easily navigate to a variety of functions available to them without having to move sequentially through excessive menus and screens, aligned with business process. | Required | |
| TG1.68 | System will be designed to include only the necessary information and functionality on screens and shall be based on the user's access level and the user's configuration, aligned with business process. | Required | |
| TG1.69 | System will be designed to include logical transitions between screens and level of detail during navigation, aligned with business process. | Required | |
| TG1.70 | System will use colors to enhance user experience and System usability while complying with all disability requirements notated elsewhere in these requirements, aligned with business process. | Required | |
| TG1.71 | System will comply with the Web Content Accessibility Guidelines (WCAG) Standard (2.1 or later). | Required | |
| TG1.72 | System will ensure that all new or updated customer facing web-based access requires no desktop software except the State-standard version web browser and complies with recognized usability standards, including, but not limited to: the Americans with Disabilities Act Amendments Act (ADAAA), Older Americans Act, and the Rehabilitation Act Section 508 Subpart B Section 1194.21. | Required | |
| TG1.73 | System will support undo and redo, or provide onscreen confirmation / acceptance to the user to confirm a change that is permanent and cannot be "undone". | Required | |
| TG1.74 | System will provide users with a clearly marked "emergency exit" for the instances when a user mistakenly chooses a function and such "emergency exit" must be simple with minimal dialogue, and leave all data unchanged. | Required | |
| TG1.75 | System will eliminate error-prone conditions or check for them and present users with a confirmation option before they commit to the action, while ensuring the integrity of data. | Required | |
| TG1.76 | System will express its error messages in plain language, precisely indicate the problem, and constructively suggest a solution, aligned with business process. | Required | |
| TG1.77 | System will not require users to re-enter data due to validation errors if the system can auto-correct based on the entered data, or the user can navigate to the entry error to correct the entry, aligned with business process. | Required | |
| TG1.78 | System will provide field level on-screen edits with limited user override capabilities, aligned with business process. | Required | |
| TG1.79 | System will provide the ability to make fields visible / invisible depending on parameters, user rights, consent, and access controls, aligned with business process. | Required | |
| TG1.80 | System will hide fields not accessible to a given user based on access rights, member consent, and fields not in use, aligned with business process. | Required | |
| TG1.81 | System will have a cursor that shall automatically advance to the next logical input field when the maximum allowed numbers of characters have been entered for the keyed field or when the user presses the "Enter" key, aligned with business process. | Required | |
| TG1.82 | System will provide the option of having a selection from the dropdown boxes automatically and take the user to the next input field, aligned with business process. | Required | |
| TG1.83 | System will identify invalid entries to the user as immediately as possible, aligned with business process. | Required | |
| TG1.84 | System will provide the option to have rollover / tooltip help or context messages and provide the option to turn off this option in the user preferences profile. | Required | |
| TG1.85 | System will provide a mouse-over option over State-defined fields that temporarily displays a description of the data element for the user, aligned with business process. | Preferred | |
| TG1.86 | System will maintain compatibility with the three (3) most current versions of each browser, provide data over a web browser interface (i.e., HTML over HTTP) and shall include the capability to encrypt the data communicated over the network via SSL (HTML over HTTPS) which is preferred by the state. | Required |
&"Arial,Regular"&A
&"Arial,Regular"&9&F &"Arial,Regular"&9&P of &N
TG2 Audit_&_Compliance
| State of Washington Department of Children, Youth, and Families (DCYF) |
| DCYF Enterprise Payment Solution (DEPS) |
| Attachment F: Solution Technology-Related Requirements Traceability Matrix (RTM) |
| RFP No. 24-DCYF-CW-081 |
Audit and Compliance
| Req # | Requirement Description | Requirement Priority | Vendor Response: | |
| Y or N | Vendor Response: | |||
| O, C, D, T, F, N | Vendor Proposed Release Date | |||
| (If selecting F) | Vendor Justification for Not Meeting Requirement, if applicable | |||
| (If selecting N) | Additional Comments (Not Required) | |||
| TG2.1 | The System will maintain a record (e.g. audit trail) of all additions, changes and deletions made to its data in a database management system. In addition, for investigative purposes, the System will provide a log of query or view access to certain type of records and/or screens. The System will provide the ability to search or export this to a report, by user ID, user role, or client ID. This must include, but is not limited to: |
a. The user ID of the person who made the change
b. The date and time of the change
c. The physical, software/hardware and network location (IP address) of the person while making the change
d. The information that was changed
e. The outcome of the event, where applicable (e.g., client name successfully changed)
| f. The data before and after it was changed, and which screens were accessed and used | Required | ||
| TG2.2 | The System will allow an authorized administrator to set the inclusion or exclusion of auditable events based on organizational policy and operating requirements/limits. The System will log actions by authorized administrators to change these auditable events parameters and provide reports related to such actions. | Required | |
| TG2.3 | The System will support logging to a common audit engine managed by a database management system. | Preferred | |
| TG2.4 | The System will be able to detect security-relevant events (as defined in NIST 800-53 moderate baseline, rev 5) that it mediates and generate audit records in a database management system. At minimum, the events shall include, but not be limited to: |
a. Start/stop
b. User login/logout
c. Session timeout
d. Account lockout
e. Client record created/viewed/updated/deleted
f. Scheduling
g. Query
h. Order
i. Node-authentication failure
j. Signature created/validated
k. Personally Identifiable Information (PII) export
l. Personally Identifiable Information (PII) import
m. Security administration events
n. Backup and restore
| o. Audit Event Types | Required | |
| TG2.5 | The System will provide authorized administrators with the ability to read all audit information from the audit records in the following two (2) ways: |
a. The System will provide the audit records in a manner suitable for the user to interpret the information. The System will provide the capability to generate reports based on ranges of System date and time that audit records were collected.
| b. The System will be able to export logs into text or spreadsheet format in such a manner as to allow correlation based on time (e.g. Coordinated Universal Time [UTC] synchronization). | Required | ||
| TG2.6 | The System will be able to perform time synchronization using NTP/SNTP, and use this synchronized time in all security records of time. | Required | |
| TG2.7 | The System will have the ability to format for export recorded time stamps using UTC based on ISO 8601. | Preferred | |
| TG2.8 | The System will prohibit all users read access to the audit records, except those users that have been granted explicit read access. | Required | |
| TG2.9 | The System will protect the stored audit records from unauthorized deletion and track authorized deletions in a destruction log managed by a database management system. | Required | |
| TG2.10 | The System will prevent modifications to the audit records. | Required | |
| TG2.11 | The System will provide logging, reporting and accessing errors and exceptions in a database management system.. | Required | |
| TG2.12 | The System will provide the capability for integrating consent audit trails and data access audit trails in a consolidated searchable system for search/report to support consent rule enforcement or investigation including audit trails based on deprecated rules or policies. | Preferred | |
| TG2.13 | The System will generate and protect consent audit events at the same or better levels as other data access audit records. | Preferred | |
| TG2.14 | The System will support the ability to expunge data, based on predetermined business rules and/or amendments to State / Federal regulations. | Required | |
| TG2.15 | The System will encrypt all Personal Identifiable Information (PII), as the term is defined in the National Institute of Standards and Technology (NIST) Publication 800-122, during all phases of data use, including data in motion and data in use. Encryption must be in compliance with encryption related security controls as defined in IRS Publication 1075. | Required | |
| TG2.16 | The System will maintain an audit trail of users who attempt to change or delete case or client records that have been identified for litigation holds. | Preferred | |
| TG2.17 | Audit logs will be retained for a period agreed upon with DCYF or implemented in alignment with DCYF Audit Record Retention policy. | Required | |
| TG2.18 | System must be able to track data bidirectionally at the transactional level. For example, DCYF needs to be able to track and match individual transactions to the specific child in which the transaction/data relates. | Required |
&"Arial,Regular"&A
&"Arial,Regular"&9&F &"Arial,Regular"&9&P of &N
TG3 Perf. and Avail.
