SAAS_Requirement_Questionaire_.docx

Software as a Service Questions (SaaS Only) Proposers are required to answer all of the questions listed in Attachment D in the format that is provided. Questions are listed in gray fields and answers should be typed in the white space below, which can expand to fit almost any length. If your answer exceeds the maximum, then use a separate page (referencing the question) for the full answer.

Questions must be answered in the order listed and all questions must be answered fully. In the event that an exhibit(s) is required to answer a question fully, the proper exhibit number is referenced within respective questions. All exhibits required for this document must be attached to this document upon submittal. Exhibits are acceptable but simply referencing an exhibit will not suffice for answering any given question.

Contents

Part 1: Interface and Data Exchange Questions Describe your recommendation for connecting the vendor network to the Solano County network in a dedicated and secure fashion (e.g. IPSec VPN or similar).

Is your solution compliant with the NIEM standards?

What types of interfaces have you developed? Unidirectional or bi-directional? What technologies have you used? (API, web services, etc.) Does the solution support integration via service-oriented architecture?

Part 2: Technology/Security Information Compliance and Audit

1. Is your product/service PCI-DSS and PCI-PA Compliant?

2. What is your organization’s PCI merchant level? (1, 2, 3 or 4)

3. Can you provide an attestation of compliance document?

4. If an independent PCI audit has been conducted, would you be willing to allow the county to review any such audit? (If “Yes”, please attach a copy of the audit report as an exhibit. If “No”, please explain.)

5. Does the proposed solution currently use an Extended Validation SSL certificate (EV SSL) for web identity verification?

If “No” would you be willing to obtain an Extended Validation SSL (EV-SSL) certificate?

6. Has your application and service environment undergone an SSAE 16 audit within the past 2 years? (If “No”, please explain why as a service provider your organization has chosen to not have such audits performed.)

If “Yes” what level of audit was conducted (SOC 1, SOC 2 or SOC 3)

If “Yes”, would you be willing to allow the county to review this audit? (If “Yes” please attach a copy of the audit report as an exhibit. If “No”, please explain.)

7. Do any web sites servicing this system/application use TLS or IPSec encryption?

8. Do any web sites servicing this system/application request login credentials, process sensitive information or credit card transactions?

9. Solano County expects the Vendor to provide an annual attestation by an objective third party, stating that their application has been tested for common security vulnerabilities as articulated by the “OWASP Top 10” as published by the Open Web Application Security Project (see www.owasp.org for current list of the top 10). This testing must be performed at the expense of the Vendor and by an objective third party. As a Vendor, would you be willing to have such tests performed?

If “Yes”, would you provide Solano County with the independent testing firm’s report?

If “No”, explain any barriers that exist which prevent you from meeting this expectation.

HIPAA Compliance and Auditing

10. Has a risk analysis been conducted?

If “Yes”, when was the last risk assessment conducted and how often is the risk assessment repeated?

If “Yes”, would you be willing to allow the county to review the results or a summary of the results?

If “No”, describe the barriers you experience in conducting risk assessments.

11. Describe how you meet ALL HIPAA and HITECH security requirements.

12. Describe the security reporting tools available to meet all auditing and HIPAA reporting needs.

13. Will Solano County data be accessed by Business Associates?

If “Yes”, who will access Solano County data and how will this data be accessed/used by Business Associates?

Backup/Disaster Recovery

14. What type of business continuity and disaster recovery options are available? Is this part of the standard services?

15. Describe your back-up management. Describe how often systems are backed up and related retention policies.

16. Where are the disaster recovery data centers located? (City and State, specific addresses are not expected)

17. Will this disaster recovery site be connected to Solano County? If “Yes”; Describe the vendor's recommendation for connecting the vendor network to the Solano County network in a dedicated and secure fashion (e.g. IPSec VPN or similar).

