Technical_Requirements_Worksheet.xlsx

XLSX spreadsheet 61 KB Posted

Attached to
Utility Billing Software Replacement Phase 2
Solicitation number
RFP-605021-25/LTT
Issued by
Seminole County, Florida

About this file

The document is a Technical Requirements Worksheet for a Software-as-a-Service (SaaS) solution issued by Seminole County Utilities Division for a Customer Information System (CIS) replacement project. The procurement seeks a comprehensive utility billing software that will support approximately 42,500 residential and 2,900 commercial water customers, handling around 5,000 monthly call center interactions and 29,600 monthly bills. The technical requirements document outlines extensive specifications across multiple domains including database support, network requirements, security protocols, data management, interface capabilities, identity management, system maintenance, and customer self-service functionality. Key technical evaluation criteria include compliance with security standards, multi-factor authentication, end-to-end encryption, PCI compliance, and integration capabilities with existing systems like AMI Headend, JDE Financial System, and various payment processing platforms.

The technical requirements indicate a sophisticated procurement process with a points-based scoring system evaluating Capability & Experience (40 points), Functional Requirements (12.5 points), Technical Requirements (12.5 points), Integration Approach (15 points), and Cost (20 points). The project requires vendors to demonstrate robust cybersecurity measures, including 99.99% system availability, SAML authentication, single sign-on capabilities, and compliance with Americans with Disabilities Act and Florida Sunshine Law requirements. The contract appears to have a 7-year total cost of ownership model, with vendors expected to provide comprehensive support including consulting services, training, system maintenance, and ongoing technical support. The procurement allows for flexible responses, permitting vendors to propose standalone Customer Information System solutions or integrated approaches with self-service and payment processing capabilities.

View the file

Other files

File Type Posted
Utility_Billing_Software_Replacement_Phase_2_(Addendum_#1_Revision).pdf PDF
Proposal_Response_REV_8.19.pdf PDF
Utility_Billing_Software_Replacement_Phase_2.pdf PDF
Draft_Term_Contract.pdf PDF
Insurance_Requirements.pdf PDF
Interface_Experience_Worksheet.xlsx XLSX spreadsheet
Technical_Requirements_Worksheet.xlsx XLSX spreadsheet
Functional_Requirements_Worksheet.xlsx XLSX spreadsheet
Staffing_Matrix_Worksheet.xlsx XLSX spreadsheet
Pricing_Worksheet.xlsx XLSX spreadsheet
Proposal_Response.pdf PDF
Sample_Purchase_Order.pdf PDF
Show all 12

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file

Text version

Priority

Manatee Technical Requirements Ranking
Requirement CategoryRank% of Score
Data
Database Support
Identity Provider
Interface Management
Network Requirements
Operating System Support
Security
Supported Devices
Supported Web Browsers
System Maintenance
System Tools
Technical Architecture
Web design standards
Compliance:
Americans Disabilities Act--
Florida Sunshine Law--
PCI Compliance--

INSTRUCTIONS

TECHNICAL REQUIREMENTS: INSTRUCTIONS
VENDOR RESPONSE:A selection from the drop-down must be chosen for EACH requirement.

CUSTOMER SELF SERVICE: If the proposed solution includes Customer Self Service (CSS), the CSS must comply with ALL technical requirements. If not, provide an explanation in the comments section.

'UPCOMING VERSION':Any time that 'Base Functionality - Upcoming Version' is chosen, you must provide the release number and estimated date in the 'Vendor Narrative or Additional Comments' field.
'NEW MODIFICATION REQUIRED':Any time that 'New Modification Required' is chosen, you must provide details regarding the severity of such customization and possible cost / development hours required;

this information should also be provided in the General Pricing Worksheet under 'Modifications'.

NARRATIVES: Use the 'Vendor Narrative or Additional Comments' field to provide as much detail as possible in answering the Narrative Response Type requests.

