Technical_Requirements.xlsx
XLSX spreadsheet 15 KB Posted
- Solicitation number
- 2026-RFI-089
- Issued by
- Allegheny County, Philadelphia City, Pennsylvania
About this file
This is a Technical Requirements document for the City of Pittsburgh's 311 Customer Relationship Management System procurement. The document outlines comprehensive technical specifications organized into eleven categories that vendors must meet or address in their proposals. Key requirement areas include Outages & Breaches (24-hour notification for incidents, ISO/IEC 27001 certification, 99.99% uptime for systems handling confidential information), Cybersecurity (single sign-on support, multi-factor authentication, secure development lifecycle with annual penetration testing, data encryption at rest and in transit, continental U.S. data hosting), Network (modern firewalls, VPN, secure remote access), Infrastructure (separate instances for testing, training, staging, and production; zero-downtime maintenance), and Software & Application requirements (role-based management, built-in integrations with systems like Computronix, Cartegraph, and ESRI, performance monitoring). All requirements in these categories are designated as Mission Critical, meaning they are essential for solution selection.
Additional Mission Critical requirements address Data Ownership and Access (open REST API for data export, comprehensive API documentation, complete data dictionary, guaranteed city ownership of all data in non-proprietary formats, transition assistance upon contract termination), Support & Documentation (online help, customer service during business hours, security audit documentation, as-built documentation at go-live), Geospatial capabilities (ESRI compatibility, support for standard GIS formats and ArcGIS Online publishing), and Artificial Intelligence (full disclosure of AI systems used, training data restrictions prohibiting use of city data for vendor model training, post-deployment monitoring and evaluation reporting). Accessibility requirements mandate ADA compliance conforming to WCAG 2.1 Level AA standards. One requirement is designated Highly Desirable: HTTPS-based services support and consideration of vendors operating outside the United States. The document also defines vendor response options ranging from Core Capability and Configurable by Vendor to Requires Customization and Not Applicable.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Functional_Requirements.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Technical Requirements
| Number | Category | Requirement | Need Designation | Vendor Response (choose from dropdown) | Comments |
| 1.01 | Outages & Breaches | Notify the City of any breach, security incident, or unplanned service interruption immediately, and no later than 24 hours after detection. Obtain prior City approval for planned maintenance and document notification timelines. | Mission Critical | ||
| 1.02 | Outages & Breaches | Maintain a complete incident‑response capability, engaging qualified third parties when needed. Provide all evidence, reports, and communications to the City in an agreed format and upon request. Hold ISO/IEC 27001 certification or be in formal pursuit of certification/audit prior to working with the City. | Mission Critical | ||
| 1.03 | Outages & Breaches | Meet 99.99% uptime for systems handling City Confidential Information and maintain continuity through backups, redundancy, and colocation. | Mission Critical | ||
| 2.01 | Cybersecurity | Support SSO; enforce strong password policies with one‑way cryptographic hashing; require MFA for administrative accounts; implement secure password reset with identity verification; lock accounts after repeated failures. Describe how the system manages multiple users, concurrency control, record locking, and conflict resolution. | Mission Critical | ||
| 2.02 | Cybersecurity | Log all authentication events (success/failure, date/time, IP, username) and maintain protected audit logs capturing attempted security violations. | Mission Critical | ||
| 2.03 | Cybersecurity | Maintain a secure SDLC with policies, training, testing, audits, emergency updates, bug handling, and annual independent penetration tests (external/internal) for internet‑exposed and CI‑handling systems; use trusted certificates and TLS. Provide the City, upon request, documentation of security audits completed within the past 12 months, including security practices and data classification. Encrypt data at rest and in transit using industry‑standard cryptography. | Mission Critical | ||
| 2.04 | Cybersecurity | Host cloud data within the continental United States. Upon request, provide the City a copy of its Confidential Information, permanently delete it from vendor systems, and supply a database backup (.bak). | Mission Critical | ||
| 2.05 | Cybersecurity | Cooperate with the City to remediate audit findings affecting Confidential Information, including temporarily taking systems offline or limiting access as requested. | Mission Critical | ||
| 2.06 | Cybersecurity | Support HTTPS‑based services where applicable. | Highly Desirable | ||
| 3.01 | Network | Follow current network best practices; maintain network integrity with modern firewalls, VPN, and secure remote access; provide network authentication and event logging; ensure no performance degradation to the City’s network. | Mission Critical | ||
| 4.01 | Infrastructure | Describe platform, infrastructure architecture, hosting options (City or vendor), virtualization capabilities, and hardware requirements; provide current as‑built documentation for City‑hosted deployments. | Mission Critical | ||
| 4.02 | Infrastructure | Support separate instances for testing, training, staging, and production. | Mission Critical | ||
| 4.03 | Infrastructure | Regularly maintain and optimize databases (indexing, caching, query tuning) and perform backups/upgrades without downtime. | Mission Critical | ||
| 4.04 | Infrastructure | Identify initial storage capacity, scalability options, and associated costs. | Mission Critical | ||
| 5.01 | Software & Application | Provide role‑based management (network maps, configuration, alerts/notifications, reporting, console), built‑in integrations with City systems (e.g., Computronix, Cartegraph, ESRI), and performance monitoring features (agentless, passive/active/real‑time/custom templates, bulk changes). Detail out‑of‑the‑box functionality vs customizations. | Mission Critical | ||
| 5.02 | Software & Application | Specify required licenses; prefer solutions using industry‑standard components (e.g., MS SQL) with no extra licensing costs; use City‑owned licenses where possible to reduce costs. Support two‑way Microsoft Outlook integration when applicable. | Mission Critical | ||
| 5.03 | Software & Application | Support an unlimited number of configurable security groups with distinct settings and names. | Mission Critical | ||
| 6.01 | Data Ownership, Access, and Reporting | Provide an open REST API for exporting all system‑created data to the City’s ingestion platform or the Western Pennsylvania Regional Data Center. | Mission Critical | ||
| 6.02 | Data Ownership, Access, and Reporting | Provide comprehensive API documentation with sample requests, headers, data descriptions, output formats (e.g., JSON/CSV), code snippets (e.g., Python), and details on encodings, data types, requests, and objects. | Mission Critical | ||
| 6.03 | Data Ownership, Access, and Reporting | Provide a complete data dictionary including field definitions, types, lengths, value ranges, relationship diagrams, key fields, and an entity-relationship diagram detailing inter‑table relationships. | Mission Critical | ||
| 6.04 | Data Ownership, Access, and Reporting | Guarantee City ownership and free access to all captured data during and after the contract; retain data, metadata, logs, and outage notifications for the life of the contract. Data export must be available in non-proprietary formats (CSV, JSON). Vendor must support transition assistance upon contract termination. Database must be available in an acceptable backup format (eg. .bak) of city's determination. | Mission Critical | ||
| 6.05 | Data Ownership, Access, and Reporting | Provide in‑house reporting with real‑time and historical views, support exports (PDF, Word, Excel), and report performance metrics (response time, page load, API response, transaction time, third‑party impact). Describe the system’s ability to import data from common formats (XML, CSV, TXT). | Mission Critical | ||
| 6.06 | Data Ownership, Access, and Reporting | Provide a content availability and migration plan, including direct content remittance to the City when needed. | Mission Critical | ||
| 7.01 | Support & Documentation | Provide online help, customer service during City business hours, and audit documentation (security audits in past 12 months) upon request; deliver As‑Built documentation at Go‑Live. | Mission Critical | ||
| 8.01 | Geospatial | Ensure ESRI compatibility, support standard GIS formats (.geojson, .dbf, .shp, .gdb), enable publishing via ArcGIS Online/ESRI enterprise, ensure transferability to the City’s ArcGIS Online/Portal, and support use of City GIS layers for geocoding and administrative geographies. | Mission Critical | ||
| 9.01 | Artificial Intelligence (AI) | Identify AI systems used, their function/purpose, model types (e.g., LLM/transformer/deep learning), domains, and data stored; state whether data can be deleted or users can opt out. City Data cannot be used to train vendor models or provided to third parties. | Mission Critical | ||
| 9.02 | Artificial Intelligence (AI) | Describe training data, features, target labels, and the cadence for updating the training set. | Mission Critical | ||
| 9.03 | Artificial Intelligence (AI) | Describe post‑deployment monitoring and steps to address adverse incidents; report evaluation outcomes (performance, fairness, human legibility, privacy, reliability); include vendor and third‑party pen testing/offensive security for products and AI models. Respondent must report on the outcomes of the evaluations they have conducted around performance, fairness, human legibility, privacy, reliability. | Mission Critical | ||
| 10.01 | Accesssibility | Deliver ADA‑compliant software conforming to WCAG 2.1 Level AA (or current standard) across web/mobile/components; provide VPAT® or equivalent on request and remediate gaps at no cost. | Mission Critical | ||
| 11.01 | Supplemental | Vendors outside the United States may apply if they meet all stated standards. | Highly Desirable |
Definitions
| City Need | Definition | Vendor Response | Definition |
| Mission Critical | Essential requirement that must be met for the solution to be selected; may justify additional cost if necessary to achieve. | Core Capability | Functionality delivered natively as part of the standard solution with no additional cost. |
| Highly Desirable | Important capability that strengthens the solution and may influence cost‑benefit evaluation but is not mandatory. | Configurable by Vendor | Capability that the vendor can enable through configuration during implementation, without additional cost beyond standard services. |
| If Possible | Optional capability that provides added value if included at no or minimal additional cost. | Configurable by City Staff | Capability that City staff can configure using available tools and documentation with no additional vendor cost. |
| Requires Customization | Capability requiring vendor‑developed custom work that will add cost beyond standard implementation. | ||
| Provided in Conjunction with a 3rd Party | Capability delivered through a third party, which may introduce additional cost and coordination needs. | ||
| Not Applicable | Capability not supported by the proposed solution and therefore not considered in cost evaluation. |
File details come from the government source that posted it. Updated .