| State of Washington Department of Children, Youth, and Families (DCYF) |
| DCYF Enterprise Payment Solution (DEPS) |
| Attachment F: Solution Technology-Related Requirements Traceability Matrix (RTM) |
| RFP No. 24-DCYF-CW-081 |
Performance and Availability
| Req # | Requirement Description | Requirement Priority | Vendor Response: | |
| Y or N | Vendor Response: | |||
| O, C, D, T, F, N | Vendor Proposed Release Date | |||
| (If selecting F) | Vendor Justification for Not Meeting Requirement, if applicable | |||
| (If selecting N) | Additional Comments (Not Required) | |||
| TG3.1 | The System will have the ability to support session replication and seamless failover using high-availability architectural options, including native cloud deployment best practices. | Required | ||
| TG3.2 | The System will be designed such that the System Administration staffing requirements and workload shall be minimally impacted with expanded System usage. | Required | ||
| TG3.3 | The System will be built so that there are no component or overall solution limits on its scalability. | Required | ||
| TG3.4 | The System will leverage virtualization and native cloud capabilities to expedite disaster recovery. For on-premise components of the solution, virtualization should be used to quickly reconfigure system platforms without having to acquire additional hardware. | Required | ||
| TG3.5 | The System will provide the ability to recover from data loss due to end user errors and any application errors. | Required | ||
| TG3.6 | The System will provide robust and reliable data backup, with the ability to perform archival/incremental backups, with all data and data backups residing within the United States. Backup ability shall include: |
a. Daily backup of system and data - either disk-based or tape media
b. Daily backup reports of all successful/failed system backups/archives provided to the Agency
c. Maintain 60 days of data backups
d. Weekly backup copy of data and systems archived and securely transported to a secure external site.
e. Data recovery accomplished minimal impact/slowdown of system functions.
| f. Backup and recovery capabilities must be able to support the DCYF RPO and RTO objectives. | Required | ||
| TG3.7 | The System will provide tools for managing an environment that supports both high availability and disaster recovery. | Required | |
| TG3.8 | The System will allow access to the System 24 hours/day x 7 days/week excluding times when scheduled maintenance events are required. | Required | |
| TG3.9 | The System will have all necessary functionalities, such as transactional processing, database back-out capabilities, backup and restore capabilities, transaction log database (point-in-time) restores, to ensure data integrity across all technology components. | Required | |
| TG3.10 | The System should provide the ability to restore intermediate or transient data using the original solution design and fault tolernace / recovery, without using Disaster Recovery resources. | Required | |
| TG3.11 | The System will have the ability to scale up or down without impacting availability. | Required | |
| TG3.12 | The System's performance shall not be compromised due to scalability. The System will have the ability to increase capacity on demand without compromising on performance. | Required | |
| TG3.13 | The System will meet page load times of 0-3 seconds. | Required | |
| TG3.14 | The System will be configurable to prevent corruption or loss of data already accepted into the System in the event of a System failure (e.g. integrating with a uninterrupted power supply (UPS) for on-premises systems, etc.). | Preferred |
&"Arial,Regular"&A
&"Arial,Regular"&9&F &"Arial,Regular"&9&P of &N
TG4 Interface List
| State of Washington Department of Children, Youth, and Families (DCYF) |
| DCYF Enterprise Payment Solution (DEPS) |
| Attachment F: Solution Technology-Related Requirements Traceability Matrix (RTM) |
| RFP No. 24-DCYF-CW-081 |
Interface List
The requirements below describe the interfaces needed and are assumed to leverage the integration hub chosen for the System - See T2 Interoperability requirements and T8.7.