SaaS

Seminole County CIS Selection TECHNICAL REQUIREMENTS WORKSHEET - SaaS

VENDOR:INPUT COMPANY NAME
Req IDTopicResponse TypeRequirementVendor ResponseVendor Narrative or Additional Comments
SaaS 1.0Database Support---
SaaS 1.1Database SupportNarrativeMethod on which the County would access the system data-
SaaS 1.2Database SupportNarrativeProvide an ERD (Entity Relationship Diagram) along with a Data Dictionary as an attachment. Confirm in the Narrative column that both documents have been provided as attachments.-
SaaS 2.0Network Requirements---
SaaS 2.1Network RequirementsRequirementVendor shall use commercially reasonable resources and efforts to maintain adequate internet connection bandwidth, service capacity, and ensure its data center and/or other vendors performing subcontracted services have industry standard physical, technical, human, security, and administrative controls.
SaaS 2.2Network RequirementsNarrativeDescribe the systems network requirements and/or bandwidth requirements.-
SaaS 2.3Network RequirementsNarrativeIs there a VPN component to the system? If so, what type of VPN systems are proposed (site-to-site, IPSec, SSL/TLS, etc.)? Describe the VPN requirements in detail.-
SaaS 2.4Network RequirementsNarrativeDescribe any physical communication requirements for integration with the client's CIS system.-
SaaS 2.5Network RequirementsRequirementThe system will have 99.99% availability.
SaaS 3.0Security---
SaaS 3.1SecurityRequirementAuthentication of utility users will be provided utilizing SAML authentication or a similar method.
SaaS 3.2SecurityRequirementThe latest version of ADFS (Active Directory Federated Services) is required, using the latest version of SAML, must be used for authentication.
SaaS 3.3SecurityRequirementOnce authenticated, Single Sign-on capability is provided with seamless interaction between bill presentment, payment processing, customer self-service functions and all other integrated sub-systems required, providing a single log-in for the (non-utility employee) customer. (Describe your single sign-on capability in working with other providers in the narrative column).
SaaS 3.4SecurityRequirementThe system will utilize end-to-end encryption, TLS 1.2 or better
SaaS 3.5SecurityRequirementThe end-to-end encryption will protect data both in-transit and at rest.
SaaS 3.6SecurityRequirementThe system uses 256 bit encryption.
SaaS 3.7SecurityRequirementThe vendor shall utilize a third- party certificate provider who is a recognized and trusted authority.
SaaS 3.8SecurityRequirementAs standard process, vendor provides system administrator a step-by-step process for initial password setup. Admin must assign a password to the user when creating a user master record. Password must meet the internal requirements set by the system.
SaaS 3.9SecurityRequirementSystem provides the ability to support a centralized security administration function.
SaaS 3.10SecurityRequirementSystem provides the ability to create a Master Record/Role to enable the user to log onto the system and allow access to the functions and objects within the limits of the authorization profiles specified in the role. The user master record contains all information about the corresponding user, including the authorization profiles.
SaaS 3.11SecurityRequirementSystem provides the ability to create a Single Role that allows the automatic generation of an authorization profile. The role contains the authorization data and logon menu for the user.
SaaS 3.12SecurityRequirementSystem provides the ability for system administrator to setup user-defined security hierarchy for role-based security.
SaaS 3.13SecurityRequirementSystem provides the ability to define the level of access for which a user is authorized (i.e. read-only or update).
SaaS 3.14SecurityRequirementSystem provides the ability to duplicate/copy a user profile and all its authorization profiles and components to a different or new user.
SaaS 3.15SecurityRequirementSystem provides the ability to group users into classes and provide access restrictions by roles as defined.
SaaS 3.16SecurityRequirementSystem provides the ability to generate reports to review authorization profiles given to the users defined in the system.
SaaS 3.17SecurityRequirementSystem provides the ability to check for failed password logon attempts and increase the unsuccessful logon counter for the affected user master record.
SaaS 3.18SecurityRequirementSystem provides the ability to define the number of retries allowed before terminating the logon attempt and disabling the account when a user enters an incorrect password.
SaaS 3.19SecurityRequirementSystem provides the ability to record/capture the following information about each unauthorized access attempt and/or limit the information to any one of the following individual fields: user ID, workstation, date, time, transaction type (menu, file, screen, field), access type (inquiry, modify, etc.).
SaaS 3.20SecurityRequirementSystem provides the ability to support secure access to the database, so that only authorized users are allowed to access the database, and report attempts to access the database by unauthorized users.
SaaS 3.21SecurityRequirementSystem provides the ability to prevent passwords from being printed or displayed. Mask passwords as they are being typed.
SaaS 3.22SecurityRequirementSystem provides the ability to encrypt passwords while stored so they cannot be viewed. No clear-text passwords.
SaaS 3.23SecurityRequirementSystem provides the ability to disconnect a user already logged on.
SaaS 3.24SecurityRequirementSystem provides the ability to time out or suspend a user after a configurable period of idle time. This time out requires the user to re-enter their password before continuing.
SaaS 3.25SecurityRequirementSystem provides the ability to give or remove user access to encrypted data, including the ability to give user access to view partial encrypted data (i.e. last 4 digits of SSN).
SaaS 3.26SecurityRequirementThe system will provide an audit log of user activity.
SaaS 3.27SecurityNarrativeIf the system uses a 'system account' or 'service accounts', describe the process to change the account(s) passwords.-
SaaS 3.28SecurityNarrativeDescribe which industry-accepted endpoint protection solution is used in all hosting servers.-
SaaS 3.29SecurityRequirementThe Vendor is responsible for sending the SC’s system/network vulnerability scan results upon request.
SaaS 3.30SecurityRequirementThe Vendor shall supply firewall and IPS logs for malicious intrusion and access attempts into hosted SC systems upon request.
SaaS 3.31SecurityRequirementThe Vendor shall conduct annual security assessments, vulnerability assessments, or audits of systems that contain SC data.
SaaS 3.32SecurityRequirementVendor monitoring and notifications shall occur automatically in a manner that SC will learn about outages as an escalation from the vendor.
SaaS 3.33SecurityRequirementIn the event of any outage impacting the primary data center, the hosting platform shall offer the option to have a disaster recovery or backup data center where SC staff and visitors will continue to be able to access the proposed system. The backup data center will be located within the Continental United States and must be able to accommodate/host the proposed system. Please explain how this process will be performed in the narrative section
SaaS 3.34SecurityNarrativeProvide details on intrusion and cyberattack detection technology and methods used to identify source and analyze the behavior of the attack.-
SaaS 3.35SecurityNarrativeProvide details addressing policy, procedures, and security updates for zero-day exploit vulnerabilities.-
SaaS 3.36SecurityRequirementThe solution shall protect the website against Distributed Denial of Service (DDoS) and other cyberattacks must be able to detect and mitigate malicious traffic within reasonable time.
SaaS 4.0Incident Response---
SaaS 4.1Incident ResponseNarrativeDescribe the Vendor plan for compliance with all applicable breach notification laws, including SC’s Personal Information Notification and provide a Root-Cause analysis report.-
SaaS 4.2Incident ResponseRequirementThe Vendor must provide a report to SC within 5 business days about any potential breaches or unintended disclosures of confidential information, including steps Vendor is taking to rectify the potential breach or unintended disclosure.
SaaS 4.3Incident ResponseRequirementIncident response actions that may affect confidential information must be conducted quickly and with ample resources and provide a Root-Cause analysis report. SC may request a professional third-party incident response team if its in-house resources do not have sufficient skill or availability.
SaaS 4.4Incident ResponseRequirementSC shall have the right to view all incident response evidence, reports, communications, and related materials upon request.
SaaS 4.5Incident ResponseRequirementIf requested by SC, or if required by law, the vendor, at its own cost and expense, shall notify in writing all direct-contact persons affected by the incident and reimburse SC for any third-person notifications that must be sent.
SaaS 5.0Audit and Inspection---
SaaS 5.1Audit and InspectionRequirementIn the event of adverse risk findings through an audit or assessment, the vendor shall cooperate with SC in remediating any risks to the system, including complying with requests to temporarily take the system offline or otherwise limit access to the system during remediation.
SaaS 5.2Audit and InspectionRequirementAudit logs shall be implemented for all systems on the SC’s network. All attempted violations of system security must generate an audit log. Audit logs must be secured against unauthorized access or modification.
SaaS 6.0Data---
SaaS 6.1DataRequirementVendor shall house all services and equipment in an operational environment that meets industry standards including climate control, fire and safety hazard detection, redundancy, electrical needs, and physical security.
SaaS 6.2DataRequirementAll data is exchanged using secure FTP, TLS 1.2 or better.
SaaS 6.3DataRequirementData exchange can be supported in real-time and by batch.
SaaS 6.4DataRequirementAny data exchange that utilizes a batch process can be scheduled and automated. Thus, not relying on any kind of manual intervention/push.
SaaS 6.5DataRequirementData can be imported via batch files including csv, txt, and xlsx.
SaaS 6.6DataRequirementData can be exchanged using API web services. Provide details regarding your web service protocols in the Narrative column.
SaaS 6.7DataNarrativeDescribe your business continuity, data recovery, cyber event, and data availability processes.-
SaaS 6.8DataNarrativeDescribe your data center disaster recovery procedures.-
SaaS 6.9DataRequirementThe system provider will agree to contract language which stipulates that the ownership of all data (with the exception of PCI Data) used in the provision of customer self-service, bill presentment, and payment processing services will remain with the client. At termination of the contract the vendor will allow the client to export the data. After export is complete, the vendor will conduct a data destruction.
SaaS 6.10DataRequirementDue to differing privacy standards from country to country, all data must be stored and maintained in the US only.
SaaS 6.11DataRequirementA Cloud or SaaS provider must be SAS 70/SSAE 16/SSAE 18 (SOC2, Type 1 or Type 2) FIPS 140-2 or FIPS 140-3 certified and will agree to provide the latest audit reports (and bridge letter where applicable).
SaaS 6.12DataRequirementThe system will use date effective records or audit tables for historical reporting. At a minimum, the following information must be recorded in the date effective records or audit table:

