February 4, 2022

REQUEST FOR PROPOSAL

RP014-22

The Gwinnett County Board of Commissioners is soliciting competitive sealed proposals from qualified service provider for the Provision and Implementation of Enterprise Records Management Solution and Professional Services on an Annual Contract with Four (4) Options to Renew for the Department of Information Technology Services (DoITS).

Proposals must be returned in a sealed container marked on the outside with the Request for Proposal number and service provider name. Proposals will be received until 2:50 P.M. local time on March 18, 2022 at the Gwinnett County Financial Services - Purchasing Division – 2nd Floor, 75 Langley Drive, Lawrenceville, Georgia 30046. Any proposal received after this date and time will not be accepted. Proposals will be publicly opened and only names of submitting service providers will be read at 3:00 P.M. A list of service providers submitting proposals will be available the following business day on our website www.gwinnettcounty.com.

A WebEx pre-proposal conference is scheduled for 10:00 A.M local time on February 28, 2022. To access, dial 408-418-9388, enter Access Code +1-408-418-9388,,23477364228## . All potential service providers are urged to attend. Questions regarding proposals should be directed to Dana Garland, CPPB, FOII, NIGP-CPP at dana.garland@gwinnettcounty.com or by calling 770-822-8723 no later than 3:00 p.m. on March 3, 2022.

Proposals are legal and binding upon the bidder when submitted. One unbound single-sided original, six (6) bound copies, and one (1) electronic copy on a flash drive should be submitted.

Successful service providers will be required to meet insurance requirements. The Insurance Company should be authorized to do business in Georgia by the Georgia Insurance Department and must have an A.M. Best rating of A-5 or higher.

Gwinnett County does not discriminate on the basis of disability in the admission or access to its programs or activities. Any requests for reasonable accommodations required by individuals to fully participate in any open meeting, program, or activity of Gwinnett County Government should be directed to the ADA Coordinator at the Gwinnett County Justice and Administration Center, 770-822-8165.

The written proposal documents supersede any verbal or written prior communications between the parties.

Selection criteria are outlined in the request for proposal documents. Gwinnett County reserves the right to reject any or all proposals to waive technicalities and to make an award deemed in its best interest.

Award notification will be posted after award on the County website, www.gwinnettcounty.com and service providers submitting a proposal will be notified via email.

We look forward to your proposal and appreciate your interest in Gwinnett County.

Dana Garland, CPPB, FOII, NIGP-CPP Purchasing Associate III http://www.gwinnettcounty.com/ mailto:dana.garland@gwinnettcounty.com http://www.gwinnettcounty.com/

REQUEST FOR

PROPOSAL

RP014-22

Provision and Implementation of

Enterprise Records Management Solution and Professional Services

GWINNETT COUNTY, Georgia

RP014-22 Page 3 of 112

Contents

INTRODUCTION

BACKGROUND AND CURRENT ENVIRONMENT

Demographics Background and Intent Gwinnett Department of Support Services Gwinnett Department of Information Technology Services Gwinnett Computing Infrastructure Gwinnett Current Document Management, Records Management, ERP, Collaboration, and Line of Business Solutions County Records Retention Schedules

SCOPE OF SERVICES

Project Overview Component Systems Information Security Protection System Software and Hardware Cloud ERM Solutions Licensing/Subscription Requirements Implementation and Support Implementation Approach Site Preparation and Bandwidth Requirements Assessment

Project Management Change Management Documentation Configuration/Training Environment Acceptance Tests Performance/Stress Testing Requirements System Performance and Testing Requirements Reliability Testing Requirements Application Errors Error Reporting Warranty Support and Maintenance Training Post-Cutover Support

PROPOSAL RESPONSE REQUIREMENTS

PROPOSAL EVALUATION PROCESS

Selection Criteria Selection Process

RP014-22 Page 4 of 112

PROPOSAL RESPONSE FORMAT

PROPOSAL RESPONSE SECTION 1 – INTRODUCTORY DOCUMENTS

Cover Sheet Cover Letter and Executive Summary Table of Contents Proposal Compliance Table Addenda Signed

PROPOSAL RESPONSE: SECTION 2 ‐ EXPERIENCE AND QUALIFICATIONS OF THE

COMPANY

Identification Information Experience Information Financial Condition and Bank References Service Provider’s Customer References

PROPOSAL RESPONSE: SECTION 3 – SOLUTION DESCRIPTION

Solution Technical Architecture Cloud-based Architecture or Hybrid Hardware and Server Configuration Support for Legacy Content and Shared Drive Migrations Solution Security and Authentication Solution Interoperability Solution Maintenance and Support Availability and Reliability Solution Component – Professional Services

Solution Component - Capture Solution Component – Storage and Management Solution Component - Delivery Solution Component – Preservation Solution component – Interfaces and Integrations

PROPOSAL RESPONSE SECTION 4 - FUNCTIONAL REQUIREMENTS RESPONSE65

Functional Requirements Response Workbook Structure Completing the Functional Requirements Response Workbook

PROPOSAL RESPONSE: SECTION 5 ‐ IMPLEMENTATION AND PROJECT

MANAGEMENT

Project Management Testing Training

PROPOSAL RESPONSE: SECTION 6 ‐ ADDITIONAL SOLUTIONS

RP014-22 Page 5 of 112

PROPOSAL RESPONSE SECTION 7 ‐ PRICING

Pricing / Costs

GENERAL PROPOSAL INSTRUCTIONS

Proposal Response Submission Proposal Delivery Instructions Service Providers Expenses Contact with Employees and Others Use of Gwinnett County Stakeholder Names Contract Term

Payment Term

PROPOSAL RESPONSE SECTION 8 – RESPONSE FORMS

Proposal Compliance Checklist Gwinnett County Standard Documents

RP014-22 Page 6 of 112

INTRODUCTION

The intent of this Request for Proposal (RP014-22) is for Gwinnett County government, located in Gwinnett County (County), Georgia to obtain fixed-price proposals from service providers offering an Enterprise Records Management (ERM) software solution to support a formalized, Countywide approach to governance, storage, retention, retrieval and destruction of physical and electronic records and documents. The service provider shall provide Enterprise Records Management (ERM) Software, Software Maintenance, and Technical Support Services for DoSS/DoITS. The solution is required to be a commercial off-the-shelf (COTs) solution that will meet the functional requirements and criteria as described in this request for proposal which includes the solution and all services to implement and support that solution. The County is also interested in obtaining professional services and capabilities that will support the taxonomy and preliminary organization, governance, business flows, and other critical success items as outlined in the Solution Component – Professional Services section of this request for proposal. The County anticipates these services would be not only one of the first deliverables of the engagement, but also be repeated, along with testing activities as the solution is implemented in phases (based on departments or other delineations). These services’ capabilities will be considered in the overall evaluation;

however, the County reserves the right to purchase those capabilities and services at their discretion in total or in part and to solicit for these at a later date.

The County is interested in solutions that have a proven track record of providing enterprise records management as described by this request for proposal to other governmental jurisdictions of the same size and complexity as Gwinnett County. The proposed solution should meet the requirements outlined in the request, and the service provider should be prepared to demonstrate those capabilities prior to award. Note: commercial production systems or systems that are undergoing major functional changes or upgrades are not acceptable for industry-standard systems sought in this solicitation. Although the County is interested in implementing systems with a proven track record and implementation history, that does not exclude service providers from submitting alternate proposals that may utilize emerging technology whether on-premise, hosted, or cloud-based solutions to provide the best result for the County. Finally, all proposed solutions must comply with the existing Exhibit A - Security Requirements for Technology Purchases provided in the solicitation.

Conceptually, the proposed solution and services that will provide information governance across all County departments include records retention requirements, security of information assets, improved access to information used to support its business processes and make critical decisions, and higher levels of service to County constituents through capabilities like dynamic web forms, self-service applications, and web-based search of publicly available records. This is to include the following capabilities/component categories that all work together with no integrations, interfaces, or development required by either the County or the service providers:

• Professional Services,

• Capture,

• Storage and Management,

• Delivery,

• Preservation, and

• Interface/Integration.

RP014-22 Page 7 of 112

The categories include, but are not limited to, the following capabilities described for each.

Specific requirements and capabilities that comprise these categories are represented in the request for proposal document and subsequent addendums and workbooks.

• Professional Services

Professional services refer to the services that the service provider is proposing to implement the proposed solution (i.e., user training, administrative training, project management, and configuration assistance) and any supplemental services that are requested and recommended to assist in the organizing of data, creation and implementation of roles and responsibilities, creation and application of a standardized taxonomy and folder structure, and refinement of a core common metadata model.

• Capture

Capture capabilities are generally considered those that enable information from a source to be ingested into the ERM environment. This includes ingesting all various electronic structured and unstructured content as well as hard-copy paper records. In addition to the content itself, the ERM must be capable of capturing metadata (search and classification information; scanning and imaging of hard-copy content; optical character recognition (OCR); and electronic forms creation, processes, usage, and management).

• Storage and Management

Storage and management capabilities refer to features and functionality that provide a secure and shared repository of records and related content that support collaboration, administration of retention policies, and disposition management throughout the records lifecycle. In addition to the content repository/repositories, the ERM must be capable of providing library services, version control, security including roles and permissions, redaction and markup support, tracking and audit logging, collaboration enablement (internal and external), records management including retention policy administration, and workflow creation and processing to support business processes and services.

