RP034_25 INV.pdf

October 16, 2025

REQUEST FOR PROPOSAL

RP034-25

The Gwinnett County Board of Commissioners is soliciting competitive sealed proposals from qualified service providers for Provision and Implementation of an Agenda Management Solution on a Multi-Year Contract for the Department of Information Technology Services.

Proposals must be returned in a sealed container marked on the outside with the Request for Proposal number and Service Provider Name. Proposals will be received until 2:50 P.M. local time on November 12, 2025 at the Gwinnett County Financial Services - Purchasing Division – 4th Floor, Charlotte J. Nash Building, 75 Langley Drive, Lawrenceville, Georgia 30046. Any proposal received after this date and time will not be accepted. Proposals will be publicly opened and only names of submitting Service Providers will be read at 3:00 P.M. A list of Service Providers submitting proposals will be available the following business day on our website www.gwinnettcounty.com.

Questions regarding proposals should be directed to Bethany White at Bethany.White@GwinnettCounty.com or by calling 770-822-5149 no later than 3:00 p.m. on November 3, 2025. Proposals are legal and binding upon the service provider when submitted. One (1) unbound single sided original, six (6) bound copies, and one (1) electronic copy on a flash drive should be submitted.

Successful service providers will be required to meet insurance requirements. The Insurance Company should be authorized to do business in Georgia by the Georgia Insurance Department and must have an A.M. Best rating of A-7 or higher.

Gwinnett County does not discriminate on the basis of disability in the admission or access to its programs or activities. Any requests for reasonable accommodations required by individuals to fully participate in any open meeting, program or activity of Gwinnett County Government should be directed to the ADA Coordinator at the Gwinnett County Justice and Administration Center, 770-822-8165.

The written proposal documents supersede any verbal or written prior communications between the parties.

Selection criteria are outlined in the request for proposal documents. Gwinnett County reserves the right to reject any or all proposals, to waive technicalities, and to make an award deemed in its best interest.

Award notification will be posted after award on the Gwinnett website, www.GwinnettCounty.com and service providers submitting a proposal will be notified via email.

We look forward to your proposal and appreciate your interest in Gwinnett County.

Bethany White Purchasing Associate II

The following pages should be returned as part of your proposal document:

References, Page 41 Code of Ethics Affidavit, Page 54 Contractor Affidavit and Agreement, Page 55 http://www.gwinnettcounty.com/ mailto:Bethany.White@GwinnettCounty.com

RP034-25 Page 2

INTRODUCTION

The Gwinnett County Board of Commissioners (County) is soliciting i competitively sealed proposals from qualified service providers for a Commercial-Off-The-Shelf (COTS) cloud-based Agenda Management Solution. The cloud solution must enable a holistic approach to agenda management that can be used by all County departments. Emphasis is to be placed on process automation and simplification of the entire life cycle of agenda items. The solution is required to be a Software as a Service (SaaS) solution that will meet the functional requirements and criteria as described in this request for proposal.

The table below outlines what components will require compatibility.

Major functional are or component

Compatibility or Replacement

Agenda creation and routing Replacement Meeting management Replacement Live stream audio on and visual Compatibility with current recording equipment as outlined in the functional requirements Website graphical user interface (GUI) Replacement or compatibility with existing website GUI as described in Section 2.4 and various Functional Requirements in Exhibit B.

Other functional areas as described in the RFP Replacement of other capabilities with interfaces as indicated in Exhibit B Functional Requirements.

The County is interested in solutions that have a proven track record of providing the necessary functionality described by this proposal to private practices and/or other government jurisdictions of similar size and complexity as the County. The proposed solution should meet the requirements outlined in the request for proposal and the service provider should be prepared to demonstrate those capabilities during an in-depth demonstration, should the County request this during evaluation.

Note, commercial production systems or systems that are undergoing major functional changes or upgrades, are not acceptable for industry-standard systems sought in this solicitation.

The County intends to award a contract for this proposal to one (1) service provider. There are no expressed or implied obligations for the County to reimburse responding service providers for any expenses incurred in preparing proposals in response to this solicitation. The full cost of proposal preparation and interview presentation (if required) is to be borne by the proposing service provider.

Proposals should be signed in ink by a company official who has the authority to commit company resources

The request for proposal and the successful proposal will become part of a written contract between the County and the proposing service provider. The contract shall be on forms supplied by the County.

A sample contract has been included for review by the service provider.

Finally, all proposed solutions must comply with the Exhibit A – Security Requirements for Purchase and list any exceptions or the proposal response may be deemed non-responsive and not scored by the County.

RP034-25 Page 3

BACKGROUND AND CURRENT ENVIRONMENT

This section of the proposal provides background on the County, the current agenda management solution and relevant systems in operation in the current environment, as well as the planned future environment.

