Technical_Requirements_2023-2024_(1).xlsx
XLSX spreadsheet 105 KB Posted
- Attached to
- Automated Red Light Enforcement
- Solicitation number
- 2025-RFP-020
- Issued by
- Allegheny County, Philadelphia City, Pennsylvania
About this file
The document is a Technical Requirements spreadsheet for the City of Pittsburgh's Automated Red Light Enforcement (ARLE) Program, involving the Department of Mobility and Infrastructure (DOMI), Office of Management and Budget, Department of Public Safety, and Pittsburgh Parking Authority. The project seeks a qualified vendor to install red light traffic signal enforcement equipment at approved intersections and provide professional services to develop and operate an ARLE program consistent with Pennsylvania State Code. The technical requirements detail comprehensive system capabilities, including outage and breach reporting, data and security protocols, network requirements, application and infrastructure specifications, data access and reporting capabilities, and integration requirements.
The technical requirements emphasize strict security and data management standards, including requirements for cloud-hosted data remaining in the continental United States, 99.99% system uptime, encryption protocols, authentication methodologies, and comprehensive security practices. Vendors must provide detailed documentation on their systems, including AI implementations, performance metrics, API access, and integration capabilities. The solution must support multiple Windows platforms, provide remote administration, enable report exports, and include built-in backup and restore capabilities. Additional requirements include role-based management, customer service support during business hours, and the ability to integrate with existing city applications and monitoring tools.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Automated_Red_Light_Enforcement_(Addendum_#2_Revision).pdf | ||
| Potential_ARLE_Locations_2025-City_of_Pittsburgh.pdf | ||
| Cost_Proposal_Template_(1).docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Technical Requirements Final
| Requirement ID | Requirements | |
| (All of the items apply to any subcontractors that work on the solution. ) | System Capability | |
| (select from dropdown) | Comments: | |
| Outage and Breach Reporting | ||
| 1.1 | Provide your outage notication communication | |
| 1.2 | Provides fast detection and root cause diagnosis | |
| 1.3 | The City of Pittsburgh (referred to as City) must be notified in writing within 24 hours of the earliest indication or report of a potential breach or unintended disclosure of Confidential Information (CI) or a System that supports CI. | |
| 1.4 | Response actions to incidents that might affect CI or Systems must be conducted quickly and with ample resources. Vendor will hire a professional third-party incident response team if in-house resources do not have sufficient skill or availability. The Vendor is expected to distribute all incident response evidence, reports, communications and related materials to security@pittsburghpa.gov. The format of incident reports will be agreed upon with the City in advance. | |
| 1.5 | City shall have the right to view all incident response evidence, reports, communications and related materials upon request. | |
| 1.6 | If requested by the City, or if required by law, the Vendor shall notify in writing (vendor to state expected time) all persons affected by the incident, at its own cost and expense. | |
| 1.7 | Vendors shall have a comprehensive secure development system in place consistent with industry standard best practices, including policies, training, audits, testing, emergency updates, proactive management, and regular updates to the secure development lifecycle System itself. | |
| 1.8 | Vendors will make updates available to the City in a timely fashion at no additional cost. Vendor to state expected time. | |
| 1.9 | The system can provide the ability to track and log system uptime and transaction response times in order to provide information for SLA monitoring | |
| 1.10 | Provides for predictive failures and issue alerting functions | |
| 1.11 | Ability to allow for notification of blackouts | |
| Data and Security | ||
| 2.1 | All cloud-hosted data must remain in the continental United States. | |
| 2.2 | Ownership of all data remains exclusively with the City, at no additional cost. | |
| 2.3 | Data should be encrypted at rest and in transit. | |
| 2.4 | Vendors must have the ability to provide authentication via generally agreed upon SSO methodologies. | |
| 2.5 | The City shall have the right to view all documentation containing the results of any security audits completed within the last twelve (12) months, including documentation regarding security practices and data classification. | |
| 2.6 | The Vendor shall use commercially reasonable efforts to secure and defend any System housing Confidential Information against third parties. | |
| 2.7 | Vendors that handle Confidential Information must respond to and resolve security-related bug reports, inquiries and incidents in a timely and professional manner. The Vendor must notify the City within 24 hours of when Vendor becomes aware of any such incident that poses a potential risk to City data. The Vendor shall send the notification to security@pittsburghpa.gov | |
| 2.8 | Must follow industry standard password requirements. (Passwords must be stored in non-reversible one-way cryptographic hash) | |
| 2.9 | Log all successful and failed authentication attempts, including date, time, IP address, and username. | |
| 2.10 | Offer a secure password reset feature, including verification of identity, email or text notification. | |
| 2.11 | Temporarily lock accounts with repeated failed login attempts and provide support to affected users. | |
| 2.12 | Vendors managing City-owned CI must engage an independent third party annually to assess the practical security of Vendor's Systems. These reviews must include penetration tests from the perspective of an external attacker and an internal user with common privileges. The penetration tests must include all Systems exposed to the internet and any Systems, internal or external, that Handle Confidential Information. Such annual assessment shall be at Vendor’s sole expense. | |
| 2.13 | Audit logs must be implemented for all Systems including those that handle CI. All attempted violations of System security must generate an audit log. Audit logs must be secured against unauthorized access or modification. Electronic logs required | |
| 2.14 | In the event of adverse findings through a City or Vendor audit, the Vendor shall cooperate with the City in remediating any risks to CI, including complying with request to temporarily taking the system offline or otherwise limiting access to the system, and any other follow up actions reasonably necessary to secure the CI. | |
| 2.15 | For the life of the contract, all data should be retained and available upon request from the City, available via API calls. | |
| 2.16 | All metadata, logs, notifications of system outages, etc. should also be retained for the life of the contract. | |
| 2.17 | Vendor Systems that Handle Confidential Information shall be available and fully functional 24x7x365 with 99.99% uptime, unless otherwise agreed upon in writing with the City. Vendor shall make plans for colocation, backups and any other Systems necessary to ensure continuity. | |
| 2.18 | Vendor must notify and obtain agreement from the City for any planned interruptions in service, with the exception of emergency security updates. Vendor must notify the City immediately of any unintended service interruption. Vendor to state expected time for notification. | |
| 2.19 | RFP responses should include a plan for content availability in the event of the need to migrate to a different platform. Remittance of content directly to the City of Pittsburgh is acceptable. | |
| 2.20 | Include online Help | |
| 2.21 | Comprehensive Security - Local certificates, trusted certificates, and 128-bit SSL | |
| 2.22 | System should be able to provide an unlimited number of different security groups that can be defined, each with their own security settings and group names that are appropriate. | |
| 2.23 | ISO/IEC 27001 Certification or in pursiut of audit before working with the City | |
| 2.24 | Storage needs to be capable of compliance with CJIS Security Policy storage requirements: https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center | |
| 2.25 | On Request, vendor shall provide City with a copy of and permanently delete any CITY Confidential Information from its systems and provide a backup copy of the database in .bak file format. | |
| 2.26 | General maintenance related to retention and archiving | |
| 2.27 | Vendor to provide their capability to optimize database indexes and query structure, or provide frequency of database indexes, caching and query structure | |
| 2.28 | Vendor to identify if they are HIPAA compliance when applicable | |
| Network | ||
| 3.1 | The solution must adhere to latest best network industry practices. | |
| 3.2 | The solution must assure that the integrity of the City's network is sustained by the implementation and utilization of modern firewall, VPN and other remote access technologies. | |
| 3.3 | The soluton must provide network authentication and system user events logging. Vendor to state expected time/frequency | |
| 3.4 | The solution must assure that there will be no degradation in performance of City's network due to their system or design. | |
| 3.5 | Proposers must include a list of web browsers and devices their system does/does not support | |
| Application and Infrastructure | ||
| 4.1 | Solutions are preferred to be cloud based solutions hosted with the provider. If solution needs to be customer hosted enviroment, Google Cloud Platform is preferred. | |
| 4.2 | Respondent must detail all additional software licenses that would be required to utilize the product/solution. | |
| 4.3 | Provider solution must not incur additional software licensing expense. Provider solution must be a complete package. Solutions utilizing industry standard component applications such as MS SQL are preferred . | |
| 4.4 | If and when a City owned software license for a component in the solution stack is viable for utilization to avoid additional software licensing expense, it is to be utilized. | |
| 4.5 | If the suggested solution is to be implemented on the City Infrastructure, requirements for component resources from a virtualized hardware perspective are required. vCPU, Memory, Storage per server with an overall summary. | |
| 4.6 | Respondent must detail out of the box solution vs customizable | |
| 4.7 | Solutions are preferred to be accessible to users with disabilities on mobile devices | |
| 4.8 | Vendor to identify starting storage space, scalability and cost | |
| Data Access and Reporting |
tc={CC1D8584-06D6-4E9C-88AD-CBD692F50E33}: [Threaded comment]
Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924
[Tasks]
There is a task anchored to this comment that cannot be viewed in your client.
Comment:
@Belasco, Chris can you review the data sections?
| 5.1 | In the event of geospatial information or services are hosted on ArcGIS Online by an entity outside of the city, the information and services must be transferable to City's ArcGIS Online and/or Portal environment. Same, when geospatial information is needed, the Solution should have the ability to use City GIS layers hosted on ArcGIS online and/or Portal to create geocoding for locations and administrative geographies provided by the City | |
| 5.2 | The system must allow for exporting of data through an open, REST API to the City's data ingestion system or the Western Pennsylvania Regional Data Center, as needed. | |
| 5.3 | Vendor shall provide data dictionary – to include - Full explanation for database fields, field types, number of characters, value ranges, relationship diagram(s) (database map) of the data model, and key fields, and fields used in relationships with other database tables. | |
| 5.4 | The API provided by the system should include documentation that contains: Sample requests, headers and other relevant metadata, Clear, comprehensive descriptions of the data represented in the API, such as its output format (e.g., JSON or CSV), understandable by someone with a basic to intermediate familiarity with the system, Generated code snippets in some of the most popular programming languages (e.g., Python). API documentation should include details of specific encodings, documentation, data types, requests, and objects for the API. | |
| 5.5 | Supports a dashboard with a login dependent views | |
| 5.6 | Ability to provide trend analysis | |
| 5.7 | Real-time Reporting - At least 150 configurable reports, real-time, and historical graphs | |
| 5.8 | City must have full ownership and free access to data captured by the System, both during and after the contract period | |
| 5.9 | Full API Access - All data created in vendor software must be made available via API | |
| 5.10 | A general site user must have the ability to embed third party code (ex. Google Calendar) | |
| 5.11 | Geospatial data must be compatible with ESRI systems and common geospatial data storage formats (.geojson, .dbf, .shp, .gdb) | |
| 5.12 | Vendor to detail database optimization process | |
| 5.13 | Vendor must identify and briefly summarize the AI system(s) used in your product and what domain the system is intended to be applied. | |
| 5.14 | Vendor must identify what function the AI system is intended to perform and for what purpose, and how prediction is supposed to be used. | |
| 5.15 | Vendor must identify what model is used (e.g., large language model, transformer, deep learning, supervised learning, built on an existing open source model, computer vision) | |
| 5.16 | Vendor must identify how the AI system was trained, what features and what target labels used, what data was used, and how often data is added to the training set. | |
| 5.17 | Vendor must identify what data is stored in the AI system(s), and whether it can be deleted or users can opt out of data collection. | |
| 5.18 | Vendor must report on the outcomes of the evaluations they have conducted around performance, fairness, human legibility, privacy, reliability. | |
| 5.19 | Vendor must identify once the system is deployed how the system should be monitored and what steps the vendor will take to address any adverse incidents. | |
| 5.2 | Vendor to Provide Performance Metrics on: | |
| • | Response Time: Fore web and mobile applications to measure the amount of time a server or application takes to respond to all of its data inputs and requests. | |
| • | Page Load Time: For web applications, measure the time it takes for a page to fully load. | |
| • | API Response Time: For APIs, measure the time it takes for an API endpoint to respond. | |
| • | Transaction Time: Measure the time it takes for specific user transactions to complete. | |
| • | Impact of third-party services (e.g., APIs, external scripts) on the application's performance. |
| Miscellaneous | |
| 6.1 | Companies from outside the United States are welcome to apply, provided they meet the standards as described above. |
| 6.2 | Remote meetings may be acceptable, with prior arrangement from the City. |
| 6.3 | Role-based Management - Access network maps, configuration, alerts, notifications, reporting, and management console |
| 6.4 | The system can accommodate separate instances for testing, training, staging and production |
| 6.5 | The vendor shall provide customer service support during the City of Pittsburgh's normal business hours. |
| 6.6 | The vendor shall provide "As-Built" documentation to the City of Pittsburgh representing the state of the application service at the time of Go-Live. |
| Project-Specific Technical Requirements (Mandatory) | |
| 7.1 | Solution to run on multiple Windows platforms |
| 7.2 | Ability to support remote administration |
| 7.3 | Ability to export reports in common formats (PDF, Word, Excel) |
| 7.4 | Solution shall have built-in backup and restore capability |
| 7.5 | If solution hosts or utilized a source of data, solution must have built-in database maintenance and reporting tools |
| 7.6 | Vendor shall include a description of the system’s basic architecture |
| 7.7 | Vendor shall describe how the system handles multiple users, data concurrency control, record locking, and conflict resolutions |
| 7.8 | Vendor shall describe the hosting models (customer enviroment or vender enviroment) |
| 7.9 | Vendor shall describe if the solution servers can be virtualized (and if so, describe the system) |
| 7.10 | Vendor shall describe hardware requirements or recommendations |
| 7.11 | If applicable, describe how the solution can perform database maintenance, including, but not limited to, backup and upgrades without requiring system downtime |
| 7.12 | If applicable, describe the solutions ability to auto-discover targets on the network |
| 7.13 | If applicable, describe the solutions ability to monitor an application and its performance with agentless configurations where possible. |
| 7.14 | If applicable, describe the solutions ability to monitor user response time and throughput by location or other logical grouping. |
| 7.15 | If applicable, describe the solutions ability to drill down into the full |
technical details on how the server and the browser interact with one another.
| 7.16 | If applicable, describe the solutions ability to assemble an e-mail, with one click, that includes a complete user session with replay to provide additional information when triaging an incident. |
| 7.17 | Must support alerting and notifications by email, SMS, pager message, and HTTP |
request
| 7.18 | Vender must provide a visual of the solutions network Mapping, Network topology, subnets, devices, applications, and systems. |
| 7.19 | If applicable, solution should have configurable monitoring that identifys performance, passive, active, real-time, custom (scripted), monitoring templates, and bulk changes |
| 7.20 | If applicable, solution should have have predictive Alerting that is customizable and identifies up, down, and threshold (min/max), maintenance mode, device dependency, and escalation. |
| 7.21 | If applicable, solution must support, SNMP (supports SNMP V1, V2c and V3), WMI (Windows Management Instrumentation), HTTP based services, TCP and UDP based services including PING, Port, SMTP, POP3, FTP |
| Integration or API Requirements (Project-Specific - I&P review this section for relevance to each project/solitication ) | |
| 8.1 | Ability to support two-way communication with Microsoft Outlook |
| 8.2 | Ability to integrate with payroll systems to include, but not limited to Ceridien TimePro version |
| 8.3 | Vendor shall describe if the system have built-in integration with other systems |
| 8.4 | Vendor shall describe if the system can import date from various formats (XML, CSV, TXT). |
| 8.5 | The vendor shall INTERACT with City specific applications (for example APRS, Firehouse, CYA, etc) |
| 8.6 | Solution allows for reading/writing of map services specifically created and published via ArcGIS for Server environment |
| 8.7 | Integrates with existing monitoring tools |
| 8.8 | If applicable, vendor application must use the City's current contracted credit card processor. |
Index
| Core Capability |
| Configurable by Vendor |
| Configurable by City Staff |
| Requires Customization |
| Provided in Conjunction with a 3rd Party |
| Not Applicable |
Data Validation
| Core Capability |
| Configurable by Vendor |
| Configurable by City Staff |
| Requires Customization |
| Not Applicable |
File details come from the government source that posted it. Updated .