Vendor Compliance Response Workbook.xlsx
XLSX spreadsheet 32 KB Posted
- Solicitation number
- 142927
- Issued by
- Howard County, Maryland
About this file
This is a Vendor Compliance Response Workbook for the Columbia Association's Enterprise Resource Planning (ERP) Modernization sourcing initiative in Maryland. The workbook serves as a self-certification and compliance portal requiring bidding vendors to demonstrate compliance across 28 granular controls and 6 mandatory gating requirements. The sourcing process evaluates vendors on critical capabilities including security compliance (SOC 2 Type II and ISO/IEC 27001 certifications), payment integrity (PCI-DSS v4.0 Tier-1 tokenized payment gateways), identity governance (SSO and MFA integration via SAML 2.0 or OIDC), billing core functionality (native rules-based billing engine for complex property assessments and cap phase-ins), data privacy (static data masking for PII in lower environments), and disaster recovery capabilities (RTO < 4 hours and RPO < 1 hour). The compliance framework is structured across five primary domains: Identity and Access Management (6 controls), Property and Assessment Billing Engine (4 controls), Systems Interoperability and Middleware Integration (6 controls), Zero-Trust Cloud Infrastructure Security (6 controls), and Core Operational and Business Process SLAs (6 controls). Bidders must also submit integration depth validation including API logs, JSON/XML payloads, and latency metrics for Club Automation CRM, Ceridian Dayforce HRIS, 8x8 PBX/Diagenix IVR, and Smartsheet integrations.
The workbook requires vendors to provide mandatory evidence supporting all compliance claims, with any self-certification of "No" or "Partial" on the gating matrix triggering automatic disqualification. Technical validation must demonstrate realistic system performance with synchronous endpoints processing requests under 200 milliseconds and webhook ingestion completing within specified SLA windows (5 minutes for Club Automation, 15 minutes for Dayforce payroll accrual ingestion, and 10 seconds for work order processing). The internal sourcing committee audit automatically flags omitted self-certifications, unsubstantiated compliant claims lacking mandatory evidence, and any vendor reliance on costly add-on modules or custom extensions exceeding 30 percent of compliant scope. The current submission status reflects 28 total requirements with zero percent SLA compliance rate and pending gating eligibility status, with audit results indicating 34 omitted answers requiring rejection and multiple incomplete gates and SLA submissions requiring completion before vendor qualification.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| ERP Vendor Compliance Response Guide.pdf | ||
| ERP Requirements Traceability Matrix.xlsx | XLSX spreadsheet | |
| RFP 27-05 ERP Software and Services 9.8.26.pdf | ||
| Minority Business Enterprise (MBE) Participation Form.docx | DOCX document | |
| 27-05 Pricing Schedule.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
TOC & Dashboard
| COLUMBIA ASSOCIATION - ERP MODERNIZATION SOURCING | ||
| Vendor SLA Self-Certification & Compliance Portal | ||
| VENDORS COMPLIANCE & ELIGIBILITY TELEMETRY DASHBOARD | ||
| TOTAL REQUIREMENTS | SLA COMPLIANCE RATE | GATING ELIGIBILITY STATUS |
| 28 | 0.0% | PENDING |
| SOURCING PORTAL WORKBOOK DIRECTORY | |||
| Tab Name | Target Objective & Scope | Quick Navigation Link | Current Status |
| TOC & Dashboard | Executive summary dashboard of compliance metrics, TCO rollups, and TOC navigation links. | Go To Dashboard → | ACTIVE |
| Gating Matrix | 6 Mandatory Pass/Fail Gating requirements (SOC2, PCI, NIST SSO, DR SLAs, SDM masking). Any 'No' triggers DQ. | Go To Gating Matrix → | ⚠️ GATES INCOMPLETE |
| SLA Matrix | 28 granular compliance controls across IAM, Rules-Based Billing, iPaaS Integration, Zero-Trust, and Operations. | Go To SLA Matrix → | ⚠️ INCOMPLETE |
| Integration Depth | Vendor technical validation requiring API logs, sample JSON payloads, and transactional latency metrics. | Go To Technical Test → | SUBMISSION REQUIRED |
| System Integrity Audit | Sourcing Committee internal verification dashboard checking blank fields, evidence links, and risk scores. | Go To Audit Trail → | ❌ AUDIT FAIL |
| CRITICAL PROCUREMENT COMPLIANCE RULES: | |||
| 1. Mandatory Gates: Gating Compliance Matrix (Tab 2) contains 6 non-negotiable gates. Any self-certified 'No' or 'Partial' triggers automatic disqualification. | |||
| 2. Required Evidence: Every compliant claim on the Gating Matrix must include supporting evidence in the Mandatory Evidence Reference field. |
Every "Fully Compliant" or "Configurable" claim on the SLA Matrix must include a verifiable document or URL reference in the Mandatory Evidence Reference field (Column H). Claims submitted without supporting evidence may be audited as Non-Compliant.
