LCPS Technical Requirements.xlsx
XLSX spreadsheet 90 KB Posted
- Attached to
- RFP R25268 Internet Services
- Solicitation number
- 82059
- Issued by
- Loudoun County, Arlington CDP, Virginia
About this file
This technical requirements document from Loudoun County Public Schools (LCPS) outlines detailed specifications for digital platforms and applications to be used within their educational system. The document covers extensive technical requirements across multiple categories including delivery methods, maintenance and upgrades, account management, authentication, standards and reporting, roles management, network requirements, support services, security, privacy compliance, Schoology LMS integration, accessibility, and artificial intelligence implementation.
The requirements specify a 99.9% system availability, Azure SSO integration preference, SAML or oAuth authentication support, and mandatory compliance with various security standards including FERPA, COPPA, and HIPAA. The technical environment includes Metro Fiber Ring (100 Gbps) WAN communication, Gigabit Ethernet LAN, WiFi 6 or 7, Windows Server 2016-2022, SQL Server 2019, and support for various end-user devices including Windows workstations, Apple devices, and Chromebooks. The document emphasizes strict data privacy requirements, including U.S.-based data storage, encryption standards, and compliance with Virginia's Executive Order 30 regarding AI integration in education.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFP R25268 Internet Services.pdf | ||
| RFP# R25268 Exhibit 3 Pricing Schedule_Internet Services.xlsx | XLSX spreadsheet | |
| LCPS Technical Requirements.xlsx | XLSX spreadsheet | |
| RFP R25268 Internet Services.pdf | ||
| RFP# R25268 Exhibit 3 Pricing Schedule_Internet Services.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Application Requirements Name of Digital Platform (complete this form for each different platform)
| Item | Description | Level | Vendor exceptions or limitations |
| Delivery Methods: | |||
| 1 | All applications must conform to HTML5 standards and content must be fully accessible through LCPS supported browsers on all device types. Vendors will provide a list of all minimum browsers, versions, plugins required, and client operating systems as well as browsing functionality that may require compatibility mode. Indicate if any parts of the product utilize Flash. Describe the process for updating to support new browsers versions and the policy for supporting older browsers. | Required | |
| 1a | Online resource must be certified against Chrome (latest version) | Required | |
| 2 | Content must be accessible via managed and BYOT mobile device. Provide description of your mobile offerings for iOS, ChromeOS and Android. | Required | |
| Maintenance, Upgrades, and Planned Outages: | |||
| 3 | LCPS requires that the system be available to a level of 99.9%, calculated over a 30-day period, 24/7, outside of regularly-scheduled maintenance and/or update windows. Describe your expected availability. | Required | |
| 3a | Describe the credit structure in place for failure to meet 99.9% SLA. Also describe the credit structure if any individual application features or components are not available (such as videos, quizzes, interactive content) 99.9% SLA. | Preferred | |
| 4 | LCPS requires a dedicated technical resource to assist with maintenance, upgrades, and issues. LCPS must be provided with at least 7 days notification of any planned service outage. The Offeror will post this notification to any user log-in into the resource or accessing online resources for at least 7 days prior to the planned service outage. | Required | |
| 5 | When regular scheduled maintenance is required, offeror should state specifically when and how long the “down-time” period will last. Offerror should provide the current yearly schedule and the schedule for previous year(s). | Required | |
| Account Management and Authentication: | |||
| 6 | The system should support the option of authentication of users via integration with LCPS Active Directory or cloud services using SAML or oAuth. We prefer to use Azure SSO. Provide detailed documentation for how the system integrates with these methods. | Required | |
| 7 | The system shall support unique UserID for LCPS students, teachers and staff specified by LCPS and independent of other institutions using the product. | Required | |
| 8 | The system shall provide automated rostering and license provision through Clever, ClassLink, or Schoology | Required | |
| 9 | Describe system time out and maximum log on attempt thresholds. | Required | |
| 10 | The system shall be in compliance with LCPS security and password policies by providing the capability to enforce a strong, complex password policy as well as provide capability to enforce different password policies for different groups of users. | Required | |
| 11 | Passwords shall be transmitted and stored in an encrypted format. | Required | |