NOTE: Please note that many of these interfaces are dependent on systems used by DCYF and the State that may be changed by concurrent ongoing projects during the DEPS procurement and implementation timeline. As such, this list of interface is evolving and is meant to be indicative of the complexity and extent of interfaces that will be required.
| Req # | Interfaced System | Requirement Origin | Current Status of Interface | Requirement Priority | Vendor Response: | |
| Y or N | Vendor Response: | |||||
| O, C, D, T, F, N | Vendor Proposed Release Date | |||||
| (If selecting F) | Vendor Justification for Not Meeting Requirement, if applicable | |||||
| (If selecting N) | Additional Comments (Not Required) | |||||
| TG4.1 | ACES | Existing SSPS interface that sends data to ACES | Required | |||
| TG4.2 | ACT (Automated Client Tracking System) | System will interface with the legacy system - ACT (Automated Client Tracking System). | Required | |||
| TG4.3 | AFRS (Agency Financial Reporting System) | Existing SSPS interface - GSD | Existing SSPS interface. | |||
| NOTE: AFRS is currently scheduled to be replaced with OneWashington in mid-2025. | Required | |||||
| TG4.4 | ATLAS (Automated Tax and Licensing Administration) | System will interface with the legacy system - ATLAS (Automated Tax and Licensing Administration System). | Required | |||
| TG4.5 | BARCODE (Child care services authorization) | Existing SSPS interface - GSD | Existing SSPS interface | Required | ||
| TG4.6 | CARS (Collections and Accounts Receivables System) | System will interface with the legacy system - CARS (Collections and Accounts Receivable System). | Required | |||
| TG4.7 | Contract Management System | Functional Requirements | Existing SSPS Interface - CAPS for EL | |||
| Data exchange with DCYF Contract Management System to send necessary inputs to create Service Provider contracts, as well as receive generated contracts. | Required | |||||
| TG4.8 | DSHS RDA | DSHS Data Repository (Facilities, Finance, and Analytics Administration) | Required | |||
| TG4.9 | DSHS SQL SSPS Data DB | System will interface with the legacy system - DSHS SQL SSPS Data DB. | Required | |||
| TG4.10 | EAS (Electronic Attendance System) | System will interface with the legacy system - EAS (Electronic Attendance System). | Required | |||
| TG4.11 | EIB (Enterprise Interface Builder) | System will interface with EIB (Enterprise Interface Builder). TO BE replaced by OneWA Workday. | Required | |||
| TG4.12 | EL (Early Learning) Portal | System will interface with the legacy system - EL Portal (Early Learning Portal). | Required | |||
| TG4.13 | FamLink | Existing SSPS interface | Required | |||
| TG4.14 | Future CCWIS System | CCWIS interface would depend upon how much of payment functionality can be provided by CCWIS. If both CCWIS and OneWA can not cover the functionality, DEPS integration with future CCWIS will be required. | Required | |||
| TG4.15 | Garnishments | Existing SSPS interface - GSD | Existing SSPS interface | Required | ||
| TG4.16 | Grants Management System (GMS) (Using Transaction Generator) - Interfaces with AFRS | Added by CD (confirm if needed on this list) | Required | |||
| TG4.17 | MERIT | Existing SSPS interface | Required | |||
| TG4.18 | OIAA (Office of Innovation, Alignment and Accountability Server) | System will interface with the legacy system - OIAA (Office of Innovation, Alignment and Accountability Server). | Required | |||
| TG4.19 | OneWA - Statewide implementation of Workday Financial Management System | DEPS will need to interface with Workday through the Informatica based Integration Layer after July 2025, assuming the system is deployed on time. | Required | |||
| TG4.20 | SEIU 925 Child Care Union | Data exchange from both CC Union (list of providers) to SSPS and SSPS daily/monthly data report to CC Union | Required | |||
| TG4.21 | SEMS (Support Enforcement System) | System will interface with the legacy system - SEMS (Support Enforcement System). | Required | |||
| TG4.22 | SOL (Statue of Limitations) | Required | ||||
| TG4.23 | State Auditor (SOA) | Required | ||||
| TG4.24 | Subsidy ETL Database | System will interface with the legacy system - Subsidy ETL Database. | Required | |||
| TG4.25 | Symago (IVR Solution) | Required | ||||
| TG4.26 | Tiered Reimbursement Application | Existing interface outbound from SSPS to TRA | Required | |||
| TG4.27 | TRDB (Tax Reporting Database) | Existing SSPS interface | Required | |||
| TG4.28 | Treasury Management System (TM$) | Required | ||||
| TG4.29 | VOW (OFR - Overpayments) | Existing SSPS interface via FILE SHARE ONLY | Required | |||
| TG4.30 | WA Compass (Child care Provider Portal) | Existing SSPS interface - ADDED: PORTAL FOR CC LICENSES ONLY (NO direct SSPS INTERFACE at this time) | Required | |||
| TG4.31 | WACAP Licensing | PORTAL FOR FP LICENSES ONLY (NO SSPS INTERFACE) |
NOTE: Depending on scope of future DEPS functionality, this interface may not be required. Required
&"Arial,Regular"&A
&"Arial,Regular"&9&F &"Arial,Regular"&9&P of &N
T1 Cloud & Remote Hosting
| State of Washington Department of Children, Youth, and Families (DCYF) |
| DCYF Enterprise Payment Solution (DEPS) |
| Attachment F: Solution Technology-Related Requirements Traceability Matrix (RTM) |
| RFP No. 24-DCYF-CW-081 |
Cloud & Remote Hosting
| Req # | Requirement Description | Requirement Priority | Vendor Response: | |
| Y or N | Vendor Response: | |||
| O, C, D, T, F, N | Vendor Proposed Release Date | |||
| (If selecting F) | Vendor Justification for Not Meeting Requirement, if applicable | |||
| (If selecting N) | Additional Comments (Not Required) | |||
| T1.1 | The Vendor will manage the acquisition, delivery, installation, and configuration of the development and production hardware, software, and cloud services, and ensure that appropriate level of documentation regarding the provisioned infrastructure is made available to DCYF and WA Tech representatives. | Required | ||
| T1.2 | Hosting shall include Vendor responsibility for maintenance of all hardware, software, network connections, back-ups, system and software patches, hardware refreshes. DCYF and WA Tech representatives must be able to see the patch levels, view scans for vulnerabilities, and receive periodic system health report. | Required | ||
| T1.3 | The Vendor will be responsible for all software installations and upgrades of any out of the box product. | Required | ||
| T1.4 | The Vendor will be responsible for upgrading other software and hardware required to maintain the hosted environment. DCYF and WA Tech must be notified of all future upgrades and modifications to the application through a state approved change management process. | Required | ||
| T1.5 | If a browser is involved, minimum browser requirements must be supported (see TG1.48 and TG1.49). | Required | ||
| T1.6 | The facility where the System shall be hosted must be a Tier III or IV equivalent facility with N+1 capability for HVAC, electrical, UPS and generator facilities. The facility must have dual instances for power and network / Internet connectivity and have a SOC 2 Type 2 Certifiation. The Vendor may have the internal capability in providing a total solution for a state-of-the-art Cloud services or may partner with a Cloud provider in meeting the requirements of providing a highly secure and high availability services. | Required | ||
| T1.7 | All server components hosting the application must be redundant/clustered with redundant storage connectivity and data replication. An option of off-site redundancy for the server components and replicated data must be provided. | Required | ||
| T1.8 | The Vendor will provide adequate bandwidth to maintain application performance, availability, and reliability. | Required | ||
| T1.9 | The System will provide dedicated hosting space for DCYF, and have a development, test, training, staging and a production environment. | Preferred | ||
| T1.10 | All hosting services must be based in the continental U.S. (preferably western US to minimize any latency if opportunity is available and no features or redundancy are lost in a West Coast hosting location) and all data must reside in U.S. data centers. | Required | ||
| T1.11 | The hosting environment must have advanced intrusion-prevention and firewall protection. Hosting environment shall provide internal and external Intrusion Prevention Audits conducted by 3rd party security firm on a bi-annual basis. | Required | ||
| T1.12 | Hosting shall include Vendor responsibility for maintenance of all hardware, software, network connections, back-ups, system and software patches, hardware refreshes, and use US DOD hardening guidelines. | Required | ||
| T1.13 | All hardware and software components of the hosting infrastructure must be fully supported by their respective manufacturers at all times. | Required | ||
| T1.14 | All critical patches for operating systems, and database must be applied within 30 working days of release by their respective manufactures, once testing in a staging or pilot environment as well as UAT is completed to prevent interruption to production system. All changes shall go through state approved Change Management process. | Required | ||
