PS_Mobile_Alerting_Requirements.xlsx
XLSX spreadsheet 28 KB Posted
- Attached to
- Mobile Alerting System
- Solicitation number
- 2023-RFP-218
- Issued by
- Allegheny County, Philadelphia City, Pennsylvania
About this file
This is a detailed technical requirements spreadsheet for a Mobile Alerting System from the City of Pittsburgh, specifically targeting the Department of Public Safety (including Fire, OEMHS, EMS, and Police). The solicitation seeks a comprehensive mobile alerting solution that provides direct incident information to public safety personnel across multiple platforms, with requirements for functionality across Windows, Android, and iOS devices. The system must support 24/7 direct customer support, integrate with Allegheny County's Computer Aided Dispatching system, offer customizable mapping features, enable simultaneous user notifications, and provide robust communication capabilities including email, voice, text, mobile app, and third-party platform integrations.
The technical requirements emphasize extensive security, data protection, and operational capabilities, including 99.99% system uptime, cloud-based hosting (preferably in the continental United States), encryption of data at rest and in transit, and compliance with industry security standards like CJIS and HIPAA. Key technical specifications include support for role-based access management, comprehensive reporting (at least 150 configurable reports), geospatial data compatibility, API access, and the ability to handle multiple user environments. The system must also provide advanced features like two-way communication, customizable alert templates, event management, threat intelligence, and potential future enhancements involving AI/ML capabilities. Vendors are required to provide detailed documentation, annual security assessments, and ensure complete data ownership and accessibility for the City of Pittsburgh.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Mobile_Alerting_System_(Addendum_#1_Revision).pdf | ||
| Standard_SLA_with_Remedy_(1)_(3).doc | DOC document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Technicial
| Requirement ID | Requirements | System Capability | Comments: |
| (All of the items apply to any subcontractors that work on the solution. ) | (select from dropdown) | ||
| Outage and Breach Reporting | |||
| 1.1 | Provide your outage notication communication | ||
| 1.2 | Provides fast detection and root cause diagnosis | ||
| 1.3 | The City of Pittsburgh (referred to as City) must be notified in writing within 24 hours of the earliest indication or report of a potential breach or unintended disclosure of Confidential Information (CI) or a System that supports CI. | ||
| 1.4 | Response actions to incidents that might affect CI or Systems must be conducted quickly and with ample resources. Vendor will hire a professional third-party incident response team if in-house resources do not have sufficient skill or availability. The Vendor is expected to distribute all incident response evidence, reports, communications and related materials to security@pittsburghpa.gov. The format of incident reports will be agreed upon with the City in advance. | ||
| 1.5 | City shall have the right to view all incident response evidence, reports, communications and related materials upon request. | ||
| 1.6 | If requested by the City, or if required by law, the Vendor shall notify in writing all persons affected by the incident, at its own cost and expense. | ||
| 1.7 | Vendors shall have a comprehensive secure development system in place consistent with industry standard best practices, including policies, training, audits, testing, emergency updates, proactive management, and regular updates to the secure development lifecycle System itself. | ||
| 1.8 | Vendors will make updates available to the City in a timely fashion at no additional cost. | ||
| 1.9 | The system can provide the ability to track and log system uptime and transaction response times in order to provide information for SLA monitoring | ||
| 1.1 | Provides for predictive failures and issue alerting functions | ||
| 1.11 | Ability to allow for notification of blackouts | ||
| Data and Security | |||
| 2.1 | All cloud-hosted data must remain in the continental United States. | ||
| 2.2 | Ownership of all data remains exclusively with the City, at no additional cost. | ||
| 2.3 | Data should be encrypted at rest and in transit. | ||
| 2.4 | The City shall have the right to view all documentation containing the results of any security audits completed within the last twelve (12) months, including documentation regarding security practices and data classification. | ||
| 2.5 | The Vendor shall use commercially reasonable efforts to secure and defend any System housing Confidential Information against third parties. | ||
| 2.6 | Vendors that handle Confidential Information must respond to and resolve security-related bug reports, inquiries and incidents in a timely and professional manner. The Vendor must notify the City within 24 hours of when Vendor becomes aware of any such incident that poses a potential risk to City data. The Vendor shall send the notification to security@pittsburghpa.gov | ||
| 2.7 | Must follow industry standard password requirements. (Passwords must be stored in non-reversible one-way cryptographic hash) | ||
| 2.8 | Log all successful and failed authentication attempts, including date, time, IP address, and username. | ||