| 12 | Offeror must describe the system’s password management capabilities (i.e., admin reset, global reset, individual self- service reset, forced change, etc.). Indicate whether the system provides the ability to require the end user to change passwords upon initial login. | Required | |
| 13 | Offeror must describe the system’s Multi-Factor Authentication (MFA) capabilities. Whenever possible, integrating with Azure AD authentication is preferred, as LCPS can leverage it's own Azure-based MFA conditional access policies. If offerer can not utilize the LCPS preferred Azure MFA infrastructure, please describe the MFA options that can be provided. | Required | |
| Standards and Reporting | |||
| 14 | Offeror should conform to and deliver access to content via a rostering standard such as One Roster, Clever, Schoology or 1Ed Tech Interoperability v1.1 (or higher) | Preferred | |
| 15 | All student-level data within the system should be available to query and extract by the vendor and provided to LCPS within 5 days of request | Required | |
| 16 | Describe current reporting capabilities and anticipated future reporting capabilities available to LCPS. Indicate if reports are able to be self-generated by LCPS or available by request. Offerors should provide reports, preferrably daily usage reports (total daily logins for students and teachers separately), for the last 30, and 90 days, and for the full school year. In addition, Offerors should provide a listing of support tickets reported with ticket details including resolutions when requested. Reports should be provided within 5 days of request. Reports shall be delivered to the designated LCPS representative in Microsoft Excel or CSV format unless otherwise agreed upon in writing. | Required | |
| Roles and Managements Capabilities: | |||
| 17 | The system shall support a role-based access system following the “need to know” principle. This principle requires each user be granted the most restrictive set of privileges needed for the performance of authorized tasks. The system shall support controls to ensure the provision of, and access to data, features, functionality, and administrative capabilities based on end users permissions for delivery of services based on end-user roles. List and describe the user roles within the system and access to data. | Required | |
| 18 | Describe any class, school, and central district management portal or other administrative features. Describe how users such as principals, specialists, and facilitators will gain access to the system. | Required | |
| 19 | Role permissions shall be configurable at the district level. | Preferred | |
| Network and Caching: | |||
| 20 | Describe any system features that would consume a significant amount of network bandwidth. Provide average per user bandwidth utilization. | Required | |
| 21 | Describe any required firewall or content filter settings that must be in place for the system to function properly. | Required | |
| Support: | |||
| 22 | Offeror must provide clearly visible support contact information within the online environment. At a minimum, support hours must be Monday - Friday with weekend support hours also provided. Evening hours also preferred. Provide all support hours for students, teachers and staff. | Required | |
| 23 | LCPS should be provided with a dedicated techincal support resource and escalation via phone support must be provided for designated LCPS contacts. Identify escalation contacts. Describe hours of availability for tier 2 and tier 3 technical support coverage. Describe process and procedures for escalation and documented response and reconciliation targets by severity and impact. | Required | |
| 24 | Describe the methods of support provided to the district and to end-users. e.g. Toll-free help-desk live operator, email, live chat. Explain and state the hours that each support type is available. | Required | |
| 25 | Provide a report over the current school year outlining the top 10 customer reported issues for the product(s) being proposed. Note their frequency, impact, the resolution, and the time to resolve. | Required | |
| 26 | Offeror should provide a web-based incident tracking system allowing designated LCPS support contacts to create and track system problems. Describe current incident tracking capabilities. | Required | |
| 27 | The system shall provide an online knowledge base. Describe what tools and documentation are available and accessible online that provide training materials, support references, and quick reference guides. | Required | |
| 28 | The Offeror shall provide details on version releases to the designated LCPS contact at a minimum of 30 days before the release. | Required | |
| 29 | In addition to scheduled maintenance and service outages, describe the Offeror notification processes to clients (e.g. via email or other) concerning upcoming releases, fixes, changes, and retirements. | Required | |
| Security, Privacy, and Compliance: | |||
| 30 | Offeror must have a formally appointed information security officer or equivalent. Please provide the name and contact information. | Required | |