-User ID -Date and time of action -Field name -Before value -After value

SaaS 7.0Interface Management---
SaaS 7.1Interface Management-Provide your experience in integration with the following systems:-
SaaS 7.1.1Interface ManagementNarrativeBadger-Beacon-
SaaS 7.1.2Interface ManagementNarrativeAMI Headend-
SaaS 7.1.3Interface ManagementNarrativeJDE Financial System-
SaaS 7.1.4Interface ManagementNarrativeJDE Asset Management-
SaaS 7.1.5Interface ManagementNarrativeIntegrated Web Batch Management(Bath and Job scheduling)-
SaaS 7.1.6Interface ManagementNarrativeThird Party-
SaaS 7.1.7Interface ManagementNarrativeData Prose-
SaaS 7.1.8Interface ManagementNarrativeBill Print and Mail-
SaaS 7.1.9Interface ManagementNarrativeData Prose-
SaaS 7.1.10Interface ManagementNarrativeUPSP Address Validation Services-
SaaS 7.1.11Interface ManagementNarrativeBill Presentation within the Customer Information System and Custerom Self Service (CSS)-
SaaS 7.1.12Interface ManagementNarrativeCheckfree-
SaaS 7.1.13Interface ManagementNarrativeVanco-
SaaS 7.1.14Interface ManagementNarrativeCash Remittance-
SaaS 7.1.15Interface ManagementNarrativeRTR-
SaaS 7.1.16Interface ManagementNarrativeCollection Agency-
SaaS 7.1.17Interface ManagementNarrativeSelectron-
SaaS 7.1.18Interface ManagementNarrativeContact Center-
SaaS 7.1.19Interface ManagementNarrativeAccela-
SaaS 7.1.20Interface ManagementNarrativeGeospatial Information Systems (GIS)-
SaaS 7.1.21Interface ManagementNarrativeSCUID-
SaaS 7.1.22Interface ManagementNarrativeWasteworks-
SaaS 7.1.23Interface ManagementNarrativeLandfill-
SaaS 7.1.24Interface ManagementNarrativeBeacon-
SaaS 7.1.25Interface ManagementNarrativeMeter Data Management-
SaaS 7.1.26Interface ManagementNarrativeElavon (Seminole County Payment System)-
SaaS 7.1.27Interface ManagementNarrativeMicrosoft PowerBI-
SaaS 7.2Interface ManagementRequirementAbility to implement real-time, two-way API between Customer Information System and Elavon(Seminole County Payment System)

- Account number

- Last name

- Phone number

- Service address -Payments SaaS 7.3 Interface Management Requirement Ability to implement direct real-time integration with Esri's ArcGIS Portal and/or ArcGIS Online providing the system with the ability to link

- Billing records with customer addresses

- Meter Location

- Other relevant GIS data

SaaS 7.4Interface ManagementNarrativeExplain how your system will integrate with Esri's ArcGIS Portal and/or ArcGIS Online-
SaaS 7.5Interface ManagementRequirementAbility to implement direct real-time integration via API with Beacon
SaaS 7.6Interface ManagementRequirementAbility to implement direct real-time integration via API with Accela
SaaS 7.7Interface ManagementRequirementAbitity to implement direct-real-time integration via API with MS PowerBI
SaaS 7.8Interface ManagementNarrativeExplain the approach and any limitations to interface with other tools/software.-
SaaS 7.9Interface ManagementNarrativeDescribe how the system enables SC staff to monitor and troubleshoot interfaces.-
SaaS 7.10Interface ManagementNarrativeList and describe the private, partner, and/or public APIs available with your system. Provide API documentation for each API and confirm in the Narrative field that this has been provided.-
SaaS 7.11Interface ManagementNarrativeDescribe the process to develop a new system interface.-
SaaS 8.0Identity Provider---
SaaS 8.1Identity ProviderNarrativeExplain how the system authenticates internal utility users and handles identity management (specific methods of Active Directory, SAML, etc.).-
SaaS 8.2Identity ProviderNarrativeExplain how your system stores and manages an identity for utility system users, including the storage of user passwords and use of encryption.-
SaaS 8.3Identity ProviderNarrativeExplain how your system will determine a threat during the identification process (including Malware, DDoS, Brute-Force).-
SaaS 8.4Identity ProviderNarrativeDescribe how your system maintains a record of previous threats including the retention period.-
SaaS 9.0System Tools---
SaaS 9.1System ToolsNarrativeDescribe the capabilities for the utility team to add a data field to forms/tables, including the formatting of the field, reporting capability, functionality, interfacing, etc. without customizations of the system. Include how this impacts upgrades.-
SaaS 9.2System ToolsNarrativeDescribe the systems capabilities for archive/purge of system data and logs. Also, include the suggested best practice for data archive/purge as it pertains to maintaining optimal system performance.-
SaaS 10.0System Maintenance---
SaaS 10.1System MaintenanceNarrativeDescribe the process to apply a system updates (hotfix, point patch, minor version update) including level of effort for SC staff, time, and impact to users.-
SaaS 10.2System MaintenanceRequirementVendor shall supply all hosting equipment (hardware and software) required for performance of the contract and ensure maintenance and replacement as necessary to maintain compliance with the Service Level Agreement(s).
SaaS 10.3System MaintenanceRequirementVendor shall use commercially reasonable resources and efforts to maintain adequate internet connection bandwidth, service capacity, and ensure its data center and/or other vendors performing subcontracted services have industry standard physical, technical, human, security, and administrative controls at all times.
SaaS 10.4System MaintenanceNarrativeDescribe procedures to verify that backup and restoration processes were run appropriately. Explain if backup copies are stored in the secure offsite location-
SaaS 10.5System MaintenanceNarrativeDescribe the Vendor’s Disaster Recovery Plan (DRP) and recovery of all stored documents, system configuration/setup-
SaaS 10.6System MaintenanceNarrativeDescribe how the Vendor conduct upgrades of the solution, as they become available, to strengthen and update functionality, as well as ensure SC is operating on the most current version of the solution.-
SaaS 10.7System MaintenanceNarrativeSC requires the ability to patch the system without disruption or an outage.-
SaaS 10.8System MaintenanceNarrativeDescribe the process to apply a major version update including level of effort for SC staff, time, and impact to users.-
SaaS 10.9System MaintenanceNarrativeDescribe the process for restoring and/or cloning data from Production to Test environments-
SaaS 10.10System MaintenanceNarrativeDescribe how modifications or customizations to the system will be incorporated into the next released minor version of the system.-
SaaS 10.11System MaintenanceNarrativeProvide a sample SLA and confirm in the Narrative field that this has been provided.-
SaaS 10.12System MaintenanceNarrativeDescribe the vendor support details during warranty period.-
SaaS 10.13System MaintenanceNarrativeDescribe your level of support (e.g. 24/7 live support via e-mail, chat, and/or phone)-
SaaS 10.14System MaintenanceRequirementThe Vendor shall provide designated SC staff with access to live support in event of emergencies.
SaaS 10.15System MaintenanceRequirementThe Vendor’s support team shall be fluent in the functionality and uses of both the document management system’s features and associated applications and modules
SaaS 10.16System MaintenanceRequirementIt is desired that the Vendor shall provide assistance as needed to SC staff for document management and configuration related tasks.
SaaS 10.17System MaintenanceRequirementThe Vendor shall provide on-demand access to support materials and content, including but not limited to online training manuals and support FAQs
SaaS 10.18System MaintenanceRequirementAll updates, maintenance and deployment related activities shall be performed after SC business hours (7:00am to 6:00pm) and after coordinating with SC IT for approval with ample notice of at least 2 weeks. Prior to the activity, vendor must provide expected downtimes. SC shall also be notified upon completion of these activities
SaaS 11.0Consulting Services---
SaaS 11.1Consulting ServicesRequirementThe Vendor shall provide general consulting services related to proposed solution design, applications, and technology.
SaaS 11.2Consulting ServicesRequirementThe Vendor shall quote an hourly cost that will be used when additional project-based services are required.
SaaS 12.0Training Support---
SaaS 12.1Training SupportRequirementThe Vendor shall develop training materials including but not limited to outlines, knowledge articles and process flows. These materials must be updated as needed with each release and providing training and training materials.
SaaS 12.2Training SupportRequirementThe Vendor will provide necessary installation and training to use, configure and carry-on maintenance tasks needed to keep the proposed system running.
SaaS 12.3Training SupportRequirementThe Vendor shall provide either online or onsite training (classroom) for internal users on applications and functionality.
SaaS 13.0Supported Web Browsers---
SaaS 13.1Supported Web BrowsersRequirementIf the system is accessed via web browser it must use HTML5 with no additional plug ins.
SaaS 13.2Supported Web Browsers-The system will support the multiple modern web browsers including the following:-
SaaS 13.2.1Supported Web BrowsersRequirementMicrosoft Edge
SaaS 13.2.2Supported Web BrowsersRequirementGoogle Chrome
SaaS 13.2.3Supported Web BrowsersNarrativeOther (Specify in the notes column)-
SaaS 14.0Customer Self Service---
SaaS 14.1Customer Self ServiceRequirementThe system will support Multi-Factor Authentication (MFA) for external (non-utility employee) customer logins and will provide customers with the option to select their preferred MFA method during registration.
SaaS 14.2Customer Self ServiceRequirementSystem will provide a multi-factor authentication during registration, such as a customer response to a system-generated email or text
SaaS 14.3Customer Self ServiceNarrativeDescribe the customer log-in process, including details on use of email addresses, phone number, PIN, and/or passwords.-
SaaS 14.4Customer Self ServiceNarrativeDescribe your Identity Service Provider Protocols from the moment when someone first visits your site until they sign off.-
SaaS 14.5Customer Self ServiceNarrativeSystem has the capability to serve as identity provider to authenticate external users as they access multiple domains and/or services: bill presentment, payment processing, meter consumption platform, company website, etc.-
SaaS 14.6Customer Self ServiceNarrativeThe system will provide customers the ability to interact with a Customer Support Representative via SMS text messaging or MMS messages-
SaaS 14.7Customer Self ServiceNarrativeThe system will provide customers the ability to interact with a Customer Support Representative via an Online Chat-
SaaS 14.8Customer Self ServiceNarrativeAbility for customers to recover and/or change user ID and/or password without the intervention of Customer Support Representative and describe the process of doing so.-
SaaS 14.9Customer Self ServiceNarrativeThe system allows authentication via third parties (Facebook, Google, etc.).-
SaaS 14.10Customer Self Service-The responsive design or the app design will support multiple device types, including the following:-
SaaS 14.10.1Customer Self ServiceRequirementiOS devices as currently supported by Apple
SaaS 14.10.2Customer Self ServiceRequirementAndroid devices from various manufacturers currently supported by that manufacturer. (Specify in the notes column)
SaaS 14.10.3Customer Self ServiceRequirementDesktop Computers utilizing a supported browser
SaaS 15.0Location and Performance---
SaaS 15.1Location and PerformanceRequirementExcept where Vendor obtains SC’s prior written approval, Vendor shall perform all the Services only from or at locations within the geographic boundaries of the continental United States. Any SC approval for the performance of Services outside of the continental United States shall be limited to the specific instance and scope of such written approval, including the types of Services and locations involved.
SaaS 16.0PCI Compliance---
SaaS 16.1PCI ComplianceRequirementPayment processor service provider must be PCI level 1 certified and will agree to provide the latest audit report(s) in a annual basis
SaaS 16.2PCI ComplianceRequirementProvide the data flow diagram for PCI compliance.
SaaS 16.3PCI ComplianceRequirementPayment processor service provider must be Payment system/Data Security Standard (PA-DSS) certified for point-of-sale.
SaaS 16.4PCI ComplianceRequirementSystem must meet PCI standards and best practices, have a valid PCI DSS Certificate of Compliance and pass tenable and ssl labs security scans conducted by MCUD.
SaaS 17.0Data Center Compliance---
SaaS 17.1Data Center ComplianceRequirementProvide details on the proposed document management system data center compliance standards and certification.

