RFP 2025_008 Recreation Management Software f.pdf

RFP# 2025-008

Recreation Management Software for CRPA

THE PROJECT: The Cherokee County Board of Commissioners Purchasing Department (County) is requesting competitive sealed proposals to provide a comprehensive, cloud-based Recreation Management Software system in support of the Cherokee Recreation and Parks Agency (CRPA). The solution will support multiple functionalities, including program registration, payment processing, point-of-sale (POS) operations, league management, facility reservations, and integration with the PlayCherokee.org website. This procurement is intended to replace an expiring contract, with a desired go-live before September 25, 2025.

The ideal solution will enhance user experience, improve operational efficiency, and provide robust reporting capabilities and meet the specifications and as described herein.

There will not be a “pre-bid” meeting to review the requirements.

All times in the solicitation are local times to Cherokee County, Georgia in the Eastern Time Zone.

This Request for Proposals is one of two documents making up this solicitation. The second document is Cherokee County Standard Solicitation Terms and Conditions, which contains all the standard forms potentially required to accompany a submission. Both of these documents together constitute the entire solicitation at the time of issuance.

The County reserves the right to reject any or all bids/proposals, to waive technicalities and to make a selection and final award as deemed to be in the best interest of the County, including using any form of contract it deems most advantageous to the County.

SCHEDULE: (ONLY BOLDED ITEMS WILL REQUIRE AN ADDENDA TO CHANGE. OTHER DATES ARE SUBJECT TO CHANGE WITHOUT NOTICE)

Issued 12/4/24

Questions Due 12/16/24 5 pm

Answers Due 12/18/24

Bids/Proposals Due 1/10/25 10 am

Anticipated Award Date 2/18/25

Cherokee County Board of Commissioners Purchasing Department

1130 Bluffs Parkway, Canton, GA 30114 Phone: (678) 493-6000

Fax: (678) 493-6035

REQUEST FOR PROPOSALS

Solicitation Requirements & Instructions, RFP 2025-008

THE EXPECTED PERIOD OF PERFORMANCE:

The base period of performance is broken down into two areas; Procurement of Product(s) and Service Delivery. This is a function of the Statement of Work (SOW) and/or specification and reflects if there is physical item or items to be delivered and / or delivery of services. An X in the box corresponding to item 1 below, Physical Delivery indicates a physical item or items are to be delivered and an X in the 2. Delivery of Services indicates that Services are to be performed. Either or both may apply to the work contemplated by this solicitation.

Additionally, should there be an X in the box corresponding item 3. Option Grant, then the County requests the right to extend the period of performance beyond the Base Rate as specified.

1. NO PHYSICAL ITEMS/GOODS PHYSICAL DELIVERY OF ITEMS/GOODS REQUIRED:

For Physical Delivery solicitations, the period of performance for an award shall begin with either the placement of Purchase Order or the date indicated on the Agreement. All items to be delivered are to be FOB Cherokee County at the address indicated in the solicitation.

Performance shall be complete upon final acceptance by the County. Time is of the essence for the delivery of each item specified. Warranty requested as below:

Warranty Term Requested: ____

2. No SERVICES REQUIRED PERFORMANCE OF SERVICES:

For Performance of Services solicitations, the period of performance shall begin with the placement of either a Purchase Order or the date of the Agreement unless the Agreement, the SOW or the Solicitation Terms indicate that performance shall begin upon the issuance of a Notice to Proceed (NTP), in which case the NTP would represent the beginning of performance. Term of services requested are as below:

Services Term:

One Year Two Years Three Years Other: Five Years (inclusive of all renewals)

3. OPTION GRANT:

This solicitation contains requested options; please see Statement of Work for details.

SUBMITTAL INSTRUCTIONS:

Interested Bidders/Proposers should carefully review the requirements defined herein and provide complete and accurate submissions that should include the following items (only items indicated with an “X” in the corresponding boxes are required for this solicitation):

Information and Addenda Acknowledgement Form (Appendix A) Non-Influence and Non-Collusion Affidavit (Appendix B) E-Verify Affidavit (Appendix C) References* (Appendix D) Acceptance of County’ Standard Agreement**, as below: (Appendix E)

Professional Services Agreement (Sample provided) Construction Services Agreement (Sample Provided)

Architectural & Engineering Services Agreement (Sample Provided) Other:

Certification Regarding Debarment, Suspension, and Other Responsibility Matters Primary Covered Transactions (Appendix F)

Contractor’s License Certification (Appendix G) Bonds Requirements if the price bid > $100K

Ability to Provide Performance, Labor & Matl. Payment Bond (Appendix H) Bid Bond (See Appendix I)

Evidence of/ability to provide Insurance at the limits identified herein,*** Certifications, Licenses or Registrations as required by law and/or as requested Pricing on Proposer’s Company Letterhead Pricing on included pricing sheet / bid form Contractor’s Qualifications Statement (Appendix J) Added Terms to Construction Service Agreement (Attachment) Substitutions Proposed: See Instructions Standard Solicitation Terms****, Item 9 Any other requirements as requested under the scope of work

Notes:

*The County reserves the right to contact not only those references provided, but may also use previous performance for the County, other contacts it identifies and other sources of information believed to be viable to evaluate capability, viability and performance.

