SaaS Questionnaire for Vendor (2).docx
DOCX document 34 KB Posted
- Attached to
- Argonne Payroll/Effort/Timekeeping System RFI
- Solicitation number
- 5-P124-I--05426-00
- Issued by
-
Department of Energy Office of Science
About this file
This document is a Software as a Service (SaaS) Questionnaire for Argonne National Laboratory, detailing comprehensive technology and security requirements for a potential software solution. The questionnaire comprehensively covers multiple critical areas including system architecture, hosting operations, security events, data protection, authentication, backup and recovery, and support considerations. Argonne seeks a SaaS solution with specific technical requirements such as secure hosting within the continental United States, three-tier network architecture, encrypted web browser accessibility, subscription-based access, and robust security measures including multi-factor authentication, data encryption, and comprehensive incident detection and response capabilities.
The document is directly related to a pre-solicitation opportunity (RFI) for a Payroll/Effort/Timekeeping System, targeting a commercial-off-the-shelf (COTS) solution that can integrate with Workday Financial and HR systems while meeting Department of Energy (DOE) compliance requirements. The solution must handle complex payroll processing, multiple schedule types, union contract variations, and provide enterprise-level reporting and metrics tracking. Key compliance requirements include adherence to DOE guidelines, federal/state tax regulations, and potential FedRAMP certification, with the ultimate goal of supporting Argonne National Laboratory's financial management operations efficiently and accurately.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
REV 10-27-2022
ARGONNE NATIONAL LABORATORY
Software as a Service (SaaS) Requirements
Technology Requirements Argonne National Laboratory seeks a Software-as-a-Service (SaaS) solution due to the desire for product innovation, expedient implementation, predictable operating costs, low administrative and internal IT overhead, and enhanced customer support. Ideally, the vendor-delivered model should include the following:
· Software is securely hosted on servers, in a three-tier separated network architecture that the vendor provides and maintains.
· Software and network infrastructure must have perimeter security protection such as Firewalls, IPS/IDS, DLP, and Anti-malware/virus with proper security incident/intrusion detection and escalation process in place.
· Software is securely accessible via encrypted sessions (TLS/HTTPS with +128-bit cipher strength, TLS >=1.2) using a web browser with no client-side downloads required.
· Software supports the major web browsers: Firefox, Google Chrome, Internet Explorer, Opera and Safari with equal functionality.
· Data encryption, key management, backup and recovery are in place to provide protection to sensitive and confidential data.
· Access to the software is subscription-based rather than licensed.
· A single code-base is deployed across all customers.
· The location of the hosted hardware and data, including all back-ups, must be within the continental United States.
TECHNOLOGY
| F. |
| SYSTEM ARCHITECTURE |
| F1. |
| Provide an overview of your product and system architecture. Attach any documentation or diagrams that support your overview. |
Response
| F1.a |
| Base software technologies |
Response
| F1.b |
| Software development kit/development tools used |
Response
| F1.c |
| Databases used/supported |
Response
| F1.d |
| Operating systems supported |
Response
| F1.e |
| Web browsers supported |
Response
| F1.f |
| Reliance on proprietary technologies |
Response
| F1.g |
| Third party software products and versions required |
Response
| F1.h |
| Open source integrated products |
Response
| F1.i |
| Configuration architecture |
Response
| F1.j |
| Extensibility architecture |
Response
| F1.k |
| Customization architecture |
Response
| F1.l |
| Authentication and authorization – Is Multi-Factor Authentication currently available for use? If not, provide explanation with mitigating functionality. Include the date MFA will be available. |
Response
| F1.m |
| Workflow and routing architecture |
Response
| F1.n |
| Integration and e-mail calendaring systems (Exchange) |
Response
| F1.o |
| UI architecture |
Response
| F1.p |
| Application user interfaces (APIs) |
Response
| F1.q |
| Self-diagnosis and healing |
Response
| F1.r |
| Could the system be configured to send email from the cloud using a “From:” address with an anl.gov domain? |
Response
| F1.s |
| If the answer to F1.r is yes, does the system support DKIM (Domain Keys Identified Mail)? |
Response
| F1.t |
| If the answer to F1.r is yes, does the system support DMARC (Domain Message Authentication Reporting & Conformance)? |
Response
| F1.u |
| If the answer to F1.u is yes, does the system support SPF (Sender Policy Framework)? |
Response
| F2. |
| Describe the skill requirements for an in-house system integrator or other technical expertise required and the amount of IT support required. |
Response
| F3. |
| Describe how your software integrates with other systems (COTS, SaaS and custom developed). |
Response
| F4. |
| Describe how data is imported/exported between systems. |
Response
| F5. |
| Describe how data in the system can be mass updated. |
Response
| F6. |
| Describe the reporting engine(s), capabilities and features supported by your system. |
Response
| F7. |
| What flexibility is supported related to security within the product: field level, record level, table-level security definition, roles definition, reporting security? |
Response
| G. |
| HOSTING OPERATIONS |
| G1. |
| If applicable, provide a copy of your Authority to Operate (ATO) letter. The ATO must be based on compliance with the applicable NIST SP 800-53. The letter or its attachments must indicate: |
1. A FIPS-199 level of at least Moderate,
2. A signatory that is an authorized official of an agency of the U.S. federal government,
3. The validity dates of the ATO, and
4. The organization or individual that performed the certification.
Response
| G1a. |
| Does your organization hold a FedRAMP certification? If so, at what level? |
Response
| G1b. |
| Does your organization currently have any commercial security certifications such as an ISO-27001 or SOC2 Type 2? If so, please include any certificate letters and reports from these certifications in the response. |
Response
| G2. |
| Provide an overview of your hosting facilities, including backup and disaster recovery, and your recovery point objective (RPO)/recovery time objective (RTO). |
Response
| G3. |
| Describe where the servers, network hubs, etc. are physically located, including primary and backup facilities. If cloud-based, please identify the vendor(s) and region(s). |
Response
| G4. |
| Describe how you protect against power outages/surges, single points of failure (hardware and network), and water damage. |
Response
| G5. |
| Describe the access controls including access to server rooms, paper records, back-up facilities, and tape/disk storage. |
Response
| G6. |
| Describe any video surveillance (outside building/ inside building /inside server room) at the facility. |
Response
| G7. |
| Describe whether responsibility for physical security has been formally assigned and to whom. |
Response
| G8. |
| Are background checks performed before physical and logical access is granted to employees? |
Response
| G9. |
| Are employees with access to a client’s data required to sign a confidentiality agreement before being granted access? |
Response
| G10. |
| Will any of the services or operational functions be outsourced to another organization? If so, what services and to whom? |
Response
| G11. |
| What is your protocol for ensuring the security of a client’s data when using third parties? |
Response
| G12. |
| Can Argonne restrict the access by your employees to Argonne’s information (e.g. restrict access to only U.S. citizens)? |
Response
| G13. |
| Can Argonne’s data be restricted to only U.S. datacenters? |
Response
| H. |
| SECURITY EVENTS |
| H1. |
| Are the following host-based security activity events being logged and reviewed? Who performs these reviews and how often are they performed? |
Response
| H1.a |
| Invalid login attempts |
Response
| H1.b |
| Brute force login attempts |
Response
| H1.c |
| Unauthorized attempts to access system resources |
Response
| H1.d |
| Unauthorized attempts to view or change security definitions and rules |
Response
| H1.e |
| Authorized security rule changes |
Response
| H1.f |
| Authorized access to resources |
Response
| H1.g |
| Change of system security settings |
Response
| H1.h |
| Host OS and application software security patching cycle |
Response
| H2 |
| Are the following network security activity events being monitored? Who performs these reviews and how often are they performed? |
Response
| H2.a |
| Security incident/intrusion monitoring, detection, validation, and escalation process and procedure |
Response
| H2.b |
| Unusual traffic or known penetration attempts |
Response
| H2.c |
| Denied access attempts at the firewall |
Response
| H2.d |
| Malicious software prevention, detection, correction |
Response
| H3 |
| Can logged events be sent to an external entity/customer? |
| I. |
| BACK-UP AND RECOVERY |
| I1. |
| Describe the back-up process for the data, applications, and operating system including the tape rotation and retention policy, the recovery procedures, and where the tapes are stored. |
Response
| I2. |
| Describe the fail over or high availability system and the location. |
Response
| I3. |
| Describe the disaster recovery plan and how often it is tested. |
Response
| I4. |
| Describe your Business Continuity Plan. |
Response
| I5. |
| Describe the policies/procedures in place for clients to “recover” their data, should the contract terminate or the vendor cease operations and what formats are available. |
Response
| I6. |
| Describe the policies/procedures in place for clients to “recover” their data in the event of a disaster affecting the operation of the vendor’s data center inhibiting the availability of the client to access its information. |
Response
| I7. |
| Describe your retention policy and to what extent you offer flexibility for clients to define their own retention policies within your system. |
Response
| J. |
| PASSWORDS |
| J1. |
| Describe the ability to authenticate to a client’s Active Directory using the LDAPS, Kerberos, or SAML protocols. |
Response
| J2. |
| Describe how login IDs and passwords are administered (i.e., created, deleted, passwords changed, etc.) |
Response
| J3. |
| How often may passwords be changed or reset? |
Response
| J4. |
| Are users forced to change their passwords and is this customer configurable? |
Response
| J5. |
| Is there a minimum password length? |
Response
| J6. |
| Describe any character set specifications (password complexity). |
Response
| J7. |
| Do the users’ IDs get locked out after a certain threshold for denied access attempt and, if yes, what is that threshold? |
Response
| J8. |
| Is there a restriction around the reuse of passwords and, if passwords may be reused, after how many intervals may it be reused? |
Response
| K. |
| DATA PROTECTION |
| K1. |
| Describe the process to ensure data protection and security. |
Response
| K2. |
| Describe how one customer’s information is separated from other customers. |
Response
| K3. |
| Describe how transmitted data is encrypted. |
Response
| K4. |
| Describe how the system protects against inadvertent deletion of data by users, and allows restoring requested schemas, tables, or the entire database from a backup source. |
Response
| L. |
| BREACHES OF SECURITY |
| L1. |
| Describe how and how quickly clients are notified when security mechanisms have been breached. |
Response
| L2. |
| Describe your incident response procedure. |
Response
| M. |
| SUPPORT AND SERVICE LEVEL INFORMATION |
| M1. |
| Describe your approach to Service Level Agreements. |
Response
| M2. |
| Describe your system uptime for the last twelve months. |
Response
Describe any scheduled outages for maintenance or upgrades.
Response
| M3. |
| What are your processes around performance testing and tuning for new customers |
Response
| N. |
| PRODUCT RELEASE AND MAINTENANCE |
| N1. |
| Describe how new releases are developed and deployed. |
Response
| N2. |
| Describe how often new releases are deployed. |
Response
| N3. |
| Describe the schedule of forthcoming releases and the important enhancements expected in the releases. |
Response
| N4. |
| Describe how requests for enhancements and changes are handled. |
Response
1 | Page
File details come from the government source that posted it. Updated .