| 2.9 | Offer a secure password reset feature, including verification of identity, email or text notification. | ||
| 2.1 | Temporarily lock accounts with repeated failed login attempts and provide support to affected users. | ||
| 2.11 | Ability to provide authentication via generally agreed upon SSO methodologies. | ||
| 2.12 | Vendors managing City-owned CI must engage an independent third party annually to assess the practical security of Vendor's Systems. These reviews must include penetration tests from the perspective of an external attacker and an internal user with common privileges. The penetration tests must include all Systems exposed to the internet and any Systems, internal or external, that Handle Confidential Information. Such annual assessment shall be at Vendor’s sole expense. | ||
| 2.13 | Audit logs must be implemented for all Systems including those that handle CI. All attempted violations of System security must generate an audit log. Audit logs must be secured against unauthorized access or modification. Electronic logs required | ||
| 2.14 | In the event of adverse findings through a City or Vendor audit, the Vendor shall cooperate with the City in remediating any risks to CI, including complying with request to temporarily taking the system offline or otherwise limiting access to the system, and any other follow up actions reasonably necessary to secure the CI. | ||
| 2.15 | For the life of the contract, all data should be retained and available upon request from the City, available via API calls. | ||
| 2.16 | All metadata, logs, notifications of system outages, etc. should also be retained for the life of the contract. | ||
| 2.17 | Vendor Systems that Handle Confidential Information shall be available and fully functional 24x7x365 with 99.99% uptime, unless otherwise agreed upon in writing with the City. Vendor shall make plans for colocation, backups and any other Systems necessary to ensure continuity. | ||
| 2.18 | Vendor must notify and obtain agreement from the City for any planned interruptions in service, with the exception of emergency security updates. Vendor must notify the City immediately of any unintended service interruption. | ||
| 2.19 | RFP responses should include a plan for content availability in the event of the need to migrate to a different platform. Remittance of content directly to the City of Pittsburgh is acceptable. | ||
| 2.2 | Include online Help | ||
| 2.21 | Comprehensive Security - Local certificates, trusted certificates, and 128-bit SSL | ||
| 2.22 | System should be able to provide an unlimited number of different security groups that can be defined, each with their own security settings and group names that are appropriate. | ||
| 2.23 | ISO/IEC 27001 Certification or in pursiut of audit before working with the City | ||
| 2.24 | Storage needs to be capable of compliance with CJIS Security Policy storage requirements: https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center | ||
| 2.25 | On Request, vendor shall provide City with a copy of and permanently delete any CITY Confidential Information from its systems and provide a backup copy of the database in .bak file format. | ||
| 2.26 | General maintenance related to retention and archiving | ||
| Network | |||
| 3.1 | The solution must adhere to latest best network industry practices. | ||
| 3.2 | The solution must assure that the integrity of the City's network is sustained by the implementation and utilization of modern firewall, VPN and other remote access technologies. | ||
| 3.3 | The soluton must provide network authentication and system user events logging. | ||
| 3.4 | The solution must assure that there will be no degradation in performance of City's network due to their system or design. | ||
| 3.5 | Proposers must include a list of web browsers and devices their system does/does not support | ||
| Application and Infrastructure | |||
| 4.1 | Solutions are preferred to be cloud based solutions hosted with the provider. If solution needs to be customer hosted enviroment, Google Cloud Platform is preferred. | ||
| 4.2 | Respondent must detail all additional software licenses that would be required to utilize the product/solution. | ||
| 4.3 | Provider solution must not incur additional software licensing expense. Provider solution must be a complete package. Solutions utilizing industry standard component applications such as MS SQL are preferred . | ||
| 4.4 | If and when a City owned software license for a component in the solution stack is viable for utilization to avoid additional software licensing expense, it is to be utilized. | ||
| 4.5 | If the suggested solution is to be implemented on the City Infrastructure, requirements for component resources from a virtualized hardware perspective are required. vCPU, Memory, Storage per server with an overall summary. | ||
| 4.6 | Respondent must detail out of the box solution vs customizable | ||
| Data Access and Reporting | |||
| 5.1 | In the event of geospatial information or services are hosted on ArcGIS Online by an entity outside of the city, the information and services must be transferable to City's ArcGIS Online and/or Portal environment. Same, when geospatial information is needed, the Solution should have the ability to use City GIS layers hosted on ArcGIS online and/or Portal to create geocoding for locations and administrative geographies provided by the City | ||
| 5.2 | The system must allow for exporting of data through an open, REST API to the City's data ingestion system or the Western Pennsylvania Regional Data Center, as needed. | ||
| 5.3 | Vendor shall provide data dictionary – to include - Full explanation for database fields, field types, number of characters, value ranges, relationship diagram(s) (database map) of the data model, and key fields, and fields used in relationships with other database tables. | ||
| 5.4 | The API provided by the system should include documentation that contains: Sample requests, headers and other relevant metadata, Clear, comprehensive descriptions of the data represented in the API, such as its output format (e.g., JSON or CSV), understandable by someone with a basic to intermediate familiarity with the system, Generated code snippets in some of the most popular programming languages (e.g., Python). API documentation should include details of specific encodings, documentation, data types, requests, and objects for the API. | ||
| 5.5 | Supports a dashboard with a login dependent views | ||
| 5.6 | Ability to provide trend analysis | ||
| 5.7 | Real-time Reporting - At least 150 configurable reports, real-time, and historical graphs | ||
| 5.8 | City must have full ownership and free access to data captured by the System, both during and after the contract period | ||
| 5.9 | Full API Access - All data created in vendor software must be made available via API | ||
| 5.1 | A general site user must have the ability to embed third party code (ex. Google Calendar) | ||
| 5.11 | Geospatial data must be compatible with ESRI systems and common geospatial data storage formats (.geojson, .dbf, .shp, .gdb) | ||
| 5.12 | Vendor to detail database optimization process | ||
| Miscellaneous | |||
| 6.1 | Companies from outside the United States are welcome to apply, provided they meet the standards as described above. | ||
| 6.2 | Remote meetings may be acceptable, with prior arrangement from the City. | ||
| 6.3 | Role-based Management - Access network maps, configuration, alerts, notifications, reporting, and management console | ||
| 6.4 | The system can accommodate separate instances for testing, training, staging and production | ||
| 6.5 | The vendor shall provide customer service support during the City of Pittsburgh's normal business hours. | ||
| 6.6 | The vendor shall provide "As-Built" documentation to the City of Pittsburgh representing the state of the application service at the time of Go-Live. | ||
| Project-Specific Technical Requirements (Mandatory) | |||
| 7.1 | Solution to run on multiple Windows platforms | ||
| 7.2 | Ability to support remote administration | ||
| 7.3 | Ability to export reports in common formats (PDF, Word, Excel) | ||
| 7.4 | Solution shall have built-in backup and restore capability | ||
| 7.5 | If solution hosts or utilized a source of data, solution must have built-in database maintenance and reporting tools | ||
| 7.6 | Vendor shall include a description of the system’s basic architecture | ||
| 7.7 | Vendor shall describe how the system handles multiple users, data concurrency control, record locking, and conflict resolutions | ||
| 7.8 | Vendor shall describe the hosting models (customer enviroment or vender enviroment) | ||
| 7.9 | Vendor shall describe if the solution servers can be virtualized (and if so, describe the system) | ||
| 7.1 | Vendor shall describe hardware requirements or recommendations | ||
| 7.11 | If applicable, describe how the solution can perform database maintenance, including, but not limited to, backup and upgrades without requiring system downtime | ||
| 7.12 | If applicable, describe the solutions ability to auto-discover targets on the network | ||
| 7.13 | If applicable, describe the solutions ability to monitor an application and its performance with agentless configurations where possible. | ||
| 7.14 | If applicable, describe the solutions ability to monitor user response time and throughput by location or other logical grouping. | ||
| 7.15 | If applicable, describe the solutions ability to drill down into the full | ||
| technical details on how the server and the browser interact with one another. | |||
| 7.16 | If applicable, describe the solutions ability to assemble an e-mail, with one click, that includes a complete user session with replay to provide additional information when triaging an incident. | ||
| 7.17 | Must support alerting and notifications by email, SMS, pager message, and HTTP | ||
| request | |||
| 7.18 | Vender must provide a visual of the solutions network Mapping, Network topology, subnets, devices, applications, and systems. | ||
| 7.19 | If applicable, solution should have configurable monitoring that identifys performance, passive, active, real-time, custom (scripted), monitoring templates, and bulk changes | ||
| 7.2 | If applicable, solution should have have predictive Alerting that is customizable and identifies up, down, and threshold (min/max), maintenance mode, device dependency, and escalation. | ||
| 7.21 | If applicable, solution must support, SNMP (supports SNMP V1, V2c and V3), WMI (Windows Management Instrumentation), HTTP based services, TCP and UDP based services including PING, Port, SMTP, POP3, FTP | ||
| Integration or API Requirements (Project-Specific - I&P review this section for relevance to each project/solitication ) | |||
| 8.1 | Ability to support two-way communication with Microsoft Outlook | ||
| 8.2 | Ability to integrate with payroll systems to include, but not limited to Ceridien TimePro version | ||
| 8.3 | Vendor shall describe if the system have built-in integration with other systems | ||
| 8.4 | Vendor shall describe if the system can import date from various formats (XML, CSV, TXT). | ||
| 8.5 | The vendor shall INTERACT with City specific applications (for example APRS, Firehouse, CYA, etc) | ||
| 8.6 | Solution allows for reading/writing of map services specifically created and published via ArcGIS for Server environment | ||
| 8.7 | Integrates with existing monitoring tools |
Functional (all bureaus)
| Requirement ID | Requirements | |
| (All of the items apply to any subcontractors that work on the solution. ) | System Capability | |
| (select from dropdown) | Comments: R= Required Functionality |
W = Wish List
| Functional Requirements | ||
| 1.1 | Compatible with Windows, Android and iOS with the same functionality | R |
| 1.2 | 24/7 direct customer support | R |
| 1.3 | Intergration with Alleghency County's Computer Aided Dispatching (CAD) system | |
| 1.4 | Mapping features that can be customized | R |
| 1.5 | Ability to notify all users simultaneously | R |
| 1.6 | Ability for users to respond to notification within application | R |
| 1.7 | HIPAA Compliant | R |
| 1.8 | Ability to customize response zones and individual units | R |
| 1.9 | Ability to manual update calls | R |
| 1.10 | Ability to Notify respoders of Changing assignments | R |
| 1.11 | Ability to Notify users via land line | R |
| 1.12 | Update Mapping data Immediatly/on the fly | R |
| 1.13 | Ability to manual Dispatch units | R |
| 1.14 | Ability to show dispatch times | R |
| 1.15 | Constant capabilities on mobile application and web versions | r |
| 1.16 | Ability to self-dispatch | r |
| 1.17 | Ability to sort and filter by type | r |
| 1.18 | Customizable Responses | r |
| 1.19 | Filtering of responses to show last response only | r |
| 1.20 | Ability to customize in the future to meet needs | r |
| 1.21 | Assignments need to default to a priority category | r |
| 1.22 | Hazard or response conditions | r |
| 1.23 | Ability to select assignments/response easily. Example: 1. BEAR 2. BearCat 3. Direct to Scene | w |
| 1.24 | Customizable Groupings for sending alerts | w |
| 1.25 | Ability to enter/edit incident type. | w |
| 1.26 | Ability to limit number of responses to assignments/responses | w |
| 1.27 | Ability to use on iPADs | w |
| 1.28 | Multiple channels: email, voice, text, mobile app, apps like Microsoft Teams or Slack | w |
| 1.29 | Ability to include custom branding and logos | r |
| 1.3 | Predefined templates by event type | r |
| 1.31 | Ability to customize messages | r |
| 1.32 | Ability to customize event types | r |
| 1.33 | Ability to import/create distribution groups | r |
| 1.34 | Ability for self-serve to add, modify, remove subscriptions | r |
| 1.35 | Two-way communication to confirm receipt of original alert/message | r |
| 1.36 | A mobile application on all platforms (Apple, Android, etc) |
▪ For access and use of all functionality
▪ For receiving alerts and sending confirmation / status updates
▪ A panic button for emergencies
| ▪ Ability to track location | w | ||
| 1.37 | Event management features besides mass communication and threat intelligence | w | |
| 1.38 | Playbook templates and ability to create your own runbooks | w | |
| 1.39 | Ability to create calendar entries and teleconferences | w | |
| Reporting: | |||
| 2.1 | Ability to generate reports | r | |
| 2.2 | Enhanced reporting capabilities with the ability to sort responses and copy/paste those responses to word document | r | |
| Intelligence: | |||
| 3.1 | Weather, traffic, crime, protests, construction | w | |
| 3.2 | Real-time alerts | r | |
| 3.3 | Historical trending data | w | |
| 3.4 | Ability to ingest other threat intel feeds or custom information | w | |
| 3.5 | Scenario simulations | ||
| Geospatial | |||
| 4.1 | Different types of maps | ||
| 4.2 | Different types of filters/views | ||
| 4.3 | Ability to import / add custom location, assets, and route information | ||
| 4.4 | Information on the refresh/update rate | ||
| 4.5 | Capability to download a static copy to laptop or mobile app | ||
| Administriative/Training : | |||
| 5.1 | Log records of access and all activities | ||
| 5.2 | A separate dev/test environment | ||
| 5.3 | Training and education materials | ||
| Misc. | |||
| 6.1 | A user community for benchmarking and sharing best practices | w | |
| 6.2 | Roadmap of future enhancements | r | |
| 6.3 | Advanced features such as AI/ML and chatbot capabilities | w | |
| Other Requirements from Non PS Departments (DOMI, DPW and PLI): | |||
| 7.1 | Option to push certain alert types to external (public) users | w | |
| 7.2 | Option to create user groups (ex: public safety, traffic, emergency utility work, etc) and/or for users to subscribe to different alert types | w | |
| 7.3 | Option to create user groups (ex: Forestry, Streets Divisions, Environmental Svcs, Parks and Facilities, etc) and/or for users to subscribe to different alert types | w |
index
| Core Capability |
| Configurable by Vendor |
| Configurable by City Staff |
| Requires Customization |
| Provided in Conjunction with a 3rd Party |
| Not Applicable |
File details come from the government source that posted it. Updated .