| 31 | Is your information security program based on an industry accepted framework? If so, what framework did you choose? | Required | |
| 32 | Performed an information security risk assessment within the last year? If so, was this an internal self-assessment or performed by a third party? Were the results of the assessment remediated to a level accepted by management? If possible, please share a sanitized executive summary. | Preferred | |
| 33 | Undergo any industry recognized security audits such as ISO 27001 or SOC2? If so, please share copies of your reports. | Preferred | |
| 33a | Describe the types of standards (or laws) you adhere to and/or are certified for (PCI DSS, GDPR, FERPA, COPPA, HIPAA, etc.). | Preferred | |
| 34 | Describe how often and what type of security training you provide your employees. | Preferred | |
| 35 | Has your organization experienced any reportable breaches of sensitive/confidential information in the last two years? If so, provide a summary of the breach and corrective actions taken. | Required | |
| 36 | Data encryption: All communication involving student data, including user authentication (usernames and logins) and data transfer, must be encrypted using secure protocols such as TLS 1.2 or higher. This applies to all access methods, including web browsers, mobile applications, and APIs. Any sensitive student data stored on the client side, such as passwords, tokens, or cached data within mobile device storage or HTML5 local storage, must be encrypted using industry-standard encryption algorithms. The encryption keys must be protected with robust key management practices. | Required | |
| 36a | The Offeror shall provide information and documentation on the security and encryption of data at rest. | Required | |
| 36b | The offer shall provide email security with all of the following being implemented: DMARC with a policy of "reject" or "quarantine" and valid DKIM and SPF records. | Required | |
| 37 | Data location: The Offeror shall ensure that all student-identifiable data collected, processed, and stored is maintained within the United States. Any exceptions to this requirement must be explicitly approved by LCPS and must comply with all applicable state and federal laws. The Offeror shall identify the specific location(s) where student data will be stored, including the physical address. | Required | |
| 38 | Data seizure or disclosure: Access to LCPS data shall only be in response to a properly issued subpoena. | Required | |
| 38a | The Offeror should describe the system safeguards in place to prevent unauthorized access to the system. | Required | |
| 39 | Auditing: The Offeror shall describe the auditing capacity of the system. | Required | |
| 39a | The system shall provide logon/logoff monitoring and support activity-based auditing when requested by LCPS | Required | |
| 39b | The system shall provide LCPS an audit report that details account privileges that can be filterable by school and role. | Required | |
| 40 | Privacy Policies: Privacy policies must be posted online and accessible to all users. Notice of changes to policies should be provided to the designated LCPS contact no later than within 24 hours of their effective date. LCPS requires that the Offeror be a signatory to the SIIA/Future of Privacy Forum student data privacy pledge (http://studentprivacypledge.org/) or certify in writing that they provide equivalent or better assurances. Provide documentation of pledge signature or certification of assurances equal to or greater than those required by the pledge. | Required | |
| 41 | The Offeror must agree to sign and comply with the LCPS Data Privacy Addendum at the time of contract award | Required | |
| 42 | The Offeror shall list any 3rd party tracking or advertising networks used in the system. | Required | |
| 43 | Secure Web Development: The Offeror must provide information on how the system support secure web environment, including but not limited to, cookie handling, input validation, directory browsing control, and system hardening. | Required | |
| 43a | If the application provides a system-wide directory listing, it must also provide a method to delist a student in the directory. Describe method used. | Required | |
| 44 | The Offeror shall describe current processes and policies for host site security, including but not limited to, physical access control, virus protection, system updates, server and device security standard, backup and disaster recovery, change management, and incident handling | Required | |
| 44a | The Offeror should provide their formal security incident response plan and state when was the plan last exercised. | Required | |
| 44b | The Offeror should provide their formal disaster recovery plan and state when was the plan last exercised. | Required | |
| Schoology LMS Integration Availability | |||
| 45 | Do you offer integration via Schoology LMS? | Preferred | |
