RFP Doc2246180914 Appendix A - Requirements.xlsx
XLSX spreadsheet 15 KB Posted
- Solicitation number
- 2246180914
- Issued by
- Multnomah County, Oregon
About this file
This is a requirements specification document for the City of Portland, Oregon's Merchant Services and Payment Gateway Services procurement (RFP 2246180914). The City's Treasury Division seeks a qualified vendor to provide integrated merchant and payment gateway services supporting multiple payment channels across multiple city bureaus. The scope excludes Procurement Card services. The requirements document specifies mandatory and preferred capabilities across six categories: general system requirements, payment gateway functionality, and merchant services qualifications.
The requirements encompass critical system infrastructure standards including 99.99% uptime availability across geographically-diverse U.S. data centers, 24/7 multi-channel support (web, mobile, phone) available 6am to midnight Pacific time, and scalability to handle existing transaction volumes and projected growth during peak periods (January through April tax season). Payment gateway requirements mandate hosted payment pages with customizable branding, business unit-based configuration, mobile responsiveness, data postback capabilities, and daily payment data extracts in industry-standard formats. Merchant services requirements demand the proposer demonstrate at least five years' experience with Level 1 and public sector clients, qualified depository status per Oregon Revised Statute 295, and the ability to ensure the City maintains Merchant of Record status with direct settlement within one business day. Additional mandatory requirements include PCI/PA DSS certification maintenance, role-based and business unit-based access controls, ADA compliance at WCAG 2.2 level AA, encryption and tokenization protocols, comprehensive backup and disaster recovery capabilities (24-hour recovery), and real-time monitoring and fraud detection systems.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
All Requirements
| REQUIREMENT ID | REQUIREMENT TYPE | REQUIREMENT TITLE | PRIORITY | REQUIREMENT DESCRIPTION | RESPONSE | COMMENTS IF NEEDED |
| G1 | General | System availability and reliability | Mandatory | Platform utilizes multiple, geographically-diverse U.S. data centers and will provide SLA guaranteeing 99.99% uptime (24x7). | ||
| G2 | General | Scalability | Mandatory | Capable of handling existing City transaction volume and projected growth, including peak volumes occuring during tax season (January - April). | ||
| G3 | General | Support | Mandatory | Multi-channel support (web/mobile/phone) available 6am - midnight (Pacific), 7 days per week. | ||
| G4 | General | Account executive availability | Mandatory | Make primary account executive available in local time (Pacific). | ||
| G5 | General | Communications | Mandatory | Communicate clearly, and with as much advance notice as possible, about technical and service changes including system upgrades, interruptions to service, and changes to terms or pricing. | ||
| G6 | General | Data API | Mandatory | Enables standardized access to transactional data via API to support integrations and reporting. | ||
| G8 | General | Exportable reports | Mandatory | Allows report and data exports in standard file formats (e.g., .xls, .xlsx, .csv, .pdf). | ||
| G9 | General | Scheduled reports | Mandatory | Enables design and scheduled delivery of custom reports. | ||
| G10 | General | Backups | Mandatory | Backups enable full system recovery within 24 hours. | ||
| G11 | General | Monitoring and alerting | Mandatory | Provides realtime monitoring and notification of service disruptions, transaction anomalies, suspected fraud, and processing issues. | ||
| G12 | General | Role-based access | Mandatory | Role-based permissioning must be available for City and vendor users (e.g. read-only, refund/cancel, group administrator). | ||
| G13 | General | Business unit-based access | Mandatory | Access controls must be available to partition administration and reporting access to users by business unit. | ||
| G14 | General | Encryption and security | Mandatory | Tokenization of card data, encryption, point-to-point encryption (P2PE), support for PCI-certified devices. | ||
| G15 | General | Development and Testing | Mandatory | QA/Testing environment available to the City, supporting development and validation of new forms, features, and integrations. | ||
| G16 | General | Americans with Disabilities Act (ADA) compliance | Mandatory | System shall comply with the guidelines defined in the American’s with Disabilities Act as described in the Web Content Accessibility Guidelines International Standard 2.2, at level AA or better. | ||
| P1 | Payment Gateway | Admin user interface (UI) | Mandatory | System provides web-based UI to view/search transactions, process cancellations/refunds, and generate ad-hoc reports. | ||
| P2 | Payment Gateway | Hosted payment pages | Mandatory | Vendor hosts the payment processing web interface. Payment pages shall not reside on City servers. | ||
| P3 | Payment Gateway | Hosted payment pages branding | Mandatory | Hosted payment pages must be customizable by the City to include look and feel consistent with the City's web pages (portland.gov) and branding. | ||
| P4 | Payment Gateway | Business unit-based payment page configuration | Mandatory | Payment pages must allow configuration by business unit, including branding and merchant account. | ||
| P5 | Payment Gateway | Page customization | Mandatory | Can customize page elements of payment screen(s) (text, rearrange elements, show/hide elements). | ||
| P6 | Payment Gateway | Custom fields | Mandatory | Custom fields can be passed to the payment page, displayed on receipt, and returned to business application. | ||
| P7 | Payment Gateway | Payment confirmation | Mandatory | A confirmation page can be optionally shown after successful payment. Page can be customized. | ||
| P8 | Payment Gateway | Receipt communication | Mandatory | Email and/or SMS receipt sent to customer (based on configuration). Can be customized. | ||
| P9 | Payment Gateway | Digital accessibility for mobile payments | Mandatory | Webpages are responsive and support payment on mobile devices. | ||
| P10 | Payment Gateway | Browser support | Mandatory | Web service does not include any proprietary browser extensions and uses W3C standard markup that is supported in all major web browsers. | ||
| P11 | Payment Gateway | Data postback | Mandatory | Payment result data is passed back to the City business application for recording and/or post-processing. | ||
| P12 | Payment Gateway | Scheduled flat file extract | Mandatory | Able to deliver a daily payment data extract in an industry-standard format with unique identifiers and fields including Invoice Number and Customer ID. | ||
| P13 | Payment Gateway | Data postback fallback | Mandatory | Payment result postback to City business application is fault tolerant and can retry or use a back channel if initial attempts fail. | ||
| P14 | Payment Gateway | City employee authentication | Preferred | Access to the admin interface should authenticate using single sign-on (SSO) via the City Microsoft Entra identity store. | ||
| M1 | Merchant Services | Confirm qualification and experience | Mandatory | Proposer must have at least five (5) years merchant services experience with Level 1 and public sector clients. | ||
| M2 | Merchant Services | Qualified depository status | Mandatory | Proposer is an acquiring bank or partnered processor that is a Qualified Depository for Public Funds per ORS 295. | ||
| M3 | Merchant Services | Merchant of record | Mandatory | The City of Portland must be the Merchant of Record for all transactions. | ||
| M4 | Merchant Services | Custody of funds | Mandatory | Settlements must be made directly to the City's Merchant of Record within one business day of the transaction as required by Oregon law (ORS 295). | ||
| M5 | Merchant Services | Interactive voice response (IVR) services | Mandatory | System provides PCI-compliant IVR capability in commonly spoken languages. | ||
| M6 | Merchant Services | Maintain PCI/PA DSS certification | Mandatory | Provide annual copies of Attestation of Compliance (AOCs) to the City. |
Dropdown Selections
| Dropdown Selections |
| Confirmed, we meet this requirement |
| No, we do not meet this requirement |
| We partially meet requirement, and we added an explanation in the comments |
File details come from the government source that posted it. Updated .