Technical-Requirements_NEW_FINAL_2026-06-11.xlsx
XLSX spreadsheet 24 KB Posted
- Attached to
- Recycling Engagement and Analytics Application
- Solicitation number
- 2026-RFP-168
- Issued by
- Allegheny County, Philadelphia City, Pennsylvania
About this file
This is a technical requirements document for the City of Pittsburgh's Department of Public Works in support of a proposed Recycling Engagement and Analytics Application. The document establishes comprehensive mission-critical and highly desirable technical standards that prospective vendors must meet or address in their proposals. Key requirement categories include outages and breaches management (99.99% uptime, ISO/IEC 27001 certification, incident response capabilities), cybersecurity protocols (single sign-on, multi-factor authentication, secure software development lifecycle, annual penetration testing, data encryption at rest and in transit, continental U.S. data hosting), network infrastructure standards, database maintenance and optimization, software functionality including role-based management and integration with existing City systems (Computronix, Cartegraph, ESRI), and API capabilities for data export and reporting. Additional requirements address data ownership and access, geospatial compatibility with ESRI systems, artificial intelligence transparency and governance, and ADA compliance conforming to WCAG 2.1 Level AA standards.
The document does not contain specific pricing information, contract terms, renewal options, funding amounts, or bid submission deadlines. However, it establishes that vendors must guarantee City ownership and free access to all captured data during and after contract termination, with data retention throughout the contract life and availability in non-proprietary formats. Notably, the requirements mandate that access to City data remain fully controlled within the United States, with no offshore personnel permitted to access systems or environments containing City data, though offshore development work may be permitted if it does not involve data access. Vendors are required to provide comprehensive documentation including API specifications, data dictionaries, security audit reports from the past 12 months, and as-built documentation at go-live, along with transition assistance upon contract termination.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Recycling_Engagement_and_Analytics_Application.pdf | ||
| Functional-Requirements_2026-08-06.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Technical Requirements
| Number | Category | Requirement | Need Designation | Vendor Response (choose from dropdown) | Comments |
| 1.01 | Outages & Breaches | Notify the City of any breach, security incident, or unplanned service interruption immediately, and no later than 24 hours after detection. Obtain prior City approval for planned maintenance and document notification timelines. | Mission Critical | ||
| 1.02 | Outages & Breaches | Maintain a complete incident‑response capability, engaging qualified third parties when needed. Provide all evidence, reports, and communications to the City in an agreed format and upon request. Hold ISO/IEC 27001 certification or be in formal pursuit of certification/audit prior to working with the City. | Mission Critical | ||
| 1.03 | Outages & Breaches | Meet 99.99% uptime for systems handling City Confidential Information and maintain continuity through backups, redundancy, and colocation. | Mission Critical | ||
| 2.01 | Cybersecurity | Support SSO; enforce strong password policies with one‑way cryptographic hashing; require MFA for administrative accounts; implement secure password reset with identity verification; lock accounts after repeated failures. Describe how the system manages multiple users, concurrency control, record locking, and conflict resolution. | Mission Critical | ||
| 2.02 | Cybersecurity | Log all authentication events (success/failure, date/time, IP, username) and maintain protected audit logs capturing attempted security violations. | Mission Critical | ||
| 2.03 | Cybersecurity | Maintain a secure SDLC with policies, training, testing, audits, emergency updates, bug handling, and annual independent penetration tests (external/internal) for internet‑exposed and CI‑handling systems; use trusted certificates and TLS. Provide the City, upon request, documentation of security audits completed within the past 12 months, including security practices and data classification. Encrypt data at rest and in transit using industry‑standard cryptography. | Mission Critical | ||
| 2.04 | Cybersecurity | Host cloud data within the continental United States. Upon request, provide the City a copy of its Confidential Information, permanently delete it from vendor systems, and supply a database backup (.bak). | Mission Critical | ||
| 2.05 | Cybersecurity | Cooperate with the City to remediate audit findings affecting Confidential Information, including temporarily taking systems offline or limiting access as requested. | Mission Critical | ||
| 2.06 | Cybersecurity | Support HTTPS‑based services where applicable. | Highly Desirable | ||
| 3.01 | Network | Follow current network best practices; maintain network integrity with modern firewalls, VPN, and secure remote access; provide network authentication and event logging; ensure no performance degradation to the City’s network. | Mission Critical | ||
| 4.01 | Infrastructure | Describe platform, infrastructure architecture, hosting options (City or vendor), virtualization capabilities, and hardware requirements; provide current as‑built documentation for City‑hosted deployments. | Mission Critical | ||
| 4.02 | Infrastructure | Support separate instances for testing, training, staging, and production. | Mission Critical | ||
| 4.03 | Infrastructure | Regularly maintain and optimize databases (indexing, caching, query tuning) and perform backups/upgrades without downtime. | Mission Critical | ||
| 4.04 | Infrastructure | Identify initial storage capacity, scalability options, and associated costs. | Mission Critical | ||
