S-DASOBO-00012779 CCB LMS RFP Att B-2 Requirements Fit-Gap Matrix Analysis vRELEASE 2026JAN12.xlsx
XLSX spreadsheet 121 KB Posted
- Solicitation number
- S-DASOBO-00012779
- Issued by
- Marion County, Oregon
About this file
This document is a Requirements Fit-Gap Matrix Analysis worksheet for the Construction Contractors Board (CCB) Licensing and Enforcement Modernization project in Oregon, designed to evaluate proposer solutions against 409 detailed system requirements organized across eleven functional categories. The RFP seeks a comprehensive licensing and enforcement solution to manage all statutory requirements for construction contractor licensing in Oregon, with proposers required to complete the electronic matrix to demonstrate how their proposed solution addresses mandatory requirements, core non-functional requirements, core functional requirements, and specialized requirements related to correspondence, licensing, enforcement, mediation cases, financial management, and compliance. Proposers must indicate their solution type (SaaS, PaaS, IaaS, or On-Premise) and select from five response codes for each requirement: Standard Function (S), Base Code or On Roadmap (B), Customization Required (C), Third Party Integration Required (I), or Cannot Fulfill (O), with accompanying comments explaining implementation approaches and alignment with agency goals.
The matrix establishes a scoring methodology whereby mandatory requirements are binary (Meet/Cannot Meet), and all other requirements are weighted by priority level (High=3 points, Medium=2 points, Low=1 point), with maximum possible scores of 6,060 points across all categories and 332 points for mandatory and high-priority requirements. Key mandatory capabilities include external account creation, multi-channel payment processing, case management workflows, document storage, data sharing, electronic communications, electronic signatures, audit trails, reporting functionality, mobile scalability, cloud hosting, Microsoft Active Directory integration, and Azure cloud hosting compliance. The solution must support 24/7/365 availability for external users (99.99% uptime) and weekday availability for internal staff, with disaster recovery and business continuity capabilities, PCI-DSS compliance for payment processing, SOC-2/FedRAMP security certification, and encryption of all personally identifiable and payment card information in accordance with FIPS Publication 140-2.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions and Score Summary CCB Licensing and Enforcement Modernization Requirements Scoring Matrix
| Worksheet Completion Instructions | |
| Proposer shall complete and submit an electronic version of this Requirements matrix to demonstrate how the proposed solution addresses the requirements. Please follow these instructions to complete the scoring matrix. | |
| 1 | ENTER Offeror's Name in cell A12 of this Instructions Tab. |
| 2 | INDICATE proposed solution type (e.g., SaaS, PaaS, IaaS, or On-Premise) in cell H12 of this Instructions Tab. |
| 3 | This workbook is arranged in eleven worksheets or Catagory Tabs: |
- Instructions (this tab) -Glossary of Terms -Common Acronyms -Mandatory Requirements -Core Non-Functional Requirements -Core Functional Requirements -Correspondence Requirements
- Licensing (also covering Education requirements) -Enforcement and Mediation Cases Requirements
- Financial Requirements
- Compliance Requirements 4 On the Mandatory Tab, Proposer must select if they can Meet or Cannot Meet the requirement. Definitions: Meet: Can meet the requirement either with "outof the box" system functionality or with configuration Cannot Meet: Cannot meet the requirement. If any Mandatory Requirements cannot be met, the Proposer will not be considered to go forward. The sheet is protected to only allow entries to be made in columns F and G. Only selections made in Column F will be scored.
For each detailed Requirement line items in each Requirements Catagory Tabs:
a. SELECT ONE of the five Response Options from the drop down menu in Column F "Response." The codes in the drop-down list correspond to the codes described in the Code Table below, AND
b. COMPLETE Column G "Comments" with Offeror's or Solution Provider's brief comments that support, explain, or clarify the code selected in Column F.
| The comments should succintly describe how the proposed Solution will implement the requirement line item, especially where the required functionality DOES NOT "Currently Exist" in the general release version of the proposed Solution at the time of Offer submission. In any explanation provided, Offeror must describe how the proposed Solution addresses the required functionality, whether it requires custom code, how it aligns with the Authorized Purchaser’s stated goals, preferences, and principles, and where custom code may be required. The explanation may also provide configuration alternatives or funciontality to be developed. However, DO NOT use this Column G for the narrative requested by the RFP. | |||
| 5 | ENSURE to provide a respone and comments for each requirement line item. | Total number of requirements across the Category Tabs: | 409 |
| Proposers Name: | Indicate if this is a Saas, PaaS, IaaS or On-Premise System: | |||||||||
| Score | ||||||||||
| Summary: | Total Points | 0 | 0.0% | Mandatory and High Reqs marked "S" standard functions | 0 | 0.0% | Mandatory and High Reqs marked "B" Base Code or On Roadmap | 0 | 0.0% | Proposed Solution potential value-add |
(Non-mandatory requirements that Proposer asserts meet "S" or "B" Codes below.
| out of | out of | out of | 0 |
| 6060 | 332 | 332 |
| Requirements Category Tab Column | Explanation of Column | Code Table | |||
| Column A | Requirement ID | Points | Response Code | Condition | Description |
| Column D | Priority Rating (as determined by the Agency) | 5 | S | Standard Function | Offeror and Solution Provider assert the functionality described by the requirement currently exists in the generally available Solution described in the Offer and is used in their customer's production environment. |
| Column E | Requirement Decription | 4 | B | Base Code Configurable or On Roadmap | The functionality described in the requirement is -- |
- Available in the proposed Solution by configuration of existing base code, OR
- On Solution Provider's product roadmap for general availability release within one year of RFQ Release (ensure to include expected date of general availability)
| Column F | Response Code (See table to right) | 2 | C | Customization Required | Proposed Solution does not currently include functionality to meet the requiremet on the Solution Provider's product roadmap, and would require custom development to provide the functionality. |
| Column G | Proposer Comments | 1 | I | Third Party Integration Required | The functionality is provided through the use of a separate software package(s). If third party software is necessary to provide the functionality, please describe in Column E. |
| Column H | Auto Calculated Response Points | 0 | O | Cannot Fulfill Requirement | Proposed Solution does not provide the functionality and is not on product roadmap for release within one year of RFQ Release. Offeror may provide alternative functional solutions in Offeror's Comments in Column G. |
| Column I | Maximum Points | ||||
| Column J | Auto Calculated Points |
Glossary of Terms
| Term/ Acronym | Description |
| Access / Roles / Privileges | Security control features |
| Administrative Fees | Fees for services or work product. Does not include licensing or application fees. |
| Administrative Users | User role having administrator privileges to the System. May be designated for each division/section. |
| Applicant/Registrant/Licensee | A sole proprietor, partnership, limited liability partnership, joint venture, limited partnership, limited liability company, corporation or trust that makes application to license and is responsible for the license. |
| Application Fees | Fee paid to CCB to assess the applicant's qualifications. |
| Archive | To move data for which regular use is no longer needed to a repository for long-term retention, to be kept separate for compliance reasons or for moving off primary storage media. |
| Associated Records | Records that are cross referenced with one or more other records that have common individuals or entities. |
| Assumed Business Name | An entity or business name that is not its legal name. |
| Bigger Bond | A circumstance in which a contractor has been required to carry a bond in a greater amount than is required by their endorsement. |
| Billing | Monthly billing when a payment plan is in place |
| Bond amount/Bonds | See also Surety Bonds. An insurance policy held by a licensee, with a unique number and expiration date, which protects against losses. Bond amounts are determined by statute and differ based on license/endorsement type. |
| Branching Logic | A custom pat based on a user's response. |
| Case | Any transaction or service that is "opened," processed through a workflow and "closed" over a period of time to achieve a resolution of a request or other complex activity. |
| Certification | A designation that confirms completion of required training and is the basis for CCB issuing an authorization to perform work within the scope of the credential. |
| Citation (Field) | A notice issued by a field investigator on the job site that acts as the Notice of Intent (NOI) to Take Action for a violation by a licensed or unlicensed entity. |
| Civil Penalty | Dollar amount assessed to a licensed or non-licensed violator, when they have violated Board laws/rules. |
| Commercial Contractor 1 | A contractor that may supervise, arrange for, or perform (partly or completely) an unlimited number of unrelated building trades involving any small or large commercial structure or project. A Level 1 commercial contractor must have at least 8 years of construction experience. |
| Commercial Contractor 2 | A contractor that may supervise, arrange for, or perform (partly or completely) an unlimited number of unrelated building trades involving any small or large commercial structure or project. A Level 2 commercial contractor must have at least 4 years of construction experience. |
| Commercial Developer | A developer of property that is zoned for or intended for use compatible with a small commercial or large commercial structure and is intended for sale. |
| Commercial Specialty Contractor 1 | A contractor that may perform work involving one or two unrelated building trades for small or large commercial projects. A Level 1 commercial specialty contractor must have at least 8 years of construction experience. |
| Commercial Specialty Contractor 2 | A contractor that may perform work involving one or two unrelated building trades for small or large commercial projects. A Level 2 commercial specialty contractor must have at least 4 years of construction experience. |
| Context Sensitive | The display of a data field is dependent on the value contained in another data field. |
| Continuing Education Credit | Education credits required for a licensee to remain in compliance. |
| Continuing Education Audit | An audit performed to ensure that a contractor has performed their continuing education in a previous licensing period. |
| Continuing Education Provider | An individual or business that provides continuing education credits. |
| Contractor | A person that, for compensation or with the intent to sell, arranges, undertakes, offers to undertake, or submits a bid to construct, alter, repair, restore, add to, subtract from, improve, inspect, move, wreck, or demolish, for another, a building, highway, road, railroad, excavation or other structure, project, development, or improvement attached to real estate. Includes a school district or community college which permits students to perform construction on a structure intended for sale, persons performing certain landscape work (when not licensed by the Landscape Contractors Board), and persons who perform home inspections services. "Contractor" includes persons who are and who are not licensed by the CCB. |
| Correspondence | A system used to generate written communications from the agency |
| Custom Field | A field that is configured by the CCB without the need for custom source code or database changes and is otherwise not included in the standard fields of the software. |
| Dashboard | A page in the system that provides a visual display of metrics and other specific information. |
| Days | "Days" means calendar days, unless otherwise provided or the context otherwise indicated. |