**If Acceptance of County’s Standard Agreement is checked, all work/items defined herein are to be quoted according to these requirements. Copies of these agreements can be located at the County’s Procurement web page.

***Insurance levels requested are those identified in the County’s Standard Agreement, section “I.”

****Standard Solicitation Terms Refer to Cherokee County Standard Solicitation Terms and Conditions

EVALUATION CRITERIA:

Bids/Proposals that contain options or additive work above and beyond the base bid will be evaluated financially according to the criteria described in the solicitation. However, should the use of options or additive work proposed exceed the County budget, the County retains its rights to address such situations as described in its Standard Terms For Bid and Proposal Solicitation as well as the right to award based on the base bid only or the base bid plus quoted additive work that is within its budget.

Bids determined to be Responsive and Responsible will be ranked based Bid Form Criteria.

OR

Proposals determined to be Responsive and Responsible will be evaluated on the following criteria:

Pass/Fail Criteria

Licensing and Certifications Contractor must provide all required software licenses and compliance certifications (e.g., HIPAA, PCI- DSS). Contractor must demonstrate that the proposed software and all associated public-facing components comply with Section 508 and WCAG 2.1 Level AA standards as evidenced by VPAT or other approved Accessibility Conformance Report.

Cloud-Based Hosting Proposed system must be fully cloud-based and hosted in U.S.-based, federally compliant data centers.

Mandatory Reporting and Functionality

1. Reports: The solution must have the ability to run a revenue report by g/l code.

2. Bank Transmittals: For bank transmittal, the solution must provide an identifiable way to determine the deposit/ach transfer belongs to Parks.

Integration In addition to ensuring that the proposed solution integrates and works seamlessly with all proposed subsystems, the solution must integrate with the following required systems:

1. PlayCherokee.org

2. Program/processor must be able to electronically transfer funds daily to Wells Fargo bank.

3. Web applications must be compatible with and align with Edge’s security configurations and policies.

Chrome compatibility will also be validated.

4. Solution must allow the application to utilize County Entra environment for Single-Sign on / MFA.

Data Security

1. Vendor must meet NIST and HIPAA security standards, as well as County Security standards.

Implementation Timeline Must provide a realistic implementation plan that ensures go-live readiness by September 25, 2025.

Scored Evaluation Criteria

Weighting Evaluation Criteria

35% System Functionality and Technical Architecture 15% Implementation, Data Migration, and Vendor Experience 15% Support, Maintenance, Training, and Demonstrations 15% System Performance and Availability 20% Cost and Total Cost of Ownership

Evaluation Criteria Detail

Address (respond to or provide) each Key Element in your proposal.

1. System Functionality and Technical Architecture (35%)

This criterion evaluates the proposed system’s core functionality and technical design. It ensures the solution meets the County’s needs for program registration, pass management, POS, league management, facility reservations, and web hosting. Additionally, the offeror must demonstrate these features during system demonstrations should they be called in for demonstrations.

Key Elements:

• Core functionalities: registration, passes, POS, facility reservations, league management.

• Cloud-based system, mobile compatibility, and browser support. Provide a comprehensive list of browsers that you are most compatible with.

• Description/Demonstration of key system features, including ease of use, navigation, and overall functionality during live demos. Provide descriptions in initial proposal, and demonstrate if called in for demonstrations.

2. Implementation, Data Migration, and Vendor Experience (15%)

This criterion assesses the offeror’s approach to system implementation and data migration, as well as their relevant experience with similar projects. Interviews will be used to gauge their understanding of project risks and their ability to address challenges.

Key Elements:

• Phased implementation plan, including risk mitigation and detailed timelines.

• Data migration plan ensuring minimal disruption and schedule for completion.

• Scalability to accommodate future growth (e.g., more users, facilities, and transactions).

• Offeror’s Past Performance on similar government projects.

o Five reference projects demonstrating past performance. These references should be included in Appendix D, with an attachment to Appendix D expanding on the information provided in Appendix D to include relevant project descriptions, approximate cost, functionalities, and role of the Proposer.

3. Support, Maintenance, Training, and Demonstrations (15%)

This criterion evaluates the offeror’s ability to provide ongoing technical support, regular system maintenance, and comprehensive training for County staff. Demonstrations will focus on ease of training and support processes.

Key Elements:

• 24/7 technical support, including web-based assistance, phone support, and remote diagnostics.

• Defined SLAs for issue resolution and maintenance.

