Technical_Requirements_2022_-_2023_(2)_(1).xlsx
XLSX spreadsheet 30 KB Posted
- Attached to
- Web Content Management System
- Solicitation number
- 2022-RFP-256
- Issued by
- Allegheny County, Philadelphia City, Pennsylvania
About this file
The document is a Technical Requirements spreadsheet for a Web Content Management System (CMS) procurement by the City of Pittsburgh, Pennsylvania. The project involves replacing the city's existing customized in-house Redtail/City Website with an enterprise-level CMS solution, including data migration of approximately 6,000 active pages, cloud web hosting, integrated web forms, user management, press release publication/email distribution, training materials, and ongoing support. The technical requirements document outlines comprehensive specifications across multiple domains including system capabilities, data and security protocols, network infrastructure, solution architecture, reporting capabilities, and integration requirements.
The procurement emphasizes strict security and technical standards, requiring vendors to maintain 99.99% system uptime, encrypt data at rest and in transit, comply with industry security certifications like ISO/IEC 27001, and ensure all cloud-hosted data remains within the continental United States. The City prefers cloud-based solutions, with Google Cloud Platform as an alternative if customer-hosted environments are necessary. Vendors must provide robust security measures, including annual third-party penetration testing, comprehensive audit logging, secure authentication methods, and the ability to handle confidential information with industry-standard protections. The technical requirements also mandate API accessibility, data ownership retention, and compatibility with existing city systems and geospatial technologies.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Web_Content_Management_System.pdf | ||
| Appendix_D_Requirements_Template_(2).xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Technical Requirements Final
| Requirement ID | Requirements | |
| (All of the items apply to any subcontractors that work on the solution. ) | System Capability | |
| (select from dropdown) | Comments: | |
| Outage and Breach Reporting: | ||
| 1.1 | Provide your outage notication communication | |
| 1.2 | Provides fast detection and root cause diagnosis | |
| 1.3 | The City of Pittsburgh (referred to as City) must be notified in writing within 24 hours of the earliest indication or report of a potential breach or unintended disclosure of Confidential Information (CI) or a System that supports CI. | |
| 1.4 | Response actions to incidents that might affect CI or Systems must be conducted quickly and with ample resources. Vendor will hire a professional third-party incident response team if in-house resources do not have sufficient skill or availability. The Vendor is expected to distribute all incident response evidence, reports, communications and related materials to security@pittsburghpa.gov. The format of incident reports will be agreed upon with the City in advance. | |
| 1.5 | City shall have the right to view all incident response evidence, reports, communications and related materials upon request. | |
| 1.6 | If requested by the City, or if required by law, the Vendor shall notify in writing all persons affected by the incident, at its own cost and expense. | |
| 1.7 | Vendors shall have a comprehensive secure development system in place consistent with industry standard best practices, including policies, training, audits, testing, emergency updates, proactive management, and regular updates to the secure development lifecycle System itself. | |
| 1.8 | Vendors will make updates available to the City in a timely fashion at no additional cost. | |
| 1.9 | The system can provide the ability to track and log system uptime and transaction response times in order to provide information for SLA monitoring | |
| 1.10 | Provides for predictive failures and issue alerting functions | |
| 1.11 | Ability to allow for notification of blackouts | |
| Data and Security: | ||
| 2.1 | All cloud-hosted data must remain in the continental United States. | |
| 2.2 | Ownership of all data remains with the City, at no additional cost. | |
| 2.3 | Data should be encrypted at rest and in transit. | |
| 2.4 | The City shall have the right to view all documentation containing the results of any security audits completed within the last twelve (12) months, including documentation regarding security practices and data classification. | |
| 2.5 | The Vendor shall use commercially reasonable efforts to secure and defend any System housing Confidential Information against third parties. | |
| 2.6 | Vendors that handle Confidential Information must respond to and resolve security-related bug reports, inquiries and incidents in a timely and professional manner. The Vendor must notify the City within 24 hours of when Vendor becomes aware of any such incident that poses a potential risk to City data. The Vendor shall send the notification to security@pittsburghpa.gov | |
| 2.7 | Must follow industry standard password requirements. (Passwords must be stored in non-reversible one-way cryptographic hash) | |
| 2.8 | Log all successful and failed authentication attempts, including date, time, IP address, and username. | |
| 2.9 | Offer a secure password reset feature, including verification of identity, email or text notification. | |
| 2.10 | Temporarily lock accounts with repeated failed login attempts and provide support to affected users. | |
| 2.11 | Ability to provide authentication via generally agreed upon SSO methodologies. | |
| 2.12 | Vendors managing City-owned CI must engage an independent third party annually to assess the practical security of Vendor's Systems. These reviews must include penetration tests from the perspective of an external attacker and an internal user with common privileges. The penetration tests must include all Systems exposed to the internet and any Systems, internal or external, that Handle Confidential Information. Such annual assessment shall be at Vendor’s sole expense. | |
| 2.13 | Audit logs must be implemented for all Systems including those that handle CI. All attempted violations of System security must generate an audit log. Audit logs must be secured against unauthorized access or modification. Electronic logs required | |
| 2.14 | In the event of adverse findings through a City or Vendor audit, the Vendor shall cooperate with the City in remediating any risks to CI, including complying with request to temporarily taking the system offline or otherwise limiting access to the system, and any other follow up actions reasonably necessary to secure the CI. | |
| 2.15 | For the life of the contract, all data should be retained and available upon request from the City, available via API calls. | |
| 2.16 | All metadata, logs, notifications of system outages, etc. should also be retained for the life of the contract. | |
| 2.17 | Vendor Systems that Handle Confidential Information shall be available and fully functional 24x7x365 with 99.99% uptime, unless otherwise agreed upon in writing with the City. Vendor shall make plans for colocation, backups and any other Systems necessary to ensure continuity. | |
| 2.18 | Vendor must notify and obtain agreement from the City for any planned interruptions in service, with the exception of emergency security updates. Vendor must notify the City immediately of any unintended service interruption. | |
| 2.19 | RFP responses should include a plan for content availability in the event of the need to migrate to a different platform. Remittance of content directly to the City of Pittsburgh is acceptable. | |
| 2.20 | Include online Help | |
| 2.21 | Comprehensive Security |
o Local certificates, trusted certificates, and 128-bit SSL
| 2.22 | System should be able to provide an unlimited number of different security groups that can be defined, each with their own security settings and group names that are appropriate. |
| 2.23 | ISO/IEC 27001 Certification or in pursiut of audit before working with the City |
| 2.24 | Storage needs to be capable of compliance with CJIS Security Policy storage requirements: https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center |
| Network: | |
| 3.1 | The solution must adhere to latest best network industry practices. |
| 3.2 | The solution must assure that the integrity of the City's network is sustained by the implementation and utilization of modern firewall, VPN and other remote access technologies. |
| 3.3 | The soluton must provide network authentication and system user events logging. |
| 3.4 | The solution must assure that there will be no degradation in performance of City's network due to their system or design. |
| 3.5 | Proposers must include a list of web browsers and devices their system does/does not support |
| Solution Infrastructure: | |
| 4.1 | Solutions are preferred to be cloud based solutions hosted with the provider. If solution needs to be customer hosted enviroment, Google Cloud Platform is preferred. |
| 4.2 | Respondent must detail all additional software licenses that would be required to utilize the product/solution. |
| 4.3 | Provider solution must not incur additional software licensing expense. Provider solution must be a complete package. Solutions utilizing industry standard component applications such as MS SQL are preferred . |
| 4.4 | If and when a City owned software license for a component in the solution stack is viable for utilization to avoid additional software licensing expense, it is to be utilized. |
| 4.5 | If the suggested solution is to be implemented on the City Infrastructure, requirements for component resources from a virtualized hardware perspective are required. vCPU, Memory, Storage per server with an overall summary. |
| Data and Reporting: | |
| 5.1 | When geospatial information is needed, the Solution should have the ability to use City GIS layers hosted on ArcGIS online to create geocoding for locations and administrative geographies provided by the City |
| 5.2 | The system should allow for exporting of data through an open, REST API to the City's data ingestion system or the Western Pennsylvania Regional Data Center, as needed. |
| 5.3 | Vendor shall provide data dictionary for database fields, field types, number of characters, value ranges, relationship diagram(s) (database map) of the data model, and key fields used in relationships with database tables. |
| 5.4 | The API provided by the system should include documentation that contains: Sample requests, headers and other relevant metadata, Clear, comprehensive descriptions of the data represented in the API, such as its output format (e.g., JSON or CSV), understandable by someone with a basic to intermediate familiarity with the system, Generated code snippets in some of the most popular programming languages (e.g., Python). API documentation should include details of specific encodings, documentation, data types, requests, and objects for the API. |
| 5.5 | Supports a dashboard with a login |
dependent views
| 5.6 | Ability to provide trend analysis |
| 5.7 | Real-time Reporting |
o At least 150 configurable reports, real-time, and historical graphs
| 5.8 | City must have full ownership and free access to data captured by the System, both during and after the contract period |
| 5.9 | Full API Access - Access to our data through the use of an API must be provided. |
| 5.10 | A general site user must have the ability to embed third party code (ex. Google Calendar) |
| 5.11 | Geospatial data must be compatible with ESRI systems and common geospatial data storage formats (.geojson, .dbf, .shp) |
| Miscellaneous: | |
| 6.1 | Companies from outside the United States are welcome to apply, provided they meet the standards as described above. |
| 6.2 | Remote meetings may be acceptable, with prior arrangement from the City. |
| 6.3 | The City's preference is that Adobe Flash not be part of this solution. |
| 6.4 | Role-based Management |
o Access network maps, configuration, alerts, notifications, reporting, and management console
| 6.5 | The system can accommodate separate instances of databases for testing, training, and quality assurance |
| 6.6 | The vendor shall provide customer service support during the City of Pittsburgh's normal business hours. |
| 6.7 | The vendor shall provide "As-Built" documentation to the City of Pittsburgh representing the state of the application service at the time of Go-Live. |
| Project-Specific Technical Requirements (Mandatory): | |
| 7.1 | Solution to run on multiple Windows platforms |
| 7.2 | Ability to support remote administration |
| 7.3 | Ability to export reports in common formats (PDF, Word, Excel) |
| 7.4 | Solution shall have built-in backup and restore capability |
| 7.5 | If solution hosts or utilized a source of data, solution must have built-in database maintenance and reporting tools |
| 7.6 | Vendor shall include a description of the system’s basic architecture |
| 7.7 | Vendor shall describe how the system handles multiple users, data concurrency control, record locking, and conflict resolutions |
| 7.8 | Vendor shall describe the hosting models (customer enviroment or vender enviroment) |
| 7.9 | Vendor shall describe if the solution servers can be virtualized (and if so, describe the system) |
| 7.10 | Vendor shall describe hardware requirements or recommendations |
| 7.11 | If applicable, describe how the solution can perform database maintenance, including, but not limited to, backup and upgrades without requiring system downtime |
| 7.12 | If applicable, describe the solutions ability to auto-discover targets on the network |
| 7.13 | If applicable, describe the solutions ability to monitor an application and its performance with agentless configurations where possible. |
| 7.14 | If applicable, describe the solutions ability to monitor user response time and throughput by location or other logical grouping. |
| 7.15 | If applicable, describe the solutions ability to drill down into the full |
technical details on how the server and the browser interact with one another.
| 7.16 | If applicable, describe the solutions ability to assemble an e-mail, with one click, that includes a complete user session with replay to provide additional information when triaging an incident. |
| 7.17 | Must support alerting and notifications by email, SMS, pager message, and HTTP |
request
| 7.18 | Vender must provide a visual of the solutions network Mapping, Network topology, subnets, devices, applications, and systems. |
| 7.19 | If applicable, solution should have configurable monitoring that identifys performance, passive, active, real-time, custom (scripted), monitoring templates, and bulk changes |
| 7.20 | If applicable, solution should have have predictive Alerting that is customizable and identifies up, down, and threshold (min/max), maintenance mode, device dependency, and escalation. |
| 7.21 | If applicable, solution must support, SNMP (supports SNMP V1, V2c and V3), WMI (Windows Management Instrumentation), HTTP based services, TCP and UDP based services including PING, Port, SMTP, POP3, FTP |
| Integration or API Requirements (Project-Specific - I&P review this section for relevance to each project/solitication ) | |
| 8.1 | Ability to support two-way communication with Microsoft Outlook |
| 8.2 | Ability to integrate with payroll systems to include, but not limited to Ceridien TimePro version |
| 8.3 | Vendor shall describe if the system have built-in integration with other systems |
| 8.4 | Vendor shall describe if the system can import date from various formats (XML, CSV, TXT). |
| 8.5 | The vendor shall INTERACT with City specific applications (for example APRS, Firehouse, CYA, etc) |
| 8.6 | Solution allows for reading/writing of map services specifically created and published via ArcGIS for Server environment |
| 8.7 | Integrates with existing monitoring tools |
Index
| Core Capability |
| Configurable by Vendor |
| Configurable by City Staff |
| Requires Customization |
| Provided in Conjunction with a 3rd Party |
| Not Applicable |
Data Validation
| Core Capability |
| Configurable by Vendor |
| Configurable by City Staff |
| Requires Customization |
| Not Applicable |
File details come from the government source that posted it. Updated .