rfp_13365_attachment 1_it requirements_business critical.xlsx
XLSX spreadsheet 34 KB Posted
- Solicitation number
- BPM013365
- Issued by
- California
About this file
This is an Information Technology Requirements document for a Request for Proposals (RFP 13365) issued by the San Diego County Probation Department for Artificial Intelligence Report Writing Services. The document establishes business-critical IT requirements that all proposers must address as part of their solution submissions. The requirements are organized into mandatory compliance standards covering security, infrastructure, data management, and system architecture that vendors must acknowledge with Yes or No responses, along with detailed explanations of how their proposed solutions will meet each requirement or what modifications would be necessary.
The IT requirements encompass seventeen major categories spanning single sign-on integration via SAML 2.0 or OAuth 2.0, personally identifiable information protection, domestic support and data residency within United States borders, endpoint detection and malware protection, data encryption in transit and at rest, dedicated infrastructure with county DNS integration, web browser-based application compatibility, role-based access controls, FIPS 140-3 validated cryptographic modules, prohibition of deprecated protocols, trusted document management systems compliant with county record retention policy, and accessibility standards for electronic documents meeting WCAG 2.1 Level AA and ADA Title II requirements. Additional project requirements address system documentation, online help functionality, user training materials and delivery, data extraction and conversion services from existing systems, and technical support documentation for configurations and customizations developed during implementation.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| rfp_13365_full package.pdf | ||
| rfp_13365_attachment 3_data security checklist.xlsx | XLSX spreadsheet | |
| rfp_13365_attachment 5_rfp additional submittals.xlsx | XLSX spreadsheet | |
| rfp_13365_attachment 2_it requirements_detailed technical.xlsx | XLSX spreadsheet | |
| rfp_13365_attachment 4_fbi cjis security policy requirements.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Version Log
| Version | Date | Description |
| 1 | 7/5/18 | Initial draft |
| 2 | 7/13/18 | Updates from team review; remove Pricing and Customer References tabs. |
| 2.1 | 7/15/18 | Minor editing: instructions, vendor profile, and questionnaire worksheets |
IT Requirements - Attach. 1
REQUEST FOR PROPOSALS (RFP 13365)
PROBATION DEPARMENT
ARTIFICIAL INTELLIGENCE (AI) REPORT WRITING SERVICES
Information Technology Requirements Business Critical
| Attachment 1 - Statement of Work | IT Review and Comments (Check / Complete as applicable) | |
| The following are business critical requirements that proposer must resond to. All Information Technology Requirements shall be incorporated as an Attachment to Exhibit A - Statement of Work. State Yes or No to indicate whether or not your solution will meet the requirement. If No, state what work is necessary to meet the requirement or how your solution will meet the requirements and the work necessary to meet the requirements - indicate costs if needed. Applicable product literature or technical documentation can be provided to support your response. |
The County will favor a response that substantially meets the Information Technology requirements outlined in this document. Should you take exception(s) to the requirements, you understand that the County may, as part of its evaluation process, conclude that exceptions are so material as to make the Offeror’s response to the solicitation unacceptable.
| Response # | Requirement Description | YES/NO | Vendor Response and Comments. | |
| Please describe how your product will comply with the requirement | Vendor response acceptable as stated | Vendor response acceptable as modified below (re-state) | Vendor No confirmation and comments can be reserved | |
| MR-1 | Solution shall support Single Sign On (SSO) integration with the County's external identity provider (IDP) via SAML 2.0, Open ID Connect (Oauth 2.0) or WS-Federation. County ID (ex: srwillam) is the standard claim attribute for SSO integration. County ID (ex: srwillam) is the standard claim attribute for SSO integration (CoSD ID will be used for the Claim ID, not email address). If using OAuth 2.0 vendor shall use Authorization Code flow, PKCE, and the State parameter. | |||
| MR-2 | The solution shall protect the privacy of customer personal identifiable information (PII) in accordance with Federal and State regulations. Please describe how the solution meets the requirements. | |||
| MR-3 | All support for the solution shall be provided from locations within the borders of the United States including customer service and non-client facing technology and infrastructure support personnel. | |||
| MR-4 | All data processed and stored by this solution shall only traverse networks contained within the borders of the United States. | |||
| MR-5 | Endpoint Detection & Response (EDR) or Anti-Malware protection software shall be installed on all systems supporting the solution. Please describe the specific software that the solution uses. | |||
| MR-6 | Solution shall support data in-transit encryption, including but not limited to: |
1. Client to server communications
2. Server to server communications
3. Database communications
4. API communications
5. List any unencrypted data-in-transit instances the solution requires MR-7 The solution shall support data encryption for all data at rest including:
1. Disk level encryption
2. Database/Storage/Share Encryption
3. File level encryption
| MR-8 | Contractor shall provide dedicated internet protocol addresses and URLs for the County implementation (not multi-tenant) to use County DNS (not re-direct to the contractor environment). This will enable the use of County DNS and security standards such as 24/365 DNS availability, Web Application Firewall, Geo-blocking, Security Monitor, Client Reputation, IP Allow/Deny lists, Bot Management, Dynamic Site Accelerator, DDOS defense, primary and secondary DNS services, and interface to internal DNS services. |
| MR-9 | Solution shall be a web browser based application on a browser version supported by the leading browser market share vendors (e.g. Google Chrome, Microsoft Edge, Apple Safari, etc). |
| MR-10 | The solution product development teams shall not have access to production infrastructure and/or production data. |
