RFP 26-1368112 Policy Management Solution Functional and Technical Matrix.xlsx
XLSX spreadsheet 51 KB Posted
- Attached to
- Cloud-based Policy Management Solution
- Solicitation number
- 35555
- Issued by
- Hartford County, Connecticut
About this file
This is a Request for Proposal (RFP) response matrix for Connecticut's procurement of a cloud-based Policy Management Solution (RFP 26-1368112). The RFP seeks a Software-as-a-Service (SaaS) solution to provide a centralized platform for managing institutional policies, procedures, standards, and guidelines across multi-campus or multi-entity higher education environments. The solution must support cloud-hosted deployment and include browser-based policy authoring tools, configurable approval workflows, role-based permissions, a public-facing policy library, version control and historical tracking, search functionality, and integration capabilities with institutional identity management systems and other enterprise applications. Vendors must complete multiple Excel workbook tabs addressing functional and technical specifications, compensation, staffing plans, technical questions, and security questionnaires. All specifications are designated as either required or preferred, with vendors expected to clearly state compliance status, describe available features, provide implementation dates for planned features, and explain how their solutions address any gaps.
Pricing must include all hosting, licensing, implementation, and support costs, with quotes valid for a minimum of three years and two optional renewal increases specified separately. Vendors must clearly distinguish one-time implementation fees from recurring annual fees and provide pricing for optional modules, integration services, and other add-ons. The RFP requires vendors to address implementation services including data migration, system configuration, training, user documentation, and ongoing technical support with defined Service Level Agreements guaranteeing minimum 99.5 percent system uptime. Additionally, vendors must complete a comprehensive SaaS IT Security Questionnaire covering physical security, network security, platform hardening, application security, operational procedures, and staff qualifications, with responses evaluated for acceptable risk levels. The proposal submission must include identified key personnel with resumes for account management, implementation, and ongoing support roles, as well as descriptions of required Connecticut State resources and their accessibility to the contract awardee.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 35555_Mar_18_26_solicitation_doc.pdf | ||
| 35555_Mar_23_26_solicitation_doc.pdf | ||
| 35555_May_11_26_solicitation_doc.pdf | ||
| 35555_May_18_26_solicitation_doc.pdf | ||
| RFP 26-1368112 Cloud-based Policy Management Solution.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
| Appendix A - Proposal Response Matrix |
| RFP - 26-1368112 Cloud-hosted Policy Management Solution |
| Proposer: |
| Date: |
| Solution Type (On-Premise, Vendor Hosted, SaaS): |
| Instructions |
| 1) Vendor should fill out each accompanying tab for their solution. For a vendor providing multiple solutions, they should fill out a excel workbook for each solution. For purposes of this RFP, different hosting options (i.e. on-Premise v. Vendor Hosted v. SaaS) will be considered different solutions. |
| Compensation: Vendors should provide pricing. All prices must include any hosting, licensing, implementation, and support costs, if any. Pricing should be valid for a minimum of three (3) years, with two (2) optional renewal increases specified, if any. Clearly note any one-time fees versus recurring annual fees. Also, provide pricing for optional modules, costs for integration, SOS, etc., if any. |
| 2) For Functional and Technical specifications tab, Respondent should state whether they are compliant with the specification or if the feature is currently available. For features available or planned, the Respondent should describe the feature in the appropriate cell. For planned features, the Respondnent should provide the scheduled implementation date and appropriate notes. For features not currently available or specifications not met, the Respondent should state in the notes how their product will help the Institution address the features absent. All specifications are marked as either being preferred by the University or required. |
| 3) Each cell with the background color as this cell must be completed by the Respondent. |
| 4) For the Questions tab, please fill out a response for each question. For additional documentation, please provide a link or reference an attached document in the appropriate box. |
| 5) For the Staffing Plan tab, please fill out each key personnel member or key personnel role to be provided. When providing only a role instead of an identified member, fill out the appropriate cells for the minimum qualifications for that role. Fill out all resources expected to be required from CS State in the second table in the tab. |
| 6) Vendor-hosted Security Questionnaire needs to be completed. If the answers poses more risk that willing to be accepted, a Proposer may not be awarded. |
Compensation
| Appendix A - Compensation | Proposer: | |||||
| RFP - 26-1368112 Cloud-hosted Policy Management Solution | Date: | Date: | ||||
| Solution: | Solution: | |||||
| Annual Fee | Service Level Package(s) Fee(s), if not included in Annual Fee (provide details of Service Level Obligations) | Implementation Fee - Flat Fee for Standard Implementation (provide the SOW, which reflects both Vendor and Institution tasks/effort and timeline) | Hourly Professional Service Rates for Services beyond what is included in the Standard Implementation Package. Provide Labor Role name and description. | |||
| Labor Role | Labor Description | Labor Rate | Percentage Discount offered for Block Hour Purchase |
| Assumptions and additional comments, if any. Include any potential additional costs or limitations associated with the fee. |
| Provide and any value-add or optional products or costs, including any third-party transaction fees. |
Functional & Tech Requirements
| Appendix A - Functional and Technical Proposal Response Matrix | Proposer: |
| RFP - RFP - 26-1368112 Cloud-hosted Policy Management Solution | Date: |
| Solution: |
| Functional and Technical Requirements | |||||
| General | |||||
| Feature/Requirement: | Required/Preferred: | Currently Available/Compliant (Yes/No/Planned): | Description of Vendor Feature: | Scheduled Feature Implementation: | Notes (Required if Not Currently Available): |
| 1. General System Requirements | |||||
| Vendors must describe how their solution meets the following general requirements. | Required | ||||
| Solution must provide a centralized platform for managing institutional policies, procedures, standards, and guidelines. | Required | ||||
| Solution must support cloud-based Software-as-a-Service (SaaS) deployment. | Required | ||||
| System must support multi-campus or multi-entity environments common in higher education systems. | Required | ||||
| Solution must allow configurable workflows for policy creation, review, approval, and publication. | Required | ||||
| Solution must support role-based permissions for policy administrators, reviewers, approvers, and end users. | Required | ||||
| System must provide a public-facing policy library accessible to students, faculty, staff, and external stakeholders. | Required | ||||
| System must maintain historical versions of policies and track revision history. | Required | ||||
| Solution must allow attachment of related documents, forms, and supporting materials. | Required | ||||
| System must support tagging, categorization, and metadata for policies. | Required | ||||
| Solution must provide search functionality across policy content and metadata. | Required |
| 2. Policy Authoring and Editing | |
| Solution must include a browser-based policy authoring tool. | Required |
| System must support structured policy templates. | Required |
| Solution must support rich text formatting and document styling. | Required |
| System must allow collaborative editing by multiple users. | Required |
| Solution must support import of policies from Microsoft Word or PDF. | Required |
| System must allow linking of related policies. | Preferred |
| System must allow embedding of images, charts, or tables within policy documents. | Preferred |
| System must support policy numbering and naming conventions. | Preferred |
| System must support configurable policy fields (owner, responsible office, effective date, review cycle). | Required |
| 3. Workflow and Approval Management | |
| Solution must support configurable approval workflows. | Required |
| Workflow must support multiple review and approval levels. | Required |
| Solution must allow workflow routing by role, department, or individual. | Required |
| System must allow administrators to configure approval hierarchies. | Required |
| Solution must allow tracking of policy status (draft, review, approved, published, archived). | Required |
| System must support electronic approvals. | Required |
| System must maintain audit logs of workflow actions. | Required |
| System must provide dashboards showing workflow progress and bottlenecks. | Required |
| 4. Policy Publication and Distribution | |
| Solution must provide a centralized policy repository. | Required |
| System must support publishing policies to a public website or internal portal. | Required |
| Solution must allow policies to be published automatically after approval. | Required |
| System must support policy visibility controls (public, internal, restricted). | Required |
| System must provide responsive design for mobile devices. | Preferred |
| System must support automatic archiving of superseded policies. | Required |
| Solution must allow display of policy version history. | Required |
| 5. Policy Review and Attestation | |
| Solution must support periodic policy review cycles. | Required |
| System must automatically notify policy owners when reviews are due. | Preferred |
| Solution must support policy attestation or acknowledgment by users. | Preferred |
| System must track attestation completion and provide reports. | Preferred |
| System must support targeted policy distribution to specific groups (students, faculty, staff, departments). | Required |
| System must maintain records of user acknowledgements. | Preferred |
| 6. Reporting and Analytics | |
| Solution must provide configurable reports. | Required |
| System must report on policy lifecycle metrics. | Required |
| System must report on review compliance and overdue policies. | Preferred |
| System must report on policy acknowledgements and attestations. | Preferred |
| System must support export of reports to CSV, Excel, or PDF. | Preferred |
| Solution must provide dashboards for administrators. | Preferred |
| 7. Search and User Experience | |
| Solution must provide full-text search capabilities. | Preferred |
| System must allow filtering by policy category, department, or topic. | Required |
| System must provide intuitive navigation of policy content. | Preferred |
| System must support keyword tagging. | Preferred |
| System must support bookmarking or favoriting policies. | Preferred |
| 8. Integration Requirements | |
| Solution must support integration with institutional identity management systems. | Required |
| System must support Single Sign-On (SSO). | Required |
| Solution must support integration with common higher education systems such as learning management systems and HR systems. | Required |
| System must provide RESTful APIs for integration with other enterprise systems. | Preferred |
| Solution must support integration with document storage platforms (SharePoint, OneDrive, etc.). | Preferred |
| 9. Security Requirements | |
| Solution must comply with industry-standard security practices. | Required |
| System must support role-based access control. | Required |
| System must encrypt data in transit using TLS 1.2 or higher. | Required |
| System must encrypt data at rest. | Required |
| System must support audit logging for administrative actions. | Required |
| System must support multi-factor authentication where required. | Required |
| Vendor must provide documentation of security certifications (SOC 2, ISO 27001, etc.). | Required |
| 10. Compliance and Accessibility | |
| Solution must comply with accessibility standards such as WCAG 2.1 AA. | Required |
| System must support compliance with federal and state regulations applicable to higher education. | Required |
| System must support retention policies for institutional records. | Required |
| Vendor must provide documentation of compliance with relevant privacy regulations (FERPA where applicable). | Required |
| 11. Implementation and Support | |
| Vendor must provide implementation services. | Required |
| Vendor must execute data migration. | Required |
| Vendor must provide system configuration and training. | Required |
| Vendor must provide user documentation and knowledge base resources. | Required |
| Vendor must provide ongoing technical support. | Required |
| Vendor must provide service level agreements (SLAs) for system uptime and support response. | Required |
| 12. Technical Architecture | |
| Solution must be cloud-hosted with high availability architecture. | Required |
| System must provide documented uptime of at least 99.5%. | Required |
| Vendor must provide disaster recovery and backup capabilities. | Required |
| System must support modern web browsers (Chrome, Edge, Firefox, Safari). | Required |
| Vendor must provide system monitoring and maintenance procedures. | Required |
| Vendor must provide data export capabilities for institutional records retention. | Required |
Questions
| Appendix A - Technical Proposal Response Matrix | Proposer: |
| RFP - 26-1368112 Cloud-hosted Policy Management Solution | Date: |
| Technical Questions | Solution: |
| Technical Proposal Questions | ||
| General | ||
| Company Information / Client Composition | ||
| Question: | Response: | Links/Attachments: |
| Product Functionality | ||
| Question: | Response: | Links/Attachments: |
| Technical | ||
| Question: | Response: | Links/Attachments: |
| Security & Compliance | ||
| Question: | Response: | Links/Attachments: |
| Support & Training | ||
| Question: | Response: | Links/Attachments: |
| What types/level of training do you provide as part of the delivered solution? What training do you recommend for technical staff, functional staff, and casual users? How extensive is the on-line help capability of the system offered? | ||
| What influence do clients have on new features and functionality? Please include a description of a recent example and any firm sponsored forums and workgroups. | ||
| Describe the process that is used to address enhancement priorities from a customer service perspective. | ||
| What is your cadence and schedule for test and production environment upgrades? | ||
| Describe the assistance available during product upgrades, version upgrades, or new releases | ||
| Where are your analysts based geographically? Do they work in secure office locations or is home-working permitted? | ||
| Product Integration/APIs | ||
| Question: | Response: | Links/Attachments: |
| Can your solution integrate with our existing systems (please specify APIs, connectors, etc.)? | ||
| What platforms and environments is your software compatible with (cloud/on-premise/hybrid)? | ||
| Service Level Agreements | ||
| Question: | Response: | Links/Attachments: |
| What type of support do you provide during peak times? | ||
| What is the structure for reporting issues and guidelines for providing resolutions? |
Required Staff Resources
| Appendix A - Technical Proposal Response Matrix | Proposer: | ||||||||
| RFP - 26-1368112 Cloud-hosted Policy Management Solution | Date: | ||||||||
| Staffing Plan and Requirements | Solution: | ||||||||
| PART 1: VENDOR RESOURCES | |||||||||
| 1) Provide a complete listing of key personnel assigned to your proposal including account staff, implementation team and ongoing support team. | |||||||||
| 2) Please mark a "X" in the appropriate column to indicate whether the allocated person will be utilized for account management, implementation, and/or support services. | |||||||||
| 3) Please fill out CT State required resources in the lower table. | |||||||||
| Vendor Resources | |||||||||
| Role/Position | Account Management | Implementation | Ongoing Support | Name (Please include Resume / CV of proposed resource, where applicable) | Years Experience | Qualifications / Product Experience | Length of Employment | Relevant Projects | Accessibility (Method & Hours of Contact, etc.) |
Ex: Project Magaer X X John Doe 10 Insert response… Insert response… List projects Available M-F, normal business hours
Ex: Account Executive X X X Bob Roberts 15 Insert response… Insert response… List projects Available M-F, normal business hours
Ex: Technical Support X X TBD 10 Insert response… Insert response… List clients 24/7, 365
| PART 2: CT State RESOURCES |
| 1) Provide a complete listing of key personnel assigned to your proposal including account staff, implementation team and customer support team. |
| 2) Please mark a "X" in the appropriate column to indicate whether the allocated person will be utilized for account management, implementation, and/or support services. | |||||
| 3) Please fill out CT State required resources in the lower table. | |||||
| CT State Resources | |||||
| Role/Position | Account Management | Implementation | Support following Go-Live | Qualifications/Technical Skills | Expected Accesssibility to the Contract Awardee (Method & Hours of Contact, etc.) |
Ex: System Administrator X X Describe… Describe…
Vendor-Hosted Security Question
| Appendix A - Technical Proposal Response Matrix | Proposer: | |
| RFP - 26-1368112 Cloud-hosted Policy Management Solution | Date: | Date: |
| SaaS IT Security Questionnaire | Solution: | Solution: |
| SaaS IT Security Questionnaire | |||
| Physical Security | |||
| YES | NO | Comments | |
| Is there a documented physical security policy? | |||
| Is access to the datacenter restricted and logs kept of all access? | |||
| Are visitors permitted into the datacenter? | |||
| Are all entry and exit points to the datacenter alarmed? | |||
| Is there a documented procedure for the removal of equipment from the datacenter? | |||
| Network | |||
| Does your company require the use of two-factor authentication for the administrative control of servers, routers, switches and firewalls? | |||
| Does your company support Secure Sockets Layer (or other industry-standard transport security) with 128-bit or stronger encryption and two-factor authentication for connecting to the application? | |||
| Does your company provide redundancy and load balancing for firewalls, intrusion prevention and other critical security elements? | |||
| Does your company perform, or have a 3rd party perform, external penetration tests at least quarterly, and internal network security audits at least annually? | |||
| Does your company contract for, or provide protection against, denial-of-service attacks against its Internet presence? | |||
| Platform | |||
| Can your company provide a documented policy for "hardening" the operating system under the Web and other servers? | |||
| Can your company provide validated procedures for configuration management, patch installation, and malware prevention for all servers and PCs involved in SaaS delivery? | |||
| Does your company have a documented set of controls that it uses to ensure the separation of data and security information between customer applications? | |||
| Applications and Data | |||
| Can you provide how you review the security of applications (and any supporting code, such as Ajax, ActiveX controls and Java applets) that it develops and uses? If so, please describe. | |||
| Does your company use content monitoring and filtering or data leak prevention processes and controls to detect inappropriate data flows? | |||
| Does your company have documented procedures for configuration management, including installing security patches, for all applications? | |||
| Is your company compliant with relevant regulations (i.e. PCI, HIPAA, FERPA) | |||
| Operations | |||
| Does your company perform background checks on personnel with administrative access to servers, applications and customer data? | |||
| Can your company show a documented process for evaluating and remediating security alerts from operating system and application vendors? | |||
| Does your company use write-once technology for storing audit trails and security logs? | |||
| Can your company provide and demonstrate procedures for vulnerability management, intrusion prevention, incident response, and incident escalation and investigation? | |||
| Can your company provide procedures for business continuity and disaster recovery that include your applications and data, as well as evidence that it has tested those procedures during the past 12 months? | |||
| End Services | |||
| Does your company security staff average more than four years' experience in information and network security? | |||
| Does more than 75% of your company’s security staff have security industry certification, such as from the Certified Information Systems Security Professional (CISSP) certification program (www.isc2.org) or Global Information Assurance Certification (GIAC; www.giac.org/)? |
File details come from the government source that posted it. Updated .