rfp_13227_att 1_business critical_information technology requirements.xlsx
XLSX spreadsheet 33 KB Posted
- Attached to
- RFP - BILLING AND COLLECTION FOR AMBULANCE TRANSPORTATION AND FIRE INSPECTION FEES SERVICES
- Solicitation number
- BPM013227
- Issued by
- California
About this file
This document is an Information Technology Requirements attachment for a Request for Proposal (RFP) issued by San Diego County Fire for Billing and Collection of Ambulance Transportation and Fire Inspection Fees Services. The RFP seeks a web-based solution that will integrate with the County's existing systems and infrastructure. The attachment outlines mandatory business-critical IT requirements that proposers must address in their responses, including security, compliance, data management, and system documentation standards. Proposers are required to state whether their solution meets each requirement and, if not, describe necessary modifications or additional work required. The County has indicated that it will favor responses substantially meeting the outlined IT requirements and reserves the right to deem exceptions material enough to render a proposal unacceptable.
The IT requirements encompass comprehensive security and data protection specifications, including Single Sign-On integration via SAML 2.0, OAuth 2.0, or WS-Federation; protection of personally identifiable information in accordance with federal and state regulations; US-based support and data processing; Endpoint Detection and Response software; encryption of data in transit and at rest using FIPS 140-3 validated cryptographic modules; and compliance with deprecated protocol restrictions. Additional requirements address trusted document management systems meeting County Chief Administrative Office Policy 0040-09, role-based access controls, prevention of hardcoded credentials and secrets in source code, web accessibility standards (WCAG 2.1 Level AA), and comprehensive documentation and training deliverables including online help systems, user guides, technical manuals, data models, and project-specific training materials for end users, super users, and support staff. The project also requires data extraction, transformation, and loading services from existing systems into the new solution.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| rfp_13227_full package.pdf | ||
| rfp_13227_att 2_detailed technical_information technology requirements.xlsx | XLSX spreadsheet | |
| rfp_13227_att 3_data security checklist.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Version Log
| Version | Date | Description |
| 1 | 7/5/18 | Initial draft |
| 2 | 7/13/18 | Updates from team review; remove Pricing and Customer References tabs. |
| 2.1 | 7/15/18 | Minor editing: instructions, vendor profile, and questionnaire worksheets |
(1) IT Requirements - Attach. 1 Request for Proposal (RFP) 13227 San Diego County Fire Billing And Collection For Ambulance Transportation And Fire Inspection Fees Services
Information Technology Requirements Business Critical
| Attachment 1 - Statement of Work | IT Review and Comments (Check / Complete as applicable) | |
| The following are business critical requirements that proposer must resond to. All Information Technology Requirements shall be incorporated as an Attachment to Exhibit A - Statement of Work. State Yes or No to indicate whether or not your solution will meet the requirement. If No, state what work is necessary to meet the requirement or how your solution will meet the requirements and the work necessary to meet the requirements - indicate costs if needed. Applicable product literature or technical documentation can be provided to support your response. |
The County will favor a response that substantially meets the Information Technology requirements outlined in this document. Should you take exception(s) to the requirements, you understand that the County may, as part of its evaluation process, conclude that exceptions are so material as to make the Offeror’s response to the solicitation unacceptable.
| Response # | Requirement Description | YES/NO | Vendor Response and Comments. | |
| Please describe how your product will comply with the requirement | Vendor response acceptable as stated | Vendor response acceptable as modified below (re-state) | Vendor No confirmation and comments can be reserved | |
| MR-1 | Solution shall support Single Sign On (SSO) integration with the County's external identity provider (IDP) via SAML 2.0, Open ID Connect (Oauth 2.0) or WS-Federation. County ID (ex: srwillam) is the standard claim attribute for SSO integration. County ID (ex: srwillam) is the standard claim attribute for SSO integration (CoSD ID will be used for the Claim ID, not email address). If using OAuth 2.0 vendor shall use Authorization Code flow, PKCE, and the State parameter. | |||
| MR-2 | The solution shall protect the privacy of customer personal identifiable information (PII) in accordance with Federal and State regulations. Please describe how the solution meets the requirements. | |||
| MR-3 | All support for the solution shall be provided from locations within the borders of the United States including customer service and non-client facing technology and infrastructure support personnel. | |||
| MR-4 | All data processed and stored by this solution shall only traverse networks contained within the borders of the United States. | |||
| MR-5 | Endpoint Detection & Response (EDR) or Anti-Malware protection software shall be installed on all systems supporting the solution. Please describe the specific software that the solution uses. | |||
| MR-6 | Solution shall support data in-transit encryption, including but not limited to: |
1. Client to server communications
2. Server to server communications
3. Database communications
4. API communications
5. List any unencrypted data-in-transit instances the solution requires MR-7 The solution shall support data encryption for all data at rest including:
1. Disk level encryption
2. Database/Storage/Share Encryption
3. File level encryption
| MR-8 | Contractor shall provide dedicated internet protocol addresses and URLs for the County implementation (not multi-tenant) to use County DNS (not re-direct to the contractor environment). This will enable the use of County DNS and security standards such as 24/365 DNS availability, Web Application Firewall, Geo-blocking, Security Monitor, Client Reputation, IP Allow/Deny lists, Bot Management, Dynamic Site Accelerator, DDOS defense, primary and secondary DNS services, and interface to internal DNS services. |