• Regular system updates and security patches.

• Training for up to 30 internal users, including training materials and hands-on environments.

4. System Performance and Availability (15%)

This criterion measures the solution’s reliability and responsiveness. It focuses on uptime, response times for key system functions, and error management. Additionally, it evaluates tools for monitoring system performance and reporting key performance indicators (KPIs).

Key Elements:

• Uptime and availability: minimum 99.9% uptime per month.

• Performance benchmarks: record search, transaction response, and report generation times.

• Error logging and customizable error reporting.

• Real-time system monitoring dashboards and KPI reporting.

6. Cost and Total Cost of Ownership (20%)

This criterion evaluates the overall cost-effectiveness of the solution, including initial implementation costs, licensing fees, transaction fees, and ongoing maintenance. Cost will also consider optional modules or additional services.

Key Elements:

• Transparent pricing, including initial setup, licensing, and transaction fees.

• Total cost of ownership over the 5-year contract period.

Second-Round Evaluation: Demonstration and Interview

Demonstrations and Interviews at the discretion of the Evaluation Committee, remote demonstrations and/or interviews may serve as a second-round evaluation component for shortlisted offerors. These sessions allow evaluators to adjust scores from their initial evaluation based on information obtained through demonstrations, interviews, and reference project information, including the following items which will be explored during demonstrations and Interviews:

• Validate system functionality and user experience in real-time.

• Assess how the offeror addresses County-specific needs (e.g., unique workflows, data migration challenges).

• Evaluate the offeror’s team, project management approach, and understanding of County requirements through interviews.

• Second round Interviews may explore lessons learned from past projects and strategies for handling potential implementation challenges.

• Demonstrations of the support interface, training modules, and help documentation.

• Interviews to assess the offeror’s readiness to provide personalized support and ongoing improvements.

References may be contacted should the evaluation team deem them necessary.

Proposals will be scored on the above evaluation criteria. Failure to provide information necessary to evaluate proposal (particularly the “key elements” requested above for evaluation), may result in a lower scoring proposal.

The County reserves the right to reject the offer of any vendor who has previously failed to perform properly or complete on time contracts of a similar nature, or who upon investigation shows is not in a position to perform the contract.

HOW AND WHERE TO SUBMIT BIDS AND PROPOSALS:

The County has two methods for receiving bids and proposals that are mutually exclusive; either electronically or by physical receipt. The box with the “X” below indicates how and where bids or proposals are to be submitted. The County will NOT accept proposals by fax, or e-mail unless authorized, in writing, by the Procurement Director. The solicitation submission deadline will be strictly enforced; no late bids/proposals will be accepted for any reason, please plan accordingly.

A. Electronic Submissions Only:

Bids and Proposals are to be submitted electronically ONLY to BidNet Direct. Physical copies are not to be submitted unless approved in advance by the Purchasing Director.

Proposals and all requested documentation to be provided electronically should in the Adobe Portable Document Format (PDF) as ONE file unless otherwise indicated in these solicitation instructions. Documents provided in response to this solicitation are to be named according to the following naming convention:

a. [Solicitation Number]_[Vendor Name]_[Document Type] Example: “2017-111_ABC Company_Proposal”

QUESTIONS/ADDENDA:

Only written inquiries will be permitted during the solicitation period. Questions are to be submitted via BidNet Direct for this solicitation no later than the date and time indicated in the Schedule, as may be amended. Answers will be posted via formal Addendum and only released as part of the solicitation documents on BidNet Direct. All interested parties are instructed to monitor BidNet Direct on a regular basis throughout the solicitation period. The final date for posting of Addenda is per the Schedule, as may be amended.

STATEMENT OF WORK AND / OR SPECIFICATION LOCATED ON THE NEXT PAGE

STATEMENT OF WORK AND / OR SPECIFICATION:

STATEMENT OF WORK:

The Cherokee County Recreation and Parks Agency is seeking a comprehensive, web-based

Recreation Management Software system for webpage hosting of the playcherokee.org website as well as integration and software management of program registration, passes, point of sale, league management and facility reservations.

The County anticipates entering into an agreement with one company to provide all aspects of the webhosting, management and point of sale transactions for a total potential contract period of five years, inclusive of automatic annual renewals.

Listed below are current general offerings, options, and descriptions that provide an overview of the departments use case. The list is not comprehensive, and the offeror should address its scalability both in volume and type of offerings, using the lists below as a general current use description.

CRPA program offerings:

• Dance

• Karate

• Camp

• Swim Lessons

• Aerobics

• Senior Trips

• Therapeutic classes/activities

• Year Round and Summer Swim team

Pass options:

• Annual / Monthly memberships

• 3 month

• Seasonal Pool Passes

• Punch passes for Aerobics

• Daily

Point of Sale options:

• Daily Admissions

• Resale

• Brick Sales

• Party Packages

• Lease / cleanup / setup

• Boat Passes

• T-Shirts

Facility Reservation options:

• Internal scheduling for programs and leagues

• External facilities for pavilions, cabanas, and splash pad party

League Management:

• Capability for up to 5,000 single youth league participants, 500 teams, and up to 30 facilities

• Ability to schedule tournament brackets of up to 250 teams

Webpage hosting:

• Ability to host webpage

• Recovery of webpage should there be an issue

• Integration of product to the website

Reporting:

• Allocate revenue to GL Codes

• Provides reports for programs (rosters, head counts for classes, sign in/out for camps)

• Provides revenue reports

Support and Training:

• Provide 24/7 customer support

• Provide support

• Provide training for up to 30 internal users

Data Migration:

• Data shall be moved from current platform to the new platform

• Migration must be completed within 30 days of initiation, if data is comparable

• Personalized support during Data Migration phase

System Capabilities:

• Ability to assign roles to internal users with varying levels of access

Software must be able to:

• Provide a mobile Site for cell phones and tablets

• Be a cloud based software

• Process online payments for customers

Other Requirements:

• If using other teams/companies to support all the functions needed for our requirements, please list company name, address, and contact person.

General Characteristics of Products and Services

For the purposes of the RFP, County employee customers/users of the software are referred to as the internal user and customers accessing the software through the County’s website are referred to as the external user.

1. Describe the fundamental design of the software application to include the database structure, connectivity and the method of data entry/user interface.

2. Describe your implementation services, with particular emphasis on planning, conversion and process change management. Provide a sample incremental plan.

3. Provide a list of at least 3 current customers using your product in a similar capacity.

4. Identify issues and challenges the County might anticipate in this software implementation and indicate how they are resolved using your system and services.

5. Describe any available technical support services and each associated cost for the internal user.

If there are different levels of support services, please describe each level and list the services included. At a minimum support should include:

a) Web-based technical assistance

b) Phone support during business hours and non-business hours

c) Remote diagnostics

d) Training opportunities (upon implementation and updates)

6. Provide an outline that the internal user would follow in the below situations:

a) Reporting a problem with the software

b) Obtaining instruction/clarification on a specific system feature

c) Requesting customized reports or services

d) Obtaining technical assistance in making changes in the system coding to achieve a specific objective

e) Requesting additional instruction or on site services

7. Provide an outline that the internal user would follow in the below situations:

a. Reporting a problem with the software

b. Reporting a problem with the user account or log in

8. Proposing Company shall, in its proposal, include:

a. Detailed pricing, all pricing that makes up the total cost must be itemized;

b. all charges that would occur with each transaction for the Agency and for the end user, all will be considered part of the total price as our consumer bears the cost of this product;

c. implementation fees for the product;

d. league management fees if separate from the company’s product;

e. web hosting cost if separate from company’s product; and

f. preferred method of payment (yearly, quarterly or monthly).

RFP 2025-008: Recreation Management Software for Cherokee

County Recreation and Parks Agency

TECHNICAL REQUIREMENTS

General Technical Requirements:

• Provide a description and diagram of the Proposing Company's proposed technical architecture.

Include all database/web/networking hardware, software, tools, and if hosted, information on the data center where the solution is hosted.

• If the Proposing Company's proposed solution requires any data to be stored off-site (including data

"in the cloud") describe how the data is stored in federally compliant data centers residing within the continental United States of America and follows HIPAA standards, and other legally required standards.

• Describe the software licensing model of the solution, including any required third party licensing.

• Describe how the Proposing Company's maintains licensed software no more than two supported versions behind the latest release and updated with latest security patches

• Describe any impact to the solution when customizations are made for upgrades and maintenance processes. County prefers to minimize downtime and impact to the users.

• Describe how the proposed solution is scalable and flexible enough to accommodate any changes required by the State and/or federal statute, mandate, decision or policy.

• Describe how the system stores objects such as pictures, documents, PDF files, etc. If an electronic document management system is part of the solution, provide a description of the proposed document system and how it is able to support multiple objects.

• Describe how the proposed solution is responsive to mobile technology and works with mobile devices such as smart phone or tablets. Include what mobile platforms are supported.

• Describe what industry standard browsers are supported by the Proposing Company's solution.

Hosting Requirements:

• The selected Vendor shall supply all hosting equipment (hardware and software) required for performance of the Contract.

• The selected Vendor shall provide secure (SSL, HTTPS, or similar) access to all levels of users (as defined by the County) via the internet.

• The selected Vendor shall use commercially reasonable resources and efforts to maintain adequate internet connection bandwidth and server capacity.

• The selected Vendor shall ensure the maintenance of all hosting equipment (hardware and software) and replace as necessary to maintain compliance with the Service Level Agreements.

• The selected Vendor shall use commercially reasonable efforts to ensure that it and its datacenter

Vendors and other vendors performing subcontracted services related to the Service, have, and shall at all times have, in place industry standard physical, technical, human and administrative controls

(including but not limited to for intrusion prevention, loss of data, detection and monitoring) reasonably designed to achieve information security of the data processed through the Services.

Without limiting the foregoing, the selected Vendor’s controls shall at a minimum meet applicable law and the standards set forth in Cybersecurity Framework, NIST SP800-53 rev 4.

• The system must provide tight security controls which meet regulatory, compliance and audit standards. Security must be role-based to the menu, screen, and data field level. Microsoft Active

Directory is required for single sign-on and global security administration; LDAP compatibility is sufficient.

• The selected Vendor has the responsibility to ensure that servers are located in a climate-controlled environment. Vendor shall house all servers and equipment in an operational environment that meets industry standards including climate control, fire and security hazard detection, redundancy, electrical needs, and physical security.

• The selected Vendor shall monitor system and error logs and perform preventative maintenance in order to minimize and predict system problems and initiate appropriate action.

• The selected Vendor shall use industry best practice and completely test and apply patches for all third-party software products before release.

• The selected Vendor shall provide ongoing software updates for the proposed solution as they become available and in compliance with the defined maintenance windows. The selected Vendor shall completely test updates; such updates may include bug fixes, patches and other improvements.

• The selected hosted solution Vendor shall conduct a third party independent security/vulnerability assessment at its own expense on an annual basis and submit the results of such assessment to the

County.

• The selected Vendor must agree to third party application and vulnerability security scans on an agreed upon schedule.

• The selected Vendor shall comply with County’s directions/resolutions to remediate the results of the security/vulnerability assessment to align with the standards of the County.

• The selected Vendor shall limit logical and physical access to all system components and provide access only to those individuals with a business need for services provided. The selected Vendor shall audit the data center (i) annually through an independent third party auditor and the audit results shall form part of the selected Vendor’s SSAE 16 (or similar standard) report, against industry standard controls for data security and disaster recovery, that the selected Vendor shall make available to

County upon its reasonable written request and (ii) upon County’s reasonable request (not to exceed once in any 12-month period), with reasonable prior written notice (at least 30 days) and under reasonable time, place and manner conditions, County will be permitted to conduct a structured walkthrough of the applicable selected Vendor’s data center to review the control environment and security practices relevant to the County Data and to review practices regarding disaster recovery, the selected Vendor’s security and/or audit personnel will participate in the structured walkthrough with

County. County will treat all records discussed pursuant to any such structured walkthrough as

Confidential Information of the selected Vendor per the confidentiality terms of this Agreement.

• The selected Vendor shall employ industry best practice disaster recovery and resiliency procedures to assist in preventing interruption in the use of the system.

• The selected Vendor shall take all necessary measures to protect the data and encryption keys where applicable, including but not limited to the backup of the servers on a daily basis in accordance with industry best practices and encryption techniques.

• The Provider agrees to have appropriate controls in place to protect critical or sensitive data and shall employ stringent policies, procedures, and best practices to protect that data particularly in instances where sensitive data may be stored on a Provider controlled or owned electronic device.

• The selected Vendor shall utilize a secured backup solution to prevent loss of data, back up all data every day and store backup media. Storage of backup media offsite is required. Stored media must be kept in an all hazards protective offsite storage facility. All back up data and media shall be capable of encryption.

• Termination - The County will have access to the Service to export and retrieve its County Data for one hundred and twenty (120) days after the effective date of termination or expiration. County shall have the ability to access its County Data at any time during the subscription term set forth in this agreement in a readily readable, structured and documented format, such as csv-format or some other standard format offered by the selected Vendor. The selected Vendor shall provide to County certain transition services after termination of this Agreement at the selected Vendor then-current and generally charged hourly rates as the parties may agree in good faith in a mutually-agreed statement of work executed by both parties. Subject to the foregoing and applicable law, the selected Vendor shall have no obligation to maintain or provide any County Data. At County’s request upon termination or expiration of the Agreement, the selected Vendor shall, within a reasonable time period, remove, delete, purge, overwrite or otherwise render inaccessible all County Data still remaining on the servers used to host the Service to the extent possible based on the then-current technology available within the Service, unless and to the extent applicable laws and regulations require further retention of such data. The selected Vendor shall provide the County a written and signed statement affirming the deletion, purging, overwriting, and rendering inaccessible all data associated with this Agreement.

System Availability

• The selected Vendor shall make available the system and any custom software on a 24 x 7 basis as established by the solicitation with the exception of approved downtime for scheduled maintenance.

All scheduled maintenance must take place during the hours of 12:00 AM and 5:00 AM. Advance notification of a minimum 7 business days must be provided for scheduled maintenance.