| Delivery Method | Identifies which delivery channel shall be used to distribute content to a specific contact (for example: email, secure email, SFTP, portal) |
| Dispute Resolution | Process where a CCB Mediator works with a complainant and respondent to resolve a complaint through mediation. |
| DRS Complainant | A person who files a complaint against a contractor under ORS 701.131 to 701.180. The complainant has a contractual relationship with the contractor. |
| DRS Complaint | Means a complaint filed and processed under ORS 701.131 to 701.180. Various types of complaints are defined in OAR 812-002-0140 |
| Endorsement | Sub designation of a license that defines the scope of work and other licensing requirements. |
| Enforcement Complainant | A person who notifies CCB of actions by a contractor that require investigation and could result in penalties. Complainant may be anonymous or identified. |
| Enforcement Complaint | A complaint received by the CCB that triggers a site visit to a construction site for various reasons. |
| Entity Type | Describes the business structure of licensee/applicant. The type of entity drives what needs to be reported by the licensee/applicant. |
| Exam Fee | Fee paid by pre-license candidates (applicants) to take the pre-license test. |
| Exempt | The exempt class is composed of sole proprietors, partnerships, joint ventures, limited liability partnerships, limited partnerships, corporations, trusts, and limited liability companies that do not qualify as non-exempt (i.e. cannot employ others) |
| Family Members | Members of the same family and are parents, spouses, sisters, brothers, daughters, sons, daughters-in-law, sons-in-law, or grandchildren |
| Field Investigation Report | When a job-site check results in a potential violation or an informational report is needed, a Field Investigation Report is written to document the violation |
| Field Labels | Descriptive text adjacent to a data field. |
| Final Order | Enforcement case closure document either after a hearing, following settlement, or by default. |
| Financial Transaction | An accounting transaction (e.g., debit or credit) entered into the system. |
| Form | A live, structured page within the application into which data can be entered by the user. |
| General Contractor | A contractor whose business operations allow the use of more than two unrelated building trades or crafts that the contractor supervises or performs in whole or part. |
| Home Energy Performance Score Contractor | A contractor who operates a business issuing home energy performance scores |
| Home Inspector Services Contractor | A contractor who operates a business offering home inspection services. |
| Home Services Contractor | A contractor who operates a business offering service, repair or replacement under a home services (warranty) agreement. |
| Inactive Status | A license status that does not allow a licensee to perform work, does not require a bond, insurance or continuing education to renew and must be renewed on time in order to retain the license. A license may not be placed or maintained in inactive status more than once during any two-year licensing term. |
| Independent Contractor Classification | A person who provides services for remuneration and who, in the provision of the services is free from direction and control over the means and manner of providing the services, customarily engaged in an independently established business; licensed under ORS chapter 671 or 701 if the person provides services for which a license is required under ORS chapters 671 or 701; and is responsible for obtaining other licenses or certificates necessary to provide the services. |
| Individual | A natural person |
| Insurance | Public liability, personal injury and property damage insurance covering the work of the contractor, including coverage of liability for products and completed operations according to the terms of the policy and subject to applicable policy exclusions. |
| Insurance Agent | Licensed individual utilized by contractor to issue their liability insurance |
| Integration | A connection that allows for the automated, bi-directional exchange of information between two applications in a controlled fashion. |
| Interested Party | In a Dispute Resolution case, an interested party is someone who receives copies of information upon request that are sent to the Complainant and Respondent. Examples include Attorneys. |
| Job Site Check | When a field investigator approaches a job site from an assigned activity/report or randomly. |
| Judgment | A judgment issued in a court action or a court order. |
| Key Employee | An officer or employee of a licensee who is a corporate officer, manager, superintendent, foreperson, lead person or any other person who exercises management or supervisory authority over the construction activities of the business. |
| Lapse | Commences at the time that a license expires, is suspended or is terminated for any reason and ends when the license is renewed, reissued, or reinstated. |
| Large Commercial Structure | A structure that is not a residential structure or small commercial structure. |
| License | Authority that allows licensee to operate a construction business in the state of Oregon |
| License Card | Physical or digital copy of the license reflecting license status. |
| License Expiration | The point where a license becomes invalid unless renewed. |
| License ID | The unique identifier for a particular license |
| License Period | Period between first issuance and renewal, and between each subsequent renewal. |
| License Status | Indicator if a license is valid or in a different status. For example: active, revoked, etc. |
| Locksmith | A person who services, installs, repairs, rebuilds, rekeys, repins or adjusts locks, hardware peripheral to locks, safes, vaults, safe deposit boxes or mechanical or electronic security systems. |
| Manager Member | An LLC member as well a runs the day-to-day business |
| Mediation Result | Documented result between a complainant and respondent after a planned or scheduled mediation. |
| Non-exempt | The non-exempt class is composed of sole proprietors, partnerships, joint ventures, limited liability partnerships, limited partnerships, corporations, trusts, and limited liability companies that employ one or more employees or that utilize one or more workers suppled by a worker leasing company. |
| Notice of Intent (NOI) to Take Action | Document served on a licensee or unlicensed entity when the agency intends to revoke, suspend, refuse, or condition a license, or assess a civil penalty. |
| Officer | A president, vice president, secretary, treasurer or director of a corporation, a general partner in a limited partnership, a manager in a manager-managed limited liability company, a member of a member-managed limited liability company, a trustee, a person who has a financial interest in a business and manages or shares in the management of the business or a responsible managing individual. |
