IT Requirements_v2.6_TINmatchingrfq13416_att1.xlsx
XLSX spreadsheet 34 KB Posted
- Attached to
- RFQ - 1099 AND TIN MATCHING REPORTING SERVICES
- Solicitation number
- BPM013416
- Issued by
- California
About this file
This is an Information Technology Requirements document for RFQ 13416 issued by the San Diego County Health and Human Services Agency for 1099 and TIN Matching Reporting Services. The document outlines mandatory business-critical and functional requirements that proposers must address in their responses to demonstrate solution compliance. The IT requirements document serves as Attachment 1 to the Statement of Work and requires vendors to indicate whether their proposed solutions meet each specified requirement or, if not, to describe necessary work and associated costs.
The requirements encompass eleven mandatory technical standards covering privacy and data protection, U.S.-based support and infrastructure, endpoint detection and response capabilities, data encryption in transit and at rest, separation of development and production environments, identity provider integration for credentials, prevention of hardcoded secrets in source code, FIPS 140-3 validated cryptographic modules, and prohibition of deprecated protocols and ciphers. Additionally, the document specifies functional requirements related to system documentation, online help functionality, training materials, data extraction and conversion services, and project deliverables including custom documentation for business processes, configurations, installations, and hands-on training. The version log indicates the document has undergone multiple revisions through July 2018, with the final version 2.6 updated on November 21, 2025, and primary contacts listed as David Lindsay and Melanie Caramat from San Diego County.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| rfq_13416_1099_tin_matchng_rptng_svcs.pdf | ||
| Data Sec Chklst_tinmatchingrfq13416_att2.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Version Log
| Version | Date | Description |
| 1 | 7/5/18 | Initial draft |
| 2 | 7/13/18 | Updates from team review; remove Pricing and Customer References tabs. |
| 2.1 | 7/15/18 | Minor editing: instructions, vendor profile, and questionnaire worksheets |
(1) IT Requirements - Attach. 1
Request for Quote (RFQ) 13416 Health and Human Services Agency
1099 AND TIN MATCHING REPORTING SERVICES
Information Technology Requirements Business Critical
| Attachment 1 | IT Review and Comments (Check / Complete as applicable) | |
| The following are business critical requirements that proposer must resond to. All Information Technology Requirements shall be incorporated as an Attachment to Exhibit A - Statement of Work. State Yes or No to indicate whether or not your solution will meet the requirement. If No, state what work is necessary to meet the requirement or how your solution will meet the requirements and the work necessary to meet the requirements - indicate costs if needed. Applicable product literature or technical documentation can be provided to support your response. |
The County will favor a response that substantially meets the Information Technology requirements outlined in this document. Should you take exception(s) to the requirements, you understand that the County may, as part of its evaluation process, conclude that exceptions are so material as to make the Offeror’s response to the solicitation unacceptable.