| T1.15 | The Vendor will provide DCYF with architectural diagrams (including Entity Relation diagrams), list of all infrastructure, OS, COTS, etc. Documentation shall be maintained throughout the contract life-cycle. The Vendor will provide copies of the COTS license keys in the event of management transfers to DCYF or another Vendor at the end of the contract. Vendor to provide and maintain a transition plan throughout the life of the contract. The Vendor will maintain an Active maintenance contract with OEM at all times, aligned to availability commitment provided to end user at the application level. | Required | ||
| T1.16 | All hardware, software, network communications, and other infrastructure necessary to meet the requirements of this RFP shall be provided at no additional cost to the State, including any licenses that must be procured and maintained. | Required | ||
| T1.17 | The Vendor will provide private cloud hosting, including Software as a Service (SaaS) for Hosting Applications, Development tools, Cloud Infrastructure, Security as a Service (SECaaS), and business analytics capabilities. | Required | ||
| T1.18 | The Vendor will provide infrastructure maintenance including, but not limited to: |
a. installation
b. patch management
c. malware protection
d. system monitoring
e. notification services
f. database maintenance
g. back-up
h. retention services
| i. Maintenance and Operations documentation and run books | Required | ||
| T1.19 | The System will provide the ability to prevent email and hardcopy output in lower level environments from being delivered. Each deployment of the System (for example development, QA, Staging, etc.), should be capable of being configured for isolation, such that connections to the URLs, email services, printing, reporting, and file-replication cannot accidently be distributed (or trigger activity) in another deployment environment. This ensures development and testing cannot impact DCYF's customers, partners, or peers. | Required |
&"Arial,Regular"&A
&"Arial,Regular"&9&F &"Arial,Regular"&9&P of &N
T2 Interoperability
| State of Washington Department of Children, Youth, and Families (DCYF) |
| DCYF Enterprise Payment Solution (DEPS) |
| Attachment F: Solution Technology-Related Requirements Traceability Matrix (RTM) |
| RFP No. 24-DCYF-CW-081 |
Interoperability & Integration
| Req # | Requirement Description | Requirement Priority | Vendor Response: | |
| Y or N | Vendor Response: | |||
| O, C, D, T, F, N | Vendor Proposed Release Date | |||
| (If selecting F) | Vendor Justification for Not Meeting Requirement, if applicable | |||
| (If selecting N) | Additional Comments (Not Required) | |||
| T2.1 | The System will provide direct interfacing with other systems using Application Programming Interfaces (API) and data exchange standards as developed and agreed with DCYF including selected industry standards such as USCDI, HL7 FHIR and HL7 for imports and export of information. | Required | ||
| T2.2 | The System will be able to support Application to Application (A2A) synchronous and asynchronous messaging using web services. The messaging capabilities shall be able to support a wide variety of A2A patterns including, but not limited to: |
a. Data look-up and retrieval
b. Data look-up with services provided by other applications
c. Simple bulk data transfer to/from other Systems
| d. Business application logic and processes that can also be integrated with, and triggered by, external applications using APIs | Required | ||
| T2.3 | The System's interface infrastructure shall continue to operate despite failure or unavailability of individual technology components such as a server platform or network connection. | Required | |
| T2.4 | The System's interfaces shall be scalable to accommodate peak interface usage and changes in scale including changes in user population, transaction volume, throughput and geographical distribution. The System will be capable of making any changes to the interface data elements/layouts easily, and to test those changes. | Required | |
| T2.5 | The System will implement, at a minimum, interfaces (real-time and/or batch) with the applications and data sources listed in the section "G4 Interface List". | Required | |
| T2.6 | The System will provide the capability to perform source to destination file integrity checks for exchange of data and alert appropriate parties of issues. | Required | |
| T2.7 | The System's components shall be committed to an advanced approach to interoperability using Integration Platform as a Service, web services and Service Oriented Architecture (SOA) aligned with DCYF and industry standards and vision for interoperability consistent with ACF DEPS requirements. | Required | |
| T2.8 | The System will integrate with External Systems (State and Federal) using a Service and API-based approach and an API management hub, which is responsible for monitoring and controlled routing of message exchange between services, resolving contention between communicating service components, controlling deployment and versioning of services and marshaling use of redundant services. | Required | |
