• Security
  • Integration
  • Accessibility Information
    		•

    Government code




    Download 25,1 Kb.
    Sana26.12.2019
    Hajmi25,1 Kb.
    #5096


    ELECTRONIC AND INFORMATION RESOURCES ENVIRONMENT SPECIFICATIONS

    [INCLUDE THIS DOCUMENT IF CONTRACTOR WILL PROVIDE ELECTRONIC AND INFORMATION RESOURCES AS DEFINED BY SECTION 2054.451, GOVERNMENT CODE:
    The specifications, representations, warranties and agreements set forth in Proposer’s responses to this document will be incorporated into the Agreement.
    University is primarily a [Optional:______________] [Optional: Microsoft products] environment.
    Basic Specifications


    1. If the EIR will be hosted by University, please describe the overall environment requirements for the EIR (size the requirements to support the number of concurrent users, the number of licenses and the input/output generated by the application as requested in the application requirements).

    1. Hardware: If Proposer will provide hardware, does the hardware have multiple hard drives utilizing a redundant RAID configuration for fault tolerance? Are redundant servers included as well?

    2. Operating System and Version:

    3. Web Server: Is a web server required? If so, what web application is required (Apache or IIS)? What version? Are add-ins required?

    4. Application Server:

    5. Database:

    6. Other Requirements: Are any other hardware or software components required?

    7. Assumptions: List any assumptions made as part of the identification of these environment requirements.

    8. Storage: What are the space/storage requirements of this implementation?

    9. Users: What is the maximum number of users this configuration will support?

    10. Clustering: How does the EIR handle clustering over multiple servers?

    11. Virtual Server Environment: Can the EIR be run in a virtual server environment?




    1. If the EIR will be hosted by Proposer, describe in detail what the hosted solution includes, and address, specifically, the following issues:

    1. Descrobe the audit standards of the physical security of the facility; and

    2. Indicate whether Proposer is willing to allow an audit by University or its representative.

    1. If the user and administrative interfaces for the EIR are web-based, do the interfaces support Firefox on Mac as well as Windows and Safari on the Macintosh?




    1. If the EIR requires special client software, what are the environment requirements for that client software?




    1. Manpower Requirements: Who will operate and maintain the EIR? Will additional University full time employees (FTEs) be required? Will special training on the EIR be required by Proposer’s technical staff? What is the estimated cost of required training.

    2. Upgrades and Patches: Describe Proposer’s strategy regarding EIR upgrades and patches for both the server and, if applicable, the client software. Included Proposer’s typical release schedule, recommended processes, estimated outage and plans for next version/major upgrade.



    Security





    1. Has the EIR been tested for application security vulnerabilities? For example, has the EIR been evaluated against the Open Web Application Security Project (“OWASP”) Top 10 list that includes flaws like cross site scripting and SQL injection?  If so, please provide the scan results and specify the tool used. University will not take final delivery of the EIR if University determines there are serious vulnerabilities within the EIR.




    1. Which party, Proposer or University, will be responsible for maintaining critical EIR application security updates?




    1. If the EIR is hosted, indicate whether Proposer’s will permit University to conduct a penetration test on University’s instance of the EIR.




    1. If confidential data, including HIPAA or FERPA data, is stored in the EIR, will the data be encrypted at rest and in transmittal?



    Integration





    1. Is the EIR authentication Security Assertion Markup Language (“SAML”) compliant? Has Proposer ever implemented the EIR with Shibboleth authentication? If not, does the EIR integrate with Active Directory? Does the EIR support SSL connections to this directory service?




    1. Does the EIR rely on Active Directory for group management and authorization or does the EIR maintain a local authorization/group database?




    1. What logging capabilities does the EIR have? If this is a hosted EIR solution, will University have access to implement logging with University’s standard logging and monitoring tools, RSA’s Envision?




    1. Does the EIR have an application programming interface (“API”) that enables us to incorporate it with other applications run by the University? If so, is the API .Net based? Web Services-based? Other?




    1. Will University have access to the EIR source code? If so, will the EIR license permit University to make modifications to the source code? Will University’s modifications be protected in future upgrades?




    1. Will Proposer place the EIR source code in escrow with an escrow agent so that if Proposer is no longer in business or Proposer has discontinued support, the EIR source code will be available to University.

    Accessibility Information





    1. Please complete the Voluntary Product Accessibility Template (“VPAT”) found at http://www.itic.org/index.php?submenu=resources&src=gendocs&ref=vpat&category=resources and submit the VPAT with Proposer’s proposal.]



    Page 1

    Download 25,1 Kb.




    Download 25,1 Kb.