18. Solano County may require the solution to be available for 24 hours per day, 7 days per week. The maximum downtime in the event of a failover should be 20 minutes. Provide details about the server configuration that you recommend for achieving this standard. Please include:

· Virtualization

· Storage Configuration (e.g., SANs, etc.)

· High Availability

· Load Balancing

· Fault Tolerance/Redundancy

· Failover

· Backups

19. How is your content housed? Is it a database, what type (SQL, Oracle, etc.)?

Data Access, Security, Segregation & Encryption

20. Describe how the solution meets Solano County’s requirement that all data must remain, both during transmission between data centers and at rest within the borders of the lower 48 states.

21. How is Solano County data and application separated from other customers (e.g. separate instance, separate servers, separate database, etc.)

22. Describe how your security model integrates to the network environment. Does it support: single-sign-on and Active Directory integration? Multiple forms of authentication? Multiple levels of security for internal and external users?

23. Describe the application-level security model of the proposed solution (e.g., user setup, roles, groups, password rules, access logs, granularity of security, etc.)

24. Describe how users’ access is removed from the application/system when the user changes roles or leaves the organization. Include information on any tools/utilities provided with the system to automate user access removal.

25. Describe how the solution enforces the IT security best practice of Role-Based Security: Access control shall be based on the role a user plays in the organization.

26. Describe how the vendor's services enforce the following IT security best practices:

a. Least Privilege: Only authorize access to the minimum amount of resources required for a function.

b. Separation of Duties: Functions shall be divided between staff members to reduce the threat that one person can commit fraud undetected.

c. Role-Based Security: Access control shall be based on the role a user plays in an organization.

27. Describe how the vendor restricts its employees and other personnel from accessing the Solano County data set.

28. Describe, if and how, Solano County data will be encrypted while in motion; both on physical media and electronic transmission, including mobile computing devices.

29. Describe, if and how, Solano County data will be encrypted while at rest.

30. Describe the communication protocols to allow appropriate communication within the system components, including integration and security.

31. If encryption is used, either in transit or at rest, will the vendor or Solano County manage the encryption keys? If the vendor manages the encryption keys, please describe your encryption key management practices.

32. Describe your solution’s ability to support data extraction into a third-party data warehouse.

33. Vendor is expected to notify Solano County of any breach or unauthorized access of Solano County data within two (2) business days following discovery. For purposes of this document, a “breach” is defined as:

“a security incident, in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen, used or accessed in any manner by an individual not authorized to access the information in question.”

a. Describe how the vendor will immediately notify Solano County of any breach of county information.

b. In the event of a breach of County information, the County reserves the right to participate in breach root cause analysis activities undertaken by the vendor. At a minimum, the County shall be provided with a detailed report of the outcome of such root cause analysis activities and remediation plans and activities. Please indicate your willingness to have Solano County participate in such root cause analysis and detail the level at which you would permit Solano County’s involvement. Describe the process for Solano County to participate in breach root-cause analysis activities.

34. Disposal of data at contract termination – describe how the vendor will erase, destroy or otherwise securely eliminate all data on all media under its control containing copies of county data not later than 90 days after termination of the contract. In addition, describe how the vendor will provide documented attestation that such removal, erasure or destruction has taken place. For purposes of this document, a “to erase” is defined as:

”to render the relevant data unrecoverable by any reasonable means.”

35. Will the county be allowed to approve and authenticate the method used to erase county data?

36. At the time of termination of the contract, Solano County requires all information assets provided to the vendor to be returned. For purposes of this document, a “Information Assets” is defined as:

“any information, whether in electronic or printed form, equipment, media, etc. that Solano County has provided to the vendor.”

Please describe how you as the vendor will track these assets and ensure that they are returned to Solano County.

37. Describe and detail the anti-malware software, procedures, and policies used to protect the vendor's infrastructure from malicious software.

38. Describe the vendor's methodology for conducting vulnerability testing; include scanning frequency and the methodologies used to remediate such vulnerabilities. If it is determined that the vulnerability is due to a configuration/system supported by Solano County identify the remedy for Solano County.

Part 3: Solution Information

1. Does your solution have any known conflicts with any other software (infrastructure software, applications, etc.)?

2. What internet browsers are supported by the proposed solution? Describe any required browser add-ons, etc.

3. Does your application require Java? Is there a specific version required? Describe the justification for requiring a specific Java version.

4. Please describe your solution's ability to support Solano County's requirement for single sign on.

5. What capabilities do you offer to connect to your application, push and pull data (i.e. API’s, web-services). Are APIs secured and encrypted?

6. When is planned downtime for your application; what is your maintenance window?

7. Describe the network monitoring tools supported in the vendor network.

8. Is there a software client that the Solano County will have to load? If so, can Solano County use MS SCCM to “push” the client?

9. If there a software client that the Solano County will have to load, Is it Microsoft Window 10 64 bit capable?

10. Please describe how your company is committed to supporting future operating system versions? (i.e., how does your company support migration from current operating systems to newer versions as older operating systems reach end of life?)

Part 4: Certification

1. Is the product/service you are proposing ISO 27001 certified?

If “Yes”, please provide evidence of such certification

If “No” are you considering achieving ISO certification?

If ISO certification is under consideration, describe your expected timeline for achieving certification.

If not, please explain why not.

2. Is the product/service you are proposing FIPS 140-2 certified?

If “Yes”, please provide evidence of such certification.

If “No”, are you considering achieving FIPS certification?

If FIPS certification is under consideration, describe your expected timeline for achieving certification.

If not, please explain why not.

Part 5: Monitoring/Alerting

1. Solano County seeks a monitoring system that alerts and/or notifies IT support staff regarding successful and failed operations associated with the system. The monitoring system must be configured to test a varied number of tasks as job packages according to a given schedule. The alerting mechanism should also be integrated into the existing bug tracking system to log and record chosen events. The alerts and notifications can be including email and paging functionality. Can the proposed solution deliver this functionality? If so, please describe.

2. In the event a custom modification to the application is required during implementation, indicate your philosophy for making the modification.

3. In a hosted environment, describe how your organization manages system logs. Please discuss retention practices and event monitoring an analysis processes.

4. Do access interfaces monitor failed access attempts? If “Yes”, describe which interfaces do not monitor these attempts and why.

5. In the event of an information security incident, would Solano County be granted access to or provided with log extracts? If not, explain why.

Part 6: Mobile Computing

1. Does your product/service have a mobile computing element (e.g., mobile phone/tablet app)?

If “Yes”, please describe the security incorporated into the mobile application.

2. Describe how Solano County data may be secured in the event that a mobile computing element is lost, stolen or a breach is otherwise suspected.

3. Describe security for mobile devices, such as mobile phones, tablets, and any other wireless hand held computer/devices.

Part 7: Technology Information Client Requirements

1. Please provide the hardware requirements for the client machines, including:

Supported manufacturers

Number/speed of processors

Memory

Disk space

Network interface

Other hardware

Operating system/version

Other required software and versions (e.g. Internet Explorer, .Net, etc.)

Third-party applications and versions, what they are used for (e.g., Microsoft Word, Adobe Reader, etc.).

Unique Hardware and Software Requirements

1. Is any specific hardware or software required or recommended for use with the proposed solution? Please provide details on manufacturer, product description, and model number if appropriate, and the item’s purpose.

Part 8: Promotion from Test to Production

1. How do you promote configuration changes from the test environment to the production environment?

2. How often does the promotion from the test environment to the production environment not work as expected? When this occurs, how do you identify the source of an issue and resolve it? What are some of the common issues that typically occur?

3. What methods do you use to confirm that the configurations of the test environment and the production environment are the same?

Part 9: Payment Processor

1. How are payments processed, is credit card information stored or sent directly to a payment processor?

2. How long have you offered card processing services?

3. Is your solution able to utilize the County’s payment processor xxx? If so describe

4. Clearly define the interchange rates by volume and credit card. List any additional fee’s added to transactions.

5. Do receipts clearly identify and/or separate out any convenience fees passed on to the customer?

6. Describe your overall financial transaction security model.

Part 10: General/Specific Questions on Proposed Solution Solution Overview

1. How long has the proposed solution been on the market?

2. How many releases have there been since its initial release?

3. What is the current version?

When is the next release planned?

5. Describe how the solution can be configured or tailored at the agency level to meet the County’s needs, including:

· Software components that can be agency-configured (e.g. settings, code tables, business rules, workflows, screen layouts, field names, agency-definable data elements, document template, etc.)

· Assistance provided by the proposer with initial configuration

· Process and support for on-going configuration needs

6. Describe how the solution can be tailored by the end users for their personal preferences (e.g., favorites, user interface look and feel, dashboards, hotkeys, etc.).

7. Describe the on-line help capabilities of the solution.

8. Describe the security model of the proposed solution (e.g., user setup, roles, groups, password rules, access logs, etc.).

9. What functionality is offered as part of the base product (please list)? What optional modules are available and do you recommend any of them for this installation (please list)?

10. What optional modules are available and do you recommend any of them for this installation (please list)?

11. Provide key challenges your customers have faced when implementing your proposed solution.

12. What is your recommended strategy for incorporating historical data into your proposed solution?

13. Does the solution integrate with e-mail systems (please list)? What mechanism does it use (e.g., SMTP protocol)?

Part 11: Reporting

1. What ad hoc reporting tool does your solution utilize? Describe its capabilities.

2. Can industry standard reporting tools (such as Power BI, Crystal Reports, etc.) be used with your solution? Is there one your recommend over the other and if so, why?

3. Describe how you ensure that reports that were used in the customer’s previous system are correctly re-created in your solution?.

Part 12: Support and Maintenance

1. Please describe your customer support program, including capabilities, procedures, roles and responsibilities, and facility/technical requirements (e.g., remote access to systems). Include copies of your service level agreement and transition plan as an attachment.

2. Describe the organizational structure of your support team (e.g., tiers, involvement of development staff).

3. What are your standard support hours?

4. Is after-hours support available? What does it cover? Please provide the cost (if extra) in your response.

5. Please describe in detail the support methods your company utilizes, including phone, email, website, remote connectivity, on-site, etc.

6. What mechanisms does the solution provide to assist with troubleshooting system problems (e.g., error logs, writing to Windows Event logs, etc.)? (This is not the same as application error messages provided to end-users when they use the solution.)

7.

How does your company classify the urgency of support issues (e.g., system down, critical, routine, etc.)? What are the response times for each classification, and what are the resolution times for problems of each level? If you offer multiple levels of support options, what does each cover (application, database, infrastructure, time to respond to an issue, time to resolve an issue, etc.)?

8. Describe your escalation procedures for support issues and SLA’s.

9. How do you communicate known issues to your customer base?

10. What internal Solano County staffing do you estimate is required to support the solution on an on-going basis (e.g., number and roles of server support, database administrators, desktop support, business staff, development staff, etc.)?

11. Please describe the installation process for new releases of your solution and how you support it. Include both the server and client upgrade processes. How long does a typical upgrade take to install? How much system downtime should Solano County expect.

12.

Specifically, what is the upgrade process for the client machines? What involvement of IT or other staff is required? What rights to the local machine are required for the client upgrade to install?

13. How often do you release:

a) Major upgrades (e.g., major rewrites, significant new modules, user interface revisions)?

b) Periodic upgrades (e.g., enhancements to existing solution, new features upgrades to underlying technology, etc.)?

c) Warranty (bug) fixes?

14. How do you inform customers and how much advance notice is given of the items (bug fixes, enhancements) included in new releases, and prerequisites for installing the new version?

15. Where and when are release notes made available to customers?

16. Please describe your product development roadmap for the next 18 months (enhancements, technology updates, etc.).

17. What are the types of costs, if any, associated with the installation of upgrades (e.g., software, services)? Please provide cost details in Section 2 of your response.

18. How long do you support prior versions of the solution? What is your support policy for customers who fall behind?

19. How do you determine what fixes, enhancements, and new features to include in major and periodic upgrades? Do you have a formal process for requirements gathering? To what extent do you solicit input from existing customers? What other factors are considered?

20. Describe how you update the software when a major new operating system or database management system is released. How soon after release do you support these upgrades? Does your solution rely on any technology no longer supported by the vendors of the operating system or database management system?

21.

Describe your policy with regard to customer application of patches/updates to operating systems, database management systems, browsers, and other underlying technology.

22. How are new versions tested prior to release to customers? Describe your quality assurance process.

23. Describe the vendor’s methodology for managing security patches, hotfixes and service packs for the vendor supplied applications.

Specifically, how often are security patches released?

How often are service packets released?

24. Please describe your release management process. In other words, when a new release of the application is proposed, please describe how Solano County would be notified, Solano County’s options relative to scheduling, Solano County’s obligations during the release process, etc.

Part 12: User Groups/Community

1. Does your company sponsor any user groups (national, by region, by state)? Please provide details.

2. Does your company sponsor user group conferences? Where and how often?

3. How long are the conferences? What activities are included (e.g., training, roundtables, consulting)? How many customers typically attend?

Part 13: Application Testing 1.

Describe the test environment(s) and sandbox(es) provided to application system users.

2. Are application users provided the ability to test at their discretion all host provider system fixes, security patches, new releases, new versions and enhancements prior to their implementation?

3.

Describe the process to select implementation dates for changes. Would the Recorders Office have any control over when the deployments occur?

4. How are changes made, are new releases or configuration changes uploaded from a QA to a test environment? Once tested and confirmed are the changes then automatically uploaded into production or manually changed?

5. Do you have a standard QA plan? If so, can you provide an example?

Part 14: Training and Documentation Training

1. Describe in detail the types of training you provide for the following, including type of participant, length of training, etc.

a) Technical system administrator – understanding of the overall system architecture, interface configurations, data import/export capabilities, etc.

b) Business-side administrator – workflow configuration options, code table entry, business rule configuration, document/template creation, etc.

c) End-user – tailored to work functions (heavy data entry, role-specific, queries and reporting)

d) Other types of training provided

2. Describe the training methodology your company utilizes (direct training by company staff, train-the-trainer, computer-based, practicum, etc.). How much hands-on training do you recommend?

3. Provide details on the number and type of classes you recommend, the number of students, required facilities and tools, etc.

4. Describe the training materials you utilize – manuals, on-line help, quick reference guides, etc. Please attach copies where possible.

5. Please provide an actual training plan that you have utilized in implementations for other customers of similar size and complexity.

6.

Describe the assistance and training provided during go-live (first week) and post-live (first month) to ensure that users are successfully working with the new solution.

7. What on-going training opportunities does your company provide?

Documentation

8. Describe the other reference material and documentation you provide, including:

· System administrator manuals

· Configuration documentation

· Interface documentation

· Upgrade instructions or manuals

· Data dictionary

· System design documentation

· Business process documentation

· Any other documentation provided to the customer Please attach examples of each.

Part 15: Data Conversion

1. Describe the data conversion process your company utilizes, including the tools and technology, roles and responsibilities, typical number of test conversions, estimated amount of time, and so forth.

2. In what formats do you allow the provided data?

3. Describe how you will assist the Solano County with data cleaning, detection of duplicate records and erroneous data, and data transformation to deliver accurate historical data to the new solution.

4. Can you provide an example data conversion plan as an attachment?