• Delivery

Content delivery capabilities refer to the features and functionality that provide for automated, transparent, and secure sharing, identification, and delivery of ERM content with end users, administrators, external parties, and other systems. The proposed solution is expected to include, but not be limited to, a means to provide automated distribution, alerts and notifications based on configurable triggers; execute data file transfers, support multimedia exports, and provide accessibility through mobile devices; provide federated queries and searches; support public access to artifacts (web services and Application Program Interfaces); expose metadata to workflows; enable and support field-level redaction; and support status and reporting through user-friendly interfaces, dashboards, and portals.

• Preservation

Content preservation refers to the features and functionality that provide for the handling and administration of content and records in a state of long-term and secure archival. The proposed solution is expected to include, but not be limited to, a means of automatically applying configurable and dynamic retention policies both physical and electronic in a

RP014-22 Page 8 of 112 holistic manner that efficiently uses County resources and ensures consistency with County standards and all regulatory requirements.

• Interfaces and Integrations

Interfaces and integrations refer to the features and functionality that provide ability for data and content to interact between the proposed solution and the appropriate legacy systems. The proposed solution is expected to include, but not be limited to, a means of automatically interfacing and/or integrating with the systems outlined in the corresponding section of the functional requirements, interrogatories, and Interface worksheet that are included in this request for proposal.

While the service provider can propose additional capabilities that make up the proposed solution, the County reserves the right to accept the proposed solution in part or whole, with or without considering any additional option functionality that is presented. The service provider should provide a solution that is highly configurable and includes installation, training, testing, user documentation, and cutover/operational support during reliability testing. Service providers should propose all relevant professional services, a solution warranty, and maintenance to include solution updates and services for all third-party services and interfaces.

The County expects all components listed above to be included in the proposal; however, the pricing and capabilities may be procured in part or total. It is anticipated that prospective service provider may opt to partner with other firms together for this solicitation to maximize the solution being proposed. As part of the service provider’s proposal, any relationships/partnerships with other service providers should state why these companies were selected and how they meet the experience and qualifications defined in this request for proposal. Sections and requirements should be responded to for every partner and component of the solution that is proposed.

The solution provided may be exclusive to the responding service provider or a combination of the service provider’s products and those of subcontractors and partners. The level of integration between major system components will be evaluated as a part of the scoring for the submitted proposal. The County expects that in the proposed solution with systems or components from different sources, the service provider will act as the system integrator and be responsible for overall implementation, any internal interfaces required, testing, and maintenance support of a turnkey solution.

The service provider and all subcontractors and partners that have components of the solution are required to meet the minimum qualifications contained in Proposal Response including that of Experience and Qualifications of Companies.

Service providers shall provide detailed responses to interrogatories in request for proposal.

Those responses should be inclusive and call out all elements of the solution in the respective sections.

Service Providers shall provide a complete and total response to each of the functional requirements listed in Exhibit B – ERM Functional Requirements Response Workbook as well as pricing in the format prescribed in this document. Any functional requirement indicated as “Yes - fully meets” or “Yes - partially meets” is subject to a demonstration being required to evidence how that functionality is provided.

RP014-22 Page 9 of 112

BACKGROUND AND CURRENT ENVIRONMENT

This Section of the request for proposal provides background on Gwinnett County, the Department of Information Technology Services, the Department of Support Services, relevant systems in operation in the current environment, and the planned future environment.

Demographics

According to the U.S. Census Bureau, Gwinnett County's estimated 2019 population is 936,250. The County has experienced double and triple-digit population growth every Census since the 1950s and is ranked as one of the fastest-growing counties in the U.S. as well as being the second largest county in Georgia.

The Gwinnett County Government takes a business approach to run the County and continuously strives to improve the services the County provides to County agencies, businesses, and residents. The importance of this mission increases as technology becomes ever more tightly integrated into all facets of operating the County. The Information Technology (IT) component of the proposed solution the County seeks must consider lifecycle management for cross-organizational consistency.

Background and Intent

Gwinnett County seeks to provide information governance across all County departments including records retention requirements, security of information assets, improved access to information used to support its business processes and make critical decisions, and higher levels of service to County constituents through capabilities like dynamic web forms, self-service applications, and web-based search of publicly available records.

Through an ERM Assessment, the current state of the County’s information governance can be characterized by:

• Duplicate digital assets in multiple places

• Need for federated search and query across disparate sources of structured and unstructured content

• Reliance on email as a collaboration, business workflow, and document storage creating isolated silos of information

• Lack of standard structures and secure locations for storing digital records

• Records retention policies not being applied consistently (especially for digital records)

• Paper-intensive and manual processes (i.e., paper forms, wet signatures)

• Need for redaction capabilities to support Open Records requests

• Need to store and manage sensitive data (i.e., PCI, PII, HIPPA)

• Open Records requests

Gwinnett Department of Support Services

The Department of Support Services, Records Management Section, has overall responsibility for the County’s records management and storage. Versatile Professional is currently used for managing physical records in the County’s Records Center and has limitations for tracking, workflow, and auditability for an organization as large as Gwinnett County. The Versatile Professional software currently manages over 71,000 boxes of paper records. In addition to the physical records, another 50 million electronic records are estimated to exist throughout

RP014-22 Page 10 of 112 the County. An Inventory Assessment and resulting gap analysis were compiled in 2020. The inventory data will be made available to the awarded service provider to inform their implementation and professional services efforts.

Gwinnett Department of Information Technology Services

The Department of Information Technology Services (ITS) is responsible for leading the implementation of the Digital Strategy as well as providing support and delivery of technology solutions and innovations throughout the County. The department is made up of over 150 business and technology professionals that deliver innovations and services to all County departments.

Gwinnett Computing Infrastructure

Technology Type Current Technology On-premises Email Gateway Proofpoint Security Current Technology Data Loss Prevention Microsoft DLP Network Current Technology Cloud Email Gateway Proof Point Multi Factor Authentication Microsoft MFA Protocols Current Technology Directory Services Standard LDAP, Active Directory (AD), Azure AD (AAD) Software Current Technology Productivity Microsoft 365 Apps ERP SharePoint Document Repository FileNet, SharePoint, OneDrive Email, Calendar, Task Platform Microsoft Exchange Online Internet Browser Microsoft Edge Mobile Device Management Microsoft Intune

The current County requirements related to infrastructure and information security can be found in Exhibit A - Security Requirements for Technology Purchases of this request for proposal. As indicated in the response requirements, all service providers are required to comment on their adherence to those requirements and callout specifically any and all exceptions or clarifications to that end.

ITS supports over 4,500 personal computers, approximately 950 Microsoft Servers, 110 physical network locations, and approximately 5,000 telephony devices throughout the County. Production servers are managed within a 24/7/365 Data Center environment and are virtualized using VMware vSphere and ESX environments.

County workstations are a mixture of Windows 7, Windows 10, and Microsoft Office 2010/2013/2016/2019/365. Microsoft Windows 2010 is the current County standard.

The standard server operating system (for this solicitation) is Windows Server 2016 and Microsoft SQL Server 2016.

The County uses Microsoft 365 Applications to support authoring and editing desktop tools for County staff. The County’s Microsoft 365 is hosted in the Government Community. The Microsoft 365 tenant is synchronized with the County’s on-premises Active Directory (AD).

RP014-22 Page 11 of 112

The County’s email solution is Microsoft Exchange Online. Microsoft SharePoint 2019 is currently deployed to support the County’s Intranet and departmental document libraries to a limited degree. Migration to SharePoint Online is planned for the 2022 fiscal cycle.

The County’s network consists of a Gwinnett County fiber network that includes a 40 GB fiber connection between its two data centers (the 911 Center and Gwinnett County Justice and Administration Center), and 2 GB fiber connections between the Gwinnett Justice and Administration Center and other County facilities. The existing wider area network also includes an AT&T Switched-E Wide Area Network (WAN), 10GB internet access, and 100 MB Application Program Interface (API)/Access Point Name (APN) gateway provided by AT&T.

The County uses Environmental Systems Research Institute (Esri), ArcGIS v10.5.1, to maintain its GIS data.

Remote Access and Network Security Remote access are managed/provided through the County’s Infrastructure Team using Palo Alto Global Protect VPN hosted in the AT&T Global Secure Gateway with a Citrix NetScaler deployed as a secondary VPN backup.

Scanning is completed by staff using multi-function devices and scanning to shared network storage drives and or email. FileNet, Kofax, is used for both single user and scripted batch scanning.

Gwinnett Current Document Management, Records Management, ERP, Collaboration, and Line of Business Solutions

Gwinnett County has several solutions in place and under implementation that are relevant to the ERM being solicited. A summary of their state and use is provided below.

NOTE: While the County is not explicitly seeking to replace any or all the legacy content-related systems listed below (i.e., SharePoint, FileNet, Versatile, etc.) with the service provider’s proposed solution, the service provider is expected to identify if the solution would enable consolidation of existing legacy content management solutions. Likewise, any dependencies or required integrations with legacy systems are also to be explicitly included as part of the response in the solution section. The County may consider replacing current content management systems at their discretion and if, and only if, the proposed solution provides same or better capabilities at a price point and level of effort that makes sense to do so.

ENTERPRISE CONTENT RELATED SOLUTIONS

• Versatile Enterprise (Zasio)

Current User Base: The Department of Support Services uses and manages this solution.

Versatile Enterprise (VE) is the County’s current physical Records Management software that was instituted to track and apply retention periods to the physical records archived in the County’s Records Center. The program has additional configurable options that have not been implemented.