County Background

Gwinnett County, Georgia is a suburban county, located approximately 30 miles northeast of Atlanta, Georgia. The County has an estimated population of approximately 1,020,157. Currently, the County has a total of 6,105 authorized positions, including appointed and elected officials.

The governing authority of the County consists of a five-person Board of Commissioners, including a full-time chairman elected at large and four Commissioners elected on a district basis. The County operates under the County Administrator form of management and has thirteen operating departments. The County Administrator reports directly to the Board and oversees the activities of the appointed County department heads. In addition, the County Administrator's Office also acts as a liaison for the Board with other elected officials.

Gwinnett County government provides a wide array of services to its residents including "traditional" county government functions such as construction and maintenance of roads and court-related activities, as well as municipal functions such as police, fire, recreation, emergency services and water/waste services. The County Organizational Chart is shown below.

RP034-25 Page 4

Gwinnett Department of Information Technology Services

The Department of Information Technology Services (DoITS) is made up of over 200 business and technology professionals that deliver innovations and services to all County departments. DoITS is responsible for providing support and delivery of technological solutions and innovations throughout the County Government. This includes the technology that supports the current Agenda Management processes which are currently supported by customizations made to our FileNet solution with support from a variety of other enterprise products such as Microsoft Office.

Gwinnett Department of Information Technology Architecture and Environment

The County’s network is managed by the County Department of Information Technology Services.

The network supports all County departments, including the Board of Commissioners. The County’s existing network topology consists of a logical layer operating over a physical layer. The logical layer is firewalled between members and operates in a restrictive manner, allowing only approved connectivity. The physical layer uses a hub-and-spoke architecture with links provided by County-owned fiber, as well as metered connections from a network vendor.

The County Network Core consists of two primary sites: the Gwinnett County Justice and Administration Center (GJAC) and the Gwinnett County Police Department (GCPD) Annex, each with dual high-speed connections. The remote nodes have redundant connections to the Core. The County has established a data replication failover to the Alternate 9-1-1 Center at the Bay Creek District Office to support Public Safety Computer Aided Dispatch (CAD) applications.

The current County ecosystem that includes the relevant technologies for this proposal shown in the table below.

Technology Type Current Technology On-premises Email Gateway Proofpoint Security Current Technology Data Loss Prevention Microsoft DLP Network Current Technology Cloud Email Gateway Proofpoint Multi Factor Authentication Microsoft Azure Cloud Protocols Current Technology Directory Services Standard LDAP, Active Directory (AD), AzureAD Software Current Technology Productivity Microsoft 365/Windows 11

ERP (Before July 2026) Oracle Fusion Cloud for Financials SAP for Human Resources Capital

ERP (After July 2026) Oracle Fusion Cloud (Financials & HR) Document Repository FileNet, SharePoint Email Communications Platform Microsoft Exchange Online Internet Browser Microsoft Edge Document digitization and workflow DocuSign Mobile Device Management Microsoft Intune Gwinnett County website:

www.gwinnettcounty.com Liferay DXP portal

Table 1 – Technology Ecosystem

RP034-25 Page 5

Gwinnett County Current Agenda Management and Public Meetings Information

The County holds and participates in numerous standing and ad-hoc public meetings that require Agenda Management support. For example, the Planning & Development department alone manages the following boards, committees and associated workflows: Planning Commission, Zoning Board of Appeals, Board of Construction Adjustments and Appeals, Development Advisory Committee, Tree Advisory Committee, and the Licensing and Revenue Board of Appeals.

Samples of current meeting information for the County can be found at the URLs below. Numerous other sites contain meeting schedules and other relevant information available to the public and internal users.

• Planning & Development Public Meetings page of the the County website:

(https://www.gwinnettcounty.com/departments/planningdevelopment/documents/publicme etings).

• Board of Commissioners (BOC) Public Meetings page of the the County website:

(https://www.gwinnettcounty.com/departments/boardofcommissioners/publicmeetings/- /bacs/meetings/52).

• Gwinnett County Board of Registration & Elections Public Meetings page of the the County website:

(https://www.gwinnettcounty.com/departments/communityservices/publicmeetings/- /bacs/meetings/6/)_

• Public Meetings BOC page of the County website:

(https://www.gwinnettcounty.com/departments/boardofcommissioners/publicmeetings)

Boards meetings. meeting agendas, and resulting meeting minutes and that are published on websites are administered using Gwinnett County website administrative modules.Currently agenda documentation is housed and managed within the FileNet solution. Customized workflows have been established, along with disparate templates for several different meeting types. Audio and visual needs for meetings are met using both the Department of Information Technology Services and Communications Department resources.

https://www.gwinnettcounty.com/departments/planningdevelopment/documents/publicmeetings https://www.gwinnettcounty.com/departments/planningdevelopment/documents/publicmeetings https://www.gwinnettcounty.com/departments/boardofcommissioners/publicmeetings/-/bacs/meetings/52 https://www.gwinnettcounty.com/departments/boardofcommissioners/publicmeetings/-/bacs/meetings/52

RP034-25 Page 6

SCOPE OF SERVICES

Project overview

The County is procuring a cloud-based solution to automate and streamline the process of creating, distributing, and managing meeting agendas. It should include capabilities like agenda document creation consistent with County processes and templates, automated notifications, document management, and integration with other systems.