It is desired that the hosting platform resides in a certified data center that is SSAE 16 Type II Compliant with multiple layers of security access, redundant ISP providers, backup power and redundant generator, and firewall protection.

SaaS 17.2Data Center ComplianceRequirementVendor shall house all services and equipment in an operational environment that meets industry standards including climate control, fire and safety hazard detection, redundancy, electrical needs, and physical security
SaaS 18.0Americans Disabilities Act---
SaaS 18.1Americans Disabilities ActRequirementThe system must comply with Americas Disability Act accessibility requirements.
SaaS 19.0Telephone Consumer Protection Act---
SaaS 19.1Telephone Consumer Protection ActRequirementThe system will comply with the Telephone Consumer Protection Act (TCPA) and Federal Communication Commission (FCC) regulations

Change Log

6-24-2021 Update
Removed section 2.1 (Cloud or on prem question) and separated requirements into On Prem / SaaS
Split out Cloud vs. On Prem requirements, added in best practices for both
Genericized application list in section 2.7
Added narrative on modular interface design or ease of integration
Clarified breach notification language
Added requirement for customer experience of account recovery/password reset
Added requirement to get PCI Audit Report Annually
Added requirement for PCI Data Flow Diagram
For on prem, added requirement that vendor needs to use Beyond Trust for Remote access
Clarified language on individual vendor support accounts
Updated Sunshine requirements to include retention schedule
For SaaS, added narrative about upgrade process
For On Prem, added additional requirements on updating the host systems OS, Middleware, Supporting Apps, and DB
For SaaS, added requirement to be able to query the solutions DB via SQL
Added in Narrative for vendor security incident response
Added requirement for customers to be able to authenticate with third parties (google, Facebook, etc.) *This may not be implemented but good to know if they can do it
Updated user defined field requirement to include if/how they impact upgrades
For on prem, clarified Oracle and MS database language
Updated numbering
7-7-2021 Update
TMN - The Vendor Response options need to be updated to not be reflective of Banner

MB: I proposed a rating scale, let me know if we need any other choices TMN - they look good to me, we just need to make sure they're included in all the right places and that the '-' is in the narrative boxes within the Vendor Response column. I was going to do it but thought you may have a system with the '-' as a way to mark them TMN - Should the Requirement IDs match between On Prem and SaaS when they are the same?

MB: Yes, let's leave changing the numbers until the last review since it takes a while to update them all TMN - that works TMN - Removed 'please' everywhere MB: Thank you TMN - Add verbiage that Responsibilities / Expectations of MCG Technology Staff are clearly outlined / communicated MB: Is this for implementation, daily operations, or both?

TMN - I'd say both but with a focus on implementation. We've run into issues in the past where a vendor has an expectation that ITS is going to perform tasks but either doesn't provide them with the right training / tools to accomplish them or doesn't schedule accordingly.