| Response # | Requirement Description | YES/NO | Vendor Response and Comments. | |
| Please describe how your product will comply with the requirement | Vendor response acceptable as stated | Vendor response acceptable as modified below (re-state) | Vendor No confirmation and comments can be reserved | |
| MR-1 | The solution shall protect the privacy of customer personal identifiable information (PII) in accordance with Federal and State regulations. Please describe how the solution meets the requirements. | |||
| MR-2 | All support for the solution shall be provided from locations within the borders of the United States including customer service and non-client facing technology and infrastructure support personnel. | |||
| MR-3 | All data processed and stored by this solution shall only traverse networks contained within the borders of the United States. | |||
| MR-4 | Endpoint Detection & Response (EDR) or Anti-Malware protection software shall be installed on all systems supporting the solution. Please describe the specific software that the solution uses. | |||
| MR-5 | Solution shall support data in-transit encryption, including but not limited to: |
1. Client to server communications
2. Server to server communications
3. Database communications
4. API communications
5. List any unencrypted data-in-transit instances the solution requires MR-6 The solution shall support data encryption for all data at rest including:
1. Disk level encryption
2. Database/Storage/Share Encryption
3. File level encryption
| MR-7 | The solution product development teams shall not have access to production infrastructure and/or production data. |
| MR-8 | All application and system integration credentials shall be integrated with the County's external identity provider including: |
a. Application Service to Application Service credentials
b. Application Service to Database credentials
c. API credentials MR-9 The solution must prevent the following items from being stored/hardcoded within the source code:
1. Passwords
2. API keys
3. Certificates
4. Tokens
5. Hashes
6. Anything considered secret
| MR-10 | All cryptographic functions performed within the solution (e.g., data encryption, key management, hashing, digital signatures) shall utilize FIPS 140-3 validated cryptographic modules. Any cryptographic module employed for data-in-transit or data-at-rest encryption, as well as authentication protocols, shall meet or exceed the requirements as defined in NIST FIPS 140-3 (Security Requirements for Cryptographic Modules) and NIST SP 800-131Ar2 (Transitioning the Use of Cryptographic Algorithms and Key Lengths). | |
| MR-11 | All solutions, systems, and applications within the environment shall not use the following deprecated or legacy protocols and ciphers, due to known security vulnerabilities and/or insufficient cryptographic protection: | |
| • | SSLv2.0/SSLv3.0 | |
| • | TLS 1.0/TLS 1.1 | |
| • | SMBv1/SMBv2 | |
| • | LM/NTLMv1/NTLMv2 | |
| • | FTP without TLS | |
| • | SSHv1 |
Version & Contact Last Updated: 11/21/25 v 2.6
| Contact: | David Lindsay - david.lindsay@sdcounty.ca.gov |
| Melanie Caramat - melanie.caramat@sdcounty.ca.gov |
Project Req
| Requirement Number | Requirement Description | Supported | Comments |
| Project requirements | |||
| System Documentation Requirements | |||
| T-230 | Online help on system functionality is to be a component of the online system | ||
| T-231 | Online help can be searched based on screen, job function, process name, nouns so that user can find help by topic | ||
| T-232, P-165 | System documentation includes product user guides | ||
| T-233 | System documentation includes technical manuals | ||
| T-234 | System documentation includes data model, tables and attributes | ||
| T-235 | System documentation can be exported into a format that can be annotated electronically and then stored, i.e. product documentation does not need to be re-typed to create custom training material or custom business process documentation | ||
| T-236 | System documentation is available in electronic format that may be stored on county computers | ||
| T-238 | Custom documentation on business processes is developed as part of the project | ||
| T-239 | Custom documentation on configurations and customization made to base product are developed as part of the project | ||
| T-240 | Custom documentation on installation procedures for configurations, customization are developed as part of the project |
| System Training Requirements | |
| T-241 | Training materials need to be accessible online and indexed by job function or process name. |
| T-242, P-166 | Training materials include detail user steps to complete job functions. |
| T-243 | Training materials are provided in electronic format. |
| T-244 | Training class are defined, materials written, classes conducted for end user training, super user training and system application support staff are developed as part of the project |
| WW-189 | Training will be hands-on practical on the installed system, using helpful training documents. |
| Data Extraction, Data Conversion, Data Loading | ||
| T-245 | Data from existing EAM systems, custom Access databases, and excel spreadsheets is extracted, transformed and loaded into new EAM as part of the project | With error messaging on load problems |
| T-246 | Defining the data mapping from existing EAM data sources into the new EAM system is part of the project | |
| WW-190 | Data conversion services as required to transfer existing County data into the new EAM. |
&"Arial,Bold"&14&A
&"Times New Roman,Italic"&11Functional Requirements Page &P of &N &"Times New Roman,Italic"&11&D
&"Times New Roman,Italic"&11Functional Requirements Page &P of &N &"Times New Roman,Italic"&11&D
&"Times New Roman,Italic"&11Functional Requirements Page &P of &N &"Times New Roman,Italic"&11&D
File details come from the government source that posted it. Updated .