Key features of this solution should include:

• Agenda creation. Support within a single solution to generate and format agendas that utilize County-defined templates and facilitates the need to include an unlimited set of attachments. Build, edit, and distribute meeting agendas with customizable templates. Compile agenda packets of hundreds of pages including maps.

• Content and document management. Ability to store and share related agenda documents such as minutes and presentations. Compatible attachment types should include Word, Excel, Publisher and PDF format documents.

• Search. Archiving and full-text search functionality for historical agendas and minutes. Enhanced document search capability: the ability for documents to be organized and searchable using both standardized and ad hoc criteria, multi data field, in-document search, and natural language search. Search feature integration with County portal for integrated search for customers who search on the County site.

• Automated workflows and signature capture. Ability to create and manage tasks and document workflows based on established business rules and roles.

Customizable workflow for staff reviews and approval of agenda items.

• Dashboards. Configurable department user work management dashboard for management of workflow status, reminders, important dates, etc.

• Data analysis and reporting. Ability for users to create and analyze data within the system, including access to personal and team metric and workload dashboards

• Meeting scheduling & invitations. Features to schedule meetings, invite attendees, and manage RSVPs. Tools to facilitate real-time notetaking, tracking of actions, and automated minute generation.

• Voting & approvals. Functionality to track electronic votes and approvals on agenda items.

• Minute taking & distribution. Tools to record minutes and distribute them to attendees.

• Collaboration. Features to facilitate collaboration on agenda items and meeting discussions.

• Public portal access. Must integrate and be fully interoperable with the County’s official website (www.gwinnettcounty.com), enabling seamless data flow and user interaction to avoid a disjointed user experience. This includes the ability to work seamlessly with the current public meeting sites such as: Commission Meeting Videos, Commission Archives, sample public hearing meeting page, etc.

• Live streaming of meetings. Bookmark video to the appropriate section of the agenda and playback video as well as be able to recognize bookmarking done by the current video and audio solutions https://www.gwinnettcounty.com/home https://www.gwinnettcounty.com/departments/communications/tvgwinnett/videoondemand/commissionmeetingvideos https://www.gwinnettcounty.com/departments/communications/tvgwinnett/videoondemand/commissionmeetingvideos https://hosted.earthchannel.com/GwinnettCoGA/archives/boc/ https://www.gwinnettcounty.com/departments/boardofcommissioners/commissionmeetingvideos/-/ecv/showInfo/PLAY225

RP034-25 Page 7

• Presentation capabilities. Ability to support creation of presentation (i.e.

PowerPoint slides) to display on the audience screens in the chamber during meetings.

• Voice recognition during recordings. Voice recognition capabilities for up to 20 or more people speaking during board meeting recordings.

• Systems interfaces and integrations. Ability for the system to seamlessly operate with established business solutions such as Microsoft Outlook, Microsoft Teams, OneDrive, DocuSign, Microsoft Office 365, and Adobe Pro. The proposed solution also should be compatible with Microsoft Office, PDF formats, and video streaming services. This includes the previously mentioned County’s www.gwinnettcounty.com integration.

• Mobile accessibility. Responsive design for access via desktop, tablet, and mobile devices

• ADA Accessibility: Ensure accessibility compliance by adhering to Web Content Accessibility Guidelines (WCAG) 2.2 AA for color contrast, font sizes, and alternative text.

• Visual Design and Branding: The service provider will look to the Communications Department for guidance and direction on all communications collateral which includes all materials produced or controlled by the County or any service provider for the purposes of promoting or representing the County.

The service provider will include their assigned Communications liaison on all communications regarding communications collateral and will provide regular updates on deliverables for review and approval to ensure alignment with the County’s brand.

The successful service provider will include not only the cloud solution features mentioned above, but also the maintenance, professional services, training, project management, implementation, and support as described in this proposal.

Component systems

The County expects the service provider to provide all components necessary for a fully functioning solution. Each solution component should work seamlessly and collectively to provide a singular user experience. The solution provided can include components from multiple manufacturers and providers, however, the service provider is responsible for providing a single solution response that is complete and meets all requirements.

The level of integration between major system components will be a proposal evaluation factor. The County anticipates that in a proposed solution with components from different sources, the service provider will act as the system integrator and be responsible for overall implementation, any internal interfaces required, testing, training, and maintenance support of the complete solution.