MB: Perfect TMN - Add verbiage that the System provides the ability to run multiple concurrent user sessions MB: Done TMN - Add verbiage asking they describe the process for restoring / cloning data from Production to Test environments MB: Done TMN - should we add a section about Customer Self Service? It feels a bit disjointed between Functional / Technical requirements MB: agreed and done AFS - Can we confirm that this is a different requirement from 2.12.1 a-g below? It strikes me as redundant.

MB: Yes, that's redundant. I merged section 2.11 and 2.12

Removed 'System provides the ability to delete user profiles with all aspects of security accurately and completely removed from the entire system.' Confusing and not relevant
Added Customer Self Service to the integrations section
Temporarily removed req #s to reduce effort to renumber changes
Added SMS/MMS capability to CSS
Added instructions to for CSS proposers
Added instructions for On Prem vs. SaaS bids
AFS - I think they need to describe to what level this auditing is available. Is it querying activity? Only creating and updating activities? Or we make the requirement clear that all activity (including just accessing records) must be auditable.

MB: Agreed, Some vendors may not like the word 'all' in the requirement so I gave them the option to add some explanation of the limitations in the narrative column

7-8-2021 Update
Added CSS 26.1.6 to CSS requirements to On Prem and SaaS. For reference CSS 26.1.6 is:

System will provide customer with the option to select which multi-factor authentication method to use during registration Added CSS 26.1.5 to CSS requirements to On Prem and SaaS. For reference CSS 26.1.5 is:

System will provide a multi-factor authentication during registration, such as a customer response to a system-generated email or text Added CSS 26.1.2 to CSS requirements to On Prem and SaaS. For reference CSS 26.1.2 is:

Ability for customers to recover and/or change user ID and/or password without the intervention of CSR Added 27.13.6 to Interface requirements to On Prem and SaaS. For reference CSS 27.13.6 is:

Ability to implement real-time, two-way API between CIS and Payment Processor

- Account number

- Last name

- Phone number

- Service address

- PIN

Functional Req CSS 26.9.1 is already covered in CSS and Supported Web Browsers
Removed 'Payment transactions are delivered in real-time and visible in CIS immediately.' from Data as it's covered in the Functionals. Added requirement to Interfaces
Clarified Personal Identification in the Interfaces Section
Updated formatting to address comment in A23
7/14/2021 Update
Added AMI Headend to list of interfaces
Added MDM portal to CSS requirements

Technical Requirements_OLD

MCUD TECHNICAL REQUIREMENTS
Req IDTopicResponse TypeRequirementNew Requirement Language (if edits are being made)MCUD Notes (include initials & date)Status
Example1Example1Example TopicRequirementThis is an example requirementThe example is a requirement.TMN 12/10/21: Suggested verbiage updateUnder Review
Example2Example2Example TopicRequirementThis is another example requirementTMN 12/10/21: ReviewedUnder Review
2.12.1Technical Architecture---
2.1.12.1.1Technical ArchitectureRequirementThe application delivery is provided as on-prem. (Payment Processing is expected to be off-prem for full PCI compliance).2.1.1 & 2.1.2 seem to contradict., ...must be able to integrate with third party payment processors via use of a redirect to minimize PCI scope. (maybe more relavant in section 2.14 ) -12/15 MFACS JS 1/5/21: ReviewedUnder Review
2.1.22.1.2Technical ArchitectureRequirementIf not on Prem, the application delivery is provided via a Cloud or SaaS model.If SAAS, what is the SLA? What penalties are there for breaches?-12/15 MFACS JS 1/5/21: ReviewedUnder Review
2.1.32.1.3Technical ArchitectureRequirementThe application uses a Service Oriented Architecture (SOA) supporting XML, SOAP, and WEB services.Explicitly state the application module you need web services, for example "must provide a public web service api for billing operations, read/update customer, equipment, services table data" (is SOAP the requirement, what if REST only?) -12/15 MFACS JS 1/5/21: ReviewedUnder Review
2.22.2Operating System Support---
2.2.12.2.1Operating System SupportRequirementIf the application is delivered on-premises, supporting a virtual environment, the application will operate in a Virtual Server environment using VMware version 6.5 or higher.NL 12/16/2020Under Review
Operating System SupportRequirementIf the application is delivered on-premises, it will operate in a high availability active/active cluster.NL 12/16/2020Under Review
2.2.22.2.2Operating System SupportNarrativeIf the application is not supported in a virtual environment, please describe your physical server environment in the narrative comments column.NL 12/16/2020 - I think this should not be a option. If necessary, it could be a dedicated virtual envornment; however, this adds additional managment overheadUnder Review
2.2.32.2.3Operating System SupportRequirementAn on-prem application will operate under the most current release of Windows Server Operating System, and at minimum one release back.NL 12/16/2020Under Review
2.2.42.2.4Operating System SupportRequirementAn on-prem application will operate using the most current release of Red Hat-Linux operating system, or one release back.NL 12/16.2020Under Review
Operating System SupportRequirementIf the system is delivered in a client server model, the client must support the latest 64-bit release of Microsoft Windows Enterprise Desktop Operating System.NL 12/16.2020Under Review
2.32.3Database Support---
2.3.12.3.1Database SupportRequirementThe application will be able to work with application data managed in the most current release of the Oracle Enterprise or Standard Edition Database management system, or one release back.Does RDBMS matter if SAAS -12/15 MFACS JS 1/5/21: ReviewedUnder Review
2.3.22.3.2Database SupportRequirementThe application will be able to work with application data managed in the most current release of the Microsoft SQL Server Database management system, or one release back.CS JS 1/5/21: ReviewedUnder Review
2.3.32.3.3Database SupportNarrativeProvide an ERD (Entity Relationship Diagram) along with a Data Dictionary as an attachment. Confirm in the Narrative column that both documents have been provided as attachments.CS JS 1/5/21: ReviewedUnder Review
2.42.4Network Requirements---
2.4.12.4.1Network RequirementsRequirementThe application will be able to operate responsively while requiring a low bandwidth.Any new, updated, or enhanced IT software , system, or service, that requires network connectivity, must overlay and integrate with existing county network infrastructure , any needed network connectivity services that exceed, or require the expansion of, what we have in place to support the endeavor , should be identified and addressed within the scope and budget of the project . (JW cc MH 20210105)Under Review
2.4.22.4.2Network RequirementsNarrativeIs there a VPN component to the solution? If so, what type of VPN solutions are proposed (site-to-site, IPSec, SSL/TLS, etc.)? Please describe the VPN requirements in detail.Any new, updated, or enhanced IT software , system, or service, that requires network connectivity, must overlay and integrate with existing county network infrastructure , any needed network connectivity services that exceed, or require the expansion of, what we have in place to support the endeavor , should be identified and addressed within the scope and budget of the project . (JW cc MH 20210105)Under Review
2.4.32.4.3Network RequirementsNarrativePlease describe any physical communication requirements for integration with the client's CIS application system.Any new, updated, or enhanced IT software , system, or service, that requires network connectivity, must overlay and integrate with existing county network infrastructure , any needed network connectivity services that exceed, or require the expansion of, what we have in place to support the endeavor , should be identified and addressed within the scope and budget of the project . (JW cc MH 20210105)Under Review
2.4.42.4.4Network RequirementsRequirementAny off site processing or remote service provision must maintain a 99.99% availability.Any new, updated, or enhanced IT software , system, or service, that requires network connectivity, must overlay and integrate with existing county network infrastructure , any needed network connectivity services that exceed, or require the expansion of, what we have in place to support the endeavor , should be identified and addressed within the scope and budget of the project . (JW cc MH 20210105)Under Review
2.52.5Security---
2.5.12.5.1SecurityRequirementAuthentication of internal users will provide identity management utilizing SAML authentication.Under Review
2.5.22.5.2SecurityRequirementThe application has the ability to utilizes Multi-Factor Authentication (MFA) for external customer log-in.Under Review
2.5.32.5.3SecurityRequirementOnce authenticated, Single Sign-on capability is provided with seamless interaction between bill presentment, payment processing, customer self-service functions and all other integrated sub-systems required, providing a single log-in for the customer. (Please describe your single sign-on capability in working with other providers in the narrative column).Under Review
2.5.42.5.4SecurityNarrativePlease describe the customer log-in process, including details on use of email addresses, phone number, PIN, and/or passwords.Under Review
2.5.52.5.5SecurityNarrativeIf an email is required, please describe how a customer without an email who needs to set up an ACH autopay would access the system.Under Review
2.5.62.5.6SecurityNarrativePlease describe your company's approach and ability to provide Single Sign-On as it pertains to providing access across multiple platforms, possibly provided by a diverse group of solution vendors (CSS, Bill Presentment, Payment Processing, MDM, etc.).Under Review
2.5.72.5.7SecurityNarrativePlease provide a list of vendors / peripheral solutions that your system has integrated with successfully (CSS, Bill Presentment, Payment Processing, MDM, etc.)Under Review
2.5.82.5.8SecurityRequirementThe application will utilize end-to-end encryption, tls 1.2, moving to tls 1.3 when feasible. Do not use DH-ANON or ECDH-ANON for Key Exchange. Do not use the following ciphers/algorithms: 3DES EDE CBC, GOST 28147-89 CNT, RC4, or Null (no cipher)Under Review
2.5.92.5.9SecurityRequirementThe end-to-end encryption will protect data both in-transit and at rest.Under Review
2.5.102.5.10SecurityRequirementThe application uses 256 bit encryption.Under Review
2.5.112.5.11SecurityRequirementData exchange between server and mobile/web clients uses 256 encryption and SSL. Do not use SSL; TLS 1.2 (until 1.3 is more widely accepted) using AES preferably GCM) as the encryption algorithm and DHE-RSA, ECDHE-RSA, or ECDHE-ECDSA for key exchange.Under Review
