RFP_1100_LLM3010_ATT_8_v1.xlsx
XLSX spreadsheet 16 KB Posted
- Attached to
- Weather Services and Decision Dashboard
- Solicitation number
- RFP 1100 LLM3010
- Issued by
- Texas
About this file
This is a technical requirements attachment document for a Request for Proposal (RFP) issued by the State of Texas for a Weather Services and Decision Dashboard solution. The document outlines comprehensive technical specifications and compliance requirements that prospective vendors must address, organized into multiple sections covering security, records management, integration capabilities, and system reliability standards.
The requirements encompass critical functional areas including Section 508 ADA compliance, event logging in NCSA or W3C formats, and Texas Local Government Records Act adherence for records preservation, integrity, disposition, and retrievability. Security requirements mandate multi-factor authentication, role-based access control, FIPS 197 encryption standards for stored data, AES-128 or stronger encryption for data transmission, and support for token-based authentication with revocation lists. The document specifies requirements for audit logging, user session management, password management, and periodic independent security assessments. Additional sections address integration capabilities including support for CSV, XML, and JSON formats; standard technologies such as SOAP, HTTPS, REST, and MQTT; and compatibility with the organization's integration infrastructure. The solution must support high availability and fault tolerance, VMware ESXi virtualization, operational and implementation technical support from the vendor, emergency patches, and database documentation including architectural diagrams, data dictionaries, and physical data models. The document does not specify pricing terms, contract duration, renewal options, set-asides, incumbent information, or funding amounts within this attachment.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFP_1100_LLM3010_ATT_6_v1.xlsx | XLSX spreadsheet | |
| RFP_1100_LLM3010_ATT_3_v1.pdf | ||
| RFP_1100_LLM3010_ATT_1_v1.pdf | ||
| RFP_1100_LLM3010_ATT_9_v1.docx | DOCX document | |
| RFP_1100_LLM3010_ATT_12_v1.docx | DOCX document | |
| RFP_1100_LLM3010_ATT_5_v1.pdf | ||
| RFP_1100_LLM3010_ATT_11_v1.pdf | ||
| RFP_1100_LLM3010_ATT_7_v1.docx | DOCX document | |
| RFP_1100_LLM3010_ATT_2_v1.pdf | ||
| RFP_1100_LLM3010_ATT_10_v1.pdf | ||
| RFP_1100_LLM3010_ATT_4_v1.pdf |
Show all 11
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Technical Requirements Requirement No. Requirement APPLICABLE Meets Requirement?
Y - Yes, solution includes N - No, solution does not include
| C - Requires Customization | VENDOR'S COMMENTS | AE COMMENTS & ADDITIONAL NOTES |
| SEC.1 | Complies with Section 508 of the Rehabilitation Act (ADA Compliance). | |
| SEC.2 | Generates event logs in NCSA (National Center for Supercomputing Applications) or W3C extended or common log file format | |
| SEC.4 | Preservation. Application prevents the loss or unauthorized deletion of records before the expiration of their retention period as authorized by an approved records control schedule or with the written permission of the Texas State Library and Archives Commission. [ Texas Local Government Records Act §202.001(a) ] | |
| SEC.5 | Integrity.The Application prevents the unauthorized alteration of records before the expiration of their retention period and provide logs or audit trails that document edits and views of records. | |
| SEC.6 | Disposition. Application supports the systematic deletion of records upon expiration of their retention period as authorized by an approved records control schedule. and retains sufficient metadata present to identify records eligible for disposition based on defined triggering events and dates. | |
| SEC.7 | Duplicates. Application ensures all duplicates of a record, including convenience copies, are destroyed upon expiration of the retention period. Texas Rules of Evidence, Rule 1003. | |
| SEC.8 | Retrievability. Application ensures records are retrievable and available in an ASCII format until the expiration of their approved retention period. Texas Local Government Records Act §205.008(b). | |
| SEC.9 | Retrievability. Records stored on hosted platforms remain the property and responsibility of the City. Vendors is able to deliver records, in all requested formats and media, along with all finding aids and metadata, to the City at no cost when requested by an authorized City employee or when the contract is completed or terminated. Austin City Code §2-11-11. Hardware and software necessary to provide access to records must be retained until the expiration of the retention period; Sufficient metadata must be present to facilitate timely retrieval of records. | |
| SEC.10 | Holds. Application ensures specific records are not destroyed - even if their retention period has expired - if they are subject of known or reasonably anticipated litigation, public information request, audit, or other legal action. Texas Local Government Records Act §202.002, Austin City Code §2-11-11. | |
| SEC.11 | Records of Destruction Actions. Application creates records/ logs of destruction activity. Texas Local Government Records Act §203.046, Austin City Code §2-11-11. Destruction logs must (a) show a minimal set of metadata sufficient to uniquely identify the records purged; (b) show who approved and who executed destruction, and the dates on which the events took place; (c) reflect compliance with an approved, written standard operating procedure; and (d) be retained permanently. | |
| SEC.14 | Solution supports Multi factor authentication for passwords. | |
| SEC.15 | Supports role based access control for separation of administrative and user functions or access | |
| SEC.16 | Enables administrators to set a threshold for the number of invalid log-on attempts. | |
| SEC.17 | Permits administrators to configure the duration of the user's session, both active and inactive. | |
| SEC.18 | Allows for token-based authentication of end users for some tasks. token based authentication must respect a token revocation list. | |
| SEC.19 | Permits administrators to set a time-based threshold for a forced logoff of an idle session, releasing the session from application and system resources. | |
| SEC.20 | Complies with FIPS 197 stored data encryption requirements. | |
| SEC.22 | Authentication credentials are never stored or transmitted as plain text. Stored credentials are hashed using a secure hashing algorithm. | |
| SEC.24 | Data transmissions are encrypted with AES-128 or stronger cipher. | |
| SEC.25 | Allows end-users to change their active password. | |
| SEC.26 | Allows an administrator to require that end-users change their passwords at the next login or after predetermined length of time. | |
| SEC.27 | Supports configurable user security groups. Describe the granularity of access controlled by the system (e.g.,Administration, Security, application level, screen level, process level, data field level, record level, etc.). | |
| SEC.28 | Users may be assigned to multiple security groups, nested security groups, and the system allows user-specific security permissions. | |
| SEC.29 | Application is audited periodically by an independent application security assessment firm. List the percentage of issues corrected between the two most recent assessments for this application. | |
| SEC.30 | Provides exportable audit logs that maintain legal chain of evidence. Required information includes: access and modification records that include user, timestamp, element, and content if changed. Exportable files must adhere to a human readable format with defined structure (like JSON, CSV, etc.) | |
| SEC.31 | Implements sufficient access controls to protect from unauthorized access by requiring positive user identification prior to granting access to confidential or proprietary information. | |
| SEC.32 | Does the application contain data subject to regulatory protections or restrictions, such as PII, PCI, FACTA, CJIS, or NERC-CIP? | |
| SEC.33 | Requires authentication mechanisms outside AE username and password authentication (for example MFA, 3rd party, etc.). | |
| SEC.34 | Supports role-based authorization protocols like Active Directory, OAUTH, LDAP, or SAML mechanisms. | |
| SEC.40 | Provides or supports one or more Bulk Electric System (BES) Reliaibility Operating Services (as defined by NERC): |
- Dynamic Response to BES conditions
- Balancing Load and Generation
- Controlling Frequency (Real Power)
- Controlling Voltage (Reactive Power)
- Managing Constraints
- Monitoring & Control
- Restoration of BES
- Situational Awareness
- Inter‐Entity Real‐Time Coordination and Communication SEC.41 Provides service(s) and/or support for BES Critical Infrastructure devices/systems?
(i.e., electronic access control or electronic access monitoring, physical access control systems and devices, logging or monitoring systems, etc.)
| SEC.42 | BES Cyber System Information (BCSI) data is encrypted in 'transit' and at 'rest' |
| APP.1 | Product documentation includes Architectural diagrams illustrating relevant hardware and software components/ installation requirements/tiered aspects of technical solution. |
| APP.2 | Data Elements and associated Data Table keys for all data being used in interfaces and reporting is provided by the vendor |
| APP.3 | If application exposes data to AE, A complete database dictionary is provided that defines the contents of each table, record and field. |
| APP.4 | Physical data model is provided that includes referential integrity rules, constraints, keys, and indexes. |
| DFF.1 | Maintains data integrity in the case of unexpected shutdown (power failure, system crash). Describe scenarios where data could possibly be lost or corrupted in the system. What is the system recovery procedure in this case? |
| DFF.3 | Supports incremental and full backups. |
| INT.1 | Provides a software development kit (SDK) that enables creating interfaces to application functions and data. |
| INT.2 | Supports IEC CIM standard 61968. |
| INT.3 | Supports export in CSV format |
| INT.4 | Supports import of CSV format |
| INT.5 | Supports import in XML format. |
| INT.6 | Supports export of XML format. |
| INT.7 | Provides XML Schema's for all supported XML exchanges |
| INT.8 | Supports import of JSON format |
| INT.9 | All integration should leverage AE's integration infrastructure (Datapower, Tibco, Infosphere) |
| INT.11 | All integration leverage existing SOA artifacts (policies, web services, design patterns). The application interfaces (prebuilt or created by a development toolkit) shall be based on one or more of the following standard technologies: SOAP, HTTPS, JMS, REST, RPC, MQTT. |
| INT.12 | Supports YAML for Infrastructure as code (IAC) |
| AUTO.1 | Provides event based invocation of external integrations. |
| AUTO.2 | Any report can be generated on-demand or as a scheduled process. |
| AUTO.3 | Provides CLI / scriptable interface. |
| REUSE.3 | Can be virtualized on VMware ESXi. |
| RISK.1 | Supports certificate pinning |
| RISK.4 | Operational Technical support is available from the application vendor. |
| RISK.5 | Implementation Technical support is available from the application vendor. |
| RISK.6 | The vendor provides emergency patches and updates |
| RISK.7 | Application supports High Availability, Fault Tolerant, or redundant path connectivity. |
Data Validation
| Y |
| N |
| C |
File details come from the government source that posted it. Updated .