| 5.01 | Software & Application | Provide role‑based management (network maps, configuration, alerts/notifications, reporting, console), built‑in integrations with City systems (e.g., Computronix, Cartegraph, ESRI), and performance monitoring features (agentless, passive/active/real‑time/custom templates, bulk changes). Detail out‑of‑the‑box functionality vs customizations. | Mission Critical | ||
| 5.02 | Software & Application | Specify required licenses; prefer solutions using industry‑standard components (e.g., MS SQL) with no extra licensing costs; use City‑owned licenses where possible to reduce costs. Support two‑way Microsoft Outlook integration when applicable. | Mission Critical | ||
| 5.03 | Software & Application | Support an unlimited number of configurable security groups with distinct settings and names. | Mission Critical | ||
| 6.01 | Data Ownership, Access, and Reporting | Provide an open REST API for exporting all system‑created data to the City’s ingestion platform or the Western Pennsylvania Regional Data Center. | Mission Critical | ||
| 6.02 | Data Ownership, Access, and Reporting | Provide comprehensive API documentation with sample requests, headers, data descriptions, output formats (e.g., JSON/CSV), code snippets (e.g., Python), and details on encodings, data types, requests, and objects. | Mission Critical | ||
| 6.03 | Data Ownership, Access, and Reporting | Provide a complete data dictionary including field definitions, types, lengths, value ranges, relationship diagrams, key fields, and an entity-relationship diagram detailing inter‑table relationships. | Mission Critical | ||
| 6.04 | Data Ownership, Access, and Reporting | Guarantee City ownership and free access to all captured data during and after the contract; retain data, metadata, logs, and outage notifications for the life of the contract. Data export must be available in non-proprietary formats (CSV, JSON). Vendor must support transition assistance upon contract termination. Database must be available in an acceptable backup format (eg. .bak) of city's determination. | Mission Critical | ||
| 6.05 | Data Ownership, Access, and Reporting | Provide in‑house reporting with real‑time and historical views, support exports (PDF, Word, Excel), and report performance metrics (response time, page load, API response, transaction time, third‑party impact). Describe the system’s ability to import data from common formats (XML, CSV, TXT). | Mission Critical | ||
| 6.06 | Data Ownership, Access, and Reporting | Provide a content availability and migration plan, including direct content remittance to the City when needed. | Mission Critical | ||
| 6.07 | Data Ownership, Access, and Reporting | Access to City data must remain fully controlled and cannot be handled or hosted by any external or offshore entity. While development work (including code writing) may be outsourced, no offshore personnel may access systems, terminals, or environments containing city data. Any such access constitutes a compliance violation. | Mission Critical | ||
| 7.01 | Support & Documentation | Provide online help, customer service during City business hours, and audit documentation (security audits in past 12 months) upon request; deliver As‑Built documentation at Go‑Live. | Mission Critical | ||
| 8.01 | Geospatial | Ensure ESRI compatibility, support standard GIS formats (.geojson, .dbf, .shp, .gdb), enable publishing via ArcGIS Online/ESRI enterprise, ensure transferability to the City’s ArcGIS Online/Portal, and support use of City GIS layers for geocoding and administrative geographies. | Mission Critical | ||
| 9.01 | Artificial Intelligence (AI) | Identify AI systems used, their function/purpose, model types (e.g., LLM/transformer/deep learning), domains, and data stored; state whether data can be deleted or users can opt out. City Data cannot be used to train vendor models or provided to third parties. | Mission Critical | ||
| 9.02 | Artificial Intelligence (AI) | Describe training data, features, target labels, and the cadence for updating the training set. | Mission Critical | ||
| 9.03 | Artificial Intelligence (AI) | Describe post‑deployment monitoring and steps to address adverse incidents; report evaluation outcomes (performance, fairness, human legibility, privacy, reliability); include vendor and third‑party pen testing/offensive security for products and AI models. Respondent must report on the outcomes of the evaluations they have conducted around performance, fairness, human legibility, privacy, reliability. | Mission Critical | ||
| 10.01 | Accesssibility | Deliver ADA‑compliant software conforming to WCAG 2.1 Level AA (or current standard) across web/mobile/components; provide VPAT® or equivalent on request and remediate gaps at no cost. | Mission Critical | ||
| 11.01 | Supplemental | Vendors outside the United States may apply if they meet all stated standards. | Highly Desirable |
Definitions
| City Need | Revised Definition | Vendor Response | Revised Definition |
| Mission Critical | Essential requirement that must be met for the solution to be selected; may justify additional cost if necessary to achieve. | Core Capability | Functionality delivered natively as part of the standard solution with no additional cost. |
| Highly Desirable | Important capability that strengthens the solution and may influence cost‑benefit evaluation but is not mandatory. | Configurable by Vendor | Capability that the vendor can enable through configuration during implementation, without additional cost beyond standard services. |
| If Possible | Optional capability that provides added value if included at no or minimal additional cost. | Configurable by City Staff | Capability that City staff can configure using available tools and documentation with no additional vendor cost. |
| Requires Customization | Capability requiring vendor‑developed custom work that will add cost beyond standard implementation. | ||
| Provided in Conjunction with a 3rd Party | Capability delivered through a third party, which may introduce additional cost and coordination needs. | ||
| Not Applicable | Capability not supported by the proposed solution and therefore not considered in cost evaluation. |
File details come from the government source that posted it. Updated .