Within the past few years, Zasio has updated the program and promoted it as both a physical records management program that is capable of handling the County’s digital records. However, a recent ERM assessment of the product set has found that it is lacking

RP014-22 Page 12 of 112 in several of the ERM requirements specified in this request for proposal, especially as it relates to managing digital records and the full records lifecycle. VE does not perform as a unified search platform for the support of Open Record Requests or litigation discovery.

During a recently conducted ERM Assessment, County staff reported the following issues leading to inefficiencies and for which improvements are expected available with the proposed solution:

o Difficulty locating records in the system because the key words used to index the document for searches is “free-form” and subject to the discretion of the staff member entering the document rather than being supported by a drop-down value list.

o A broad search result in VE requires staff to open each electronic document, which is labor intensive.

o Allowance for only one “event date” or trigger for the start of the retention period. This may cause staff to keep records in the file too long (using the last received date as the trigger), not long enough (using the first received date); or may require a manual investigation of the retention period for each document in the file, which is labor intensive.

o Lack of scalability as the solution was architected as a departmental solution and has not been proven to handle the number of users or volume of records required by the County.

• SAP (SAP)

Current User Base: This is an Enterprise-wide solution managed by DoITS.

SAP is the County’s current Enterprise Resource Planning (ERP) solution of which the County has purchased and implemented the following modules:

o Business Warehouse (BW) – v7.4 o Business Objects (BI/Reporting) – v4.2 o Supplier Relationship Manager (SRM) – v7.0 o Customer Relationship Manager (CRM) – v7.0 o ERP Central Component (ECC) – v6.0, including:

Financial Accounting (FI) Human Resources (HR) Materials Management (MM) Production Planning (PP) Quality Management (QM) Customer Service (CS) Utilities (I-SU)

Gwinnett County is scheduled to replace a large portion of this system with another industry-leading ERP system in 2022.

• GovQA (Granicus)

Current User Base: This solution is managed by the Law Department.

GovQA is a Public Records Request Management software that the County uses to address Freedom of Information Act (FOIA) requests (Open Records requests).

RP014-22 Page 13 of 112

• FileNet P8 (IBM)

Current User Base: This solution is used by multiple departments and managed by DoITS.

The County implemented IBM FileNet that is used primarily for the submission of agenda items to the Board, invoicing, and employee performance reviews. The County has just upgraded both the FileNet document management software and the hardware and software platforms on which it runs. The infrastructure has been enhanced to provide a high availability architecture. IBM FileNet is used by some County departments and those users reported that they are satisfied with the functionality that it provides and find it easy to use. The Records Management component of FileNet has not been acquired by the County. The County has acquired multiple components that support the integration between IBM FileNet and the County’s current SAP ERP solution. A schematic that shows the current IBM FileNet implementation is shown in Figure A.2-1. The County is open to replacing the solution if and only if the proposed solution meets or exceeds the capabilities of the current system (FileNet).

• Kofax (Kofax)

Current User Base: This solution is used by multiple departments and managed by DoITS.

The County uses Kofax to perform and manage the scanning of documents that are stored in FileNet. While some departments, such as the Sheriff’s Office, use LaserFiche for line-of-business scanning, Kofax is the current enterprise standard being used for the scanning into this content repository (FileNet). Kofax is used to scan approximately five million pages a year. The County may consider replacing the solution (Kofax) at some time in the future.

RP014-22 Page 14 of 112

Figure 1 Current IBM FileNet Document Manager System Configuration

Note: 911 and GJAC refer to the two County Data Centers – the 911-Center and the Gwinnett Justice and Administration Center.

RP014-22 Page 15 of 112

• SharePoint 2019 (Microsoft)

Current User Base: This is an Enterprise-wide solution managed by DoITS.

The County uses MS SharePoint for its Intranet and Departmental Sites and some collaboration within and among department staff. The impacts of COVID-19 have increased interest in SharePoint, Microsoft Teams, and Microsoft OneDrive to support remote collaboration. The County is in the process of migrating to SharePoint Online in 2022 and is interested in learning about the service provider’s proposed ERM solution’s ability to manage these collaborative records.

MOST RELAVENT LINE OF BUSINESS SOLUTIONS

• Accela (Accela)

Current User Base: This application is used by multiple departments and managed by DoITS.

The County uses the Accela software to manage and track planning and permitting processes including application, plan reviews, plan approvals, and building inspections.

Accela is used by multiple County departments. The Departments of Water Resources, Planning and Development, Fire and Emergency Services, Support Services, and others use Accela to support their planning and permitting processes but must manually enter related information into SAP from the processes supported by Accela. Currently, there are approximately 1,850,000 documents in Accela including document types such as plans, inspection reports, permits, receipts, and violation reports. These documents occupy approximately 1.5 TB of storage space in the system. Some digital content managed by Accela has long retention requirements (e.g., fire inspection reports that must be kept for the life of the facility).