| MR-10 | Solution shall be a web browser based application on a browser version supported by the leading browser market share vendors (e.g. Google Chrome, Microsoft Edge, Apple Safari, etc). |
| MR-11 | The solution product development teams shall not have access to production infrastructure and/or production data. |
| MR-12 | All application and system integration credentials shall be integrated with the County's external identity provider including: |
a. Application Service to Application Service credentials
b. Application Service to Database credentials
c. API credentials MR-13 The solution must prevent the following items from being stored/hardcoded within the source code:
1. Passwords
2. API keys
3. Certificates
4. Tokens
5. Hashes
6. Anything considered secret
| MR-14 | Solution shall support role-based access (RBAC) incorporating the principle of least privilege. | |
| MR-15 | All cryptographic functions performed within the solution (e.g., data encryption, key management, hashing, digital signatures) shall utilize FIPS 140-3 validated cryptographic modules. Any cryptographic module employed for data-in-transit or data-at-rest encryption, as well as authentication protocols, shall meet or exceed the requirements as defined in NIST FIPS 140-3 (Security Requirements for Cryptographic Modules) and NIST SP 800-131Ar2 (Transitioning the Use of Cryptographic Algorithms and Key Lengths). | |
| MR-16 | All solutions, systems, and applications within the environment shall not use the following deprecated or legacy protocols and ciphers, due to known security vulnerabilities and/or insufficient cryptographic protection: | |
| • | SSLv2.0/SSLv3.0 | |
| • | TLS 1.0/TLS 1.1 | |
| • | SMBv1/SMBv2 | |
| • | LM/NTLMv1/NTLMv2 | |
| • | FTP without TLS | |
| • | SSHv1 | |
| MR-17 | Contractor shall meet the following requirements for a trusted system wherein County official records are only maintained in digital format as determined by County Chief Administrative Office Policy 0040-09, to meet compliance with the associated record retention schedule (County will provide specific retention schedule for the records): |
A trusted document management system ensures that all electronically stored information can be considered to be a true and accurate copy of the original information received regardless of the original format. The trusted document management system must ensure that at least two (2) separate copies of the electronically stored information are created meeting, at a minimum, all the following conditions:
(a) The trusted document management system must utilize both hardware and media storage methodologies to prevent unauthorized additions, modifications or deletions during the approved lifecycle of the stored information
(b) The trusted document management system must be verifiable through independent audit processes ensuring that there is no plausible way for electronically stored information to be modified, altered, or deleted during the approved information lifecycle
(c) The trusted document management system must write at least one copy of the electronic document or record into electronic media that does not permit unauthorized additions, deletions, or changes to the original document and that is to be stored and maintained in a safe and separate location. (d) The trusted document management systems incorporate not only technology, but also require adherence to organizational policies ensuring proper electronic document or record handling, processing as required by the organization (typically documented in the record retention policy and schedule) and electronic document management software or application components MR-18 All reporting or application systems that generate electronic documents for public use shall ensure the content is accessible. Vendors must consider HTML or other web-based formats as the default. If PDFs are necessary, they must meet WCAG 2.1 Level AA standards and comply with Title II of the ADA.
Project Req
| Requirement Number | Requirement Description | Supported | Comments |
| Project requirements | |||
| System Documentation Requirements | |||
| T-230 | Online help on system functionality is to be a component of the online system | ||
| T-231 | Online help can be searched based on screen, job function, process name, nouns so that user can find help by topic | ||
| T-232, P-165 | System documentation includes product user guides | ||
| T-233 | System documentation includes technical manuals | ||
| T-234 | System documentation includes data model, tables and attributes | ||
| T-235 | System documentation can be exported into a format that can be annotated electronically and then stored, i.e. product documentation does not need to be re-typed to create custom training material or custom business process documentation | ||
| T-236 | System documentation is available in electronic format that may be stored on county computers | ||
| T-238 | Custom documentation on business processes is developed as part of the project | ||
| T-239 | Custom documentation on configurations and customization made to base product are developed as part of the project | ||
| T-240 | Custom documentation on installation procedures for configurations, customization are developed as part of the project |
| System Training Requirements | |
| T-241 | Training materials need to be accessible online and indexed by job function or process name. |
| T-242, P-166 | Training materials include detail user steps to complete job functions. |
| T-243 | Training materials are provided in electronic format. |
| T-244 | Training class are defined, materials written, classes conducted for end user training, super user training and system application support staff are developed as part of the project |
| WW-189 | Training will be hands-on practical on the installed system, using helpful training documents. |
| Data Extraction, Data Conversion, Data Loading | ||
| T-245 | Data from existing EAM systems, custom Access databases, and excel spreadsheets is extracted, transformed and loaded into new EAM as part of the project | With error messaging on load problems |
| T-246 | Defining the data mapping from existing EAM data sources into the new EAM system is part of the project | |
| WW-190 | Data conversion services as required to transfer existing County data into the new EAM. |
&"Arial,Bold"&14&A
&"Times New Roman,Italic"&11Functional Requirements Page &P of &N &"Times New Roman,Italic"&11&D
&"Times New Roman,Italic"&11Functional Requirements Page &P of &N &"Times New Roman,Italic"&11&D
&"Times New Roman,Italic"&11Functional Requirements Page &P of &N &"Times New Roman,Italic"&11&D
File details come from the government source that posted it. Updated .