| Owner | A sole proprietor of, partner in or holder of a controlling interest in a business, a general partner in a limited partnership, a majority stockholder in a corporation, a manager in a manager-managed limited liability company, a member in a member-managed limited liability company or a person who has a financial interest in a business and manages or shares in the management of the business. |
| Penalties | The Board can issue fines that become due upon final order in response to violations. Penalties may be imposed with or without other licensing actions such as suspension, revocation, refusal, denial, or license conditioning. CCB’s schedule of penalties is located under (812-005-0800). (701.990; 701.992; 701.995) |
| Pre-License Education Provider | A business or individual that is approved by CCB to provide the 16-hours of pre-license education. |
| Proposed Order | Issued as the opinion of an Administrative Law Judge after a hearing |
| Public Works Bond | Contractors working on qualifying public works projects with a total project cost of more than $100,000 must file a $30,000 public works bond with the Construction Contractors Board (CCB). The bond must be filed before work starts. This bond will be used solely in the event of a prevailing wage claim filed with the Bureau of Labor and Industries (BOLI). |
| Refused | The party listed on this record is not currently legal to bid, arrange for or perform work. There is no bond and there may not be insurance coverage on this particular license. The agency refused to issue the license. |
| Reinstate | Restoration of a license to active status after a lapse that occurred because of a suspension. A reinstated license is valid from the date that suspension ends. |
| Reissue | A license is reissued when licensure is approved by the Board after a lapse that occurred because the licensee failed to renew the license and failed to provide proof of bonding, letter of credit, or cash deposit coverage and insurance coverage during the lapse. A reissued license is valid from the date that the lapse ends. |
| Renewal | License extension for a period of time based upon licensee completing all renewal requirements |
| Renewal Fee | Amount paid to submit a license or certificate renewal. |
| Residential Developer | A developer of property that is zoned for or intended for use compatible with a residential or small commercial structure and is intended for sale. |
| Residential General Contractor | A contractor that may supervise, arrange for, or perform (partly or completely) an unlimited number of unrelated building trades involving any residential or small commercial structure or project. |
| Residential Limited Contractor | A residential contractor that may not perform work exceeding $40,000 gross annually or enter into contracts in excess of $5,000. This endorsement is meant for part-time contractors who, for example, build for a hobby, for retirees, or for handyman services. |
| Residential Locksmith Services Contractor | A contractor who operates a business offering locksmith services only. |
| Residential Restoration Contractor | A contractor who operates a business offering restoration services for residential and small commercial structures. |
| Residential Specialty Contractor | A contractor that may perform work involving one or two unrelated building trades for residential or small commercial projects. Alternatively, these residential contractors may perform work on a single property involving three or more unrelated trades if the contract for labor and materials is $2,500 or less. |
| Respondent | A contractor or individual that is either the subject of a complaint or the subject of an enforcement action by the Board. |
| Responsible Managing Individual (RMI) | Is an owner or employee of a business that exercises management or supervisory authority over the construction activities of the business. This individual must be designated with CCB as the RMI of the business. |
| Revoke | To cancel or rescind a licensee's right to perform construction work following opportunity for hearing |
| Sabbatical | This licensee voluntarily placed its license in an inactive status. This licensee is not currently legal to bid, arrange for or perform construction work. There may not be a bond or insurance coverage on this particular license. |
| Sanction | The Board issues sanctions, including fines and licensing actions for violating Oregon’s statutes, rules, and laws. Sanctions can vary and depend on the violation. Sanctions can include Letters of Education, additional training requirements, and penalties. They may also describe more serious outcomes such as suspension of, revocation of, refusal to issue or refusal to renew a license, or imposition of a civil penalty. (701.992; 701.995; 701.098) |
| Settlement Agreement | 1. An agreement between parties in a DRS proceeding 2. Any signed administrative agreement between the CCB and a respondent |
| Small Commercial Structure | (a) A nonresidential structure that has a ground area of 10,000 square feet or less, including exterior walls, and a height of not more than 20 feet from the top surface of the lowest flooring to the highest interior overhead finish of the structure; (b) A nonresidential leasehold, rental unit or other unit that is part of a larger structure, if the unit has a ground area of 12,000 square feet or less, excluding exterior walls, and height of not more than 20 feet from the top surface of the lowest flooring to the highest interior overhead finish of the unit; (c) A nonresidential structure of any size for which the contract price of all construction contractor work to be performed on the structure as part of a construction project does not total more than $250,000; or (d) An appurtenance to a structure or unit described in paragraphs (a) to (c) of this subsection. |
| Specialty Contractor | A Contractor who performs work on a structure, project, development or improvement and whose operations as such do not fall within the definition of "general contractor." |
| Surety Bond | A surety bond is defined as a three-party agreement that legally binds together a principal who needs the bond, an obligee who requires the bond and a surety company that sells the bond. The bond guarantees the principal will act in accordance with certain laws. If the principal fails to perform in this manner, the bond will cover resulting damages or losses. Depending upon the type of license the contractor applies for, the amount of the bond required is different. |
| Suspension | An administrative action for a violation that may be corrected by specific action. |
| System | A collection of functionality working together to produce an objective. This may be a Commercial Off the Shelf (COTS) System, or in house. For example, there may be multiple COTS Systems from multiple vendors producing subsets of functionality each, or a single COTS System producing functionality. |
| UUE | Identification number in lieu of a license number for Unlicensed entity. |
| Violation | Is proposed when a person or entity (licensed or not) engages in activities or alleged activities out of compliance with statute, rule, or law in Oregon. |
| Waiver of Fees | Form/process for waiving fees |
| Workflow | A set of tasks that occur in sequence to complete an activity in the system. A workflow may or may not be supported by logic within the system that derives the appropriate next steps and processes the task to the party accountable. |
| Worker's Compensation Insurance | Insurance that provides cash benefits and/or medical care for workers who are injured or become ill as a direct result of their job. Required for all non-exempt contractors and exempt commercial contractors. |
Common Acronyms
| The below are common acronyms utilized across the CCB program and throughout this Requirements Document. | ||
| Acronym | Description | Notes |
| ABN | Assumed Business Name | |
| API | Application Programming Interface | |
| CCB | Construction Contractors Board | |
| CE | Continuing Education | |
| CM | Case Management | |
| COOP | Continuity of Operations | |
| CSS | Central Security Service | |
| DR | Dispute Resolution | |
| DRS | Dispute Resolution Section | |
| FIR | Field Investigation Report | |
| FO | Final Order | |
| IT | Information Technology | |
| L1 | Level 1 | |
| L2 | Level 2 | |
| L3 | Level 3 | |
| MFA | Multi-Factor Authentication | |
| NOI | Notice of Intent | |
| PO | Proposed Order | |
| RESTful | Representational State Transfer API | |
| RMP | Requirements Management Plan | |
| RTM | Requirements Traceability Matrix | |
| SFMA | Statewide Financial Management Application | |
| SOAP | Simple Object Access Protocol | |
| SFTP | Secure File Transfer Protocol | |
| WCAG | Web Content Accessibility Guidelines |
COMMON ACCRONYM LIST
Mandatory
| CCB Licensing and Enforcement Modernization - Mandatory Requirements | |||
| Please note, Per Section 3.1.2 of the RFP if Proposer can not meet the Mandatory Requirements, they will be considered non-Responsive (failed) and the Proposal will be rejected. | |||
| Req # | Priority | Requirement | Response |
(Please select from
| drop-down menu) | Comments | Auto Calculated Response Selection Points | Auto Calculated Points |
| (Response x Priority Rating) | Maximum Points |
(Priority Rating x Max Points)
| MAND 01 | Mandatory-5 | Support the ability for external users to create and maintain an account (such as: licensees, certificate holders, DRS and Enforcement complainants, respondents, education providers, insurance and bond providers, local government entities). Such accounts may have access to several areas assigned to them depending upon the type of user. | 25 |
| MAND 02 | Mandatory-5 | Provide the ability to take payments (cash, check, money orders, electronic payments) and provide refunds as well as provide a 3rd party payment Solution or be able to fully interface with a third party payment Provider that is approved by Oregon Treasury | 25 |
| MAND 03 | Mandatory-5 | Provide a case management/workflow component that provides a complete life cycle of a licensee record (examples include intial application, DRS complaint, Enforcement complaint, queue management, assignments, tracking, status, outcome/resolution, closure of record/case, maintenance for designated retention period). | 25 |
| MAND 04 | Mandatory-5 | Provide storage and management for uploaded documents integrated within the system. | 25 |
| MAND 05 | Mandatory-5 | Provide capability for data sharing with entities which may include data download or upload files of any common type | 25 |
| MAND 06 | Mandatory-5 | Provide the ability for communication (letter, email, text, or other as specified) between external users and CCB staff (e.g. request actions) and track responses/completion of actions | 25 |
| MAND 07 | Mandatory-5 | Provide an electronic signature, attestation, or affirmation capability integrated into the system. | 25 |
| MAND 08 | Mandatory-5 | Provide functionality for completion of and workflow management processing for online submissions | 25 |
| MAND 09 | Mandatory-5 | Provide the ability to track multiple types of agency actions related to regulated entities and cases within agency jurisdiction | 25 |
| MAND 10 | Mandatory-5 | Provide the ability to track business structures and relationships among licenses, licensees, accounts, and other entities | 25 |
| MAND 11 | Mandatory-5 | Scale to mobile devices | 25 |
| MAND 12 | Mandatory-5 | Provide full audit trail capability | 25 |
| MAND 13 | Mandatory-5 | Provide reporting capability which can support basic, pre-defined reporting as well as report development | 25 |
| MAND 14 | Mandatory-5 | Capability to generate communications (letter, email, text or other as specified) to external and internal users based upon a trigger such as workflow, date, event, etc. | 25 |
| MAND 15 | Mandatory-5 | Either provide a cloud-hosted or SDC hosted browser based SAAS. | 25 |
| MAND 16 | Mandatory-5 | Have ability to integrate internal users with Active Directory and Microsoft | 25 |
| MAND 17 | Mandatory-5 | Any and all PaaS or IaaS components of the proposed Solution will be hosted within the State’s EIS Cloud Managed Environment (Azure). | 25 |
| MAND 18 | Mandatory-5 | Workforce authentication is performed through Microsoft Entra ID, using Single Sign-On with MFA and least-privilege access | 25 |
| MAND 19 | Mandatory-5 | Where the proposed Solution integrates with Microsoft 365 services or utilizes Microsoft Graph API, the proposed Soultion complies with statewide least-privilege controls and does not request elevated permissions (e.g., Directory.ReadWrite.All, Application.ReadWrite.All, etc.) | 25 |
| 19 | Mandatory Requirements | 0 | Mandatory Requirements as "S" Standard Function | 0 | 475 |
| 0 | Mandatory Requirements in "B" Base Code or already on roadmap | Response Total Pts | Tab Max Total Pts |
19 Requirements Total on this worksheet
Core Non-Functional
| CCB Licensing and Enforcement Modernization - Core Non-Functional Requirements | |||
| Req # | Priority | Requirement | Response |
(Please select from
| drop-down menu) | Comments | Auto Calculated Response Selection Points | Auto Calculated Points |
| (Response x Priority Rating) | Maximum Points |
(Priority Rating x Max Points)
| ACM | |||
| ACM 01 | High-3 | Solution will require external users that sign on to have a unique ID. | 15 |
| ACM 02 | High-3 | The solution shall have authentication of internal users through Active Directory to reduce the need for redundant staff accounts and passwords. | 15 |
| ACM 03 | High-3 | Solution will permit external customers to use Oath 2.0 authentication from reputable sources. | 15 |
| ACM 04 | High-3 | Solution should allow admin user to inactivate or lock users. | 15 |
| ACM 05 | Low-1 | Solution should allow admin user to remove access to certain licensee or enforcement/DRS case information for a specific user. | 5 |
| ACM 06 | High-3 | External account passwords must meet complexity and length requirements that can be configured by admin users. | 15 |
| ACM 07 | High-3 | Require new external users to create an account prior to license application. | 15 |
| ACM 08 | High-3 | Solution should allow account information and details to be updated by account holder. | 15 |
| ACM 09 | High-3 | Solution should have self-service password reset feature. | 15 |
| ACM 10 | High-3 | Solution should allow admin user to have ability to initiate a reset password for the user. | 15 |
| ACM 11 | High-3 | Solution should support a single account having multiple associated businesses. | 15 |
| ACM 12 | High-3 | Solution should support methods for firm level account holders to add/remove additional account users to their account by invitation. | 15 |
| ACM 13 | High-3 | Solution should support a customer linking one or more existing licenses to an account. | 15 |
| ACM 14 | High-3 | Solution should provide an "end user agreement" that account registrants should acknowledge to be able to use the system. The contents of the end user agreement will be developed by CCB staff. | 15 |
| ACM 15 | High-3 | Solution should ensure that when account information is updated an email will be sent to account holder's email to ensure account information is not updated without account holder's knowledge. | 15 |
| ACM 16 | High-3 | Solution should provide account logout based on both a manual selection and a timespan of inactivity by the user. | 15 |
| ACM 17 | High-3 | Solution should require users to re-authenticate after an active session has lapsed. | 15 |
| ACM 18 | High-3 | Solution should allow authorized CCB staff user to view list of users and role. | 15 |
| ACM 19 | High-3 | Allow staff user with appropriate role to create a unique record for an unlicensed individual. | 15 |
| ACM 20 | High-3 | The solution shall audit all solution logins, alert on, and track invalid login attempts. | 15 |
| ACM 21 | High-3 | Solution will permit external customers to use multifactor authentication. | 15 |
| ACM 22 | Low-1 | Allow Local Government Entities the ability to create an account to list responsible bidders. | 5 |
| ACS | |||
| ACS 01 | High-3 | The solution shall enforce least privilege at an individual user level. | 15 |
| ACS 02 | High-3 | Solution should provide authorized users (system administrators) administrative control to set user roles and permissions. | 15 |
| ACS 03 | High-3 | Solution should support modifying and changing roles and permissions to accommodate changes to the business in the future. | 15 |
| ACS 04 | High-3 | Solution should support the ability for authorized staff to activate and deactivate user accounts. | 15 |
| ACS 05 | Low-1 | System should be able to show deactivated accounts in queries, reports, and forms when explicitly included as part of the data request. | 5 |
| ACS 06 | High-3 | Solution should maintain session state and provide session time-out after a pre-determined amount of time. Solution should impose idle session timeouts | 15 |
| ACS 07 | High-3 | Solution should ensure proper error handling and messaging--don't reveal system internals (e.g., stack traces, debug details, files or paths) to users when encountering errors. | 15 |
| ACS 08 | High-3 | System to log errors during all system workflows for troubleshooting and administrative review. | 15 |
| ACS 09 | High-3 | System to be at the most current version of security (e.g. TLS) on all public-facing web pages. | 15 |
| ACS 10 | High-3 | System must meet SOC-2/Fed Ramp security status. | 15 |
| ACS 11 | High-3 | The vendor must encrypt all PII and PCI data at rest and in transit, in compliance with FOPS Publication 140-2 or applicable law, regulation or rule, whichever is the highest standard. | 15 |
| ACS 12 | High-3 | The vendor must provide agency staff with copies of system vulnerability assessments completed associated with each system update to confirm that no new vulnerabilities are introduced into the system. | 15 |
| ACS 13 | High-3 | Vendor must ensure application security-relevant software and firmware are available and updated within a reasonable timeframe. | 15 |
| ACS 14 | High-3 | The system must employ malicious code protection mechanisms at system entry and exit points (e.g., firewalls, electronic mail servers, web servers, proxy servers, remote-access servers) and at workstations, servers, or mobile computing devices on the network. Code protection mechanisms must be updated whenever new releases are available and in accordance with CCB's configuration management policy, procedure, and standards. | 15 |
| ACS 15 | High-3 | Code protection mechanisms must be updated whenever new releases are available and in accordance with CCB's configuration management policy, procedure, and standards. | 15 |
| ACS 16 | High-3 | Vendor has a documented process to ensure that software weaknesses and vulnerabilities are identified and addressed as early as possible, including testing and fixing code. | 15 |
| ACS 17 | High-3 | The solution shall meet the State's security incident response standards to ensure proper handling of incidents should they occur (web site for DAS policy 107-004-120 inserted). | 15 |
| ACS 18 | High-3 | Solution should provide methods to designate and protect sensitive or protected data from access by unauthorized persons--protections extend to both screen security and data query/report methods. | 15 |
| ACS 19 | High-3 | Solution should adhere to all State of Oregon security/privacy standards. | 15 |
| ACS 20 | High-3 | The system shall protect all system media until the media's destruction or sanitization via approved equipment, techniques, and procedures. | 15 |
| ACS 21 | High-3 | All digital and non-digital media shall be physically controlled and secured in defined controlled areas using defined security measures. | 15 |
| ACS 22 | High-3 | Solution should have a remote secondary data storage location to ensure disaster recovery and business continuity. | 15 |
| ACS 23 | High-3 | The vendor must store all data including backups and log files, which must meet Oregon audit standards, in the United States. | 15 |
| ACS 24 | High-3 | System should be configurable so that PII can be retained only as long as required and can be purged after it is used. | 15 |
| ACS 25 | High-3 | One business day advance notice of scheduled downtime should be provided to Agency. | 15 |
| ACS 26 | High-3 | Software vendor must provide CCB information in order to add the software to the Agency's authorized software inventory whether located onsite or a remote service provider. Provide information to agency to update the list of authorized software programs at least annually, when required due to system upgrade or other significant change, or as part of an integral system component installation. | 15 |
| ACS 27 | High-3 | System security functionality must be isolated from non-security functionality in order to control access to and protect the integrity of the hardware, software, and firmware that performs security functionality. System must restrict access to security functions using access control mechanisms and by implementing least privilege capabilities. | 15 |
| ACS 28 | High-3 | System must have protections against unauthorized physical connections. | 15 |
| ACS 29 | High-3 | Vendor must plan and coordinate security-related activities affecting the system with appropriate agency information security oversight, change management, and other stakeholders, before conducting such activities to reduce the impact on other organizational entities that may be affected by changes to the system. | 15 |
| ACS 30 | High-3 | The solution shall require multifactor (MFA) for internal staff when logging in to comply with numerous standards. | 15 |
| ACS 31 | High-3 | The vendor must have a process to enforce cyber security requirements for any sub-contractors. | 15 |
| AUDT | |||
| AUDT 01 | High-3 | The system shall maintain a history of changes made to records to provide auditability of changes | 15 |
| AUDT 02 | High-3 | Solution should provide a record of change history for each licensee or business (modifications to record). | 15 |
| AUDT 03 | High-3 | Solution should track date/time stamps and user IDs for all updates to data fields. | 15 |
| AUDT 04 | High-3 | System shall support tracking of all communications sent to an account. | 15 |
| AUDT 05 | High-3 | The solution shall provide the ability to audit all communications sent out for tracking and review. | 15 |
| AUDT 06 | High-3 | Staff has ability to view list of logged communications (phone/email/in person/written). | 15 |
| AUDT 07 | High-3 | Solution should support capture of activity trail that can be used by IT administrative staff to ensure and manage security. Details for user sessions including login/entry date/time, user ID, IP address, and session activity should be tracked. These details should be available on a role restricted basis to support audits, incident response, and security audits. | 15 |
| AUDT 08 | High-3 | Solution should support ability to track and see history of entity structure. | 15 |
| AUDT 09 | High-3 | Solution should retain all audit records in accordance with Oregon Administrative Rule 166-300-0030 (3) for Computer System Security Records and applicable federal laws, executive orders, directives, policies, regulations, standards, and guidance, whichever is more restrictive. | 15 |
| REPT | |||
| REPT 01 | High-3 | Solution should provide reporting tool(s). | 15 |
| REPT 02 | High-3 | Solution should allow staff user to schedule report generation. | 15 |
| REPT 03 | High-3 | Solution should support the ability to save reports for future use. | 15 |
| REPT 04 | High-3 | Solution should support a standard set of reports that provide data that comply with public records requests. | 15 |
| REPT 05 | High-3 | Solution should support the ability to print and export reports in a variety of formats including Excel/CSV, and PDF (not be able to print or download restricted information that has been designated as restricted). | 15 |
| REPT 06 | Medium-2 | Solution should allow admin users to gather analytics about system use patterns. | 10 |
| REPT 07 | Low-1 | Access to system reporting functions and capabilities shall be assigned by roles | 5 |
| REPT 08 | Low-1 | The system allows access to reports via mobile platforms. | 5 |
| REPT 09 | High-3 | The system does not require add-ons or extensions for reports accessed online. | 15 |
| REPT 10 | High-3 | Report contents should be able to be sorted and filtered using various criteria. | 15 |
| REPT 11 | High-3 | Staff users have ability to reprint any items printed automatically by the system. | 15 |
| REPT 12 | High-3 | The system shall include the ability for users to query data and run a report on an as-needed basis. | 15 |
| REPT 13 | High-3 | The system shall allow users to configure reports without IT or vendor intervention. | 15 |
| REPT 14 | High-3 | The system shall include access for IT users to configure/code complicated report requests as needed without vendor intervention. | 15 |
| REPT 15 | Medium-2 | Solution provides a redundant data store for reporting. | 10 |
| USN | |||
| USN 01 | High-3 | Solution should provide consistent navigation. Examples include but not limited to buttons, bars, links, etc. located in the same place on every page. Navigational tools intended to perform a specific function (e.g. go back, go forward, scroll, etc.) perform it in a consistent manner throughout the application. | 15 |
| USN 02 | High-3 | Solution should use standard, uniform button labels (and meanings), and placement across all forms. | 15 |
| USN 03 | High-3 | Solution should ensure user buttons contain clear messaging that describes to a user what the button does. For example, a button that saves the current state of the form and moves the user to the next page of the form should be labeled 'Save and Continue' or similar. | 15 |
| USN 04 | High-3 | Solution should provide consistent, common, uniform look-and-feel and operation across all forms in the Solution to allow users to easily transition and use all parts of the Solution easily and intuitively. | 15 |
| USN 05 | High-3 | The solution shall support accessibility guidelines as defined in WCAG 2.2 to ensure it can be used by people with disabilities. | 15 |
| USN 06 | Medium-2 | Provide localization to other languages on forms and screens. | 10 |
| USN 07 | Medium-2 | Users shall have the ability to use screen reader technology which will provide auditory feedback about on-screen elements, text, and interactions | 10 |
| USN 08 | Medium-2 | Users shall have the ability to alter colors and contrasts of the interace to make elements more distinguishable and easier to see. | 10 |
| USN 09 | Medium-2 | The solution shall support providing textual descriptions for HTML for images, icons, and other non-text content within an application. | 10 |
| USN 10 | Medium-2 | The solution shall support best practices around language access such as supporting different languages, interpretation support, accessible formats, plain language, lartge print, braille, ALT text, etc. | 10 |
| USN 11 | Low-1 | The solution shall support converting content from one language into another while maintaining its meaning, context, and intent. This shall include all communication on screen, chat, phone, and/or correspondence. | 5 |
| USN 12 | Medium-2 | User shall have the ability to specify their preferred language for both written and spoken communication. | 10 |
| USN 13 | Medium-2 | Users shall have the ability to increase the size of text, icons, and other visual elements. | 10 |
| USN 14 | Medium-2 | The solution shall be available via paper forms, have the ability to be 100% paperless, and provide electronic access and/or paper copies structured in a meanful format for anyone authorized to access such information. | 10 |
| USN 15 | High-3 | The solution shall provide web analytics for external portal/web services including traffic and error reporting. | 15 |
| USN 16 | High-3 | Vendor will provide a support line and an on-line tracking system accessible to select agency staff. | 15 |
| USN 17 | High-3 | Solution should scale for use on mobile platforms. | 15 |
| USN 18 | Low-1 | Any mobile application shall be available from standard app stores. | 5 |
| USN 19 | High-3 | Solution should allow copy/paste to populate fields. | 15 |
| USN 20 | High-3 | Solution should provide consistent, uniform methods for providing feedback and assistance to all users regarding field and forms level validation of data--message placement and visual indicators should be consistent across forms. | 15 |
| USN 21 | High-3 | Solution should warn users when selecting an operation (e.g., Exit button) that may result in loss of data. | 15 |
| USN 22 | Medium-2 | Solution forms should provide user guidance for specific classes of data fields to help users enter data in correct format--calendar popups, telephone and SSN number fields that eliminate need for user to enter delimiters, notes on specific fields to spell out field constraints (e.g., login/password length and/or complexity requirements). | 10 |
| USN 23 | High-3 | Solution must provide fail-over capability. | 15 |
| USN 24 | High-3 | Solution should provide public web page information similar to provided currently - for example contractor search detail, education information, etc. (List to be determined). | 15 |
| INT | |||
| INT 01 | High-3 | Solution will provide interface capability for data sharing with multiple entities and interfaces may also include data download, upload files in common formats. | 15 |
| INT 02 | High-3 | Provide an export to Oregon Department of Justice, Child Support at regular intervals. Currently these are File Transfers. | 15 |
| INT 03 | High-3 | Validate Secretary of State Business Registry data from Secretary of State opendata website. | 15 |
| INT 04 | High-3 | Validate Workers Compensation data from DCBS opendata website. | 15 |
| INT 05 | High-3 | Validate other information as needed from the opendata website. | 15 |
| INT 06 | High-3 | Provide an export to Oregon Open Data at regular intervals. | 15 |
| INT 07 | Medium-2 | Provide an import/export to Oregon Department of Revenue at regular intervals. | 10 |
| INT 08 | Medium-2 | The system will maintain a similar, consistent naming convention between data elements on the user interface and corresponding data location names in the database. | 10 |
| INT 09 | High-3 | The solution shall have the ability to make data available through a secure file transfer process. | 15 |
| INT 10 | Low-1 | Solution will allow USPS address verification on all addresses entered and fill in county. | 5 |
| INT 11 | High-3 | The solution must provide RESTful or SOAP APIs to facilitate communication with other systems. | 15 |
| INT 12 | High-3 | Use secure authentification and authorization mechanisms (e.g., Oauth 2.0) to control access to APIs. | 15 |
| INT 13 | High-3 | Provide comprehensive documentation for API endpoints, data schemas, and usage guidelines. | 15 |
| CONF | |||
| CONF 01 | High-3 | Solution should support the ability for license types to be added, canceled, or modified over time. | 15 |
| CONF 02 | High-3 | Solution should support the ability for system business rules to be configured by CCB staff. | 15 |
| CONF 03 | High-3 | Solution will allow role-based user to add/remove/edit which fields on transactions are required, what documents must be uploaded, exam requirements by license, and define hard stops to ensure applications/forms are completed, etc. | 15 |
| CONF 04 | High-3 | The system must provide mechanisms to track changes to values for business rules. | 15 |
| CONF 05 | High-3 | The system must allow for update to the system prior to implementing changes to values in business rules. | 15 |
| CONF 06 | High-3 | The solution shall track changes to business rules automation and workflows. | 15 |
| CONF 07 | Low-1 | System provides a survey function | 5 |
| CONF 08 | Medium-2 | Allow integration with external survey after specific transactions and provide a mechanism to compile results of surveys. | 10 |
| CONF 09 | High-3 | The solution shall have training resources that can be used to train internal staff on how to configure and administer the solution. | 15 |
| CONF 10 | High-3 | The system shall logically incorporate state and federal holidays into all functionality. | 15 |
| CONF 11 | High-3 | Solution can allow on-line forms and templates to be created as needed by the agency (examples: applications, complaint forms (for DRS and Enforcement Complaints), job-site checks, field investigation reports, citations, mediation agreements, etc.). | 15 |
| IMP | |||
| IMP 01 | High-3 | Solution will provide testing and development environments in addition to production. | 15 |
| IMP 02 | High-3 | The system shall provide the ability to configure, test, staging and production environments independently to allow for full test simulation of all capapbilites/processes/workflow/reporting/etc. | 15 |
| IMP 03 | High-3 | The system shall provide the ability to clone/copy data from production to test enviornment for testing pruposes with identifying information masking. | 15 |
| IMP 04 | High-3 | During implementation, solution will provide a Sandbox environment. | 15 |
| IMP 05 | High-3 | The solution shall be cloud hosted, exclusively in the US. | 15 |
| IMP 06 | High-3 | The system shall operate and store all data within the U.S., its possessions, and territories. | 15 |
| IMP 07 | High-3 | Vendor must agree to escrow the system programming in the event of insolvency. | 15 |
| IMP 08 | High-3 | The vendor will provide disaster recovery and business continuity support to CCB 24 hours a day/7 days a week/365 days a year. | 15 |
| IMP 09 | High-3 | The vendor will participate at mutually agreed upon times in support of agency business continuity testing and recovery exercises. | 15 |
| IMP 10 | High-3 | The vendor must show proof of existing business continuity and disaster recovery plan for any site(s) where the system is located. | 15 |
| IMP11 | High-3 | The vendor must maintain and provide agency access to system and data documentation through the life of the Contract. | 15 |
| IMP 12 | High-3 | The vendor must provide and maintain any other documentation relevant to maintaining a technical understanding of system functionality. | 15 |
| IMP 13 | High-3 | The solution vendor shall support a data conversion and migration plan that includes, but is not limited to the following: planning and analysis, backing up data, data mapping, migration script generation, testing and validation, rollback planning, production migration, post-migration validation, and documenting migration plan. | 15 |
| IMP 14 | High-3 | The vendor must maintain all system (if hosted) and application components at current release levels. Patches and updates must be applied within a reasonable time frame. | 15 |
| IMP 15 | High-3 | The solution shall support custom branding. | 15 |
| AVAIL | |||
| AVAIL 01 | High-3 | Subscription Services must be available for external users 24 hours a day, 7 days a week, excluding pre-approved downtime for maintenance (99.99%). | 15 |
| AVAIL 02 | High-3 | Susbscription Services must be available for internal users weekdays between 6 am and 6 pm PST, excluding pre-approved downtime for maintenance (99.99%). | 15 |
| AVAIL 03 | High-3 | The system shall support an uptime of 99.9% | 15 |
| AVAIL 04 | High-3 | The system shall not have a system downtime outside of the regular maintenance schedule without CCB approval 72 hours prior to the downtime. | 15 |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .