LAB25454-CASE_MANAG-appA.xlsx
XLSX spreadsheet 60 KB Posted
- Attached to
- Case Management Software
- Solicitation number
- LAB25454-CASE_MANAG
- Issued by
- New Castle County, Delaware
About this file
This file is a detailed vendor instructions and requirements document for a state and local contract opportunity, specifically for the State of Delaware. The document provides comprehensive vendor guidance for a software solution, likely a SaaS (Software as a Service) case management system, with extensive technical and project management requirements. The document outlines vendor expectations across multiple domains including project management, security and data handling, and technology policies and standards.
The requirements are meticulously structured with criticality levels (Mandatory, Preferred, Optional) and require vendors to specify their delivery method for each requirement (Standard, Future, Custom, or Not Available/Not Proposing). Key technical requirements include maintaining independent tenant services, implementing comprehensive security measures, ensuring WCAG 2.1 accessibility compliance, supporting single sign-on through Delaware's OKTA system, conducting annual penetration testing, and adhering to various state technology policies. Vendors must provide detailed explanations for how they will meet each requirement, with specific emphasis on security protocols, data handling, system architecture, and ongoing maintenance and support.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| LAB25454-CASE_MANAG-ad1.pdf | ||
| LAB25454-CASE_MANAG-appB.xlsx | XLSX spreadsheet | |
| LAB25454-CASE_MANAG-rfp.pdf | ||
| LAB25454-CASE_MANAG-ad2.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Vendor Instructions
| Vendor Instructions for Business and Technical Requirements |
| Vendor Response Column: Place a “Yes” if the current release of the software can fully support ALL the functionality described in the row, without special customization. A “Yes” can only be used if the delivery method is Standard (see delivery method instructions below). Otherwise, enter an "No"; A "No" can only be used with delivery method Future, Custom, or Not Available/Not Proposing (see delivery method instructions below). |
| Criticality Column: |
(M) Indicates a requirement that is "Mandatory". The State considers it to be of such great importance that it must be met in order for the proposal to be accepted. If the proposer believes that there is something about their proposal that either obviates the need for this requirement or makes it of less importance this must be explained within the comments. The State retains the right to accept a proposal if the need of the requirement is reduced or eliminated by another feature of the proposal.
(P) Indicates a requirement which is "Preferred". This requirement is considered by the State to be of great usefullness but the lack of this feature is not considered serious enough to disqualify the proposal.
(O) Indicates a requirement which is "Optional". This requirement is considered by the State to be one which usefull or potentially usefull but not a central feature of the Project.
Delivery Method Column:
Complete the delivery method using a Standard, Future, Custom, or Not Available/Not Proposing (as defined below) that indicates how the requirement will be delivered.
Standard - Feature/Function is included in the proposed system and available in the current software release.
Future - Feature/Function will be available in a future release. (Provide anticipated delivery date, version, and service release in the comment area.)
Custom - Feature/Function can be provided with custom modifications. (Respondent must provide estimated hours and average billing rate or flat cost for the software modification in the comment area. These cost estimates should be identified clearly and included in the total cost
Not Available/Not Proposing - Feature/Function has not been proposed by the Vendor. (Provide brief description of why this functionality was not proposed.)
Comments Column:
For all Delivery Method responses vendors must provide a brief explanation of how the requirement will be met. Free form text can be entered into this column.
Attachment 1: Project Requirements
Attachment 1: Project Requirements
Attachment 1: Project Requirements - SaaS
Attachment 1: Project Requirements
Attachment 1: Project Requirements
Project Management
| Project Management | |||||
| State Requirements | Vendor | ||||
| Req # | Requirement Description | Criticality | Vendor Response | Delivery Method | Comments |
| PROJECT MANAGEMENT | |||||
| P1.1 | Vendor shall participate in an initial kick-off meeting to initiate the Project. | M | |||
| P1.2 | Vendor shall provide Project Staff as specified in the RFP. | M | |||
| P1.3 | Vendor shall submit a finalized Work Plan within ten (10) days after Contract award and approval by xxx. The Work Plan shall include, without limitation, a detailed description of the Schedule, tasks, Deliverables, critical events, task dependencies, and payment Schedule. The plan shall be updated no less than <every two weeks.> | M | |||
| P1.4 | Vendor shall provide detailed <bi-weekly or monthly> status reports on the progress of the Project, which will include expenses incurred year to date. | M | |||
| P1.5 | All user, technical, and System Documentation as well as Project Schedules, plans, status reports, and correspondence must be maintained as project documentation. (Define how- WORD format- on-Line, in a common library or on paper) | M |
Attachment 1: Project Requirements
Security and Data Handling
| Security and Data Handling | ||||||
| State Requirements | Vendor | |||||
| Req # | Requirement Description | Criticality | Vendor Response | Delivery Method | Comments | |
| GENERAL SPECIFICATIONS | ||||||
| S1.1 | The vendor will perform corrective, preventative, perfective and adaptive maintenance of all environments. | |||||
| This includes software management, system process automation, configuration, infrastructure upkeep, and reliable operations for all environments. All software and hosting environments must be kept to current supported versions. Maintenance agreement must include all product releases and upgrades available as part of the solution. | M | |||||
| S1.2 | The vendor will provide assurance that SAAS Solutions maintain an independent Tenant for the State’s service. | M | ||||
| S1.3 | The vendor will provide assurance that credentials stored in middleware solutions are encrypted at rest or in configuration files. | M | ||||
| S1.4 | The vendor will supply a description of hardening standards they utilize. | M | ||||
| S1.5 | The vendor will provide assurance that a comprehensive next generation endpoint security solution with machine learning capable anti-malware, abnormally detection, file integrity monitoring, log file monitoring, host-based intrusion detection, and file reputation scanning is deployed. | M | ||||
| S1.6 | The vendor will provide assurance that auditing on hosts will capture all security related activities and the the logs will be maintained for up to 7 years. | M | ||||
| S1.7 | The successful bidder shall continue to ensure that API integration for state data must traverses a state API gateway with OWASP top-10 and XML security protection. | M | ||||
| S1.8 | The successful bidder shall ensure that application security related events like logins, changes and administrator activities are logged and reviewed for malicious or abnormal activity. | M | ||||
| S1.9 | The successful bidder shall ensure that dynamic application scans are conducted at least yearly and after any changes are loaded into production. | M | ||||
| S1.10 | The successful bidder shall comply with the State Offshore Staffing Policy https://webfiles.dti.delaware.gov/pdfs/pp/OffshoreITStaffingPolicy.pdf | M | ||||
| S1.11 | The vendor will ensure that all off-site vendor personnel shall attach to State of Delaware’s network using only workstations or laptops governed by vendor’s NIST-compliant security policies. | M | ||||
| S1.12 | The vendor will ensure that all off-site vendor personnel shall use networks, email systems, development system, testing systems, workstations, and laptops governed by the vendor’s NIST-compliant security policies. | M | ||||
| S1.13 | The vendor will ensure that the system or solution comply with the World Wide Web Consortium (W3C) Web Content Accessibility Guidelines (WCAG) 2.1 Level A and AA guidelines for websites and mobile applications, the Americans with Disabilities Act (ADA) Titles I, II and III, Section 504 and Section 508 of the Rehabilitation Act of 1973, the 21st Century Communications and Video Accessibility Act of 2010 (CVAA), and Title 6 Delaware Code 4504. | M | ||||
| S1.14 | The vendor will ensure that database access should be restricted to only critical systems, applications and support staff. | M | ||||
| S1.15 | The vendor will ensure that database systems are encrypted beyond the default host level encryption. | M | ||||
| S1.16 | The vendor will provide a description of any Third Party certificates of audit certifying on a recurring basis including but not limited to any of the following: Internal Revenue Service Publication 1075 Compliance, NIST 800-53, CSA STAR – Cloud Security Alliance – Security, Trust & Assurance Registry, SOC 2 Compliance, Federal Risk and Authorization Management Program (FedRAMP),certification for a System hosted in a cloud environment, PCI DSS Compliance, Health and Human Services Health Insurance Portability and Accountability Act (HIPAA) Compliance | M | ||||
| S1.17 | The vendor will provide a description of how management of the hosting infrastructure will be met (e.g. hardware, operating systems, network, communications, connectivity, backup, fail-over, disaster recovery components, etc.) | M | ||||
| S1.18 | The vendor will provide a description of the usability and compatibility of your solution across internet browsers, devices, and assistive technologies, including desktop and mobile devices supporting all major operating systems, and all major browsers including current and recent versions of Internet Explorer, Google Chrome, Microsoft Edge, Mozilla Firefox, and Safari. Include any applicable VPAT or similar assessments of accessibility of existing technologies and plans to verify usability of solutions while in development and once ready for deployment. | M | ||||
| S1.19 | The vendor will provide a description of their approach to providing post deployment ongoing support, maintenance, and upgrades. | M | ||||
| S1.20 | The vendor will ensure that the system shall authenticates internal users against the State of Delaware's OKTA single sign-on and incudes support for OpenID Connect, OAuth and or SAML. | M | ||||
| S1.21 | The vendor will ensure that a firewall or other next generation network logical control system separates the layers in the architecture. | M | ||||
| S1.22 | The vendor will ensure that Firewall Rules must be are justified, documented and specific to application needs. | M | ||||
| S1.23 | The vendor will ensure that notifications to the System Administrator regarding which releases of third-party software are known to create problems with the current version of the vendor software are made within 24 hours of the update announcement. | M | ||||
| S1.24 | The vendor will ensure that the System shall be PCI-DSS compliant if the System participates in the acceptance to financial account/credit card information. | M | ||||
| S1.25 | The vendor will enusre that Solutions undergo external Penetration Testing at least yearly and System Vulnerability scans must be performed and remediated at least quarterly. The vendor shall provide a listing of security scans/vulnerability scans performed routinely against their product and the results of the most recent assessment. | M | ||||
| S1.26 | The vendor will ensure that applications requiring the use of the State’s brand and domain name can support the use case of traverseing the State's cloud based Web Application Firewall for centralized visibility to all brand threats. | M | ||||
| S1.27 | The vendor will ensure that the System or Service has a comprehensive security incident detection and response program with: |
Log Collection, correlation and threat intelligence 24x7, 365 active security event monitoring and attack response Compliance aligned log retention Copies of raw logs and threat events available upon request this may include log forwarding to Security Incident and Event Management (SIEM) system M
Attachment 1: Project Requirements
Attachment 1: Project Requirements
Attachment 1: Project Requirements
Attachment 1: Project Requirements
Attachment 1: Project Requirements https://webfiles.dti.delaware.gov/pdfs/pp/OffshoreITStaffingPolicy.pdf Technology Policies & Standards
| Technology Policies & Standards | |||||
| State Requirements | Vendor | ||||
| Req # | Requirement Description | Criticality | Vendor Response | Delivery Method | Comments |
| Possible Applicable State Policies & Standards | |||||
| P1.1 | Digital Accessibility Policy | M | |||
| P1.2 | Enterprise Services Standard | M | |||
| P1.3 | Offshore IT Staffing Policy | M | |||
| P1.4 | Disclosure of Individual User e-Resource Records Policy | M | |||
| P1.5 | Systems Architecture Standard? | M | |||
| P1.6 | Backup, Recovery and Retention Guidelines | M | |||
| P1.7 | Database Management System Guideline | M | |||
| P1.8 | Data Classification Policy | M | |||
| P1.9 | State of Delaware Information Security Policy (DISP) | M | |||
| P1.10 | Terms and Conditions Governing Cloud Services and Data Usage Agreement | M | |||
| P1.11 | Data Destruction Certification Form | M | |||
| P1.12 | Disposal of Electronic Equipment and Storage Media Policy | M | |||
| P1.13 | Identity and Access Management Guidelines | M | |||
| P1.14 | Identity and Access Management Policy | M | |||
| P1.15 | Identity and Access Management Standard | M | |||
| P1.16 | |||||
| P1.17 | |||||
| P1.18 | |||||
| P1.19 | |||||
| P1.20 | |||||
| All related documents can be accessed on the DTI site: | |||||
| https://dti.delaware.gov/technologyservices/standards-and-policies/ |
Attachment 1: Project Requirements
&A https://dti.delaware.gov/technology-services/standards-and-policies/
File details come from the government source that posted it. Updated .