• From time to time, emergency maintenance may be required to bring down the system. In such situations, if possible, the selected Vendor shall give advance notice, before the system goes down for maintenance, to the County’s Point of Contact and as defined in the Service Level Agreement. The selected Vendor will limit the emergency maintenance to those situations which require immediate action of bringing down the system that cannot wait for the next scheduled maintenance period. It is expected that the Vendor will rollover to a backup site during any such emergency maintenance.

Error Handling Requirements:

The management of the system requires that all occurrences of errors be logged for review and that critical errors be accompanied by appropriate alerts. Authorized users need to be able to query and review the error log and configure the alerts.

• Describe how the Proposing Company's proposed solution ensures all errors are written and categorized to an error log. Describe how the Proposing Company's proposed solution allows for a user to view, filter, sort, and search the error log.

• Describe how the Proposing Company's proposed solution provides for the generation of standard and customizable error reports.

• Describe how the Proposing Company's proposed solution has the ability to suppress error messages based upon user-defined criteria.

Database/Data Management Requirements:

• Describe the Proposing Company's proposed Database architecture including the database software is supported by the proposed application.

• Describe how the Proposing Company's proposed solution is built upon an integrated data model, such as a Relational Database Management System (RDBMS), with referential integrity enforced. Describe the integrated data model.

• Describe how the Proposing Company's proposed solution maintains an automated history of all transactions, including, but not limited to: date and time of change, "before" and "after" data field contents, and operator identifier or source of the update.

• Describe the ability for the Proposing Company to convert data from the current systems utilized into the Proposing Company’s proposed solution. Describe the technology used to complete the conversion.

• Describe the ability for the Proposing Company’s proposed solution to allow for creation of user-defined fields.

• The County intends to generate its required reports from the new system and prefers flexible ad hoc query and reporting tools that are intuitive to users.

• Ability to do queries and ad hoc reporting based on user-defined fields that have been defined.

• Tools and utilities available for data purge and archiving processes based on specific retentions schedules.

Backup and System Recovery

The County requires the ability to create backup copies of the software and to restore and use those backup copies for the basic protection against system problems and data loss. This requirement refers to all application system files, data files, and database data files. The Proposing Company's proposed solution should provide a comprehensive and easily manageable backup and recovery process that is responsive to County’s needs. The Proposing Company's proposed solution should identify and implement a system recovery plan that ensures component failures do not disrupt services. The plan should be completed, implemented, and tested prior to system implementation. The successful

Proposing Company's solution should specify all needed hardware, software, and tools, and the plan should clearly define all roles, responsibilities, processes, and procedures.

• Describe the Proposing Company's proposed Backup and System Recovery plan and readiness.

Describe the Proposing Company’s service level agreement on returning the solution to service from a backup. Describe the Proposing Company's proposed backup retention schedules – daily, weekly, monthly, quarterly, etc.

• Describe the Proposing Company's proposed Disaster Recovery Plan. Describe the Proposing

Company’s service level agreement on returning the solution back to operational service.

• Describe how backups of the Proposing Company's proposed solution are able to be scheduled without user intervention and without interruption to the system.

• Describe how the Proposing Company's proposed solution provides information on their test and validation process

• If there is a backup failure or downtime, describe the Proposing Company’s proposed method and timing of communication back to the County

Security and Audit

The selected Vendor will provide all Services, using commercially available security technologies and techniques in accordance with industry best practices and the County’s security standards, procedures, and requirements, including those relating to the prevention/detection of fraud and any other inappropriate use or access of systems and networks.

• Describe the Proposing Company's proposed security safeguards integrated into their application and how these safeguards address cyber security.

• The system can integrate with Active Directory Authentification so that end-users do not need separate login.

• Describe how the Proposing Company's proposed solution meets the requirements for unique user ID access. Include:

o Specification on configuration of the unique user ID.

o How the unique user ID is assigned and managed.

o How the unique user ID is used to log system activity.

o How the system handles the creation of duplicate user ID accounts.

• Describe how the Proposing Company's proposed solution meets the standard for administering passwords:

o Initial Password assignment.

o Strong Password Requirements.

o Password reset process.

o Password expiration policy.

o Password controls for automatic lockout access to any user or user group after an administrator defined number of unsuccessful log-on attempts.

• Describe how the Proposing Company's proposed solution supports the use of multi-factor authentication.

• Describe any security processes for managing security updates, and integrated components subject to vulnerability, including anti-virus.

• Describe how the Proposing Company's proposed solution provides the ability to maintain a directory of all personnel who currently use or access the system.

• Describe how the Proposing Company's proposed solution provides role-based security and allows restricted access to system features, function, screens, fields, database, etc. Role authentication may occur at the directory level, application level, or database level (depending on database platform).

Describe the security administration functions integrated into the proposed system that manage role-based access to system functions, features, and data. Include a description of:

o How and where the proposed system stores security attributes or roles (e.g., LDAP attributes, database tables, a file).

o The interface between the LDAP and the application, if roles are assigned in an LDAP directory.

o How roles are created and security is applied to the role based on how and where security attributes are stored (if multiple options describe each).

o How groups are defined and how roles and security are applied to each group.

o How access limits are applied to screens and data on screens by role or group.

o How users are created and assigned to one or more roles or groups.

o How role and group creation and assignment activity is logged.

• Describe how the Proposing Company's proposed solution automatically disconnects based upon inactivity. Describe how the feature is administered and what effect disconnect has on any activity or transaction in process at the time of disconnection.

• Describe how the Proposing Company's proposed solution protects Confidential and Highly Restricted

Data from unauthorized access during transmission. Describe transmission safeguards that are integrated into the proposed system to protect data during transmission, including any encryption technology.

• The proposed system will process Confidential and Highly restricted Data. Describe the Proposing

Company's auditing functions for all data that is viewed or changed. Describe how the Proposing

Company's proposed solution provides System Auditing functions, including but not limited to:

o The user ID of the person who viewed or made the change to the data.

o The date and time of the view or change.

o The physical, software/hardware and/or network location of the person while viewing or making the change.

o The information that was viewed or changed.

o The outcome of the event.

• If the Proposing Company's proposed solution has the ability to override edits, describe how the solution audits all overridden edits and identifies information including, but not limited to, the login

ID, date, and time.

• Describe how the Proposing Company's proposed solution produces daily audit trail reports and allows inquiries, showing updates applied to the data.

• Describe how the Proposing Company's proposed solution provides an auto archive/purge of the log files to prevent uncontrolled growth of the log and historical records storage using administrator-set parameters.

• Describe how the Proposing Company's proposed solution supports encryption of data at rest or an equivalent alternative protection mechanism. Describe the proposed encryption of data. If data is not encrypted, describe in detail compensating controls.

• Describe how the Proposing Company's proposed solution is configurable to prevent corruption or loss of data already entered into the solution in the event of failure.

• Describe how the Proposing Company’s proposed solution, has the ability to restrict access at field level ( e.g. SSN, income data)

• Describe how the Proposing Company's proposed solution, prior to access of any Confidential or

Highly Restricted Data, displays a configurable warning or login banner. In the event that a solution does not support pre-login capabilities, describe how the solution displays the banner immediately following authorization.

• Describe how the Proposing Company's proposed solution recognizes Confidential and Highly

Restricted information in screens, reports and views (i.e. PHI and SSN) by restricting distribution and access based upon system security settings and roles. Describe warning banner on printed and viewed reports.

• Describe how the Proposing Company's proposed solution alerts of potential violations of security and privacy safeguards.

• Describe how the Proposing Company's proposed solution provides the capability to monitor, identify, and report on events on the information system, detects attacks, and provides identification of unauthorized use and attempts of the system.

• Describe how the Proposing Company's proposed solution provides a process for archiving and/or destroying data and sanitizing storage media in conformance with County policies and subject to applicable HIPAA, and federal (e.g., Federal Information Processing Standards (FIPS), National

Institutes of Standards and Technology (NIST), and State laws.

• Describe how the Proposing Company's proposed solution has defined and deployed strong controls

(including access and query rights) to prevent any data misuse, such as fraud, marketing or other purposes.

• Describe how the Proposing Company's proposed solution supports removal of a user's privileges without deleting the user from the solution to ensure a history of user’s identity and actions.

Data/Information Security Breach Requirements:

“Breach” shall mean any attempted or successful unauthorized acquisition, access, use, or disclosure of data that compromises the security or privacy of such data.

The notice to be provided by Proposer shall be provided without unreasonable delay and no later than within 48 hours of Proposer’s discovery of any Breach. A Breach shall be deemed to be discovered on the first day on which the Proposer knows or reasonably should have known of the Breach. The notice to be provided by Proposer shall be made in writing to the County’s Information Services

Department and shall include the following content: (i) the nature of the Breach; (2) the specific data affected by the Breach; (3) the steps the Proposer is taking to remediate the Breach; and (4) steps the

Proposer is taking to mitigate future Breaches. Following notification of the Breach, Proposer shall cooperate with the County’s investigation of the Breach and provide any other information regarding the Breach or the data affected which the County may reasonably request. Should notice to individuals whose information was part of County Data be required under any applicable data privacy law, including, but not limited to, individual state data breach notice laws or federal laws such as

HIPAA, Proposer shall provide the County with copies of any template notification letters and draft regulatory correspondence for County’s prior approval. Proposer shall provide any notifications required under the applicable data privacy laws on behalf of the County at the request of County. The

County reserves the right to handle any notifications required and shall notify Proposer if the County will be handling the required notifications. Upon request, Proposer shall provide the County with its cyber-security policies and procedures. Proposer agrees to reimburse the County for any and all reasonable costs associated with the County’s response to Proposer’s Breach, including any fees associated with the County’s investigation of Proposer’s Breach, notification costs, and any reasonable offer of credit or identity monitoring product.

• Virus, Malicious, Mischievous or Destructive Programming. Proposer warrants that the licensed product as delivered by Proposer does not contain any viruses, worms, Trojan Horses, or other malicious or destructive code to allow unauthorized intrusion upon, disabling of, or erasure of the licensed products (each a “Virus”).

The County’s exclusive remedy, and Proposer’s sole obligation, for any breach of the foregoing warranty shall be for Proposer to (a) replace the licensed products with a copy that does not contain

Virus, and (b) if the County, has suffered an interruption in the availability of its computer system caused by Virus contained in the licensed product, reimburse the County for the actual reasonable cost to remove the Virus and restore the County’s most recent back up copy of data provided that:

• the licensed products have been installed and used by the County in accordance with the

Documentation;

• the licensed products have not been modified by any party other than Proposer;

• the County has installed and tested, in a test environment which is a mirror image of the production environment, all new releases of the licensed products and has used a generally accepted antivirus software to screen the licensed products prior to installation in its production environment.

Under no circumstances shall Proposer be liable for damages to the County for loss of the County’s data arising from the failure of the licensed products to conform to the warranty stated above.

With respect to data breaches, the selected Vendor shall immediately notify County contact by telephone and email if there is a reasonable probability that there has been a security incident. In the event of conditions described in the previous sentence, the selected Vendor shall promptly notify the

Information Security Officer or his or her designee within 24 hours or sooner by telephone or email of such incident. A follow-up written letter shall be sent within the same 24-hour period following the data breach. The selected Vendor shall (1) cooperate with the County as reasonably requested by the

County to investigate and resolve the incident, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the data breach, including any post-incident review of events and actions taken to make changes in business practices in providing the services, if necessary.

If a data breach is a result of the selected Vendor’s breach of its obligations under this Agreement, the selected Vendor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to individuals, regulators or others required by state law; (3) a credit monitoring service required by state (or federal) law; (4) a website or a toll-free number and call center for affected individuals required by state law; and (5) complete all corrective actions as reasonably determined based on root cause.

System and User Documentation

• Describe how the Proposing Company's proposed solution provides on-line Help for all features, functions, and data element fields, as well as descriptions and resolutions for error messages, using help features including indexing, searching, tool tips, and context-sensitive help topics. Provide a sample copy of five screenshots with on-line help with the Proposing Company’s response.

• Describe how the Proposing Company's proposed solution provides an on-line User Manual with a printable version available. The documentation should include full mock-ups of all screens/windows and provide narratives of the navigation features for each window/screen. Provide a sample copy of five pages of the user manual with the Proposing Company’s response.

• Describe how the Proposing Company's proposed solution will have on-line Reporting Manual with a printable version available that includes descriptions, definitions, and layouts for each standard report.

Include definitions of all selection criteria parameters and each report item/data element, all field calculations defined in detail, and field and report titles. Provide a sample copy of five pages of the

Reporting Manual with the Proposing Company’s response.

• Describe how the Proposing Company's proposed solution provides a data dictionary or database schema which can be viewed online and kept updated for each modification. Provide a sample copy of five pages of the Data Dictionary with the Proposing Company’s response.

Training Requirements:

• Describe the Proposing Company's proposed solution training plan. Describe how the Proposing

Company develops and provides training material to the County for initial training and updates to training material for enhancements and changes made to the system. The content of these materials should be consistent with the on-line Help, User Manual, and Reporting Manual.

Production, Test, and Training Platforms:

County prefers three separate environments (Production, Test, and Training) in order to operate the solution on an ongoing basis:

Test Environment – A test environment is required that mirrors the live production environment, including hardware and software. All data should be de-identified. This test environment will be used to test application changes before they are deployed to production. This step is an important part of quality assurance, where all changes are tested to minimize the risk of adverse reactions in the production environment. While it is necessary to mirror all of the functions of the production environment, it is not necessary to maintain the same load capacity.

Training Environment – A Training environment is also required that allows County to provide hands-on training to users. This environment would allow the County to maintain unique de-identified data for use in training and conduct training without interference with the test or production environments. This environment will have occasional use.

• Describe how the Proposing Company's proposed solution supports several environments, include production environment, test environment, and training environment.

• Describe how the Proposing Company’s proposed solution supports non-production environments such as testing and training environments containing de-identified data and not include Confidential or

Highly Restricted data.

• Describe how the Proposing Company’s proposed solution provides the ability to refresh any testing or training environment. Describe whether the refresh process can be completed using County resources or whether the process requires services from the Proposing Company.

Interfaces/Imports/Exports Requirements:

• Describe the Proposing Company's proposed automated approach to managing interfaces.