S-10700-00017413 Attachment H - Solution Requirements FINAL.xlsx
XLSX spreadsheet 129 KB Posted
- Solicitation number
- S-10700-00017413
- Issued by
- Oregon
About this file
Summary
This is a Solution Requirements document for a statewide regulatory licensing and compliance software system being procured by Oregon's Department of Administrative Services (DAS) on behalf of multiple Oregon licensing boards, commissions, and agencies. The RFP seeks a Commercial Off-the-Shelf (COTS), Modified Off-the-Shelf (MOTS), or Software-as-a-Service (SaaS) solution to replace existing legacy systems across Oregon's decentralized licensing ecosystem, serving hundreds of license types. The solution must encompass comprehensive application processing, licensing lifecycle management, continuing education tracking, examination management, background check and fingerprinting workflows, complaints and discipline case management, inspections and field operations, facility and practice entity licensing, reciprocity and interstate compact support, public registry and verification capabilities, payment processing and financial management, document management, communications and notifications, reporting and analytics, workflow and rules engines, security and privacy controls, accessibility compliance, integrations and APIs, data migration support, configuration management, testing and quality assurance, performance and scalability, disaster recovery, records compliance, and training and support services. The requirements document specifies detailed functional capabilities across 50 primary requirement categories (A through AN) plus agency-specific requirements for eight licensing boards including the Oregon Board of Physical Therapy, Oregon Board of Psychology, Oregon Board of Licensed Professional Counselors and Therapists, Oregon Board of Examiners for Speech-Language Pathology and Audiology, Oregon Occupational Therapy Licensing Board, Oregon Board of Medical Imaging, and Oregon Board of Naturopathic Medicine.
The requirements are structured with a point-based scoring system where proposers select compliance levels from zero to four ("Functionality Cannot Be Met" through "Solution Is Fully Compliant Out of the Box"), with corresponding point values ranging from zero to twenty points for mandatory requirements and zero to ten points for discretionary requirements, yielding a maximum total score of 10,020 points across all requirements. All major requirements are classified as either High, MedHigh, Medium, or Low priority, with mandatory designations indicating statutory or foundational necessity. The document mandates strict data isolation and multi-tenancy architecture, multi-factor authentication for user accounts, integration with state identity providers via SSO/OIDC/SAML, comprehensive audit trails and logging, compliance with Oregon Accounting Manual Chapter 10 and PCIDSS Level 1 standards, and adherence to DAS offshore/foreign services policy (Policy 107-004-052) including domestic-only data storage, processing, and support with comprehensive vendor subprocessor and personnel registries. The vendor must provide annual SOC 2 Type 2 audit results, maintain onshore development and support with U.S. work-authorized personnel, support disaster recovery with defined RPO/RTO targets, and deliver complete implementation services including data migration, configuration, training, and cutover support.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| S-10700-00017413 Attachment A Sample Price Agreement FINAL.docx | DOCX document | |
| S-10700-00017413 Attachment E- Price Proposal FINAL.xlsx | XLSX spreadsheet | |
| S-10700-00017413 Statewide Oregon Regulatory Licensing RFP FINAL.docx | DOCX document | |
| S-10700-00017413 Attachmnet - J Oregon Statewide Security Standards.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instruction Tab
| Requirements Instructions |
| Proposer shall complete and submit an electronic version of Attachment H as part of the Proposal submission. |
| The worksheet is protected to permit data entry only in Columns F and G. Proposer shall enter responses exclusively in these columns. Only selections made in Column G will be evaluated and scored. |
Proposer shall use the drop‑down menu provided in Column G to indicate the level of compliance for each requirement. The available selections and corresponding point values are as follows:
| 0 – Functionality Cannot Be Met |
| Mandatory Points: 0 |
| Discretionary Points: 0 |
| Example: The Proposer’s system does not offer automated audit‑tracking functionality, and such functionality cannot be added, configured, or customized within the proposed solution. |
| 1 – Customization Required by Proposer |
| Mandatory Points: 5 |
| Discretionary Points: 2.5 |
| Example: The required capability (e.g., API integration with a specialized State system) is not supported natively and would require the Proposer to develop custom code or build a new module. |
| 2 – Major Configuration Change Required |
| Mandatory Points: 10 |
| Discretionary Points: 5 |
| Example: The system can meet the requirement, but only with significant re‑configuration such as restructuring workflows, adding new data fields, or modifying system logic in a manner requiring dedicated implementation effort. |
| 3 – Minor Configuration Change Required |
| Mandatory Points: 15 |
| Discretionary Points: 7.5 |
| Example: The requirement can be met by adjusting existing settings—such as enabling a feature, modifying user roles, or adjusting reporting parameters—without significant technical work or structural system changes. |
| 4 – Solution Is Fully Compliant “Out of the Box” |
| Mandatory Points: 20 |
| Discretionary Points: 10 |
| Example: The proposed solution already includes the required capability (e.g., role‑based access controls or standard reporting dashboards) with no customization or configuration changes required. |
| Proposer shall refer to Tabs 2 through 16 for the complete set of Specific Requirements. Proposers shall utilize the drop‑down selection in Column F to indicate whether the proposed solution complies with, or is unable to comply with, each requirement not otherwise identified. |
| Proposer shall ensure all responses accurately reflect the capabilities of the proposed solution. |
1. Solution Requirements REQ # Description Priority Mandatory Rationale Vendor Comments (explain how the requirement would be met) Proposer Response (per code table) (up to 20 points possible per REQ#) Auto Calculated Points (total possible points 6,680) Discretionary Points (per code table) (up to 10 additional points possible by evaluator) Auto Calculated Points (total possible points 3,340) Evaluator Comments
COMMON REQUIREMENTS (For all listed agencies/boards/commissions)
A. Program Administration & Multi-Tenancy
| A1 | System shall support multi-agency, multi-program tenancy with strict data isolation by agency/board/commission. | High | Y | Foundational for statewide shared platform; avoids cross‑agency data leakage and legal risk. | 0 | 0 |