| T2.9 | The System will support creation and extension of service interfaces through the use of contemporary and industry standard APIs (e.g., REST, GraphQL, etc.). | Required | |
| T2.10 | The System will provide the ability to publish services and related data to be used by different types and classes of service consumers. | Required | |
| T2.11 | The System will provide the capabilities for a Real-Time (or near real-time) Integrated Enterprise where common data elements about the clients and services rendered are easily shared across organizational units with appropriate adherence to inter-departmental agreements as well as State and Federal security and privacy restrictions. | Required | |
| T2.12 | The System will have the capability to implement synchronous and asynchronous program-to-program communication, moving messages between service consumer modules and service provider modules at runtime. The ESB component may also move files, database rows and other data. The state has identified a preference for the System to be implemented with an Application Integration and API Mediation Layer / Hybrid Integration Platform from a shortlist of MuleSoft Anypoint and Azure API Management - see T7.7. | Preferred | |
| T2.13 | The System will have message and data formats that shall be based on logical representations of business objects rather than native application data structures. | Required | |
| T2.14 | The System will have data transformations that shall be to and from normalized formats. Normalized data formats facilitate composition and reduce the number of transformations that must be created and maintained. A canonical data representation that spans the enterprise can be used but is not required. A federated approach to data normalization is also possible. | Required | |
| T2.15 | The System will avoid point-to-point integrations. Application integration, both internal and external, shall go through the Service Bus. | Preferred | |
| T2.16 | All System services shall be classified with one of the following values: Presentation, Process, Business, Data, Access, or Utility. | Required | |
| T2.17 | All System services shall be reviewed, classified, and cataloged prior to use. The Documentation Artifacts shall be modeled per reference models such as ISO/IEC/IEEE 42010 Architecture Description Template. | Required | |
| T2.18 | All WSDLs developed for DCYF shall conform to the WSDL Development Standards. | Required | |
| T2.19 | The System's SOA-related messages shall be formally defined with XSD (preferable) or DTDs. | Required | |
| T2.20 | The System's metadata attributes shall be tracked for all services in the Integration Platform services catalog, including but not limited to: name, lifecycle status, class, description, owner, version, revision history, release frequency, versioning policy, deprecation policy, message exchange patterns, compensating transaction support, availability requirements, volume, max message size, security attributes, SLA, logging requirements. | Required | |
| T2.21 | The System will provide reliable, once-only delivery of messages (guarantee of reliable and non-repetitive delivery). | Required | |
| T2.22 | The System will provide the functionality that provides reliability for applications, services or message flows, including but not limited to: |
a. Load balancing
b. High availability
c. Fault tolerance
d. Failover
e. In-order delivery
f. Transaction support
g. Execution prioritization
| h. Message prioritization. | Required | ||
| T2.23 | Tests for High Availability and Failover must be completed prior to the release to UAT, and DR and Business Continuity plan must be tested annually. | Required | |
| T2.24 | The System will provide the technology that manages the metadata and the features needed to support the reliable operation of services. Examples include: |
a. Online catalog of services and associated artifacts such as WSDL files, XSDs, BPEL files
b. A single point of controlled access for cataloging, promoting, publishing and searching for information about managed assets
c. Metadata that enables an ESB to find, bind to and invoke the execution of a service implementation
| d. Support for extending existing asset types and defining and populating custom asset types | Required | |
| T2.25 | The System will provide support for integrating with applications with SOA and event-driven architectures in a manner that supports the following implementation strategies: |
a. Web Services: Web Services Interoperability (WS-I) Organization-compliant implementation of basic Web services standards, including SOAP, WSDL and Universal Description,…
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .