rfq_13325_it_requirements_cprtraining.xlsx
XLSX spreadsheet 33 KB Posted
- Solicitation number
- BPM013325
- Issued by
- California
About this file
This is an Information Technology Requirements attachment for Request for Proposal/Bid/Quote (RFQ) 13325 issued by the San Diego County Office of Emergency Services for an online software license subscription solution supporting self-directed CPR training. The document outlines mandatory business-critical IT requirements and functional specifications that vendors must meet or address in their proposals. The IT requirements encompass 14 major requirement categories, including data privacy and PII protection in accordance with Federal and State regulations, support personnel and infrastructure located within United States borders, data processing and network containment within the United States, endpoint detection and response software, data encryption standards for both in-transit and at-rest communications, web browser-based application compatibility with major vendors, separation of development and production environments, role-based access controls, and FIPS 140-3 validated cryptographic modules. Additionally, the solution must prohibit deprecated or legacy protocols such as SSLv3.0, TLS 1.0/1.1, SMBv1/SMBv2, and FTP without TLS, and ensure all public-facing electronic documents meet WCAG 2.1 Level AA accessibility standards and ADA Title II compliance.
The functional requirements document specifies comprehensive system documentation, training, and data migration deliverables to be provided as part of the project. Documentation requirements include online searchable help systems, user guides, technical manuals, data models, and exportable formats for custom training material development. Training deliverables include accessible online materials indexed by job function, detailed user steps for task completion, and hands-on practical training conducted for end users, super users, and system support staff. Data extraction and conversion services are required to migrate existing data from legacy EAM systems, custom Access databases, and Excel spreadsheets into the new system, with associated error messaging and data mapping documentation. The document was initially drafted on July 5, 2018, with updates through July 15, 2018, and final contact information listed as of May 5, 2026, provided by David Lindsay and Melanie Caramat from San Diego County.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| rfq_13325.pdf | ||
| rfq_13325_data_security_checklist_cprtraining.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Version Log
| Version | Date | Description |
| 1 | 7/5/18 | Initial draft |
| 2 | 7/13/18 | Updates from team review; remove Pricing and Customer References tabs. |
| 2.1 | 7/15/18 | Minor editing: instructions, vendor profile, and questionnaire worksheets |
(1) IT Requirements - Attach. 1
Request for Proposal/Bid/Quote (RFQ) 13325 Office of Emergency Services Online Software License Subscription for Self-Directed CPR
Information Technology Requirements Business Critical
| Attachment 1 - Statement of Work | IT Review and Comments (Check / Complete as applicable) | |
| The following are business critical requirements that proposer must resond to. All Information Technology Requirements shall be incorporated as an Attachment to Exhibit A - Statement of Work. State Yes or No to indicate whether or not your solution will meet the requirement. If No, state what work is necessary to meet the requirement or how your solution will meet the requirements and the work necessary to meet the requirements - indicate costs if needed. Applicable product literature or technical documentation can be provided to support your response. |
The County will favor a response that substantially meets the Information Technology requirements outlined in this document. Should you take exception(s) to the requirements, you understand that the County may, as part of its evaluation process, conclude that exceptions are so material as to make the Offeror’s response to the solicitation unacceptable.
| Response # | Requirement Description | YES/NO | Vendor Response and Comments. | |
| Please describe how your product will comply with the requirement | Vendor response acceptable as stated | Vendor response acceptable as modified below (re-state) | Vendor No confirmation and comments can be reserved | |
| MR-1 | The solution shall protect the privacy of customer personal identifiable information (PII) in accordance with Federal and State regulations. Please describe how the solution meets the requirements. | |||
| MR-2 | All support for the solution shall be provided from locations within the borders of the United States including customer service and non-client facing technology and infrastructure support personnel. | |||
| MR-3 | All data processed and stored by this solution shall only traverse networks contained within the borders of the United States. | |||
| MR-4 | Endpoint Detection & Response (EDR) or Anti-Malware protection software shall be installed on all systems supporting the solution. Please describe the specific software that the solution uses. | |||
| MR-5 | Solution shall support data in-transit encryption, including but not limited to: |
1. Client to server communications
2. Server to server communications
3. Database communications
4. API communications
5. List any unencrypted data-in-transit instances the solution requires MR-6 The solution shall support data encryption for all data at rest including:
1. Disk level encryption
2. Database/Storage/Share Encryption
3. File level encryption
| MR-7 | Solution shall be a web browser based application on a browser version supported by the leading browser market share vendors (e.g. Google Chrome, Microsoft Edge, Apple Safari, etc). |
| MR-8 | The solution product development teams shall not have access to production infrastructure and/or production data. |
| MR-9 | All application and system integration credentials shall be integrated with the County's external identity provider including: |
a. Application Service to Application Service credentials
b. Application Service to Database credentials
c. API credentials MR-10 The solution must prevent the following items from being stored/hardcoded within the source code:
1. Passwords
2. API keys
3. Certificates
4. Tokens
5. Hashes
6. Anything considered secret
| MR-11 | Solution shall support role-based access (RBAC) incorporating the principle of least privilege. | |
| MR-12 | All cryptographic functions performed within the solution (e.g., data encryption, key management, hashing, digital signatures) shall utilize FIPS 140-3 validated cryptographic modules. Any cryptographic module employed for data-in-transit or data-at-rest encryption, as well as authentication protocols, shall meet or exceed the requirements as defined in NIST FIPS 140-3 (Security Requirements for Cryptographic Modules) and NIST SP 800-131Ar2 (Transitioning the Use of Cryptographic Algorithms and Key Lengths). | |
| MR-13 | All solutions, systems, and applications within the environment shall not use the following deprecated or legacy protocols and ciphers, due to known security vulnerabilities and/or insufficient cryptographic protection: | |
| • | SSLv2.0/SSLv3.0 | |
| • | TLS 1.0/TLS 1.1 | |
| • | SMBv1/SMBv2 | |
| • | LM/NTLMv1/NTLMv2 | |
| • | FTP without TLS | |
| • | SSHv1 | |
| MR-14 | All reporting or application systems that generate electronic documents for public use shall ensure the content is accessible. Vendors must consider HTML or other web-based formats as the default. If PDFs are necessary, they must meet WCAG 2.1 Level AA standards and comply with Title II of the ADA. |
Version & Contact Last Updated: 5/5/26 v2.9
| Contact: | David Lindsay - david.lindsay@sdcounty.ca.gov |
| Melanie Caramat - melanie.caramat@sdcounty.ca.gov |
Project Req
| Requirement Number | Requirement Description | Supported | Comments |
| Project requirements | |||
| System Documentation Requirements | |||
| T-230 | Online help on system functionality is to be a component of the online system | ||
| T-231 | Online help can be searched based on screen, job function, process name, nouns so that user can find help by topic | ||
| T-232, P-165 | System documentation includes product user guides | ||
| T-233 | System documentation includes technical manuals | ||
| T-234 | System documentation includes data model, tables and attributes | ||
| T-235 | System documentation can be exported into a format that can be annotated electronically and then stored, i.e. product documentation does not need to be re-typed to create custom training material or custom business process documentation | ||
| T-236 | System documentation is available in electronic format that may be stored on county computers | ||
| T-238 | Custom documentation on business processes is developed as part of the project | ||
| T-239 | Custom documentation on configurations and customization made to base product are developed as part of the project | ||
| T-240 | Custom documentation on installation procedures for configurations, customization are developed as part of the project |
| System Training Requirements | |
| T-241 | Training materials need to be accessible online and indexed by job function or process name. |
| T-242, P-166 | Training materials include detail user steps to complete job functions. |
| T-243 | Training materials are provided in electronic format. |
| T-244 | Training class are defined, materials written, classes conducted for end user training, super user training and system application support staff are developed as part of the project |
| WW-189 | Training will be hands-on practical on the installed system, using helpful training documents. |
| Data Extraction, Data Conversion, Data Loading | ||
| T-245 | Data from existing EAM systems, custom Access databases, and excel spreadsheets is extracted, transformed and loaded into new EAM as part of the project | With error messaging on load problems |
| T-246 | Defining the data mapping from existing EAM data sources into the new EAM system is part of the project | |
| WW-190 | Data conversion services as required to transfer existing County data into the new EAM. |
&"Arial,Bold"&14&A
&"Times New Roman,Italic"&11Functional Requirements Page &P of &N &"Times New Roman,Italic"&11&D
&"Times New Roman,Italic"&11Functional Requirements Page &P of &N &"Times New Roman,Italic"&11&D
&"Times New Roman,Italic"&11Functional Requirements Page &P of &N &"Times New Roman,Italic"&11&D
File details come from the government source that posted it. Updated .