| MR-11 | All application and system integration credentials shall be integrated with the County's external identity provider including: |
a. Application Service to Application Service credentials
b. Application Service to Database credentials
c. API credentials MR-12 The solution must prevent the following items from being stored/hardcoded within the source code:
1. Passwords
2. API keys
3. Certificates
4. Tokens
5. Hashes
6. Anything considered secret
| MR-13 | Solution shall support role-based access (RBAC) incorporating the principle of least privilege. | |
| MR-14 | All cryptographic functions performed within the solution (e.g., data encryption, key management, hashing, digital signatures) shall utilize FIPS 140-3 validated cryptographic modules. Any cryptographic module employed for data-in-transit or data-at-rest encryption, as well as authentication protocols, shall meet or exceed the requirements as defined in NIST FIPS 140-3 (Security Requirements for Cryptographic Modules) and NIST SP 800-131Ar2 (Transitioning the Use of Cryptographic Algorithms and Key Lengths). | |
| MR-15 | All solutions, systems, and applications within the environment shall not use the following deprecated or legacy protocols and ciphers, due to known security vulnerabilities and/or insufficient cryptographic protection: | |
| • | SSLv2.0/SSLv3.0 | |
| • | TLS 1.0/TLS 1.1 | |
| • | SMBv1/SMBv2 | |
| • | LM/NTLMv1/NTLMv2 | |
| • | FTP without TLS | |
| • | SSHv1 | |
| MR-16 | Contractor shall meet the following requirements for a trusted system wherein County official records are only maintained in digital format as determined by County Chief Administrative Office Policy 0040-09, to meet compliance with the associated record retention schedule (County will provide specific retention schedule for the records): |
A trusted document management system ensures that all electronically stored information can be considered to be a true and accurate copy of the original information received regardless of the original format. The trusted document management system must ensure that at least two (2) separate copies of the electronically stored information are created meeting, at a minimum, all the following conditions:
(a) The trusted document management system must utilize both hardware and media storage methodologies to prevent unauthorized additions, modifications or deletions during the approved lifecycle of the stored information
(b) The trusted document management system must be verifiable through independent audit processes ensuring that there is no plausible way for electronically stored information to be modified, altered, or deleted during the approved information lifecycle
(c) The trusted document management system must write at least one copy of the electronic document or record into electronic media that does not permit unauthorized additions, deletions, or changes to the original document and that is to be stored and maintained in a safe and separate location. (d) The trusted document management systems incorporate not only technology, but also require adherence to organizational policies ensuring proper electronic document or record handling, processing as required by the organization (typically documented in the record retention policy and schedule) and electronic document management software or application components MR-17 All reporting or application systems that generate electronic documents for public use shall ensure the content is accessible. Vendors must consider HTML or other web-based formats as the default. If PDFs are necessary, they must meet WCAG 2.1 Level AA standards and comply with Title II of the ADA.
Version & Contact Last Updated: 5/5/26 v2.9
| Contact: | David Lindsay - david.lindsay@sdcounty.ca.gov |
| Melanie Caramat - melanie.caramat@sdcounty.ca.gov |
Project Req
| Requirement Number | Requirement Description | Supported | Comments |
| Project requirements | |||
| System Documentation Requirements | |||
| T-230 | Online help on system functionality is to be a component of the online system | ||
| T-231 | Online help can be searched based on screen, job function, process name, nouns so that user can find help by topic | ||
| T-232, P-165 | System documentation includes product user guides | ||
| T-233 | System documentation includes technical manuals | ||
| T-234 | System documentation includes data model, tables and attributes | ||
| T-235 | System documentation can be exported into a format that can be annotated electronically and then stored, i.e. product documentation does not need to be re-typed to create custom training material or custom business process documentation | ||
| T-236 | System documentation is available in electronic format that may be stored on county computers | ||
| T-238 | Custom documentation on business processes is developed as part of the project | ||
| T-239 | Custom documentation on configurations and customization made to base product are developed as part of the project | ||
| T-240 | Custom documentation on installation procedures for configurations, customization are developed as part of the project |
| System Training Requirements | |
| T-241 | Training materials need to be accessible online and indexed by job function or process name. |
| T-242, P-166 | Training materials include detail user steps to complete job functions. |
| T-243 | Training materials are provided in electronic format. |
| T-244 | Training class are defined, materials written, classes conducted for end user training, super user training and system application support staff are developed as part of the project |
| WW-189 | Training will be hands-on practical on the installed system, using helpful training documents. |
| Data Extraction, Data Conversion, Data Loading | ||
| T-245 | Data from existing EAM systems, custom Access databases, and excel spreadsheets is extracted, transformed and loaded into new EAM as part of the project | With error messaging on load problems |
| T-246 | Defining the data mapping from existing EAM data sources into the new EAM system is part of the project | |
| WW-190 | Data conversion services as required to transfer existing County data into the new EAM. |
&"Arial,Bold"&14&A
&"Times New Roman,Italic"&11Functional Requirements Page &P of &N &"Times New Roman,Italic"&11&D
&"Times New Roman,Italic"&11Functional Requirements Page &P of &N &"Times New Roman,Italic"&11&D
&"Times New Roman,Italic"&11Functional Requirements Page &P of &N &"Times New Roman,Italic"&11&D
File details come from the government source that posted it. Updated .