3. Technical Validation: Proposers must submit realistic JSON/XML payloads and API response logs on Tab 4 to verify real-time processing and latency claims.
Gating Matrix
| EXHIBIT 1 - MANDATORY GATING COMPLIANCE MATRIX | ||||||
| Bidding platforms must achieve 100% compliance across all 6 gates. Any 'Non-Compliant' or 'Partial' response = automatic disqualification. | ||||||
| Gate ID | Compliance Domain | Mandatory Sourcing Gate Requirement Specification | Risk Severity | Vendor Self-Certification | Mandatory Evidence Reference | Calculated Gate Status |
| GATE-SEC-001 | Security Compliance | SOC 2 Type II & ISO/IEC 27001 active certifications. Bidders must attach auditor opinions. | Critical | Incomplete | ||
| GATE-PAY-001 | Payment Integrity | PCI-DSS v4.0 Tier-1 tokenized payment gateways. Zero transiting of raw cardholder numbers across local CA networks. | Critical | Incomplete | ||
| GATE-IAM-001 | Identity Governance | SSO & MFA Integration: Centralize and federate all system logins using SAML 2.0 or OIDC authentication profiles. | Critical | Incomplete | ||
| GATE-BIL-001 | Billing Core | Native Rules Billing Engine: Calculate 100% of complex board-approved property assessments, cap phase-ins, late fees, and statutory liens natively, completely replacing COBOL-based legacy logic. | Critical | Incomplete | ||
| GATE-MIG-001 | Data Privacy | Static Data Masking (SDM) to securely scramble employee SSNs and resident financial PII in DEV/QA/UAT/TRN lower environments prior to sandboxes cloning. | Critical | Incomplete | ||
| GATE-DR-001 | Resilience SLA | Production Disaster Recovery SLA: Guaranteed Recovery Time Objective (RTO) < 4 hours and Recovery Point Objective (RPO) < 1 hour for core transactional database core in the event of any outage. | Critical | Incomplete | ||
| GATING ELIGIBILITY RESULT | TOTAL GATING FAILURES: | 0 | ||||
| GATING STATUS: | PENDING - INCOMPLETE |
SLA Matrix
| RFP EXHIBIT 2 - SLA & GRANULAR COMPLIANCE MATRIX | |||||||||
| Bidding platforms must self-certify their compliance across all 28 granular controls and specify implementation classification. | |||||||||
| SLA ID | Compliance Domain | Granular SLA Compliance Control Specification | Risk Severity | Vendor Self-Certification | Delivery Classification | Detailed Explanation & Verification Method | Mandatory Evidence Reference | Remediation Plan (Mandatory for Borderline/Gap) | Status |
| IDENTITY & ACCESS MANAGEMENT (IAM) GRANULAR SECURITY CONTROLS | |||||||||
| SLA-IAM-001 | Identity & Access | Federated SSO Integration: Secure OIDC or SAML 2.0 single sign-on across the Core ERP (Parcel Assessment) and Club Automation CRM. | High | Incomplete | |||||
| SLA-IAM-002 | Identity & Access | Context-Aware MFA: Native multi-factor challenges triggered automatically upon attempts to update vendor bank profiles, SSNs, or General Ledger parameters. | Critical | Incomplete | |||||
| SLA-IAM-003 | Identity & Access | Automated SCIM User Provisioning: Standardized SCIM infrastructure rules for real-time employee lifecycle additions, transfers, and deletions from Dayforce. | High | Incomplete | |||||
| SLA-IAM-004 | Identity & Access | Role-Based Access Control (RBAC): Hardcoded RBAC maps separating accounts payable creators from approvers, and blocking receipt allocators from modifying billing caps. | Critical | Incomplete | |||||
| SLA-IAM-005 | Identity & Access | Session Lifetime Management: Automate user session terminations after fifteen (15) minutes of absolute inactivity to mitigate workstation exposure. | Medium | Incomplete | |||||
| SLA-IAM-006 | Identity & Access | Secure Token Rotation: Enforce secure token refresh limits and dynamic rotative protocols for third-party REST/SOAP gateway authentications. | High | Incomplete | |||||
| PROPERTY & ASSESSMENT BILLING ENGINE COMPLEX EDGE-CASES | |||||||||
| SLA-BIL-001 | Billing Core | Maryland SDAT Flat-File Ingestion: Natively parse, cleanse, and map 2000-byte, 400-field public Maryland SDAT text blocks in under 1 hour. | Critical | Incomplete | |||||
| SLA-BIL-002 | Billing Core | Anomaly Record Filtering: Programmatically intercept, isolate, and route corrupt legacy 'zero-dollar' transactions without crashing billing runs. | High | Incomplete | |||||
| SLA-BIL-003 | Billing Core | Assessment Cap Phase-In Calculations: Calculate board-approved property caps natively in the dynamic billing engine without offline spreadsheets. | Critical | Incomplete | |||||
| SLA-BIL-004 | Billing Core | Abatements & Tax Credits: Automate intake, recalculation, and approval routing of county-issued tax credits directly into property billing records. | High | Incomplete | |||||
| SYSTEMS INTEROPERABILITY & MIDDLEWARE INTEGRATION (iPaaS) | |||||||||
| SLA-INT-001 | Systems Integration | Real-Time Webhook Support: Event-driven webhooks and message queues to ingest and process daily Club Automation Point of Sale postings in under 5 minutes. | High | Incomplete | |||||
| SLA-INT-002 | Systems Integration | Transaction Idempotency Safeguards: Enforce mandatory X-Idempotency-Key headers on all inbound payment endpoints to prevent double-billing. | Critical | Incomplete | |||||
| SLA-INT-003 | Systems Integration | Dead-Letter Queues (DLQs): Persistent, domain-specific DLQs to isolate malformed payloads from main pipelines within < 500ms. | High | Incomplete | |||||
| SLA-INT-004 | Systems Integration | Change Data Capture (CDC): Deploy real-time Change Data Capture replication lines with sync latencies < 10 seconds for cutover. | High | Incomplete | |||||
| SLA-INT-005 | Systems Integration | Ceridian Dayforce HRIS Sync: Ingest Dayforce payroll GL files, benefits, and labor allocations under a strict 15-minute SLA. | High | Incomplete | |||||
| SLA-INT-006 | Systems Integration | Club Automation POS Integration: Direct transaction-level details sync (not summaries) to support granular sub-ledger drill-down. | High | Incomplete | |||||
| ZERO-TRUST CLOUD INFRASTRUCTURE SECURITY CONTROLS | |||||||||
| SLA-SEC-001 | Infrastructure Security | Isolated Cloud KMS Key Management: Isolate all cryptographic keys from database storage layers, with automated annual key rotations under NIST 800-57. | Critical | Incomplete | |||||
| SLA-SEC-002 | Infrastructure Security | Mutual TLS (mTLS): Universally enforce mTLS with TLS 1.3 parameters for all API endpoints and data transits. | Critical | Incomplete | |||||
| SLA-SEC-003 | Infrastructure Security | Centralized SIEM Logging: Record all portal/IVR transactions in centralized, immutable, read-only log repository for 7 years. | High | Incomplete | |||||
| SLA-SEC-004 | Infrastructure Security | Static Data Masking (SDM): Enforce permanent cryptographic masking of SSNs and bank details in lower sandboxes (DEV, QA, UAT, TRN). | Critical | Incomplete | |||||
| SLA-SEC-005 | Infrastructure Security | DTMF Telephony Clamping: Telephony-level DTMF masking to obscure credit card tones from crossing system boundaries during phone checkout. | High | Incomplete | |||||
| SLA-SEC-006 | Infrastructure Security | Privileged Access Management (PAM): Enforce Dual-Authorized break-glass rules and Just-In-Time (JIT) admin session limits of 2 hours. | High | Incomplete | |||||
| Core Operational & Business Process SLAs | |||||||||
| SLA-OPS-001 | Operational Finance & Billing | System tracks refund cycle time metrics from initial overpayment flagging through electronic Treasurer sign-off to automated AP disbursement voucher creation. Verified via UAT audit logs demonstrating sequential workflow routing and peak-season cycle turnaround tracking. | High | Incomplete | |||||
| SLA-OPS-002 | Cutover & Migration Governance | Vendor cutover support operations must provide dedicated ticketing queues enforcing these response and resolution windows. Verified through mock-cutover ticketing response logs and cutover command center runbook sign-off. | Critical | Incomplete | |||||
| SLA-OPS-003 | Core Financials and Accounting | The system must provide automated sub-ledger locking, automated Dayforce payroll accrual ingestion, and real-time trial balance validation. Verified via simulated period-close dry runs tracking total working days elapsed to close ledgers. | High | Incomplete | |||||
| SLA-OPS-004 | Billing & Revenue Operations | Rules-based engine triggers fee application and automated letter generation based on elapsed days from the due date. Verified by automated dunning test scripts demonstrating exact date-trigger progression and mathematical interest accuracy down to the penny. | Critical | Incomplete | |||||
| SLA-OPS-005 | Cloud Infrastructure & Resiliency | Monitored via third-party APM tools and monthly availability reports. Verified by vendor SOC-2 Type II report (Availability trust principle) and historical 12-month platform uptime metrics. | Critical | Incomplete | |||||
| SLA-OPS-006 | Cutover & Migration Governance | Automated schema validation crosswalks, row-count checks, and sub-ledger-to-GL trial balance parity queries. Verified by post-migration trial balance comparison reports showing $0.00 variance on active/MCLA accounts and ≥99.5% accuracy on closed historical data. | Critical | Incomplete |
Integration Depth
| EXHIBIT 3 - VENDOR INTEGRATION DEPTH & TELEMETRY TEST | ||||||
| Bidders must submit verified API logs, transaction payloads, and latency performance metrics to demonstrate target compliance. | ||||||
| TECHNICAL TELEMETRY VERIFICATION INSTRUCTIONS: | ||||||
| 1. Paste complete, realistic JSON or XML payloads in Column G representing actual schema structures for CA integrations. | ||||||
| 2. Submit verified system logs in Column H demonstrating successful end-to-end execution, parsing, and ledger posting. | ||||||
| 3. Declare actual or simulated latency metrics (ms) verifying that synchronous endpoints process requests in under 200 ms. | ||||||
| Test Area ID | Integration Target / Spoke | SLA Performance Target Metric | Declared Response Latency (ms) | Max Concurrency Load (req/sec) | JSON/XML Request Payload Sample (Paste Below) | Verifiable System API Response Log (Paste Below) |
| TEST-INT-001 | Club Automation CRM Link | Webhook Ingestion Latency: < 5 minutes sync | ||||
| TEST-INT-002 | Ceridian Dayforce HRIS Sync | Payroll Accrual Ingestion: < 15 minutes sync | ||||
| TEST-INT-003 | 8x8 PBX / Diagenix IVR | Concurrency Telemetry: 500 req/sec | < 100ms response | ||||
| TEST-INT-004 | Smartsheet CA Support Hub → EAM / Work Order Processing | Webhook ingestion, work order creation, downstream PO/GL update processing < 10 seconds |
System Integrity Audit
| EXHIBIT 4 - INTERNAL SOURCING COMMITTEE INTEGRITY AUDIT | |||
| FOR SOURCING COMMITTEE USE ONLY: Automatically audit and verify the completeness of the vendor's technical proposal inputs. | |||
| AUTOMATED VENDOR COMPLIANCE & INTEGRITY CHECKS | |||
| Audit Check ID | Sourcing Rule & Integrity Target | Calculated Metric Value | Automated Compliance Status |
| AUDIT-CHK-001 | Omitted Self-Certifications: Flag any requirements or gating lines left blank by the vendor. | 34 | ❌ REJECTED - Omitted Answers Found |
| AUDIT-CHK-002 | Unsubstantiated Compliant Claims: Flag fully compliant/configurable claims lacking mandatory evidence in the Gating or SLA Matrix. | 0 | ✅ PASSED |
| AUDIT-CHK-003 | Mandatory Sourcing Gate Disqualification: Flag if the vendor failed any of the 6 core eligibility gates. | 0 | ✅ PASSED |
| AUDIT-CHK-004 | Add-on & Custom Scope Over-indexing: Warn if vendor meets > 30% of compliant scope via costly Add-on Modules or Custom Extensions. | 0.0% | ✅ PASSED - Standard/Native Focus |
| Helper - Total SLA Requirements | 28 | ||
| Helper - SLA Compliance Rate | 0.0% |
File details come from the government source that posted it. Updated .