In 2021, the County migrated to Accela online. A current Accela Enhancement project underway is looking to improve the multi-departmental use of Accela, sharing information between departments, and reducing manual keying from one system to another. In addition, numerous enhancement efforts are in-flight to increase functionality for those various departments. The County is interested in understanding how the ERM might be an intersection application that provides an integration point to facilitate multi-departmental access to information and integration between ERM and line of business software.

• ArcGIS (Esri)

Current User Base: This is an enterprise-wide solution managed by DoITS.

The County uses ArcGIS v10.5.1 that provides access to over 100 data layers that combine the use of parcel mapping, ortho photography, and planimetric mapping to maintain the GIS data layers and features related to GIS locations within Gwinnett County boundaries.

The County’s future vision includes using a GIS-based view to provide access to the County’s records and documents.

• Laserfiche

Current User Base: This application is licensed to 15 users in the Sheriff’s Office and managed by the Sheriff’s Office.

RP014-22 Page 16 of 112

The County uses Laserfiche for storing and retrieving inmate documents. Documents include, but are not limited to, booking records, court records, bond records, etc. Once the inmate is no longer in Gwinnett County’s custody, the Sheriff’s Office scans all inmate documents to the Laserfiche database. In addition to this, the Sheriff’s Office scans current inmate documents such as inmate grievances. The Sherriff’s Office has 15 licenses that enable those users and their associated stations to use the full functionality of the software that includes the ability to perform the following: scan, upload, store, retrieve, email, and detach sensitive information about the inmate that is not public record such as social security numbers. Other users have basic functions such as searching, retrieving, and reviewing inmate records. Those do not require a license.

• Lucity (CentralSquare)

Current User Base: This application is used by several departments and managed by DoITS.

Lucity is the asset management/work order management system implemented by the Departments of Water Resources, Community Services, and Support Services to track assets and maintenance records. Lucity does not allow for records to be appended to the asset file, and manual data entry is required when work orders are completed. Staff members suggested that Lucity users do need to use/reference supporting documents and that Lucity could be an ideal capture point if integrated with the ERM solution. This would allow users to scan and track records from the asset repair history (i.e., certificates, photos, drawings). This would make them readily available to maintenance staff rather than having the repair orders in Lucity and the other pertinent records stored on County shared drives.

• Odyssey (Tyler)

Current User Base: This application is used by all Gwinnett County Courts and managed by the Clerk of Courts.

The County began using Odyssey as their Case Management software in 2019. Odyssey is an on-premise, web-accessible product suite that delivers a comprehensive, end-to-end courts and justice software solution that automates court processes and related case management requirements. County Judges and their staff can access and enter information about cases into Odyssey. Many of the case records, including those involving estates and guardianship/conservatorship, have long to permanent retention requirements.

• Public Safety Systems

Current User Base: This application is used by several Public Safety departments and managed by DoITS.

The County is in the process of implementing CentralSquare’s Public Safety Suite Enterprise. This system includes 911, Computer-Aided Dispatch (CAD), Records Management Systems for Law Enforcement and Fire, Mobile CAD, and a variety of other capabilities and systems such as Alarm Reduction software and interfaces to over 40 integrations. Additional video records are housed and managed within two additional public safety systems: Evidence.com and a new Situational Awareness and Crime Response System (IBM solution being used to support this operation.)

RP014-22 Page 17 of 112

• uPerform

Current User Base: This application is used by several departments and managed by DoITS.

uPerform is a content development tool that allows users to create, edit, distribute, and manage content including documents, recording simulations, and eLearning courses.

uPerform is used by Departments of Human Resources (new hire orientation and training), Water Resources (DWR) (safety and awareness), Financial Services (Procurement Card Training), and Information Technology Services (BW reporting and application training).

Every employee has a uPerform account and has access to view publications. We currently have approximately 50 creators and two administrators. The County uses this platform to deliver content pertaining to training, safety, and reading comprehension for exams.

RELATED FUNCTIONALITY PROVIDED BY EXISTING SOLUTIONS

• Automated workflows are available in the following current systems:

o DocuSign o SharePoint o Accela o Nintex o Adobe o Microsoft Power Apps (Workflow)

• Electronic signature is available in the following current systems:

o DocuSign o Adobe Sign o Microsoft Word

• Electronic fillable forms are enabled by the following current systems:

o DocuSign o Nintex (internal only) o LifeRay o Microsoft Power Apps o Additional systems have eForm capabilities specific to use within those applications (i.e., NeoGov, Odyssey, UPerform, AssetWorks, e-Builder, Accela, Lucity, etc.)

• Redaction is available for specific record types within the business line applications such as the public safety solution, evidence storage systems, and in GovQA, but it is not available at an enterprise record management level at this time.

• Self-Service public records access is available to various degrees through several line-of-business solutions (i.e., Tax Assessor, Tax Commissioner, Department of Water Resources, and Police Department). Open records requests are currently made via the Gwinnett County website.

• Digital Asset Management is available to various degrees through several line-of-business solutions (i.e., Public Safety Solution (CentralSquare), Evidence.com, and other systems that house or manage video and camera footage).

County Records Retention Schedules

Service providers must review the records retention schedules used by the County to clearly understand the records management requirements related to retention management, disposition management, and archive requirements related to both digital and physical

RP014-22 Page 18 of 112 records. Special attention must be paid to the way event-driven retention periods and requirements are stated and to the schedules in their entirety as the County desires to be able to centrally manage schedule changes, updates, and deletions.

The County follows the Georgia Archives Local Government and Judicial Branch Schedules to manage its records. These schedules can be found at the following links:

• https://www.georgiaarchives.org/records/local_government/

• https://www.georgiaarchives.org/documents/JudicalSchedules.pdf https://www.georgiaarchives.org/records/local_government/ https://www.georgiaarchives.org/records/local_government/ https://www.georgiaarchives.org/documents/JudicalSchedules.pdf

RP014-22 Page 20 of 112

SCOPE OF SERVICES

Project Overview

The County is procuring a commercial off-the-shelf (COTS) solution that will provide Enterprise Records Management including, but not limited to, the following capabilities: categorization of captured records; records storage and management; records delivery; and records preservation.

The service provider is to include all hardware, software, subscriptions, implementation, support, and professional services that will result in a highly successful and scalable solution.

In addition, the proposed solution should include any and all interfaces and integrations necessary to support streamlined and efficient processes between existing systems and the proposed solution.

Component Systems

The County expects the service provider to provide all the components necessary for a fully functioning solution for each solution component and the collective solution of all those components working together as a single solution. The solution provided can include components from multiple manufacturers and providers; however, the service provider is responsible for providing a single solution response that is complete and meets all requirements. The level of integration between major system components will be a proposal evaluation factor. The County anticipates that in a proposed solution with components from different sources, the service provider will act as the system integrator and be responsible for overall implementation, any internal interfaces required, testing, training, and maintenance support of the complete solution.

As outlined in this request for proposal, the County’s desire and expectation are that the proposed solution, including any subcontractor applications, partners, and others delivering elements of the solution, will be best-of-breed and highly configurable. The County anticipates selecting the ERM solution that meets the optimal number of its functional specifications with standard system functionality at the best value for the County.

The proposed solution must enable the business outcomes outlined below.

• The solution results in a fully documented and functioning ERM governance standard that can be administered and managed using the proposed technology components of the solution. This includes taxonomy, disposition, archival, retention, destruction, and audit processes.

• The solution supports the reduction in physical document storage requirements.

• The solution supports the County’s ability to comply with federal, state, and county laws and regulations (retention requirements, open record requests, legal holds, etc.).

• The solution provides for efficient record/document (structured and unstructured) capture, storage, identification, and retrieval.

• The solution provides the ability to create and execute automated workflows and improved tracking including fully auditable records management and chain of custody tracking.

• The solution provides for highly secure document and records storage that meets or exceeds the information security guidelines included in the request for proposal, addenda, document, and functional requirements workbook.

RP014-22 Page 21 of 112

Information Security Protection

The County requires that the service provider propose a solution that provides protection against service disruption caused by ransomware in addition to the traditional Continuity of Business provisions. Such protection could use a tiered replication model where the third-tier synchronization lags behind the near real-time replication of the lower tiers. Alternatively, the approach could also include using an offline Disaster Recovery model. The service provider is responsible for providing detailed responses to interrogatories and responding to all related functional requirements in Exhibit B – ERM Functional Requirements Response Workbook.

Further, the service provider should agree to adhere to the requirements and policies outlined in Exhibit A - ITS-SST-006 Security Requirements for Purchases Standard. Any exceptions the service provider takes to the Security Requirements must be explicitly and thoroughly citied as part of the response. In addition to meeting any of the Standards outlined in Exhibit A - Security Requirements for Technology Purchases, the proposed solution must provide proof of certification as a DoD5015.2 system and must be listed on the Joint Interoperability Testing Command register as such. Finally, the proposed solution(s) must be able to comply and work with the end-point protection and other security requirements of the County.

System Software and Hardware

The service provider will propose all necessary hardware and software to ensure that the proposed solution will perform at its optimum capabilities for the users and those that interact with the system.

The County requires that service provider’s response to this request for proposal includes a turnkey system configuration necessary to meet the functional and operational requirements of this request for proposal consisting of items as outlined in the response.

If applicable, the County requires Cisco Network switches for any connectivity between the proposed infrastructure and the County’s network. In addition, the County’s preference is for hyper-converged (HCI) fully virtualized environments. As a result, the service provider should consider this type of architecture when proposing the infrastructure required for the proposed solution.

The County expects that the proposed pricing for all hardware and system software will be highly competitive and consistent with the State of Georgia and Gwinnett County hardware purchasing agreements.

Cloud ERM Solutions

The County is equally interested in either an on-premise or cloud-based (SaaS, IaaS, PaaS) offerings of an ERM solution. The County’s long-term strategy is to move in support of cloud-based options; therefore, cloud-based solutions will be scored accordingly in comparison to on-premise and hybrid solutions.

Protection of County information must be an integral part of the service provider’s proposed cloud ERM solution to ensure that there is no inappropriate use of County information at any time. Any County information in the cloud ERM solution remains the property of Gwinnett

RP014-22 Page 22 of 112

County. At no time must any information, belonging to or intended for the County, be copied, disclosed, or retained by the service provider for any purpose other than County business. The service provider must not use any personal information collected in connection with the services performed for the ERM solution for any purpose other than fulfilling the required services of the ERM solution.

The County requires that all County data (including directory data and metadata) stay within the continental United States at all times (at rest and in transport). The service provider must meet the following criteria, at a minimum, to ensure appropriate data protection safeguards are in place at all times:

• Ensure that County information is protected with reasonable security measures.

• Promote and maintain an awareness of the security needs of the County’s information among the service provider’s employees and agents.

• Safeguard the confidentiality, integrity, and availability of County information.

• Provide the County with full and unlimited access to County documents and records at all times.

• Make County information and processes available to third parties only with the express written permission of the County and/or through County-controlled applications.

• Ensure that the County’s backed‐up data is not commingled with other cloud service customer data.

• Ensure that appropriate security measures are put in place to protect the service provider’s internal systems from intrusions and other attacks.

• Encrypt all non‐public data in transit to the Cloud.

The service provider should indicate if it is certified as ISO and International Electrotechnical Commission (IEC) 27001, ISO 27002, and/or ISO 27017 standards for information security management systems.

When the destruction of digital records is performed based on the County’s ERM retention rules, the records must be destroyed according to the National Institute of Standards and Technology (NIST) approved methods.

The hosting site environment must also be robust in terms of reliability and safety. The service provider should discuss aspects of its hosting environment such as redundant power; fire suppression; 24 hours per day/365 days per year on‐site security; redundant Internet connectivity; redundant firewalls; VPN services; secured remote access methods; fault-tolerant internal network architecture, clustered central file, and database servers; load‐balanced application and web servers: backup strategies, and 24 hours by 365 days per year monitoring of all services and servers.

At a minimum, the service provider should provide documentation of internal and external security controls, compliance level to industry standards, security processes, and technical safeguards. The service provider should also discuss procedures for addressing a security breach, system patching, and major upgrades.

RP014-22 Page 23 of 112

Licensing/Subscription Requirements

Gwinnett County currently employs approximately 5,900 people. This represents roughly a 5% two-year growth from 2019-2020. The Gwinnett County ERM project scope is to implement the ERM system over time, using a department-by-department repeatable process that defines necessary taxonomy and record retention mappings, digitizes certain paper collections to support digital processing moving forward, and migrates digital content into the ERM repository from shared network drives.

The County asks that pricing be provided for the users as outlined in Exhibit C – ERM Pricing Response Workbook. The County is also asking for the ability to add up to the full enterprise as contributors to the content available to the records management system. As a result, the County will also require the per user license cost included in the pricing response – supplied under separate cover. These would be the users who regularly interact with the ERM. Eventually all employees may need to access the solution should it be used as a full content management solution. To keep cost comparisons consistent between responses, specific license counts that will be used for scoring are provided in Exhibit C – ERM Pricing Response Workbook.

Implementation and Support

The service provider, with appropriate involvement from the County, must perform all tasks required to install and implement the proposed system including all hardware/software installation, service provider configuration, instruction, and guidance on user configuration, testing, training, and construction of interfaces and support for system cutover. While some meetings may be conducted virtually, the service provider should expect these would be the exceptions and that all aspects of the professional services, implementation, project planning, and management would be supported by in-person meetings at one of the County locations.

Implementation Approach

The County seeks to understand the service provider’s recommendations with regards to the identification of predatory requirements for the ingestion of the new solution as well as how the implementation should be structured to ensure that the resulting solution will enable all the business goals to be achieved and functionalities and capabilities available. The County anticipates a phased approach that includes: (1) professional services to support ensuring the business processes, workflows, taxonomy, and other critical success factors; (2) purchase, configuration, and implementation of the technology solution (ERM); and (3) the operationalizing of the solution in the form of applying best practices and ongoing support.

Site Preparation and Bandwidth Requirements Assessment

As part of the response, the service provider shall provide the minimum and maximum bandwidth requirements as well as other permitted ranges of environmental variations necessary for the satisfactory operation of the…