2.5.122.5.12SecurityRequirementProvide system administrator a step-by-step process for initial password setup. Admin must assign a password to the user when creating a user master record. Password must meet the internal requirements set by the system.Under Review
2.5.132.5.13SecurityRequirementProvide the ability to support a centralized security administration function.Under Review
2.5.142.5.14SecurityRequirementProvide the ability to create a Master Record/Role to enable the user to log onto the system and allow access to the functions and objects within the limits of the authorization profiles specified in the role. The user master record contains all information about the corresponding user, including the authorization profiles.Under Review
2.5.152.5.15SecurityRequirementProvide the ability to create a Single Role that allows the automatic generation of an authorization profile. The role contains the authorization data and logon menu for the user.Under Review
2.5.162.5.16SecurityRequirementProvide the ability for system administrator to setup user-defined security hierarchy for role-based security.Under Review
2.5.172.5.17SecurityRequirementProvide the ability to define the level of access for which a user is authorized (i.e. read-only or update).Under Review
2.5.182.5.18SecurityRequirementProvide the ability to duplicate/copy a user profile and all its authorization profiles and components to a different or new user.Under Review
2.5.192.5.19SecurityRequirementProvide the ability to group users into classes and provide access restrictions by class as defined.Under Review
2.5.202.5.20SecurityRequirementProvide the ability to generate reports to review authorization profiles given to the users defined in the system.Under Review
2.5.212.5.21SecurityRequirementProvide the ability to check for failed password logon attempts and increase the unsuccessful logon counter for the affected user master record. If the user changes his password, the system first checks the current password. If this check fails, the system increases the unsuccessful logon counter.Under Review
2.5.222.5.22SecurityRequirementProvide the ability to define the number of retries allowed before terminating the logon attempt and disabling the account when a user enters an incorrect password.Under Review
2.5.232.5.23SecurityRequirementProvide the ability to record/capture the following information about each unauthorized access attempt and/or limit the information to any one of the following individual fields: user ID, workstation, date, time, transaction type (menu, file, screen, field), access type (inquiry, modify, etc.)Under Review
2.5.242.5.24SecurityRequirementProvide the ability to support secure access to the database, so that only authorized users are allowed to access the database, and report attempts to access the database by unauthorized users.Under Review
2.5.252.5.25SecurityRequirementProvide the ability to prevent passwords from being printed or displayed. Mask passwords as they are being typed.Under Review
2.5.262.5.26SecurityRequirementProvide the ability to encrypt passwords while stored so they cannot be viewed. No clear-text passwords.Under Review
2.5.272.5.27SecurityRequirementProvide the ability to delete user profiles with all aspects of security accurately and completely removed from the entire system.Under Review
2.5.282.5.28SecurityRequirementProvide the ability to disconnect a user already logged on.Under Review
2.5.292.5.29SecurityRequirementProvide the ability to time out or suspend a user after a configurable period of idle time. This time out requires the user to re-enter their password before continuing.Under Review
2.5.302.5.30SecurityRequirementProvide the ability to give or remove user access to encrypted data, including the ability to give user access to view partial encrypted data (i.e. last 4 digits of SSN).Under Review
2.5.312.5.31SecurityRequirementThe system will provide an audit log of user activity.Under Review
2.5.322.5.32SecurityNarrativeIf the system uses a 'system account' or 'service accounts', describe the process to change the account(s) passwordsUnder Review
2.62.6Data---
2.6.12.6.1DataRequirementAll data is exchanged using secure FTP, TLS 1.2 or better.CS JS 1/5/21: ReviewedUnder Review
2.6.22.6.2DataRequirementData exchange can be supported in real-time and by batch.CS JS 1/5/21: ReviewedUnder Review
2.6.32.6.3DataRequirementPayment transactions are delivered in real-time and visible in CIS immediately.CS JS 1/5/21: ReviewedUnder Review
2.6.42.6.4DataRequirementAny data exchange that utilizes a batch process can be scheduled and automated. Thus, not relying on any kind of manual intervention/push.CS JS 1/5/21: ReviewedUnder Review
2.6.52.6.5DataRequirementData can be imported via batch files including csv, txt, and xlsx.CS JS 1/5/21: ReviewedUnder Review
2.6.62.6.6DataNarrativeData can be exchanged using API web services. Please provide details regarding your web service protocols in the Narrative column.CS JS 1/5/21: ReviewedUnder Review
2.6.72.6.7DataNarrativeIf an interfacing application does not support API or web services, describe how integrations would be developed in the Narrative column.CS JS 1/5/21: ReviewedUnder Review
2.6.82.6.8DataRequirementIf the application requires FTP data exchange, the application utilizes SFTP protocol.CS JS 1/5/21: Seems to contradict 2.6.1. Must use SFTP.Under Review
2.6.92.6.9DataRequirementA SaaS or Cloud provider will meet client's data retention policy to retain customer data for a minimum of 36 months.CS JS 1/5/21: Are we sure 36 months is enough history?Under Review
2.6.102.6.10DataNarrativePlease describe your business continuity, data recovery, cyber event, and data availability processes.CS JS 1/5/21: Applicable for SaaSUnder Review
2.6.112.6.11DataNarrativePlease describe your data center disaster recovery procedures.CS JS 1/5/21: Applicable for SaaSUnder Review
2.6.122.6.12DataRequirementThe solution provider will agree to contract language which stipulates that the ownership of all data used in the provision of customer self-service, bill presentment, and payment processing services will remain with the client. At termination of the contract the vendor will allow the client to export the data. After export is complete, the vendor will conduct a data destruction.CS JS 1/5/21: Applicable for SaaSUnder Review
2.6.132.6.13DataRequirementDue to differing privacy standards from country to country, all data must be stored and maintained in the US only.CS JS 1/5/21: Applicable for SaaSUnder Review
2.6.142.6.14DataRequirementA Cloud or SaaS provider must be SAS 70/SSAE 16/SSAE 18 (SOC2, Type 1 or Type 2) FIPS 140-2 or FIPS 140-3 certified and will agree to provide the latest audit reports (and bridge letter where applicable).CS JS 1/5/21: Applicable for SaaSUnder Review
2.6.152.6.15DataRequirementThe system will use data effective records or audit tables for historical reporting.CS JS 1/5/21: ReviewedUnder Review
2.72.7Interface Management---
2.7.12.7.1Interface ManagementNarrativePlease provide a list of vendors/peripheral solutions for which your system has already constructed, core interfaces:CS JS 1/5/21: ReviewedUnder Review
2.7.2a2.7.2aInterface ManagementNarrativeAccelaUnder Review
2.7.2b2.7.2bInterface ManagementNarrativeAutomicUnder Review
2.7.2cInterface ManagementNarrativeAutomicAFS 12/14/2020: Duplicate itemUnder Review
2.7.2d2.7.2dInterface ManagementNarrativeBackflow SystemsUnder Review
2.7.2e2.7.2eInterface ManagementNarrativeCash Remittance (Amscot, Bank of America, Lockbox, Fiserv)Under Review
2.7.2f2.7.2fInterface ManagementNarrativeCisco Finesse for Call CenterUnder Review
2.7.2g2.7.2gInterface ManagementNarrativeESRI GISUnder Review
2.7.2h2.7.2hInterface ManagementNarrativeInfo SendUnder Review
2.7.2i2.7.2iInterface ManagementNarrativeLandfillUnder Review
2.7.2j2.7.2jInterface ManagementNarrativeLucityUnder Review
2.7.2k2.7.2kInterface ManagementNarrativeNeptuneUnder Review
2.7.2l2.7.2lInterface ManagementNarrativeUSPS Address Validation ServicesUnder Review
2.7.2m2.7.2mInterface ManagementNarrativePro Recovery Collection AgencyUnder Review

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it. Updated .