As outlined in this proposal, the County’s desire and expectation is that the proposed solution, including any subcontractor applications, partners, and any other companies or individuals required to deliver elements of the solution will be highly configurable. The County anticipates selecting the solution that meets the optimal number of functional specifications with standard system functionality at the best value for the County.

https://www.gwinnettcounty.com/home

RP034-25 Page 8

Conceptually, the proposed solution should include, but not be limited to, the capabilities/ components listed above. The functions (as well as those included in Exhibit B – Functional Requirements Workbook) should all work together with no integrations, interfaces or development required by either the County or the service provider(s).

RP034-25 Page 9

PROPOSAL REQUIREMENTS

The proposal response shall provide information necessary for the County to evaluate the qualifications, experience, and expertise of the service provider to provide the requested functionality and services.

The service provider is to make a written proposal that presents an understanding of the work to be performed. The proposal is to demonstrate and provide evidence that the service provider has the capabilities, professional expertise, and experience to provide the necessary services as described in this solicitation. The service provider is to ensure that all information required herein is submitted with the proposal. An authorized representative of the service provider should sign the proposal. All information provided is to be verifiable by documentation and demonstration requested by the County.

To enhance the evaluation process and provide each service provider an equal opportunity for consideration, all service provider should adhere to a standardized technical proposal format outlined in this proposal. Responses are to be as thorough and detailed as possible so that the County may properly evaluate the service provider’s capabilities to provide the required services. This includes the submission of the Functional Requirements Workbook and the Pricing Response Workbook in both electronic (Excel and PDF) and written formats.

Submit all electronic files on a virus-free USB drive, named as specified in this proposal.

Elaborate brochures or presentations beyond what is needed for a complete and effective proposal will not be considered and are discouraged

Service providers are encouraged to submit clear and concise responses Excessive length or extraneous information is discouraged. To help the County evaluate and select a service provider, please address the specific issues requested in this solicitation. Submission of excessive “boiler plate” information, including sales brochures, is discouraged. Proposers should not submit website links in lieu of written responses. Website links and any information contained within may not be reviewed or considered by the County.

RP034-25 Page 10

PROPOSAL EVALUATION PROCESS

The County’s evaluation process will use the criteria outlined below to identify the solution that best meets the County’s business and operational needs, is offered at the best value, and is submitted by a service provider with expertise and a proven implementation track record for delivering successful systems. The County reserves the right to reject any or all proposals, in whole or in part, to negotiate changes in the scope of services and to waive any technicalities as deemed in its best interest.

For any sections that have required questions to answer, please label the question with the corresponding number, re-state the question, and then answer it.

Selection Criteria

Selection of the successful service provider will be based upon submission of proposals meeting the selection criteria. Proposal evaluations will be based on assigned evaluation points using the following minimum selection criteria.

Part I Responsiveness

Responsiveness: The service provider’s ability to follow the proposal preparation instructions outlined in this solicitation including the failure to return required pages, missing signatures, missing documents, etc.

I. This section of the proposal response should be identified as “SECTION 1 – INTRODUCTORY DOCUMENTS” and include the items listed below in the order indicated below.

a. Cover Sheet, first page of the proposal response, to include the following at a minimum:

i. Request for Proposal Number and Name.

ii. The company submitting the proposal response (service provider).

iii. Date of Submission.

iv. Point of Contact (service provider).

b. Table of Contents that includes all major response headings and page numbers. Note: all pages in the proposal response should be uniquely numbered.

c. Cover Letter/Executive Summary, to meet the following at a minimum:

i. On company letterhead.

ii. Signed by a person with the corporate authority to enter into any contract which results from the proposal.

iii. Overview of service provider company and all partners that make up the proposed solution.

iv. List of products/modules that make up the complete proposed solution.

d. Acknowledgement that service provider has reviewed and understands Background and Current Environment.

e. Acknowledgement of review of Exhibit A - Gwinnett County IT Security Requirements for Purchases

RP034-25 Page 11

Part II Experience & Qualifications

II. Experience: (Past performance) Experience as evidenced in the response. This includes experience providing similar services to similar jurisdictions.

Qualifications: (Ability to provide the solution) Specific information on the service provider’s resources and ability to deliver the required services, providing specific approach/plans (implementation, data conversion, testing, training, cutover) to be used to perform the services. Background on the service provider such as the number of years in business and past major projects completed.

The service provider and all partners that make up the proposed solution will use the response to this section to share information related to experience and qualifications that will be used to evaluate the service provider’s ability and willingness to provide the proposed solution in the manner required by the County.

The service provider is encouraged to provide any additional information to help supplement the response provided it is directly related to this subject and not marketing or sale material or content.

This section of the proposal response should be identified as “SECTION 2 – EXPERIENCE & QUALIFICATIONS OF THE COMPANY” and include the items listed below in the order indicated below.

Identification information

The service provider must submit a SaaS/cloud solution that meets the functional requirements and other criteria outlined in this proposal.

• Q2.1. Identify the prime service provider information and explain if there are any subcontractors, partners, and parties that are part of the proposed solution. This should include the information listed below.

a. Service provider’s full legal company name.

b. Service provider’s organizational structure (individual, partnership, or corporation; private or public; profit or non-profit).

c. service provider’s headquarters location address (must be US-based).

d. Service provider’s location address that will be directly responsible for delivery of the proposed solution.

• Q2.2. Identify the other key contacts within the service provider’s organization:

such as contacts for technical clarifications, contract negotiations, etc. This should include the information listed below.

a. Person(s)’ full name(s).

b. Person(s)’ title(s).

c. Person(s)’ location(s) (city, state).

d. Person(s)’ phone number(s).

e. Person(s)’ email addresses.

RP034-25 Page 12

Experience information

The service provider and all partners that make up the proposed solution will use the response to this section to share information related to experience and qualifications that will be used to evaluate the service provider’s ability and willingness to provide the proposed solution in the manner required by the County.

The service provider is encouraged to provide any additional information to help supplement their response provided it is directly related to this subject and not marketing or sale material or content.

• Q2.3. Provide a summary of the service provider’s company history. This should include the information listed below.

a. Dates of inception to present.

b. Timelines associated with all acquisitions and changes.

• Q2.4. Provide the following information regarding the service provider’s size.

a. The total number of full-time employees. (Include a breakdown of how many at the location serving this project and how many elsewhere.)

b. The total number of locations. (Include a breakdown of US versus non-

US.)

• Q2.5. If the service provider or any of the proposed sub-contractors had a contract terminated for default during the past three (3) years, this fact is to be disclosed along with the service provider’s position on the matter(s). If the service provider has experienced no such terminations for default in the past, indicate as such.

• Q2.6. Has the service provider ever been party to a buy-out, merger, or company acquisition? If so, explain.

• Q2.7. Has the service provider’s or any service provider employee ever been named in litigation and/or arbitration related to the service provider’s products, services, or for any security breaches? If so, explain.

• Q2.8. Are there any current or past lawsuits against the service provider by current or former clients?

• Q2.9. Provide a roadmap for the proposed solution included any planned enhancements or replacements of the proposed solution.

• Q2.10. Provide a list of the service provider’s current customers within the United States that are using the proposed solution. Include the customer’s name, size of the implementation and years in service.

• Q2.11. How many US government agencies with more than 3,000 employees and 500,000 residents are using the proposed solution?

RP034-25 Page 13

Financial condition & bank references

The service provider must submit evidence of their financial condition through bank references, financial statements, and other verifiable means. The information in this section provides basic required service provider information.

• Q2.10. Describe the financial state of the solution vendors’ company that accurately represents its ability to provide long-term service to Gwinnett County.

Part III Solution Description

III. Solution Description: Specific information provided by the service provider to include how the features and functions work, the architecture, supportability, and overall robustness of the solution, as well as an overview of the complexity and flexibility of the solution and how scalable it is.

This section of the proposal response should be identified as “SECTION 3 – SOLUTION DESCRIPTION” and include the items listed below in the order indicated below.

While the County reserves the right to award the solution in part and in total, the service provider is required to propose and describe a complete solution that meets all the criteria outlined in this proposal.

Solution technical architecture

The County is seeking a SaaS cloud-based solution that includes all the functionality in a seamless solution. The County prefers the customers interface to be the County’s official website at www.gwinnettcounty.com, however, optional access through mobile devices is also allowed for admins and employees for back-office work. The County requires the service provider to review the Exhibit A

- Security Requirements for Purchases and respond to all items included by noting the service provider acceptance to all as written or providing “redline” comments back on the contents of that document.

In addition to the response to the functional requirements in Exhibit B - Functional Requirements Response Workbook, please respond to the questions below related to the technical architecture of the overall solution.

• Q3.1. Describe the technical architecture of the solution and how it would be integrated with the County’s website (www.gwinnettcounty.com) and all pages related to meetings and the respective materials. Include how County users (through a County computer and mobile devices) and external users or non-users who would interact with the proposed solution. This must include any, and all, bandwidth assumptions and requirements.

• Q3.2. Provide a complete solution component diagram that not only shows solution components, but also how it will connect the user and County to the

RP034-25 Page 14 cloud-based solution. This must include details on how the solution will interface with existing auditorium AV components, as well as current video production environment.

Note: The mixed audio feed from the auditorium system is a single audio output that combines all of the sources being used during the meeting or event (mics, laptop, video playback, etc.) into one balanced signal. This is essentially the same mix of sound that the audience hears in the auditorium and provided to our current video production system to be streamed or recorded.

In other words, the proposed solution needs to accept our audio feed and not rely on separate vendor-provided components for mixing and sound reinforcement. mixed audio feed

Where applicable, the County requires Cisco Network switches for any connectivity between the proposed infrastructure and the County’s network. In addition, the County preference is for hyper-converged infrastructure (HCI) fully virtualized environments. As a result, the service provider should consider this type of architecture when proposing the infrastructure required for the proposed cloud solution.

• Q3.3. Though the County is seeking a cloud-based solution, please describe any non-cloud-based hardware and software including the information requested below. All on-premises equipment must operate on County Standard Operating Systems and be compatible with County standard tools and software platforms without modifications or special configuration to any other systems, hardware, or software.

a. Describe how the solution will run in the County’s virtual server environment.

b. Describe all hardware and software requirements for servers including, but not limited to server configurations, number of cores, memory requirements and disk space requirements.

• Q3.4. Describe how the solution is licensed? (Note: Do not include pricing information but indicate how the solution is structured. For example, unlimited users, priced by number of forms, number of workflows, number of fields, number of signatures, number of collaborators, etc.)

• Q3.5. The solution is expected to be browser agnostic and backward compatible to all actively supported browser versions. Service provider will ensure that the solution is upgraded and maintained to this specification during its lifetime. Include a description as to how many versions backward from current is supported.

• Q3.6 Describe how user management is handled. Include in the descriptions the topics below at a minimum.

a. Single-Sign On integration with Microsoft Active Directory is preferred for all “licensed users”.

b. General public access to the system must not require licensing.

c. General public (Customers / Residents) access needs SSO with Azure

B2C if any feature needs a login to the system.

RP034-25 Page 15

d. Adding new “licensed end-users”, their roles, and permissions.

e. Delete access for all types of users.

f. Restrict and expand access for all types of users.

• Q3.7. What is the minimum network connection speed that will still ensure the service provider’s system can meet the System Performance requirements?

• Q3.8. Does any part of the proposed solution require software (other than a browser) to be installed on the client’s device (computer, mobile device, etc.)?

If yes, describe the software that must be installed, and the access authorization level required to install it.

• Q3.9.Describe any, and all programming languages that are used for the development, configuration, and customization of the proposed solution?

• Q3.10. Describe any, and all add-on or third-party software required to support the functionality described in the response to the proposal including all functionality indicated in the Exhibit B - Functional Requirements Workbooks as Available or Partially Available?

• Q3.11. What is the timeframe for technical obsolescence of the proposed solution? (For the purpose of this question, the version of the proposed solution would be considered obsolete when support is no longer available.)

Cloud-based architecture

The County is seeking a cloud-based solution.

• Q3.12. Describe the service provider’s cloud-based solution in less than 1 page and then respond to the queries below individually.

• Q3.13. What level of data centers does the service provider use?

• Q3.14. Where do the servers, processes, and data physically reside?

• Q3.15. How often is data replicated and what level of data availability/durability is provided?

• Q3.16. What is the service level agreement (SLA) for uptime?

• Q3.17. Does the service provider’s solution have regular maintenance windows, and if so, please explain?

• Q3.18. Are third parties involved in the provisioning of data center services? If yes, please identify those third parties and provide websites and/or other contact information.

• Q3.19. What services are impacted or unavailable during regular maintenance windows?

RP034-25 Page 16

• Q3.20. Does the service provider’s hosting environment provide redundancy and load balancing for firewalls, intrusion prevention, and other critical security elements?

• Q3.21. Does the service provider leverage multiple vendor systems for network appliances?

• Q3.22. Does the service provider have hardware on-premises, or rely on purchasing and shipping only?

• Q3.23. Describe the efforts in place to ensure continuous power is available to all critical systems that support the proposed solution. Include as part of the explanation includes the following topics:

a. Describe the power systems.

b. Describe the generator backups.

c. Describe how often generators are tested with and without loads.

d. Describe the proximity and availability of fuel for the generators.

Solution security and authentication

The County requires that the service provider proposes a solution that protects against service disruption caused by ransomware, in addition to the traditional Continuity of Business provisions. Such protection could use a tiered replication model where the third-tier synchronization lags the near real-time replication of the lower tiers. Alternatively, the approach could also include using an off-line Disaster Recovery model. The proposed solution(s) must be able to comply and work with the end-point protection and other security requirements of the County.

The County requires the service provider to respond to all aspects of Exhibit A - Security Requirements for Purchases included in this proposal. For compliance, all claims will need to be verifiable with corresponding audit information and/or certificates that meet the respective claims. The service provider should review that document and share any clarifications or exceptions with the requirements outlined in that document as related to the proposed solution.

• Q3.24. Review the Gwinnett County Security Requirements for Purchasing (Exhibit A) and outline any points of clarification or exception.

• Q3.25. Describe the identification and authentication methods used to ensure that users, non-users, and interfacing applications are identified and verified.

• Q3.26. Describe the identification and authentication methods used to ensure that users, non-users, and interfacing applications can only access data, features, and functionality properly authorized (i.e., how roles and permissions are administered and secured). Including how the system utilizes the County’s current security methods of MFA and VPN.

• Q3.27. Describe the ability of the solution to support data tokenization.

RP034-25 Page 17

• Q3.28. Describe the immunity methods and technologies used to ensure the solution is secure from unauthorized malicious programs. (i.e., viruses, worms, and Trojan horses)

• Q3.29. Describe the methods and technologies used to ensure data integrity.

The response should include the following topics as a minimum: (Note:

Additional security specific to solution components may also appear in additional questions.)

a. Data at rest – local to users.

b. Data in transit.

c. Data at rest – in cloud storage within the proposed solution.

• Q3.30. Does the service provider encrypt data at rest? If so, what type of encryption protection does the service provider use and how are the keys managed and secured?

• Q3.31. Describe how compliance is certified and maintained for all sensitive data, (such as PCI, PII, HIPPA, etc.). If compliance and certification is not included for a type of “sensitive” data, then the service provider is requested to explicitly acknowledge and list that data type as an exception. Depending on the response, additional contract documents may be required.

• Q3.32. Describe methods and technology in place to ensure that unauthorized maintenance and updates do not disrupt the security mechanisms of the solution and the County systems.

• Q3.33. Describe the testing methods used to ensure the solution can withstand web application vulnerabilities such as those identified by Open Web Application Security Project (OWASP).

• Q3.34. Describe the network security features of the proposed solution and cloud environment. Include the topics below at a minimum in the response:

a. Disabling unassigned IP and switch ports.

b. Specifying IP ports used at the firewall and demark boundaries.

c. Ensuring security updates are in place for items such as firmware, software, and virus protection.

• Q3.35. Describe the role of System Administration in developing and maintaining security profiles. Include the process for changing individual profiles to support personnel movement.

• Q3.36. Describe to what level depth of security and permissions may be controlled across the solution and for each component and module required as part of this solicitation.

• Q3.37. Describe how audit trails are generated and what information is provided. Include any limitations or constraints.

• Q3.38. Describe how the proposed system manages unsuccessful log-on attempts. Can the County establish the number of attempts allowed? What is

RP034-25 Page 18 the reporting or alerting mechanism used to communicate unauthorized access?

• Q3.39. Are all data transmissions encrypted, including all server-to-server data transmissions, within data centers?

• Q3.40. Does the service provider provide both physical and logical separation between the encryption keys and the encrypted data?

• Q3.41. What certifications has the service provider obtained for data protection? For any, and all certifications listed in the requirements and this proposal, the service provider, and all partners will be required to supply proof of the certification to the County’s satisfaction if requested to do so. This includes FISMA-certified and certified for compliance with NIST, DoD, PCI DSS, ISO 27001, HIPAA, SOC 2, PCI, and FIPS 140-2.

• Q3.42. Describe all documentation on the procedures for vulnerability management, intrusion prevention, incident response, and incident escalation and investigation related to the proposed solution and the systems that support it.

• Q3.43. Describe how the County can monitor the service, which logs are kept, and how accessed, for example, when there is an incident.

• Q3.44. Does the County retain end-to-end, lifecycle control over where, when, and how data flows and how it is physically stored?

• Q3.45. Describe any, and all scheduled penetration tests of either the production environment or a designated testing environment.

• Q3.46. Describe the cyber security-related insurance that the service provider is proposing to cover cost and injury caused by potential cyber-attacks made on the service provider’s systems that result in security breaches and vulnerabilities to the County?

• Q3.47. Describe any and all AI that is impeded or utilized by the proposed solution.

Solution maintenance and support

The County expects that a maintenance and support agreement will be offered and that the maintenance and support will be included in the pricing of the solution units. Support for the proposed solution is required to be available 24 hours per day 7 days per week (Monday-Sunday). The service provider’s proposed support agreement is to be included in the response and designate priority levels for system errors and include a guaranteed response time for each priority level.

Additionally, the support agreement should define the role of the service provider’s helpdesk for support.

RP034-25 Page 19

Technical Support

• Q3.48. Describe the technical solution support provided for the proposed solution? Include the items below in the description:

a. Support for the County DoITS helpdesk and service desk for escalations in performance.

b. Support for the County end-user support.

c. Support for the County System Administration support.

d. Phone support – hours of operation.

e. Online chat support – hours of operation.

f. Email support – hours of operation.

g. After-hours and emergency support for DoITS personnel.

• Q3.49. Describe how solution, support, and maintenance issues are reported by the County and then tracked, managed, resolved, and status communicated.

• Q3.50. Describe the service provider’s support procedure for the levels of errors. Include a description of how the service provider prioritizes issues, determines response time, logs support calls; tracks incidents; monitors the escalation of problems; diagnoses and corrects problems online from remote locations; and resolves problems.

• Q3.51. Describe how general support skills are transferred to the County technical support personnel for knowledge sharing.

• Q3.52. What is the service provider’s policy regarding support of third-party components included in the proposed system?

a. Has the service provider ever dropped support of a third-party component? If so, what is the service provider’s procedure for doing so and how much notice is given to customers?

• Describe how the co-managed support for the solution’s third-party components will be provided including any County responsibilities.

• Q3.53. Describe the staffing requirements typically required to support the proposed solution based on the size, complexity, functionality, and volume described in this proposal. Use the table below to respond. An example is shown below.

Staff Skills Roles Avg # of headcount

Application Administrator

Solution admin training

• User Management Configuration (enterprise)

<insert> <insert> <insert> <insert> Table 2 - Support Staffing Requirements

Warranty

RP034-25 Page 20

The entire solution as proposed by the service provider shall include a first-year warranty for service provider-supplied hardware and software for a minimum of twelve (12) months after the formal Final System Acceptance date.

The warranty is to include all system and application software updates, enhancements, and refinements, as well as all professional services necessary to support the software. The warranty is to conform to contractually agreed to specifications and protect against any defects or damage caused by manufacturers, service providers, or proposed subcontractors, in the solution’s equipment or software.

Additionally, the service provider will warrant its responses to the functional requirements included in their proposal response and any other element of their proposal and will agree to attach its proposal response to any contract reached with the County.

• Q3.54. Include in this section a copy of the service provider’s standard warranty.

• Q3.55. A warranty for the first year is required. If the proposed system does not include a minimum first-year warranty commencing at final System Acceptance, please explain.

• Q3.56. What professional services are included as part of the warranty?

• Q3.57. Will the service provider cover repair costs for work it is unable to perform based upon warranty guidelines?

Release Management and Solution Enhancements

The County requires the service provider to thoroughly describe the proposed roadmap for the proposed solution. This includes not only the functionality enhancement plan, but how those enhancements are prioritized and communicated to the County.

• Q3.58. Describe how new features are released into the Cloud production solution.

• Q3.59. Describe how new features and functionality are communicated to customers.

• Q3.60. Do configuration settings carry forward as new features and functions are made available?

Q.3.61. How are workflows and custom templates ensured to be compatible with new features and functions being added to the solution throughout its lifecycle?

RP034-25 Page 21

Q3.62. Are standard interfaces updated to maintain compatibility with newly released features and functions?

• Q3.63. What new features and functions are already planned and committed for release in the next 24 months?

User Management

The County requires the service provider to thoroughly describe the proposed roadmap for the proposed solution. This includes not only the functionality enhancement plan, but how those enhancements are prioritized and communicated to the County.

• Q3.64. Describe how user management is handled. Include in the descriptions the topics below at a minimum.

a. Adding new “licensed end-users”, their roles, and permissions.

b. Delete access for all types of users.

c. Restrict and expand access for all types of users.

• Q3.65. Describe how the solution supports configurable roles and permissions?

Availability and reliability

The County requires the service provider to thoroughly describe the level of reliability and resilience of the proposed solution and the backend systems and technology that enable that solution.

• Q3.66. Describe how the solution and the system that delivers it ensure redundancy of data (stored and in transit) and all related connectivity. Include any potential single point of failure and recommendations on how to minimize or eliminate.

• Q3.67. What is the service provider’s Disaster Recovery (DR) Plan? Does it include periodic failover testing that could impact the uptime of the application?

• Q3.68. How often is the service provider’s DR plan refreshed and updated?

• Q3.69. Describe how data stored as part of the solution is retained, archived, and controlled by the County as to the amount and retention policies associated with it.

• Q3.70. If an agreement with the service provider is terminated, how will the service provider assist with the transition of data from the service provider’s cloud to another service provider, including providing the County and/or a third party with data in an effective manner?

RP034-25 Page 22

Solution components

The Functional Requirements Workbook outlines the requirements of what capabilities the solution should immediately be able to provide the County and those that interact with the solution (users and non-users, internal and external to the County).

General

• Q3.71. Describe generally how the solution integrates with the County website (www.gwinnettcounty.com) and related meeting pages.

• Q3.72. Describe how the solution provides a consistent experience across multiple platforms and devices.

• Q3.73. How many total users and users per permission tier are provided with the initial solution?

Agenda Creation

• Q3.74. Describe how the proposed solution supports the creation of agenda items and packets.

• Q3.75. Describe what types of standard and customizable templates are available such that agenda items can be assigned specific templates based on the County-defined agenda item types and financial…