| 45a | Can both Schoology and another SSO/integration method (e.g. Clever, ClassLink, or MS Entra) be established at the same time or does one or the other need to be chosen? | Preferred | |
| 46 | If a Schoology Integration is available… | Preferred | |
| 46a | Does your Schoology integration offer Single Sign On (SSO) functionality? | Preferred | |
| 46b | Does your Schoology integration roster student information? | Preferred | |
| 46c | Is your Schoology integration an LTI 1.3 app? | Preferred | |
| 46d | Do users access content via Thin Common Cartridge? | Preferred | |
| 46e | Do users access content via Deep Linking? | Preferred | |
| 46f | Do users access content via a link to a dashboard of content? | Preferred | |
| 46g | Does your Schoology integration support grade pass back? Are grades synchronized in real time? | Preferred | |
| 46h | Does your Schoology Integration support linked sections? If applicable, please note any limitations compared to standard sections. | Preferred | |
| Accessibility | |||
| 47 | Do you meet the Americans with Disability Association (ADA) standards for accessibility? Do you meet Web Content Accessibility Guidelines (WCAG2 or newer)? Do you have a Voluntary Product Accessibility Template (VPAT) service? Please describe how you provide an accessible platform. | Preferred | |
| Artificial Intelligence | |||
| 48 | If your product has Generative Artificial Intelligence (AI) components... | ||
| 48a | Does the platform employ AI safeguards/guardrails? Please provide a high level description or link to such policy?. | Required | |
| 48b | Does the platform have any age-related guardrails that ensure age-appropriateness and reduce the risk of misinformation and bias? | Required | |
| 48c | Does your system leverage a commercial 3rd party AI model or an internal model? | Required | |
| 48d | If third-party AI tools are used, is a list of third-party partners provided? | Required | |
| 48e | Is data entered into your system used to train AI models (either internal or third party) | Required | |
| 48f | Can student-facing AI tools be disabled or otherwise managed by the division? | Required | |
| 48g | Can AI features be enabled or disabled for specific users or groups (for example, teachers or students)? By the district? By Teachers? By individual users? | Preferred | |
| 48h | If the system uses a 3rd party AI model, does the user need an account or need to authenticate to access the model? | Required | |
| 48i | Can generative AI features be customized with and trained on division-specific information? | Preferred | |
| 48j | Implement ongoing monitoring and corrections of AI at minimum of once per year. | Required | |
| 49 | If your product offers generative AI chatbot features: | ||
| 49a | Are generative AI interactions logged and accessible by teachers and/or school and division administration? Are alerts or notifications in place for students sharing dangerous or concerning information with the chatbot? | Required | |
| 49b | Does the platform warn users to not enter personally identifiable information? | Required | |
| 49c | Will/can the platform alert users that Generative AI can sometimes generate biased, harmful or inaccurate content? | Required | |
| 49d | Are data anonymization techniques in place with AI chatbots in your system? | Required | |
| 50 | Vendor to adhere to Executive Order 30 (2024). The referenced Guidelines for AI Integration Throughout Education in the Commonwealth of Virginia. Specifically, Do no harm: All integration of AI in education must be in accordance with the policy and IT standards that are set forth in the Executive Order and in other state and federal policies. This includes ensuring the safeguarding of the privacy, security, and confidentiality of personally identifiable information, ensuring that algorithms are not based on inherent biases that lead to discriminatory outcomes. | Required | |
| 51 | Has your organization completed the 1EdTech Generative AI Rubric? | Preferred |
https://www.governor.virginia.gov/media/governorvirginiagov/governor-of-virginia/pdf/eo/EO-30.pdfhttps://www.1edtech.org/sites/default/files/media/docs/2023/Data-Privacy_AI-Rubric.pdf Technical Environment
| Category | Standard |
| WAN Communication | Metro Fiber Ring (100 Gbps), 10 Gbps resilient connectivity per spoke |
| Internet Connectivity | 100 Gbps |
| LAN Communication | Gigabit Ethernet 1000Base T |
| WLAN Communication | WiFi 6 or 7 (minimum) |
| Network Protocol | TCP/IP |
| Server Operating System | Microsoft Windows Server 2016-2022 |
| Database | SQL Server 2019 |
| Directory Services | Active Directory, AzureAD |
| Virtualization | Microsoft Hyper-V, AWS EC2 |
| Workstations | Windows (Lenovo primarily) and Apple (MacBook, iMac, etc.) |
| Mobile Devices | Apple iPads (various models) |
Chromebooks (various models)
| Workstation Operating System | Microsoft Windows 11, MacOS (latest versions), ChromeOS |
| Productivity | Microsoft Office 2016 Professional Plus |
Microsoft Office 365 Google Workspace Browsers Google Chrome (latest version)
File details come from the government source that posted it. Updated .