| A2 | System shall allow per-program configuration of license types, subtypes, endorsements, specialties, and statuses. | High | Y | Core capability to reflect program variability without custom code; reduces vendor dependency. | 0 | 0 |
| A3 | System shall support program-specific workflows, forms, fees, rules, eligibility checks, documentation lists, and timelines. | High | Y | Programs have distinct rules/fees/eligibility; must be independently configurable. | 0 | 0 |
| A4 | System shall allow program admins to configure workflow steps, transitions, SLAs, and auto-escalation rules without vendor coding. | High | Y | Enables rapid change without PS; lowers TCO and improves agility. | 0 | 0 |
| A5 | System shall enable per-program branding (logos, colors, public portal name) while maintaining a consistent statewide UX and accessibility baseline. | Med‑High | Y | Agency identity while maintaining statewide consistency/accessibility compliance. | 0 | 0 |
| A6 | System shall provide configurable program calendars for renewals, application/authorization expirations, CE reporting cycles, exam windows, and grace periods. | Med‑High | Y | Renewal/CE cycles drive workload and revenue; must be adjustable per program. | 0 | 0 |
| A7 | System shall support program-specific numbering formats (license ID patterns, prefixes/suffixes, check digits). | Med | Y | Statutory/legacy ID patterns needed for continuity and integrations. | 0 | 0 |
| A8 | System shall support data partitioning for legally mandated data isolation (including role-based access controls per program). | High | Y | Compliance/privacy require strong partitioning and RBAC; auditors will test this. | 0 | 0 |
| A9 | System shall provide sandbox environments per program for configuration testing before production deployment. | High | Y | Prevents production incidents; supports safe change management and UAT. | 0 | 0 |
| A10 | System shall support delegated administration with separations of duty (e.g., configuration vs. approval vs. finance roles). | High | Y | Internal controls and fraud prevention; aligns with audit requirements. | 0 | 0 |
B. User Accounts & Identity (Public/Licensees/Applicants)
| B1 | System shall provide a self-service Public/Applicant/Licensee Portal for account creation, profile management, and application/renewal tracking. | High | Y | A self‑service portal is foundational for modern licensing; reduces staff workload and meets public expectations. | 0 | 0 |
| B2 | System shall support multi-factor authentication (MFA) for licensee and staff accounts (TOTP, SMS, email, authenticator apps). | High | Y | MFA is required for security best practices and increasingly for state standards; protects sensitive PII and license data. | 0 | 0 |
| B3 | System shall support SSO/OIDC/SAML integration with State identity providers for staff users. | High | Y | State staff must authenticate via State SSO; required for enterprise security and IAM governance. | 0 | 0 |
| B4 | System shall support account recovery (secure password reset, locked account unlocks, step-up verification). | High | Y | Account recovery is critical to reduce help‑desk burden and ensure continuous access; must be secure and user‑friendly. | 0 | 0 |
| B5 | System shall allow users to manage multiple licenses (individual + facility + business) under one account. | High | Y | Many licensees hold multiple license types; consolidated accounts prevent duplicate identities and improve UX/data integrity. | 0 | 0 |
| B6 | System shall support authorized delegates (e.g., office managers) to manage applications on behalf of licensees with auditable content. | Med‑High | Y | Delegated access is essential for businesses, facilities, and office managers managing licenses on behalf of professionals. | 0 | 0 |
| B7 | System shall provide robust profile fields (legal name, preferred name, pronouns, contact methods, addresses, employer(s), practice site(s)). | Med‑High | Y | Rich profile data supports regulatory needs, inspections, workforce analytics, and renewals. | 0 | 0 |
| B8 | System shall support multiple addresses (mailing, practice, billing) and contact methods with primary/secondary designation. | Med‑High | Y | Licensing often requires managing multiple addresses and contact methods; improves communication accuracy and compliance. | 0 | 0 |
| B9 | System shall allow licensees to designate and update a records custodian, with history tracking of custodian changes for regulatory and continuity purposes. | Medium | Y | Custodian designation supports statutory requirements for record continuity in cases of licensee incapacity or death. | 0 | 0 |
C. Online Application & Renewal
| C1 | System shall provide dynamic, rules-driven application forms tailored to license type and applicant profile. | High | Y | Dynamic, rules-driven forms tailor applications to license type and applicant profile; reduces errors and manual corrections. | 0 | 0 |
| C2 | System shall support conditional fields and branching based on answers (e.g., disciplinary history triggers additional documentation). | High | Y | Conditional branching ensures applicants provide required information based on their answers, improving completeness and compliance. | 0 | 0 |
| C3 | System shall validate required fields, acceptable values, document uploads, and dates with inline guidance. | High | Y | Inline validation prevents incomplete or incorrect submissions, lowering staff rework and applicant frustration. | 0 | 0 |
| C4 | System shall support draft saving, resume later, and pre-population from prior applications/renewals. | High | Y | Draft/resume and pre-population improve completion rates and user experience, especially for long applications. | 0 | 0 |
| C5 | System shall support initial license applications, renewals, reinstatements, reactivations, and status changes (inactive, retired, lapsed). | High | Y | Support for initial applications, renewals, reinstatements, reactivations, and status changes is core to licensing operations. | 0 | 0 |
| C6 | System shall support fee calculation rules (base fees, add-ons, late fees, pro-rations, waivers, discounts). | High | Y | Complex fee rules must be supported for accurate revenue management and statutory compliance. | 0 | 0 |
| C7 | System shall support attachments with type validation (e.g., transcripts, exam reports, CE certificates, background check evidence). | High | Y | Attachment type validation ensures appropriate evidence is submitted and reduces back-and-forth with applicants. | 0 | 0 |
| C8 | System shall support digital attestations with electronic signature and time-stamped certifications. | High | Y | Digital attestations with e-signatures and timestamps strengthen legal defensibility and compliance. | 0 | 0 |
| C9 | System shall support pre-eligibility checks (age, degree, exam results, background checks, residency requirements, training hours). | High | Y | Pre-eligibility checks reduce invalid submissions and staff workload by gating applicants who do not meet minimum criteria. | 0 | 0 |
| C10 | System shall allow applicants to submit corrections or additional information upon deficiency notice. | High | Y | Correction submissions after deficiency improve throughput and reduce abandoned applications. | 0 | 0 |
| C11 | System shall support automated deficiency notifications with specific remediation tasks. | High | N | Automated deficiency notifications reduce staff workload and provide clear remediation instructions. | 0 | 0 |
| C12 | System shall track submission date, acceptance date, clock for statutory deadlines, and staff SLA metrics. | High | Y | Tracking submissions, acceptance, statutory deadlines, and SLAs is required for compliance and oversight. | 0 | 0 |
| C13 | System shall support rule-based automatic approvals for low-risk cases; manual review queues for others. | High | Y | Rule-based automatic approvals accelerate low-risk processing while maintaining oversight for exceptions. | 0 | 0 |
| C14 | System shall allow staff to return applications for more info or schedule interviews/hearings if required. | Med-High | N | Staff need tools to return applications, request more info, or schedule interviews/hearings when required by policy. | 0 | 0 |
| C15 | System shall require users to type “Yes” or “No,” rather than selecting a checkbox, for designated critical questions or attestations on applications. | Med | N | Typed “Yes/No” for critical questions is a policy preference rather than a functional necessity. | 0 | 0 |
| C16 | System shall require users to type “Yes” or “No,” rather than selecting a checkbox, for designated critical questions or attestations on renewals. | Med | N | Typed “Yes/No” for critical renewal questions is a preference, not essential to compliance. | 0 | 0 |
D. License Lifecycle Management
| D1 | System shall maintain comprehensive license record: type, level, endorsements, scope, issuance, expiration, status history, conditions. | High | Y | Comprehensive license record is foundational for regulatory oversight and statutory compliance across all credential types. | 0 | 0 |
| D2 | System shall support temporary/limited permits, trainee/intern/resident statuses, and conversions to full licensure. | High | N | Support for temporary/limited permits and trainee/intern/resident statuses is essential for programs with staged licensure pathways. | 0 | 0 |
| D3 | System shall support reciprocity/endorsement routes with external verification workflows. | Med-High | N | Reciprocity/endorsement workflows require structured external verification and conditional approval paths. | 0 | 0 |
| D4 | System shall support inactive/retired/semi-active statuses with distinct CE and fee requirements. | Med-High | N | Inactive/retired statuses must support distinct CE and fee rules, enabling proper lifecycle management. | 0 | 0 |
| D5 | System shall support reinstatement workflows including penalties, CE catch-up, re-examination if applicable. | High | Y | Reinstatement requires workflows for penalties, CE catch-up, and re-exams; legally necessary for many boards. | 0 | 0 |
| D6 | System shall support pre-expiration notifications (multi-channel) and grace period rules. | High | Y | Pre-expiration notifications and grace period rules are critical to compliance and timely renewals. | 0 | 0 |
| D7 | System shall support license cards/certificates with secure QR/barcode validation and downloadable PDFs. | High | Y | License cards/certificates with QR/barcode validation enable secure public verification and mobile access. | 0 | 0 |
| D8 | System shall support scope/privileging add-ons (e.g., prescriptive authority endorsements, specialty modalities). | Med-High | N | Scope/privileging add-ons (e.g., endorsements, specialties) must be tracked and displayed accurately. | 0 | 0 |
| D9 | System shall audit all changes with who/when/what, preserving previous values. | High | Y | Full audit trail of who/when/what with preserved prior values is mandatory for regulatory and legal defensibility. | 0 | 0 |
| D10 | System shall support assignment and tracking of stock/audit numbers for printed licenses. | Med | N | Assignment/management of stock/audit numbers for printed licenses is required for physical inventory control. | 0 | 0 |
| D11 | System shall print licenses using a selected stock number. | Med | N | Printing licenses using a selected stock number ensures accurate reconciliation with physical inventory. | 0 | 0 |
| D12 | System shall allow staff to designate a licensee as ineligible for online renewal, regardless of whether the licensee has an email address on file. | High | Y | Staff override to mark a licensee ineligible for online renewal is essential for compliance and case management. | 0 | 0 |
E. Continuing Education (CE/CPE/CME)
| E1 | System shall support CE tracking by cycle, category, and activity type with required hours and limits. | High | Y | CE tracking by cycle, category, activity type, and required hours is foundational for compliance. | 0 | 0 |
| E2 | System shall support CE provider approvals, course catalog management, and rosters uploaded by providers. | Med-High | N | Provider approvals, course catalogs, and roster uploads support automation and reduce manual entry. | 0 | 0 |
| E3 | System shall allow licensees to self-report CE with certificate/document uploads and attestations. | High | Y | Licensee self-reporting with documentation and attestations is essential for complete CE submission. | 0 | 0 |
| E4 | System shall validate CE against minimums, maximums, carryover rules, and mandatory topics. | High | Y | Validation of CE minimums, maximums, carryover, and mandatory topics ensures statutory compliance. | 0 | 0 |
| E5 | System shall support random audit selection and targeted CE audits; manage audit workflows end-to-end. | Med-High | Y | Random and targeted CE audits with workflow support are required for enforcement and oversight. | 0 | 0 |
| E6 | System shall support CE waivers/exemptions (e.g., military service, hardship) under documented rules. | Med | Y | CE waivers/exemptions (military, hardship) must be handled under documented rules for fairness and compliance. | 0 | 0 |
| E7 | System shall provide dashboards for both licensees and staff showing CE completion progress and deficits. | Med-High | Y | Dashboards for licensees and staff showing CE progress and deficits aid transparency and reduce inquiries. | 0 | 0 |
| E8 | System shall generate reports identifying CE hours eligible for carryover to the next renewal period. | Med | N | Reporting CE hours eligible for carryover supports renewal workflows and applicant guidance. | 0 | 0 |
| E9 | System shall notify licensees when they have CE courses eligible for carryover. | Med | N | Notifications for CE eligible for carryover improve licensee awareness and reduce renewal issues. | 0 | 0 |
F. Examination Management
| F1 | System shall record exam requirements by license type (external exams, state jurisprudence, practicals). | High | Y | Recording exam requirements by license type is essential to determine eligibility and track pathways. | 0 | 0 |
| F2 | System shall integrate with exam bodies where available (data imports, verification APIs, secure file uploads). | High | Y | Integration with exam bodies (imports, APIs, secure uploads) streamlines verification and reduces fraud risk. | 0 | 0 |
| F3 | System shall store exam attempts, dates, results, pass/fail, scaled scores, and validity windows. | High | Y | Tracking exam attempts, dates, scores, and validity windows is critical for compliance and licensing decisions. | 0 | 0 |
| F4 | System shall support scheduling for state‑administered tests, including capacity limits and proctoring records. | Med-High | N | Scheduling for state-administered tests with capacity and proctoring records supports operational needs. | 0 | 0 |
| F5 | System shall enforce re‑exam eligibility rules, waiting periods, and retake fees. | High | N | Enforcement of re-exam rules, waiting periods, and retake fees ensures statutory adherence. | 0 | 0 |
| F6 | System shall allow applicants to take online tests within the system. | Med-High | N | Allowing online tests within the system increases accessibility and reduces administrative overhead. | 0 | 0 |
| F7 | System shall allow staff to configure the number of test attempts permitted for each exam. | Med-High | Y | Configurable limits on number of permitted exam attempts ensures fairness and policy adherence. | 0 | 0 |
| F8 | System shall randomize exam questions for each test attempt where configured. | Med-High | N | Randomizing exam questions per attempt reduces cheating and preserves exam integrity. | 0 | 0 |
| F9 | System shall auto‑score online tests and record pass/fail results. | High | N | Auto-scoring online tests and recording results improves turnaround time and accuracy. | 0 | 0 |
| F10 | System shall track the version of each test administered to the applicant. | Med-High | N | Tracking the version of each administered test supports audit integrity and psychometric defensibility. | 0 | 0 |
| F11 | System shall support offering online tests in multiple languages, as defined by the program. | Med | N | Supporting online tests in multiple languages expands access and equity across programs. | 0 | 0 |
G. Background Checks & Fingerprinting
| G1 | System shall support fingerprinting workflows (in‑state, out‑of‑state), including tracking of TCNs and results. | High | Y | Fingerprinting workflows with TCN/result tracking are foundational for many programs and required for cross‑jurisdiction processing | 0 | 0 |
| G2 | System shall support criminal background check integrations or secure receipt of reports, with adjudication workflows. | High | Y | Secure receipt/integration of criminal background reports with adjudication is core to licensure decisions and auditability | 0 | 0 |
| G3 | System shall track character references, professional references, and verifications from other jurisdictions. | Med-High | N | Reference and verification tracking improves reciprocity and due diligence but is not universal across all boards | 0 | 0 |
| G4 | System shall support disqualification criteria with staff override/appeal processes and documentation. | High | Y | Disqualification criteria with staff override/appeal ensures consistent, defensible outcomes and due‑process documentation | 0 | 0 |
| G5 | System shall track background check information, including LEDS results, in a CJIS‑compliant format. | High | N | CJIS‑compliant handling of LEDS/background data is mandatory for security and legal compliance | 0 | 0 |
H. Complaints, Investigations, and Discipline
| H1 | System shall provide a public complaint intake form with routing to the correct board/program. | High | Y | Public complaint intake with program routing is foundational for transparency and timely triage | 0 | 0 |
| H2 | System shall support complainant and respondent identity management with confidentiality rules. | High | Y | Confidential identity management protects parties and meets privacy laws | 0 | 0 |
| H3 | System shall track case intake, triage, assignment, investigation steps, interviews, evidence, and findings. | High | Y | End‑to‑end investigative case tracking is core to enforcement | 0 | 0 |
| H4 | System shall support legal case workflow: notices, hearings, consent orders, stipulations, sanctions. | High | Y | Legal workflow (notices/hearings/orders/sanctions) is essential for due process | 0 | 0 |
| H5 | System shall support discipline actions (probation, fines, suspension, revocation, discipline outcome, lifecycle tracking) with associated license status updates. | High | Y | Discipline actions must update license status to ensure public safety | 0 | 0 |
| H6 | System shall maintain public discipline records per program rules, with redaction where legally required. | High | Y | Public discipline records with redaction are critical for transparency and compliance | 0 | 0 |
| H7 | System shall support integration with attorneys/case management tools; track deadlines and docket events. | Med-High | N | Attorney/case tool integration and docket tracking improve coordination but are not universal | 0 | 0 |
| H8 | System shall support complaint outcomes reporting and heatmaps for trend analysis. | Med-High | N | Outcomes reporting and heatmaps aid oversight and trend analysis | 0 | 0 |
| H9 | System shall track physical evidence and maintain a complete chain‑of‑custody history for investigative materials. | Med-High | N | Physical evidence tracking with chain‑of‑custody strengthens case integrity | 0 | 0 |
| H10 | System shall allow external parties (complainants, respondents, legal counsel, etc.) to upload documents, audio, and video files related to a case without granting access to case information. | High | Y | Secure external uploads without exposing case details enable safe intake | 0 | 0 |
| H11 | System shall accept evidence uploads from external and internal users without imposing a file‑size limit, subject to agency policy. | Med | N | No file‑size limits are desirable but operationally constrained by storage/policy | 0 | 0 |
I. Inspections & Field Operations (where applicable)
| I1 | System shall manage inspection schedules for facilities/businesses with risk‑based prioritization. | High | N | Core to field oversight; risk‑based scheduling is fundamental for agencies that conduct inspections and helps align work with public‑safety priorities. | 0 | 0 |
| I2 | System shall provide mobile‑friendly inspection checklists with offline capability and photo/attachment capture. | High | N | Mobile and offline inspection capability with photo/attachment capture is essential for real‑world field operations and continuity in remote areas. | 0 | 0 |
| I3 | System shall support violation recording, corrective action plans, re‑inspections, and escalations. | High | N | Violation tracking, corrective actions, re‑inspections, and escalations form the backbone of enforcement workflows. | 0 | 0 |
| I4 | System shall generate inspection reports with digital signatures and deliver them via portal/email. | High | N | Digital, signed inspection reports with electronic delivery improve turnaround times and strengthen auditability. | 0 | 0 |
| I5 | System shall tie inspection findings to license actions (conditions, suspensions) per defined rules. | High | N | Linking inspection findings to license actions ensures consistent regulatory enforcement and reduces manual decision‑making. | 0 | 0 |
J. Facility/Business/Practice Entity Licensing
| J1 | System shall support licensing of establishments, facilities, mobile units, and practice sites. | High | N | Supports licensing across diverse entity types such as establishments, facilities, mobile units, and practice sites, which is foundational for many regulatory programs. | 0 | 0 |
| J2 | System shall track responsible parties, supervising professionals, ownership, and changes of control. | High | N | Tracking responsible parties, supervising professionals, ownership, and changes of control is essential for oversight, accountability, and compliance. | 0 | 0 |
| J3 | System shall support site addresses, GIS verification, and zoning/licensure eligibility checks. | High | N | Site address management with GIS verification and zoning/licensure checks enhances data accuracy but is not required for all program types. | 0 | 0 |
| J4 | System shall support site‑based endorsements (e.g., specific modalities, operations limitations). | High | N | Site-based endorsements (modalities, operational limits, specialized permissions) allow nuanced authorization aligned to regulatory rules. | 0 | 0 |
| J5 | System shall support bulk updates for multi‑site practices and chain operations. | Medium | N | Bulk updates for multi‑site practices and chain organizations improve administrative efficiency but are not universally needed. | 0 | 0 |
K. Reciprocity, Mobility & Compacts
| K1 | System shall support interstate compacts or reciprocity evaluation workflows, including verification requests. | High | Y | Interstate compacts and reciprocity evaluations require structured workflows for verification, eligibility checks, and cross‑state coordination. | 0 | 0 |
| K2 | System shall store other-state license data, statuses, and discipline history with authenticated evidence. | High | Y | Capturing other‑state license details, statuses, and disciplinary history with authenticated evidence is essential for accurate determination of eligibility. | 0 | 0 |
| K3 | System shall support expedited pathways with checklist automation and compact IDs. | High | Y | Expedited pathways using automated checklists and compact IDs improve processing speed and ensure compliance with compact participation rules. | 0 | 0 |
L. Public Registry & Verification
| L1 | System shall provide a searchable public licensee directory with configurable fields (status, expiration, discipline). | High | Y | A searchable public licensee directory with configurable fields is foundational for transparency and public self‑service. | 0 | 0 |
| L2 | System shall support public verification via secure QR/barcode on license certificates. | High | Y | Secure QR/barcode verification on certificates reduces fraud risk and enables fast, self‑service authenticity checks. | 0 | 0 |
| L3 | System shall support transparency controls (what is public vs. private) compliant with Oregon public records mandates. | High | Y | Transparency controls over what is public versus private are required to comply with Oregon public records mandates. | 0 | 0 |
| L4 | System shall support bulk data exports for public information requests with role-based approval. | High | Y | Bulk data exports with role‑based approval streamline public information requests and enforce governance. | 0 | 0 |
| L5 | System shall allow case‑insensitive search on all public‑facing fields. | Medium | Y | Case‑insensitive search improves usability by reducing false negatives in public queries. | 0 | 0 |
| L6 | System shall allow searching across any public‑facing field without restriction. | High | Y | Searching across any public‑facing field increases discoverability and reduces support inquiries. | 0 | 0 |
| L7 | System shall provide the ability to display public search results on a geographic map view. | Medium | N (Y for some) | Displaying public search results on a geographic map provides value but is not essential for all programs. | 0 | 0 |
| L8 | System shall allow the public to purchase licensee lists without requiring creation of a user account. | Medium | N (Y for some) | Allowing public purchase of licensee lists without an account can simplify access but introduces payment, auditing, and delivery considerations. | 0 | 0 |
| L9 | System shall display licensee status‑change dates (e.g., lapsed, expired) in public search results. | High | Y | Displaying licensee status‑change dates improves public clarity and supports compliance verification. | 0 | 0 |
| L10 | System shall display linked PDF disciplinary documents within public licensee detail views. | High | Y | Providing linked PDF disciplinary documents enhances transparency and supports public due‑diligence needs. | 0 | 0 |
M. Payments, Fees & Finance
| M1 | System shall integrate with state‑approved payment processors for cards, ACH, and digital wallets. | High | Y | Integration with state‑approved payment processors for cards, ACH, and digital wallets is essential for compliance and revenue collection. | 0 | 0 |
| M2 | System shall support fee tables by program, product, and event (applications, renewals, reinstatements, exams, inspections). | High | Y | Fee tables by program, product, and event are core to managing varied licensing and regulatory cost structures. | 0 | 0 |
| M3 | System shall support partial payments, payment plans (if authorized), and third‑party payers. | High | N | Partial payments, payment plans, and third‑party payers offer flexibility but are not required by all programs. | 0 | 0 |
| M4 | System shall support fee waivers, refunds, chargeback handling, and reconciliation. | High | Y | Support for waivers, refunds, chargebacks, and reconciliation is critical for accurate financial operations. | 0 | 0 |
| M5 | System shall generate receipts, invoices, and account statements; email and portal delivery. | High | Y | Generating receipts, invoices, and account statements with email and portal delivery is a baseline requirement for transparency and customer service. | 0 | 0 |
| M6 | System shall provide payment posting, daily deposits, journal entries, and integration to state financial systems. | High | Y | Payment posting, daily deposits, journal entries, and integration to state financial systems are essential for fiscal compliance. | 0 | 0 |
| M7 | System shall support PCI‑DSS‑compliant handling of payment data (no storage of card PANs in the system). | High | Y | PCI‑DSS‑compliant handling with no card PAN storage is mandatory for fraud prevention and regulatory compliance. | 0 | 0 |
| M8 | System shall support financial reporting by program, fee type, date ranges, and payment method. | High | Y | Financial reporting by program, fee type, date range, and payment method is required for fiscal oversight. | 0 | 0 |
| M9 | System shall import fixed‑width data files for invoicing or financial reconciliation. | Medium | N | Importing fixed‑width data files assists reconciliation but is not required by all programs. | 0 | 0 |
| M10 | System shall record, classify, and manage debt according to statewide accounts‑receivable categories such as liquidated, delinquent, or assigned. | High | Y | Recording and classifying debt per statewide accounts‑receivable rules is essential for compliance with financial policy. | 0 | 0 |
| M11 | System shall automatically calculate and assess interest on penalties in accordance with agency rules. | Medium | N | Automated interest calculation on penalties provides efficiency but is not universal across programs. | 0 | 0 |
| M12 | System shall allow staff to configure customized payment plans based on dollar amount, percentage, date/timeframe, or number of installments. | Medium | N | Staff‑configured payment plans allow tailoring but are not needed in all operational contexts. | 0 | 0 |
| M13 | System shall automatically generate and distribute invoices and monthly reminder statements to applicable parties. | High | Y | Automated invoicing and monthly reminder statements support consistent billing cycles and reduce manual workload. | 0 | 0 |
| M14 | System shall record all financial transaction details in accordance with the Oregon Accounting Manual (OAM) Chapter 10 requirements. | High | Y | Recording all financial transactions per the Oregon Accounting Manual is required for auditability. | 0 | 0 |
| M15 | System shall comply with the Oregon Treasury Merchant Card Services Agreement and support certification with Elavon or TSYS for card payment processing. | High | Y | Compliance with Treasury merchant card requirements and certification with Elavon or TSYS is mandatory for card acceptance. | 0 | 0 |
| M16 | System shall comply with NACHA and IAT requirements for ACH transactions, including support for ACH EFT sweeps on an agency‑defined billing cycle. | High | Y | NACHA and IAT compliance for ACH, including support for billing‑cycle EFT sweeps, is required for ACH processing. | 0 | 0 |
| M17 | System shall support interim ACH EFT sweeps for any agent upon agency request. | Medium | N | Interim ACH EFT sweeps are helpful operationally but not essential for all programs. | 0 | 0 |
| M18 | System shall store bank account information for agent organizations, including bank name, routing number, and account number, for ACH EFT sweep file creation. | High | Y | Storing bank account info for agent organizations to generate ACH sweep files is required in sweep‑based programs. | 0 | 0 |
| M19 | System shall assess penalty fees for insufficient funds (NSF) when an ACH EFT sweep cannot be completed. | Medium | N | Assessing NSF penalty fees is valuable for collections but not needed across all agencies. | 0 | 0 |
| M20 | System shall produce real‑time financial reports, including at minimum: Daily Sales details, Daily Sales summary, week‑to‑date sales by agent organization, week‑to‑date sales by agent location, and weekly invoices. | High | Y | Real‑time financial reporting (daily and weekly summaries, agent organization results, invoices) supports oversight and reconciliation. | 0 | 0 |
| M21 | System shall provide the agency with annual PCI‑DSS Level 1 certification documentation supplied by the vendor. | High | Y | Providing annual PCI‑DSS Level 1 certification documentation ensures compliance and risk mitigation. | 0 | 0 |
| M22 | System shall allow non‑licensee and non‑applicant users to pay fees online without the need to create an account. | Medium | N | Allowing non‑licensees to pay fees online without account creation enhances usability but is not mandatory for all workflows. | 0 | 0 |
| M23 | System shall provide fully itemized cost transparency, including licensing, hosting, integrations, customizations, and any variable/usage‑based fees. | Medium | Y | Itemized cost transparency reduces procurement risk and prevents unplanned expenses. | 0 | 0 |
| M24 | System shall allow licensees to order and pay for documents such as duplicate wall certificates or file transfers, including capture of request details and automated fee assessment. | Medium | N | Document-order workflows improve customer service and revenue accuracy but are not universally required across programs. | 0 | 0 |
N. Document Management & Templates
| N1 | System shall store all submitted documents with metadata, versioning, and retention schedules. | High | Y | Centralized document storage with metadata, versioning, and retention ensures auditability, compliance, and efficient retrieval. | 0 | 0 |
| N2 | System shall provide template-driven letters/emails/notices with dynamic merge fields. | High | Y | Template‑driven letters, emails, and notices with merge fields support consistent, automated communication. | 0 | 0 |
| N3 | System shall support e-signature integrations for certain forms (affidavits, consent orders) with audit trails. | High | Y | E‑signature integrations with audit trails for select forms reduce processing time and strengthen legal defensibility. | 0 | 0 |
| N4 | System shall support configurable print layouts for licenses, wall certificates, cards, and badges. | High | Y | Configurable print layouts for licenses, certificates, cards, and badges meet regulatory display and branding requirements. | 0 | 0 |
| N5 | System shall support OCR and text extraction for structured intake where beneficial. | Medium | N | OCR and text extraction can accelerate structured intake but may not be required for all programs. | 0 | 0 |
| N6 | System shall provide and maintain complete technical documentation including an Entity Relationship Diagram (ERD), relational database model, and data dictionary for all system data and calculated fields. | High | Y | Complete technical documentation (ERD, relational model, data dictionary) is essential for governance, integration, and long‑term maintenance. | 0 | 0 |
| N7 | System shall require the vendor to escrow system programming to ensure agency access in the event of vendor insolvency. | High | Y | System programming escrow ensures continuity in the event of vendor insolvency and is a standard risk‑mitigation requirement. | 0 | 0 |
O. Communications & Notifications
| O1 | System shall send notifications via email, SMS, in-portal messages, and (optionally) postal mail batch generation. | High | Y | Multi‑channel notifications (email, SMS, portal, optional postal batches) are essential for timely communication and regulatory operations. | 0 | 0 |
| O2 | System shall support configurable triggers: submission received, deficiency, approval, renewal due, CE shortfall, discipline events. | High | Y | Configurable triggers (submission, deficiency, approval, renewal due, CE issues, discipline events) automate communication and reduce manual workload. | 0 | 0 |
| O3 | System shall allow program admins to create broadcast messages and targeted campaigns (e.g., new rule changes). | Medium | N | Broadcast messages and targeted campaigns support stakeholder outreach but are not required for core licensing functions. | 0 | 0 |
| O4 | System shall provide communication logs in each record with timestamps and delivery status. | High | Y | Communication logs with timestamps and delivery status ensure auditability and complete record history for each licensee or applicant. | 0 | 0 |
| O5 | System shall support multilingual communications (English + additional languages configurable). | Medium | Y | Multilingual communication improves accessibility and compliance with language‑equity expectations. | 0 | 0 |
| O6 | System shall assign a unique communication ID number to every outbound communication generated by the system. | High | Y | Unique communication IDs ensure traceability, support audits, and facilitate customer‑service follow‑up. | 0 | 0 |
| O7 | System shall allow staff to designate whether each communication template is sent via certified mail or regular mail, including setting default delivery methods. | Medium | N | Designating certified vs. regular mail for each communication template supports operational needs but is not universal across agencies. | 0 | 0 |
| O8 | System shall support bulk email creation with attachments and allow filtering of recipients based on defined criteria. | Medium | N | Bulk email creation with attachments and recipient filtering provides flexible mass‑communication capabilities. | 0 | 0 |
| O9 | System shall maintain multiple contacts for third‑party entities, such as insurers, education providers, or attorneys, and support communications to any associated contact. | High | N | Maintaining multiple contacts for third‑party entities (insurers, educators, attorneys) and sending communications to any associated contact is essential for complex licensing environments. | 0 | 0 |
| O10 | System shall send inactivity notifications to applicants after a configurable number of days when a pending application remains incomplete. | Medium | Y | Inactivity notifications for incomplete applications help reduce abandoned submissions and improve throughput. | 0 | 0 |
| P. Reporting & Analytics | ||||||
| P1 | System shall provide pre-built dashboards for applications in progress, approvals, denials, cycle times, CE compliance. | High | Y | Pre‑built dashboards for applications in progress, approvals, denials, cycle times, and CE compliance provide critical operational visibility. | 0 | 0 |
| P2 | System shall support ad hoc reporting with filters, columns, grouping, and export to CSV/Excel. | High | Y | Ad hoc reporting with filters, grouping, and CSV/Excel export is essential for flexible analysis and oversight. | 0 | 0 |
| P3 | System shall support scheduled reports with secure delivery to stakeholders. | High | Y | Scheduled reports with secure delivery ensure consistent dissemination of key information to stakeholders. | 0 | 0 |
| P4 | System shall support KPI tracking by program (SLA adherence, backlog, complaint resolution times). | High | Y | KPI tracking for SLA adherence, backlog, and complaint resolution supports program performance management. | 0 | 0 |
| P5 | System shall support data visualization (charts/graphs) embedded within staff UI. | Medium | N | Embedded charts and visualizations improve insight but are not strictly required for core regulatory workflows. | 0 | 0 |
| P6 | System shall support cross-program roll-up analytics while respecting data isolation rules. | High | N | Cross‑program roll‑up analytics with enforced data isolation supports enterprise‑level reporting needs. | 0 | 0 |
| P7 | System shall support a Business‑Intelligence‑ready reporting architecture capable of multi‑dimensional data analysis. | High | Y | A business‑intelligence‑ready architecture enabling multi‑dimensional analysis supports long‑term analytical scalability. | 0 | 0 |
| P8 | System shall provide online reporting without requiring add‑on components or extensions. | Medium | Y | Online reporting without requiring add‑ons improves usability and reduces dependency on external components. | 0 | 0 |
| P9 | System shall allow authorized users to access reporting features from mobile platforms. | Medium | N | Mobile access to reporting features supports flexible work but is not essential for core licensing operations. | 0 | 0 |
Q. Workflow & Rules Engine
| Q1 | System shall include a no-code/low-code workflow designer for approvals, inspections, audits, licensing workflows, discipline cases. | High | Y | A no‑code/low‑code workflow designer enables agencies to modify approvals, inspections, audits, and discipline workflows without vendor intervention. | 0 | 0 |
| Q2 | System shall support conditional routing, parallel tasks, escalations, and timers. | High | Y | Conditional routing, parallel tasks, escalations, and timers are essential for modeling real regulatory processes. | 0 | 0 |
| Q3 | System shall support rule-based decisions (e.g., auto-approval when all checks pass and no flags present). | High | Y | Rule‑based automation (e.g., auto‑approval when checks pass) reduces processing time and increases consistency. | 0 | 0 |
| Q4 | System shall support SLA tracking with alerts on overdue tasks and queue prioritization. | High | Y | SLA tracking with alerts and queue prioritization ensures timely processing and supports program performance management. | 0 | 0 |
R. Security & Privacy
| R1 | System shall implement role‑based access control (RBAC) with least‑privilege principles. | High | Y | Role‑based access control using least‑privilege principles is foundational for protecting regulated data and agency operations. | 0 | 0 |
| R2 | System shall support granular permissions (view, create, edit, approve, finance, admin, report‑only). | High | Y | Granular permissions (view, create, edit, approve, finance, admin, report‑only) ensure separation of duties and reduce security risk. | 0 | 0 |
| R3 | System shall encrypt data at rest and in transit (TLS 1.2+; AES‑256 for storage). | High | Y | Encryption in transit (TLS 1.2+) and at rest (e.g., AES‑256) is mandatory to protect PII and regulated data. | 0 | 0 |
| R4 | System shall support logging and monitoring of all access and data changes with audit trails. | High | Y | Comprehensive logging and monitoring of access and data changes are essential for auditability and forensic readiness. | 0 | 0 |
| R5 | System shall support IP allow/deny lists for certain admin functions. | Medium | N | IP allow/deny lists for admin functions provide additional control but can be offset by MFA and zero‑trust network policies. | 0 | 0 |
| R6 | System shall support data masking/redaction for sensitive fields when viewed by certain roles. | High | Y | Data masking and redaction protect sensitive fields when viewed by non‑privileged users. | 0 | 0 |
| R7 | System shall support privacy controls in accordance with applicable state and federal requirements for PII. | High | Y | Privacy controls aligned with state and federal requirements for PII are mandatory. | 0 | 0 |
| R8 | System shall support secure session management and timeout policies. | High | Y | Secure session management and timeout policies reduce unauthorized access risk. | 0 | 0 |
| R9 | System shall support regular vulnerability scanning and penetration testing with remediation workflows. | High | Y | Regular vulnerability scanning and penetration testing with tracked remediation is critical for statewide security compliance. | 0 | 0 |
| R10 | System shall support incident response plans and breach notification workflows. | High | Y | Incident response plans and breach‑notification workflows are required to meet state security policies and statutory obligations. | 0 | 0 |
| R11 | System shall enforce the DAS offshore/foreign services approval workflow, including completion of Attachment C (https://www.oregon.gov/das/Policies/107-004-052_PR.pdf) per policy (https://www.oregon.gov/das/Policies/107-004-052.pdf): Request to use offshore or foreign services and receipt of written CSS approval before any State data is stored, processed, backed up, supported, or accessed offshore or in a foreign location. | High | Y | Required by DAS Procedure 107‑004‑052_PR (Attachment C) and Policy 107‑004‑052 | 0 | 0 |
| R12 | System shall restrict all data storage, processing, backup, and support to approved domestic or CSS-approved foreign locations; default restriction is no offshore or foreign services unless CSS approval is active. | High | Y | 0 | 0 | |
| R13 | System shall maintain a registry of all subprocessors and personnel with potential access to State data, including country/region, role, and scope of access, and notify the State of any changes prior to implementation. | High | Y | Ensures compliance with Policy 107‑004‑052 and OAR 125‑800 | 0 | 0 |
| R14 | Contracts and/or Statement of Work shall include clauses referencing DAS Policy 107‑004‑052 (https://www.oregon.gov/das/Policies/107-004-052.pdf), Procedure 107‑004‑052_PR (Attachment C; https://www.oregon.gov/das/Policies/107-004-052_PR.pdf), and Cloud & Hosted Systems Policy 107‑004‑150, require submission of Attachment C, restrict offshore services without CSS approval, and specify audit, incident notification, and termination rights for unauthorized offshore activity. | High | Y | Provides audit and oversight capabilities for CSS | 0 | 0 |
| R15 | Vendor shall provide State with ongoing reporting of offshore/foreign approval status, scope, approval/expiration dates, and integrate reminders at 60/30/7 days before renewal or expiration. | High | Y | Ensures contractual enforceability of data location requirements | 0 | 0 |
| R16 | Vendor shall treat all Authorized User Data as Level 3 per DAS Information Asset Classification Policy 107‑004‑050 and provide protections appropriate for Level 3 information. | High | Y | Ensures correct security posture for state‑classified data. | 0 | 0 |
| R17 | Vendor shall comply with Statewide IT Control Standards throughout the agreement; GovRAMP Authorized status accepted as full compliance. | High | Y | Aligns solution with statewide control baseline. | 0 | 0 |
| R18 | Vendor shall provide annual privacy and security training for all employees, agents, and subcontractors supporting the Contract. | High | Y | Ensures staff handling state data meet annual training obligations. | 0 | 0 |
| R19 | Vendor access to State networks/systems must comply with DAS Policy 107‑004‑110. | High | Y | Ensures proper governance for network/system access. | 0 | 0 |
| R20 | Vendor shall limit all use/disclosure of Authorized User Data strictly to Contract administration. | High | Y | Prevents unauthorized secondary use of state data. | 0 | 0 |
| R21 | Authorized User Data shall not be accessed, transmitted, or stored outside the United States or its territories. | High | Y | Reduces exposure to jurisdictions lacking aligned protections. | 0 | 0 |
| R22 | Vendor shall not use any data‑mining technologies or analytics on Authorized User Data for non‑authorized purposes. | High | Y | Protects state data from profiling, commercial use, or unrelated analysis. | 0 | 0 |
| R23 | Vendor shall maintain required privacy and security protections for any retained Authorized User Data while retained. | High | Y | Ensures continuing protection through full lifecycle. | 0 | 0 |
| R24 | Vendor shall not suspend agency access to its data during the Contract or post‑termination access period. | High | Y | Guarantees uninterrupted access to mission‑critical licensing data. | 0 | 0 |
| R25 | Vendor shall provide at least 90 days of no‑charge post‑termination access to all Authorized User Data and return all data in an agreed format. | High | Y | Enables smooth transitions and prevents vendor lockout. | 0 | 0 |
| R26 | Vendor shall sanitize/purge all Authorized User Data after post‑termination period per NIST SP 800‑88, with written certification to the agency. | High | Y | Ensures secure destruction of sensitive data. | 0 | 0 |
| R27 | Vendor shall notify the agency of any suspected/confirmed security incident or breach within 24 hours of discovery. | High | Y | Supports rapid containment and statutory compliance. | 0 | 0 |
| R28 | Vendor shall provide notice to the agency before responding to any third‑party request for Authorized User Data. | High | Y | Ensures agency protection and proper legal handling. | 0 | 0 |
| R29 | Vendor and agency shall notify each other of legal or regulatory changes affecting Contract performance. | High | Y | Supports continued compliance throughout lifecycle. | 0 | 0 |
| R30 | Vendor shall provide annual SOC 2 Type 2 audit results covering all Trust Services Criteria and provide POAM with 30‑day remediation. | High | Y | Verifies security posture and remediation responsiveness. | 0 | 0 |
| R31 | Vendor shall host solution in approved U.S.‑based AWS regions and shall not materially modify hosting without agency approval. | High | Y | Ensures stable, compliant hosting environment. | 0 | 0 |
| R32 | Vendor shall maintain a documented Security Risk Management Plan and provide it upon request. | High | Y | Allows agency to verify vendor risk program. | 0 | 0 |
| R33 | Vendor shall provide Security Plan materials including policies/procedures, annual SOC 2 Type 2 results, and FISMA/NIST 800‑53 assessments. | High | Y | Ensures visibility into required frameworks and controls. | 0 | 0 |
| R34 | Vendor shall use independent assessors for penetration tests and vulnerability assessments. | High | Y | Strengthens credibility and independence of assessments. | 0 | 0 |
| R35 | Vendor shall undergo an annual independent compliance assessment against Statewide IT Control Standards and provide results plus POAM. | High | Y | Ensures year‑to‑year alignment with statewide baselines. | 0 | 0 |
| R36 | Vendor shall provide the agency on‑demand access to system security logs including user‑level access logs. | High | Y | Supports forensics, investigations, and auditability. | 0 | 0 |
| R37 | Vendor shall provide audit access to facilities, systems, personnel, and records as needed to validate compliance. | High | Y | Enables agency oversight and regulatory adherence. | 0 | 0 |
| R38 | Vendor shall not provide any offshore computing services; all hosting, development, support, and maintenance must be performed onshore (U.S.). | High | Y | Reduces offshore risk and ensures compliance with statewide policy. | 0 | 0 |
| R39 | Vendor shall ensure all personnel performing work are U.S. citizens or hold valid U.S. work authorization. | High | Y | Supports workforce authorization and data‑protection requirements. | 0 | 0 |
| R40 | Vendor shall not assign personnel lacking U.S. work authorization to any activity under the Contract. | High | Y | Prevents unauthorized personnel from accessing regulated data. | 0 | 0 |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .