CITY OF PHOENIX POLICE DEPARTMENT REQUEST FOR … 19-102... · RFI ITS 19-102 Law Enforcement...

CITY OF PHOENIX POLICE DEPARTMENT

REQUEST FOR INFORMATION RFI 19-102

LAW ENFORCEMENT RECORDS MANAGEMENT SYSTEM

PROCUREMENT OFFICER Gloria Elliot

251 W. Washington Street, 6th Floor Phoenix, AZ 85003

[email protected]

TABLE OF CONTENTS

CITY OF PHOENIX Information Technology Services

251 W. Washington Street 6th Floor

Phoenix, AZ 85003

RFI ITS 19-102 Law Enforcement Records Management System of 38

SECTION I – INSTRUCTIONS .................................... ERROR! BOOKMARK NOT DEFINED. SECTION II – SCOPE ................................................. ERROR! BOOKMARK NOT DEFINED.

1) BACKGROUND ............................................................................................................6 2) DETAILED INSTRUCTIONS .........................................................................................8 3) BUSINESS .................................................................................................................. 10 4) TECHNICAL ............................................................................................................... 16 5) FEATURES ................................................................................................................. 18 6) REPORTING .............................................................................................................. 19 7) INTERFACES ............................................................................................................. 21 8) OPERATIONAL CAPABILITIES .................................................................................. 22

SECTION III – SUBMITTAL INSTRUCTIONS ............. ERROR! BOOKMARK NOT DEFINED. SECTION IV – APPENDIX .......................................... ERROR! BOOKMARK NOT DEFINED.

SECTION I - INSTRUCTIONS CITY OF PHOENIX

Information Technology Services 251 W. Washington Street

6th Floor Phoenix, AZ 85003


The City of Phoenix Police Department (PPD) is seeking information from software vendors regarding available Commercial-Off-The-Shelf (COTS) technologies for a new Record Management System (RMS) solution since the current RMS has reached the end of its product life cycle. It is also crucial that the new RMS solution is in alignment with current law enforcement and technology strategy for the City of Phoenix (City). The PPD wants to collect information on RMS product offerings that provide an innovative, flexible, and sustainable solution that supports the critical needs of 21st century law enforcement and their justice partners in order to provide superior service for the community they serve. The RMS should be user-friendly, efficient, and intuitive with a comprehensive set of features, functionality, reporting, robust back-office tools, as well as seamless integration with both internal and external systems and applications including but not limited to body worn camera and drone technologies. Furthermore, the RMS solution should consider compliance and alignment with leading industry standards and best practices (e.g., CJIS and LEITSC) in addition to the achievement of certifications and accreditations. The PPD anticipates that updated technology will offer new or enhanced capabilities, more efficient processes including but not limited to electronic records and documents (i.e., paperless), Data Warehouse/Business Intelligence as well as potential use of Artificial Intelligence (AI). The City prefers a cloud-based solution. The PPD needs to obtain relevant and meaningful knowledge about the current vendor landscape in order to get an idea of the features and capabilities of potentially suitable software product solution delivery options and pricing. PPD would also like to gain insight into vendor experiences and successful implmentations that encompass processes including project lifecycle management, development and testing, quality assurance, as well as training and product support. This Request For Information (RFI) is issued as a means of technical discovery and information gathering from vendors that provide product solutions relative to the law enforcement domain. This RFI is for planning purposes only and should not be construed as a competitive solicitation, as an obligation on the part of the City to enter into any contracts or make any purchases. This RFI is not an invitation to pre-qualify vendors. Participation in this RFI is voluntary. The City will not pay for the preparation of any information submitted by a respondent for the City’s use of that information. Any price information provided shall be and will be used for comparison purposes only. Only firms that are the vendors (licensors) of the proposed software solutions should respond to this RFI; the City is not requesting information under this solicitation from 3rd party software implementation or project management firms. Note: Be sure to review the Glossary in Appendix 2 for key terms before proceeding.





1. CITY’S VENDOR SELF-REGISTRATION AND NOTIFICATION Vendors must be registered in the City’s eProcurement Self-Registration System at https://www.phoenix.gov/financesite/Pages/EProc-help.aspx in order to receive solicitation notices, respond to solicitations and access procurement information.

2. SCHEDULE OF EVENTS

Activity Date (All times local Phoenix, AZ time) RFI Issue Date March 4, 2019 Written Inquiries Due Date March 14, 2019 7:00 a.m.

[email protected] Email Subject: RFI 19-102, Inquiries

RFI Due Date April 8, 2019 7:00 a.m. [email protected] Email Subject: RFI 19-102, Submittal

RFI Submittal Location [email protected] Figure 1 – RFI Schedule of Events

The City reserves the right to change dates and/or locations as necessary, and the City does not always hold a Pre-Offer Conference or Site visit.

3. OBTAINING A COPY OF THE SOLICITATION AND ADDENDA

Respondents may download the complete solicitation and addenda from https://www.phoenix.gov/solicitations. Internet access is available at all public libraries. Any interested respondents without internet access may obtain this solicitation by calling the Procurement Officer or picking up a copy during regular business hours at the City of Phoenix ITS Department, 251 W. Washington Street, 6th Floor, Phoenix, AZ. It is the Respondent’s responsibility to check the website and verify all required information is submitted with their offer.

4. INQUIRIES:

All questions that arise relating to this solicitation should be directed via email to the Procurement Officer and must be received by the due date indicated in the Schedule of Events. The City will not consider questions received after the deadline. No informal contact initiated by Respondents on the proposed service will be allowed with members of City’s staff from date of distribution of this solicitation until after the closing date and time for the submission of responses. All questions concerning or issues related to this solicitation must be presented in writing. The Procurement Officer will answer written inquiries in an addendum and publish any addendums on the Procurement Website.

5. PUBLIC RECORD:

All documents submitted in response to this solicitation will become the property of the City and become a matter of public record available for review pursuant to Arizona State law. If a Respondent believes that a specific section of its response is confidential, the Respondent will isolate the pages marked confidential in a specific and clearly labeled section of its response. A Respondent may request specific information is treated by the Procurement Officer as confidential provided the Respondent clearly labels the information “confidential.” To the extent necessary for the evaluation process, information marked as “confidential” will not be treated as confidential. Once the procurement file becomes available for public inspection, the Procurement Officer will not make any information identified by the Respondents as “confidential” available to the public unless necessary to support the evaluation process or if

https://www.phoenix.gov/financesite/Pages/EProc-help.aspx

mailto:[email protected]



https://www.phoenix.gov/solicitations





specifically requested in accordance with applicable public records law. When a public records request for such information is received, the Procurement Officer will notify the Respondent in writing of any request to view any portion of its response marked “confidential.” The Respondent will have the time set forth in the notice to obtain a court order enjoining such disclosure. If the Respondent does not provide the Procurement Officer with a court order enjoining release of the information during the designated time, the Procurement Officer will make the information requested available for inspection.

6. ADDENDA

Any changes to the plans, drawings and specifications will be in the form of an addendum, which will be available at: https://www.phoenix.gov/solicitations

7. WITHDRAWAL OF SUBMITTAL At any time prior to the RFI due date and time, a Respondent (or designated representative) may withdraw the Submittal by submitting a request in writing and signed by a duly authorized representative.


SECTION II - SCOPE



Phoenix, AZ 85003


1) BACKGROUND Phoenix is the capital and largest city in the state of Arizona and the fifth-most populous city in the United States. Phoenix has over 1.6 million residents in an area covering about 517 square miles. It is located in the south-central part of Arizona in Maricopa County, the fourth-most populous in the United States. It was settled in 1867 as an agricultural community near the confluence of the Salt and Gila Rivers. Phoenix incorporated as a city in 1881. The PPD uses a heavily customized and configured vendor product RMS, which was implemented in October of 2015. RMS supports approximately six-thousand users, provides interfaces1 with justice system partners, agencies, companies, and/or applications, supports real time access to over twenty law enforcement agencies and stores approximately four terabytes of data. Access to the RMS requires CJIS compliance and/or the successful completion of a maximum security background screening along with achievement of Terminal Operator Certification (TOC). Information Technology Services (ITS) coordinates the use of information technology across the various departments and agencies of Phoenix city government. The department also manages the city's radio, telephone, and enterprise computer network systems, and community outreach regarding information security and privacy. In the year 2017, the PPD Communications Bureau answered about 1.21 million 9-1-1 calls (~ 3,300 calls per day) and about 1.01 million non-emergency calls (~ 2,800 calls per day) which are called Crime Stop. In 2017, Central Dispatch dispatched approximately six hundred eighty-seven thousand (~ 687K) calls for service. PPD enforces state laws, passed by the Arizona state legislature that includes but is not limited to ARS § Title 13, Criminal Code and ARS § Title 28, Transportation), Phoenix City Codes; as well as local ordinances, and some Federal laws. PPD is also guided and/or constrained by the Arizona Criminal Justice Information System (ACJIS), Department of Justice (DOJ), and the Department of Homeland Security (DHS). PPD is considered an “interface agency” to the Arizona Department of Public Safety (DPS) and the Federal Bureau of Investigation (FBI) CJIS Division and is therefore subject to rules and regulations imposed by those agencies. PPD also shares or exchanges information with the Phoenix Municipal Court (PMC), Phoenix Prosecutor’s Office (PPO), Maricopa County Sheriff’s Office (MCSO) and Maricopa County Attorney’s Office (MCAO) along with other partners. Lastly, PPD is aligned with their Police Strategy Plan (2017-19) and must adhere to the Police Operations Orders (i.e., Police Policy).

1 Note: See Current Interfaces in Appendix 1 for detailed information about current interfaces including eCHRIS integration for provisioning of city employees and other authorized individuals.

https://www.azleg.gov/arsDetail/?title=13

https://www.azleg.gov/arsDetail/?title=28

http://www.codepublishing.com/AZ/Phoenix/html/pdfs/Phoenix36.pdf

http://www.codepublishing.com/AZ/Phoenix/html/pdfs/Phoenix36.pdf

https://www.phoenix.gov/policesite/Documents/police_stratigic_plan_2017-2019.pdf

https://www.phoenix.gov/policesite/Documents/operations_orders.pdf

SECTION II - SCOPE



Phoenix, AZ 85003


Phoenix Police Department at a Glance: 911 Dispatch Centers 2 Police Precincts & HQ 7 # of Authorized Sworn Positions 3,272 # of Authorized Sworn & Civilian Positions 4,323 Population Served 1.6 MM Square Miles Covered ~520 Mobile Data Computers (MDC) 1,400 Note: Figures above are as of August 2018. Total 9-1-1 Call Received 1.21 MM Total Non-Emergency Calls Received 1.01 MM Calls For Service (Dispatched) 686.4 K # of Incident Reports 168.6 K # of Supplement Reports 235.8 K # of Field Interview Reports 82.3 K Accident Reports 34.0 K Arrests and Bookings (Adults & Juveniles) 54.2 K # of Citations:

NOV (Parking Tickets) ATTC (Civil and Criminal Tickets)

53.0 K 23.0 K

Note: Figures above are for 2017. Figure 2 - Phoenix Police Department by the Numbers

SECTION II - SCOPE



Phoenix, AZ 85003


2) DETAILED INSTRUCTIONS Any vendor choosing to respond to this RFI must complete the RFI Response Worksheet template. The RFI Response Worksheet includes a Cover page, Table of Contents, and Instructions TAB along with TABs that correspond to Sections 3 through 8 contained within this document. The template was designed to aid each respondent in collecting their responses in a more organized, efficient and standardized manner. Each TAB is laid out in the same format except for the PRC (Pricing) TAB since it is collecting different information. Please record your responses in each TAB of the RFI Response Worksheet for each RFI Item listed in Column E. Each RFI Item is either a request for type of information (Ex., Company profile) or a request to explain or describe whether a capability (Ex., List and explain each search capability offered) is being offered in your proposed solution. Please complete the following items, as applicable, in the RFI Response Worksheet for each RFI Item:

� If an RFI Item pertains to a feature, capability or function, reporting, interface, or operational capability then select one choice from the Availability drop-down list of choices in Column F, otherwise it may be considered ‘Not Applicable’. Select the Availability Value in Figure 3 that best matches your solution

Availability Value

Description

0 Capability is not currently available and no plans to provide in future release.

1 Capability is currently available and have no plans to enhance in future release.

2 Capability is currently available and have plans to enhance in future release.

9 Not Applicable, if response is not relevant. Figure 3 – Availability Value

� If an RFI Item pertains to a feature, capability or function, reporting, interface, or

operational capability then select one choice from the Capability drop-down list of choices in Column G, otherwise it may be considered ‘Not Applicable’. Select the Capability Value in Figure 4 that best represents your solution

Capability Value

Description

0 Capability provided Out Of The Box (OOTB). 1 Capability provided as a Configuration option managed by the Customer. 2 Capability provided as a Customization option managed by the Vendor. 3 Capability provided as a Configuration or Customization option jointly

managed by the Customer and Vendor. 9 Not Applicable if response, is not relevant.

Figure 4 - Capability Value

SECTION II - SCOPE



Phoenix, AZ 85003


� Most every RFI item will require an entry in Response in the form of a brief or detailed explanation, as applicable, in Column H. In a few cases this may instead be a response of ‘Yes/No’ or other selection from a corresponding drop-down list of choices (e.g., Phone Type)

� For any RFI Item, if you plan on attaching one or more reference documents, then please list the actual filename in Reference(s) in Column I. Ex., charts, flows, diagrams, models, graphics, etc.

� Optionally and as appropriate, enter Additional Comments in Column J

The respondent may optionally choose to provide any combination of product brochures or marketing materials, technical manuals or diagrams, demonstration videos illustrating functionality as described in the RFI, screenshots, and sample reports, which the PPD may review as needed.

SECTION II - SCOPE



Phoenix, AZ 85003


3) BUSINESS The City would like to gain a clearer understanding of your company, its background and history, as well as the business outlook. This section will cover your company profile, prior achievements and your future roadmap, professional services/service model, software development and quality assurance, integration services, project schedule/implementation approach, training, product support, audits, and pricing/licensing model. INSTRUCTIONS: Please record your responses on the BUS (Business) TAB of the Vendor Response Worksheet for each of the RFI Items in Column E, EXCEPT FOR those in section 10 which should be recorded on the PRC (Pricing) TAB: 1. COMPANY PROFILE

a. Company name, address, phone number, fax number, and web address b. A brief description of the company, date established, type of ownership, products

and services offered, business size (i.e., total revenue and number of employees), and all office location addresses

c. Last three years of financial data and outlook d. Description of company operations including the number of years the company has

been supporting the proposed solution e. Location of main office, from which, the effort to deliver your proposed solution will

be managed f. A description of the company’s general business strategy and areas of expertise as

they relate to the scope of this RFI g. For each point of contact provide their full name, position or title, years of

employment, address, preferred phone number, and email address h. State whether your company is currently involved in any litigation

i. If so, describe the nature of the litigation and its potential impact on current product delivery and future roadmap

i. State whether your company has been unable to complete a contract, been removed from a contract, or been replaced during a contract period in the past five (5) years i. If so, explain what happened and why

j. Explain how much your company spends on research and development with respect to their proposed solution and with respect to Public Safety technologies in general

2. PRIOR ACHIEVEMENTS & ROADMAP a. Aside from your proposed solution describe any other discrete Public Safety

products or modules that you offer which could be easily integrated i. If so, please list and explain (e.g., CAD, Citation, Crash (Accident) Report,

Chain of Custody, Property Tracking System (PTS), Pre-Booking/Booking, etc.)

b. Identify your experience with clients of similar size and scope to the City of Phoenix that have successfully completed and implemented your proposed product solution within the last three years, preferring a minimum of three, if possible. Provide the following client/project information: i. Name of client including key contact information ii. Size of agency including annual number of calls for service, licensed users,

and other key metrics iii. Project scope and specify modules/applications and interfaces implemented iv. High-level timeline for project implementation, from contract signing to

customer acceptance. Explain if implementation was completed on schedule,

SECTION II - SCOPE



Phoenix, AZ 85003


within budget, any project goals that were not met and why. Describe any efficiencies or cost savings realized by the client

v. Explain how implementation performance (i.e., Key Performance Indicators) was measured against a baseline

c. Explain if you have any public sector clients that initiated implementation projects for the solution in the past 3 years but terminated work prior to implementation

d. List and describe ‘law enforcement’ best practices that have been or will be delivered e. Provide a list of standards and best practices that are actively followed along with

the first year, in which, they were adopted (Ex., LEITSC, 2014.) f. Provide a list of accreditations and certifications that were achieved along with the

year and explain if your solution has been vetted by the Arizona Department of Public Safety (DPS) and is CJIS compliant

g. If applicable, explain your current ITIL maturity model rating h. Explain if your organization includes a data governance group or business area i. Describe the lifecycle of your proposed solution, its history, current state, and

roadmap with milestones for the future j. Explain the number of and largest customer that you have had that are NIBRS

compliant (i.e., they have successfully achieved and sustained the minimum accuracy metrics threshold for the requisite certification period) i. For your largest customer, describe the impact to its agency and staff of our

size to achieve and support NIBRS compliance including the estimated number of support team resources

k. Explain the general availability (GA) date of your solution, the first customer ship (FCS), and the projected end of life

3. PROFESSIONAL SERVICE(S) MODEL a. Identify and describe your service model provided and supported, whether on

premise or off-premise including Software-as-a-Service (SAAS) models. If you offer an ‘on premise’ solution or solution option, then please answer the following: i. Explain if your solution leverages Oracle on Exadata and Microsoft SQL

clustered databases in a customer on-premise architecture 1. List and explain other non-proprietary database options supported for

your solution 2. Provide configurations supported by your solution and configurations not

supported, as well as versions 3. Explain if your solution supports tertiary systems in the cloud

ii. Explain if your solution supports, or is certified for operation on a server virtualized VMWare x86, VMWare vSphere Metro Storage Cluster (VMWare vMSC), Windows, Redhat Linux customer on-premise architecture: 1. Provide versions supported with your latest product release 2. Specify which operating system are predominantly used by other

customers, and which ones you provide the great degree of support b. Supplement your response to this request with an interoperable architectural

diagram outlining each Open Systems Interconnection (OSI) layer requirement for enablement, sustainment, reliability, redundancy, and growth

c. Describe the different levels or options of product and technical support offered for your solution. Define the different support levels (e.g., 24/7/365, 24/7 Monday-Friday, holidays, etc.) offered

d. Explain your staffing and support model process and plan e. Explain your staff job descriptions, qualifications, and alignment with bill rates

SECTION II - SCOPE



Phoenix, AZ 85003


f. Explain resource availability to develop, test, implement, and support your solution g. Explain your level of staff readiness in terms of CJIS compliance (e.g., background

checked, fingerprinted, etc.) h. Explain your system administrative role options that can be assigned to City support

staff for the application, database, and system configuration setup, etc. i. Explain the minimum skill sets required to perform system administration tasks

4. SOFTWARE DEVELOPMENT & QA

a. Describe the System Development Life Cycle (SDLC) methodology adopted for software development and post implementation support for your solution including project management, requirements and requirements traceability, quality assurance and control, application code reviews, testing and application penetration testing including remediation duration, implementation, documentation and training

b. Describe what quality assurance, checks, and controls are in place and for how long c. Describe overall testing approach and types of testing conducted before handing off

for User Acceptance Testing i. If applicable, list and describe automated testing tools (e.g., Mercury Load

Runner, Stress Runner) used for your solution d. Explain if your solution collects sufficient information to satisfy the Uniform Crime

Reports (UCR), National Incident-Based Reporting System (NIBRS) and monthly federal and state summary-level reporting requirements i. If version is applicable, then which version

e. Describe your overall change management process and also specifically in regards to the development and implementation of new mandated changes (e.g., Changes to Federal, State, County, or City laws and ordinances that potentially impact PPD)

f. Describe the process to collect, prioritize and manage changing requirements g. Describe the process and timelines for standard application changes that are

requested by each customer and how they are prioritized h. Provide anticipated ongoing software maintenance and support services required to

sustain the solution including estimated timeframes to complete i. Identify whether software upgrades are included in the maintenance offering ii. Explain the number of anticipated upgrades over an annual period iii. Describe the frequency of releases and whether release notes are provided iv. Provide your most recent copies of a release schedule and release notes

5. INTEGRATION SERVICES

a. Describe any 3rd party integrators or other professional services that would be required during an implementation of your solution i. If so, explain how you manage that relationship and process

b. Explain if your proposed system is typically supplemented by add-on software i. If so, explain what functionality is provided by the add-on software, and what

interfaces are required c. Describe and provide examples of, not only implementing the core solution, but also

developing other complimentary applications to meet all of the business requirements described in this document i. Identify any work completed by a 3rd party

d. Describe if your solution provides electronic access to reference materials such as maps, general orders, legal source book, penal codes, city-provided materials, etc.

6. PROJECT SCHEDULE/IMPLEMENTATION APPROACH

SECTION II - SCOPE



Phoenix, AZ 85003


a. Provide an overview of your implementation approach including the project management process

b. Provide a typical project schedule. Assume an implementation that includes replacing the functionality described for the existing RMS application including all system integrations

c. Describe options for a phased implementation, and how changes to the phasing affect the project budget

d. Explain which key variables may affect your project scheduling e. Explain how customizations are managed and incorporated into your core product f. As part of the project schedule options discussion, describe your migration process

and any special considerations to ensure the existing application and database integrity is maintained. This process should describe the migration for all existing data and applications. Define roles and responsibilities for tasks associated with this process

g. Describe the number of and roles that the City resources would be expected to provide for each stage of the project

h. Provide an implementation timeline with data conversion/migration approach i. Explain what recommendations you might make on how PPD should manage

organizational changes

7. TRAINING a. Describe your training approach and plan options for new clients and users that are

a highly mobile work force in order to minimize their ‘down time’ i. Provide a matrix of classes, hours for each class, course list by discipline or

application module b. If Computer Based Training (CBT) classes are available, provide a catalog and costs c. Explain if your training allows for deployment to or integration with any Learning

Management Systems (e.g., Moodle) used by PPD d. Describe the classes available for system administrators, including PPD RMS

support staff that will be using the solution’s business configuration tools and developing applications using API’s (Application Programming Interface) or SDK’s (Software Development Kit)

e. Explain if your solution includes 1) a provision for a User Guide, 2) Online User Help, 3) Implementation and technical documentation (Ex., API or SDK Guide)

f. Explain the scope of your technical documentation (i.e., off-the-shelf, implementation specific, or customized based on customer configuration)

8. PRODUCT SUPPORT a. Explain your product warranty and warranty period policy b. Explain whether local support and/or onsite support is needed by your firm to

maintain the system. It is the City’s expectation that no maintenance activities will impact system uptime or disrupt the production environment

c. Explain the estimated number of positions directly assigned full-time to exclusively support the development and maintenance of your solution

d. Explain the number of positions available on an ‘as-needed’ basis for production support, both before and after implementation

e. Explain whether a product help desk is in place, help desk hours and number of positions assigned for each shift

f. Explain if you offer a provision for a Service Level Agreement (SLA) for periodic solution maintenance and help desk support

SECTION II - SCOPE



Phoenix, AZ 85003


i. If so, describe or identify the section in the contract in which they are detailed g. The amount of effort required to maintain and enhance application in production

should conform to an "agreed to" level of service within an SLA between the vendor and the City PPD. Explain the frequency of your maintenance cycles and how customers are informed of future outages

h. Explain if your solution includes a provision for system availability metrics/dashboards, the methodology for calculating your metrics, and what exceptions are granted when calculating your metrics

i. Describe the pre and post implementation support provided by your company including: i. Prioritization and response times to calls for support ii. Escalation process for calls for support iii. Explain how your firm’s SLA works for system defects and problem resolution iv. Explain if you have a standing user group that provides input on product

upgrades or enhancements j. Explain your organization’s current capability maturity model level and future

roadmap

9. AUDITS a. Describe if your company is ISO 27001 cybersecurity training certified for your

solution i. If so, explain how often and ii. the date of the last certification

b. Describe if your company has completed an audit for ISO 27002 security technique for your solution i. If so, explain how often and ii. the date of the last audit

c. Explain your approach to cyber security risk and incident response management d. Explain if your company completed any other 3rd party industry audits for your

solution (e.g., Federal Information Processing Standards Publications (FIPS), Sarbanes-Oxley (SOX), Federal Risk and Authorization Management Program (FedRAMP), etc.) i. If so, provide the name of the firm ii. Provide a copy of the last two years of audits and/or submittals, if possible

e. Explain if you follow information security best practices, such as those outlined in National Institute of Standards and Technology Cybersecurity Framework 800-53 (NIST/CSF) or similar standard i. If so, identify the standard and ii. when the last 3rd party audit was performed iii. Provide a copy, if possible

f. Explain if you have written information security policies that, at a minimum, govern issues such as information handling, systems hardening, user awareness training and incident response i. Provide a copy, if possible

g. Describe your privacy breach notification/incident reporting procedures for Personally Identifiable Information (PII)

h. Explain if you have a formal written incident response plan i. If so, provide the last time it was tested

i. If you are providing a cloud solution, then explain your cloud compliance i. Provide a copy of your SSAE 18 SOC 2 level 2 report, if possible

SECTION II - SCOPE



Phoenix, AZ 85003


10. PRICING/LICENSING MODEL a. Include a general pricing model and estimate for software based on the information

provided in this RFI. This pricing should also indicate the software licensing model, and descriptions of the hosting models available and estimates of associated pricing. Note: Respondents will not be bound by any pricing estimates included in responses to this RFI.

b. This pricing is requested for informational purposes only. This is estimated pricing and is intended for budgetary purposes and will not be considered a firm fixed price: All required hardware, software, interfaces, data conversion, training and professional services inclusive of Rough Order of Magnitude (ROM) budgetary estimate breakdown

c. Provide a Bill of Material (BOM) for the costed solution taking into consideration sizing, # of transactions, etc.

# Estimated Pricing Year One

Year Two

Year Three

I INITIAL INVESTMENT 1 On Premise Software

• Assume an implementation that includes replacing the existing RMS functionality. Include any 3rd party licensing required if applicable.

• Base this cost estimate on licensing 4000 users. (identify the licensing model)

2 Hardware Purchase Provide cost estimates for all required hardware for an ‘on premise’ solution.

3 On Premise Services Full implementation and all related services to migrate the existing data. (Data migration includes all existing data and applications)

4 Training Include cost estimates for system administrators, users, and any CBT’s.

5 Interface Development Cost Estimates Provide an hourly rate estimate for professional services by role.

6 Storage Costs Estimates 7 On Premise - 3 Year estimated TCO II ANNUAL OPERATING COST ESTIMATES 1 On Premise Annual Software

Maintenance/Licensing

2 On Premise Annual Hardware Maintenance Cost Estimate

III CLOUD SOLUTION OPTIONS 1 Cloud Solution - SaaS

• Base this cost estimate on 4000 subscription users

• Hosted data base

2 Cloud Solution Services

SECTION II - SCOPE



Phoenix, AZ 85003


# Estimated Pricing Year One

Year Two

Year Three

Installation and all related services for 4000 users/hosted application and database

3 CLOUD SOLUTION ANNUAL MAINTENANCE 4 Cloud Solution - 3 Year estimated TCO IV ALTERNATE SERVICE OPTIONS 1 Provide high level budgetary options for other

services offered (if applicable) including IaaS and PaaS

4) TECHNICAL

The City would like to understand your company’s capabilities when it comes to the technology on which your proposed solution or solutions can be delivered. This includes software model, infrastructure options and information, database options, integration & Service Oriented Architecture (SOA), Software As A Service (SAAS), delivery of high availability solutions, and Security protocols. The City expects the vendor to identify all hardware and system software (i.e., operating system software and database management system software) required to implement your solution with optimum performance. All proposed hardware and system software should be non-proprietary, commercial off the shelf. The City will procure the hardware and system software based on the vendor’s recommendations. The City has an existing agreement with HP, and requires three months’ lead-time for ordering hardware. The City prefers a cloud-based solution. INSTRUCTIONS: Please record your responses for this section on the TECH (Technical) TAB of the Vendor Response Worksheet for each of the RFI Items below. 1. SOFTWARE

a. Describe your software licensing model (i.e., licensing by individual named user, concurrent user, by core, by seat, by role, etc. i. Explain if the licensing is a tiered pricing model

b. Describe the solution’s applications development environment c. Describe the available API’s, SDK’s or similar application integration tools used to

facilitate data exchanges d. Describe the solution’s integration options with internal and external applications

i. Provide a list of options previously implemented such as .NET, Java, XML, etc.

e. Describe the release, patching and update process for the product, include information on the timing and major revision support

f. Explain your options that are available to support development, staging, user acceptance testing, training, and production environments

g. Provide a complete list of any 3rd party software that is required to implement your solution

h. If your solution is a web application, then describe and explain the web platform used (e.g., IIS, Apache, etc.)

2. INFRASTRUCTURE Describe infrastructure capabilities for an ‘on premise’ and/or a SaaS solution, as applicable, for each question:

SECTION II - SCOPE



Phoenix, AZ 85003


a. Describe the infrastructure architecture for the network, end user devices (e.g., hardened laptops, desktops, smart phones, tablets, etc.), server, storage, and operating systems that comprise the solution including architectural diagrams

b. Describe the data center(s) that would support the solution including location and the redundancy and high availability architecture design (SaaS)

c. Describe whether solution is delivered in an on premise and/or Cloud based architecture (e.g., Microsoft Azure Government or Amazon Cloud) i. Also, please describe whether the solution is operationally supported as

Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or SaaS d. Explain the Internet connectivity bandwidth requirements for connectivity between

the customer’s corporate network and the vendor’s solution in the cloud (SaaS) e. Explain if there are special network requirements (i.e., LAN or WAN) for optimal

operation of this solution i. Describe the network design requirements to ensure latency does not impact

system response in both a hosted and ‘on premise’ environment f. Describe how your solution provides security safeguards to help protect the

confidentiality, integrity, and availability of City information and systems when conducting City business if it is using cloud computing

g. If the product is hosted remotely, describe the data retention, data backup and disaster recovery approaches, and identify typical system availability periods (i.e., remotely-hosted systems typically available 24 hours per day, 365 days per year)

3. DATABASE a. Provide a description of the solution’s database platform and interface capabilities b. Explain the database versions, and patch levels supported by the solution(s) as of

February 1, 2019 i. Include a sequence of preferred databases supported by the vendor based on

the most stable and best performing and certified platform for the solution c. Explain the database CPU and memory resource requirements for initial

configuration i. Please include an architectural diagram that illustrates the database

architecture d. Explain what file standards are in place for database server files and if Oracle

Automatic Storage Management (ASM) is supported e. Describe the procedures for initially building and configuring a database to support

the solution f. Please provide any installation documentation or standard operating procedures g. Explain if your solution supports Open System Architecture allowing for access to

as many regional information sources as possible h. Explain if your database adheres to Global Justice Extensible Markup Language

(GJXML) and Open Data Base Connectivity (ODBC) standards and has a documented, accessible schema

i. Explain the degree and capability of database extensibility that your solution offers

4. INTEGRATION & SOA a. Explain if your solution can leverage an existing customer on premise Active

Directory services to authenticate employees to the system b. Explain if your solution can support multiple alternate authentication repositories to

support authentication of employees that reside in different Active Directory forests

SECTION II - SCOPE



Phoenix, AZ 85003


c. Explain if your solution has an import/export feature capability at the application level, above the database layer and through the application interface

d. Explain how your SOA capabilities achieve to interface and exchange data with other systems (e.g., SAP, PeopleSoft, systems and their respective databases – MS-SQL, Oracle) i. Please describe whether the solution comes with these capabilities or whether

other tools would be needed

5. SAAS. Note: This section only needs to be completed by vendors offering SaaS. a. Describe your company’s policy for handling the customer’s intellectual property b. Provide contactable references from other government agencies that presently are

using your SaaS offering c. Explain if there are metrics for the customer to measure consumption of services,

such as bandwidth d. Describe the process or options for interfaces to other applications in a SaaS

environment e. Explain if there are options for exporting data from the SaaS solution for external

interfaces f. Explain how vulnerability management is provided within your solution

6. HIGH AVAILABILITY

a. Describe how your solution’s capability for high availability and recoverability between two data centers, located eight miles away from one another, is achievable to assure officers that the RMS solution would be highly available if one of the data centers went offline

b. If a SaaS solution is implemented, describe how to ensure the availability of the application and our information in the cloud services. For example, describe the disaster recovery/business continuity program (SaaS)

c. Describe any backup systems or alternate business processes that allow work functions to continue while the system is down or network is unavailable i. Explain if these services provided as part of the standard offering

d. Describe any specific instances of down time experienced by your customers exceeding two hours during the past five (5) years i. Describe the issues and the resolution ii. Describe what steps were undertaken to ensure the resiliency of the

application moving forward

7. SECURITY a. Provide a narrative and any other artifacts (e.g., diagrams) and techniques that

convey measures taken to ensure compliance with CJIS and PII needed in a Public Safety RMS solution

b. Explain your application vulnerability management and remediation model c. Explain how vulnerability management is provided in your SAAS and cloud-based

solution, as applicable Note: Refer to Security/Access Control sub-section in Operational Capabilities

5) FEATURES In this section, the City has identified key features that it is looking for in a solution which are listed in Figure 5 below. These key features are considered critical to the PPD and therefore we will be looking for ‘best of breed’ level of capabilities.

SECTION II - SCOPE



Phoenix, AZ 85003


INSTRUCTIONS: Record your responses for this section on the KEY FEAT (Key Features) TAB of the Vendor Response Worksheet for each of the RFI features in Figure 5 below. Please be sure to list and clearly explain each capability associated with a given feature that is provided by your solution in the Response column on the workbook. Be sure the explanation covers current and future plans. You are encouraged to add other features available in your solution that are not listed by inserting additional rows in the section labeled ‘Other Key Features’ at the bottom of the TAB.

Data/Records Reporting � Search/Advanced Search � Additional Master Indices � Standard Reporting � Mobile Access & Entry (FBR) � Address Records � Ad Hoc/Custom Reporting Police Reports � Master Name Index � Crime Analysis Reporting � Arrest & Booking � Master Vehicle Index � Data Warehouse Integration � BOLO � Missing Persons � Dashboard/KPI Reporting � Building Check � Offender Records Operational (non-Features)* � Calls For Service (CFS) � Audit & Control � Citations � Fingerprinting � Security � Field Interviews � Internal Affairs � Usability � Forensic � Mugshot & Digital Imaging � Outage (Business Continuity) � Impaired Driver Reporting

(IDR) � Protection Orders & Restraints � Disaster Recovery

� Incident Rpt � Subpoenas � Other Operational Capabilities � LEOKA Rpt � Victims’ Rights/Notifications � Notice of Violation (NOV) � Form IV/Form IV-(c)2 � Pawn � Warrants Backoffice Tools � Supplement Rpt Tracking � Forms & Content Management � Accident (Crash) Rpt � Abandoned Vehicles Tracking � Correspondence Management � Use of Force/Injured Prisoner

Rpt � Denied Firearm Purchase

Tracking � Version History

� Permit & License Tracking � Workflow Management � Special Skill Tracking � Template Management Management Logs � E-Document Management � Equipment & Asset

Management � Coroner Log � E-Signatures

� Fleet Management � Document Release Log � System Administration* � Investigative Case

Management � Follow-up Log � Juvenile Contact*

� Offender Management & Tracking

� Integrated Dist/Pros Atty Case Log � Officer Notification

� Property & Evidence Management

� Patrol Activity Log � Personnel

� Stolen Vehicle Log � Towing Services Log

Figure 5 – Key Software Features for the PPD * denotes ‘Operational Capability’ in Section II-8, Operational Capabilities

6) REPORTING

With respect to reporting, the City would like to understand your company’s capabilities for the delivery of Out Of The Box (OOTB) or a standard set of reports, capabilities associated with ad-

2 Form is specific to the state of Arizona

SECTION II - SCOPE



Phoenix, AZ 85003


hoc and custom report building, crime analysis reporting and metrics, as well as other general reporting features. INSTRUCTIONS: Record your responses for this section on the RPTG (Reporting) TAB of the Vendor Response Worksheet for each of the RFI Items below. 1. STANDARD REPORTING

a. List and describe your capability to provide standard OOTB reports for operational, managerial, and executive levels of reporting. Note: PPD would be interested in the following report types: Incident, Accident, Property/Evidence, Citation, Field Interviews, Uniform Crime Reporting (UCR)/National Incident-Based Reporting System (NIBRS), Offender History, Case Management, Billing, and Summary Reports (for Warrants, Citations, Call For Service (CFS), Traffic Accidents, and Employees) at a minimum

b. Explain the scope covered by your standard OOTB reports with respect to the operational needs of officer’s and agency-wide activity or performance in a given area

c. Explain if your capability allows authorized personnel to generate standardized reports and aggregate reports

2. AD HOC/CUSTOM REPORTING a. Describe your capability to provide ad hoc tools or templates that permit authorized

personnel to create their own reports based on available database tables and data elements

b. Explain your report design-creation-publishing methodology. Explain if it allows for advanced and flexible query and search capabilities through a user-friendly, ad hoc reporting facility

c. Explain if your solution supports templates or “widgets” to provide users the capability to create dashboards that are updated real-time

d. Describe the solution's native reporting and analytics capabilities and/or interoperability with the City's Oracle Business Intelligence Enterprise Edition (OBIEE)

e. Describe your solution capability to interface with externally hosted portals by Open Data vendors i. List vendor partners ii. Describe statistics provided, standard and custom Key Performance

Indicators (KPI), and other details available to users iii. Detail your plans to present information on these commercially hosted

systems f. Explain if your solution provides an extensive library of the most commonly used

reports, as well as a shared library built by user-submitted reports

3. CRIME ANALYSIS REPORTING a. Explain if your solution is certified to exchange crime statistics with the state and

federal government b. Provide a general description of your process of reviewing, correcting, and

reporting crime statistics c. Explain if your solution supports crime analysis by collecting, collating, analyzing,

and disseminating timely, accurate, and useful information that describes patterns, trends, problems, and potential suspects in criminal activity

SECTION II - SCOPE



Phoenix, AZ 85003


d. Explain if your solution supports the tools used by the analyst in this work, subdivided into four categories i. Tactical (pertaining to deployment and arrest tactics) ii. Strategic Analysis (long range problems) iii. Administrative (supports administrative decisions) iv. Forecasting (blend of tactical, strategic, and administrative analysis)

e. Explain if your solution provides case assignment, caseload comparison, case management monitoring, and case status reporting capabilities

f. Explain if and how your solution is able to support custom reporting/analysis/data exploration via Crystal Reports, Oracle SQL Developer, IBM I2 Analyst Notebook, ESRI ArcGIS, SPSS, and other applications frequently utilized by analysts and investigators

4. OTHER a. Explain your capability with respect to report output type options (e.g., PDF, XLS,

CSV, XML, etc.) b. Explain your best practices regarding report usability and formatting (i.e., unique

report number and/or title, print date, page numbering, etc.) c. Describe any capability you provide with respect to automatic or manual digital

redaction (i.e., search and removal or masking of PII data such as date of birth, social security number, etc.)

d. Explain how your solution ensures that published reports are not editable (e.g., unfillable or alterable once finalized)

e. Explain if and how your solution supports and provides data warehouse and data mining capabilities for Business Intelligence (BI) and dashboard reporting

7) INTERFACES

The City would like to gain an understanding of the capabilities of the solution with respect to system interfaces (e.g., the exchange of data and documents between systems, both inbound and outbound). The current RMS interfaces will need to be replaced by the new solution. The PPD RMS passes to and/or receives from these other critical systems, data and/or document files (e.g., Citation data and PDF’s). INSTRUCTIONS: Record your responses for this section on the I-F (Interfaces) TAB of the Vendor Response Worksheet for each of the RFI Items below.

1. FILE FORMATS AND TYPES

a. List all the types of file interface or data exchange options that are available with your solution

b. Explain if your solution has the capability to support DAT, CSV, TXT, PDF, JPEG, XML and other commonly used file formats or files types i. If it includes other options, please list and explain

2. SCHEDULING

a. For file interfaces that need to be executed on a regularly scheduled basis, explain what scheduling tool is used and describe its capabilities

b. Explain how your solution ensures that files are delivered and received as scheduled

3. OTHER

SECTION II - SCOPE



Phoenix, AZ 85003


a. Explain how your solution ensures that all records that were ‘sent’ have been ‘received’ with no data loss

b. Explain if your solution utilizes standard data communications protocols and message formats

c. Explain how the solution communicates issues with files not being delivered at all or on time. Explain your capabilities if and when error conditions are encountered (e.g., Not all records sent. Hash totals not reconciled)

d. Explain whether or not when upgrades are made to one system, the way it has been designed, that it does not significantly impact another system

e. Explain if and how your solution supports integration with a data warehouse accessible by Business Intelligence (BI) dashboard and tools

f. Explain your capability to offer a thorough and full integration with CAD such that searches/search results from CAD to your proposed RMS solution are seamless and continuous and presented in a web like Graphical User Interface (GUI). i. Explain your capability to support returns to the MDC and CAD and include

specifics, narratives and images associated with events

4. NEW INTERFACES a. Explain your process by which we could design, development and implement new

interfaces i. Feedback from court system on the result or disposition of a case, regardless

of whether or it not it went to trial ii. Explain your capabilities to interface with statewide database of protection

orders iii. Other new interfaces (e.g., IAPro)

Note: See CURRENT INTERFACES in Appendix 1 for further information on current interfaces (data exchanges)

8) OPERATIONAL CAPABILITIES The City has specific detailed questions about operational (a.k.a. non-functional) capabilities relative to your solution. INSTRUCTIONS: Record your responses for this section on the OPER (Operational) TAB of the Vendor Response Worksheet for each of the RFI Items below.

1. AUDIT & CONTROL

a. Record Management i. Explain your capabilities with regard to the retention, archival, and purging of

electronic records such that it ensures that PPD remains in compliance with any applicable state record retention policy

1. Ex., Automatically archive juvenile contacts after the requisite period of time has passed since the entry or when the subject turns 18 years of age, whichever occurs first

ii. Explain your capabilities to manage when two Users are attempting to access and possibly update the same record or UI form

b. Auditability (Audit Trail) i. Explain your capabilities with regard to recording, tracking and reporting on

who (i.e., User ID) or what system/process has updated a record and when it occurred (i.e., date/time) such that it ensures that PPD remains in compliance

SECTION II - SCOPE



Phoenix, AZ 85003


with any applicable federal, state, and county statute; city ordinance; or police department policy

ii. Explain if your capability includes monitoring and reporting application level, privileged use, and changes to system

c. File & Interface Integrity i. Explain how your solution enforces and validates linkage of one report to other

report/s and key reports information 1. Ex., Citation linked to an Incident Report as well as an Offender

ii. Explain if your capabilities include dashboard reporting tools for efficient and effective monitoring of system processes and jobs in order for support staff to take swift and corrective action on exceptions and outages

2. SECURITY a. Access Control

i. Explain what authentication methods your solution supports (Ex., Active Directory, Multi-factor, etc.)

ii. Explain if your solution supports authentication and how iii. Explain the authentication and access capability used by your solution to

ensure that only authorized, permissioned Users get access (i.e., internal/city, external/public). Explain if encryption is used and define your acceptable encryption hashes, cyphers, and cypher suites (NIST accepted)

iv. Explain how profiles are updated, passwords reset, and directory information is updated

v. Explain your capabilities with respect to granting security on an individual basis, group basis, and/or by role, etc. Explain if capabilities to support dual/multiple login is available

vi. Explain the audit capability of your solution including: what is logged, which accounts/roles can access logs, and how long logs are retained

vii. Explain your encryption capabilities, where applicable, for your solution (e.g., web browser, mobile access, etc.). Explain if it allows or prevents encrypted attachments (e.g., email) from being uploaded

viii. Explain if your solution provides flexibility to secure data based on various parameters (e.g., user ID, module, form fields, database fields, etc.)

ix. Explain your solution capabilities to physically isolate juvenile from adult Information

x. Explain your solution capabilities to restrict juvenile contact data and information from unauthorized Users and public view

xi. Explain your capabilities in regards to access via VPN, Internal Wi-Fi and Network connections

b. Asset Classification & Control – Explain the capabilities with regard to encryption and secure transport of data between PPD and any 3rd Party i. Describe if all City data can be transmitted and stored exclusively in the

contiguous 48 states within the United States ii. Describe on what systems that the application(s)/data is stored (e.g., Oracle,

SQL, etc.) iii. Describe if PPD application(s)/data will co-exist with that of other customers

SECTION II - SCOPE



Phoenix, AZ 85003


iv. Describe the level of separation for the application(s)/data including information pertaining to servers/buckets/containers and any logical access controls in place

v. Describe if all data elements will be encrypted at all times, including in transit and at rest

vi. If encryption is used, identify the method(s) for encryption including in transit and at rest

vii. Describe the disposition of the data on your systems once a contract is terminated

viii. Describe how data is reclaimed by the City when a contract is terminated and in what usable format

ix. Describe if custom applications are developed, any security frameworks used (e.g., OWASP) or formal processes in place (e.g., Secure SDLC)

x. Describe whether you data mine customer data and/or use it for 3rd parties

c. Electronic Communication Control i. Explain your capabilities with regard to communication solutions, interfaces,

content, governance

d. Error Handling – Explain your capabilities in regards to the following: i. handling error and boundary conditions (e.g., Internet connection goes down,

power outage, hardware failure/replacement, unexpected application error, interface errors)

ii. what information should and should not be displayed in error message iii. providing batch processes that should be re-startable from step prior to failure,

if possible

e. Security Logging – Explain your capabilities for the application, OS, and system interactions with respect to the following: i. creating and protecting a security log ii. logging all security-related events (e.g., successful and failed logins, etc.) iii. logging important events (e.g., authentication, input validation failures,

SSL/TSL connection failures, administrative functions, authorization attempts, security configuration changes and sensitive data access, etc.)

f. Segregation of Duties i. Explain your capabilities in regards to adherence to basic segregation

principles for business processes (e.g., for RMS this includes the various roles); as well as development, test and production systems via role-based access

3. USABILITY a. Accessibility

i. Explain your capabilities in regards to meeting web accessibility needs for users with visual, hearing, learning or mobility impairments as applicable

b. Attachments i. Explain your capabilities in supporting file types (e.g., PDF, audio, video) and

list all file types supported

SECTION II - SCOPE



Phoenix, AZ 85003


ii. Explain your capabilities in supporting file sizes (i.e., what is the maximum sized file and maximum number of files in one operation)

iii. Explain your capabilities regarding uploaded attachments being scanned for virus, malware, etc. along with the anti-virus software being used

iv. Explain your capabilities in the allowance of a User, other than the one who uploaded the attachment, to view uploaded attachments

c. Availability i. Explain your capability to support an expected Class of Service of 'Gold', with

a minimized Monthly Downtime Target (e.g., 1 hour or less), and a minimized Monthly Reliability Target (e.g., 1 downtime occurrence or less). The solution should also be available 24 hours a day, 365 days a year except for regularly scheduled maintenance windows (i.e., 99.99% uptime rate)

d. Configurability i. Describe your configuration management capability available using a UI ii. Describe if your configuration management capability restricted to only a

system administrator level of permission or equivalent iii. Explain what elements or components are configurable by the customer that

do not require vendor support or intervention iv. Explain your solutions capability including but not limited to the management

for setting required or optional fields on input/entry forms (e.g., Citations, Incident Reports)

v. Describe a typical implementation with City staff managing all systems administration duties

vi. Explain the capability with respect to configuration changes and how they are deployed and accepted by connected and disconnected users

vii. Explain what capabilities your solution provides in customizing and applying business rules (e.g., court and court date/time assignment for initial appearance)

e. Operability i. Explain your solution ‘ease of use’ in everyday operation (e.g., automatic

assignment, pre-filled forms, etc.) and provide a few examples ii. Explain the amount of qualification and training required to oversee and

troubleshoot your solution

f. Personalization i. Explain your solution capability and the extent, to which, an individual User

can choose to personalize their own views

g. Privacy i. Explain the capability of your solution regarding privacy and the handling of

confidential information ii. Explain the capability of your solution with respect to encryption and/or

masking of personal/confidential information 1. Explain if it includes redaction capability of output forms (e.g., victim

information on Citation’s viewed by Users external to PPD)

h. Usability/Achievability

SECTION II - SCOPE



Phoenix, AZ 85003


i. Describe how your solution is optimally designed for ease of use when navigating the system (e.g., persistent navigation capabilities), viewing and entering data (e.g., enter a unique piece of information one time and allow reuse with no redundancy), selecting and running reports, the whole ‘customer experience’ given the fact that officers usually operate in a high-risk environment

1. Ex., Drop-down lists, pre-populated defaults, automatic fill, appropriate controls for the type of data being entered, dynamic editing and error checking, auto-save, etc.

ii. Explain the level of training required for users to achieve their goals with your solution. Usability requirements should be addressed as seriously as any other architectural issue (e.g., performance)

4. OUTAGE (BUSINESS CONTINUITY) a. Data Backup & Recovery

i. Explain your capabilities to provide data backup and recovery that meet or exceed comparable requirements as for the Disaster Recovery Time and Point Objective (RTO and RPO, respectively)

ii. Explain if your disaster recovery service supports one or more of the following site setups: hot-hot, hot-warm, hot-cold

iii. Note: See 5a and 5b in Disaster Recovery

b. Data Integrity i. Explain your capabilities to ensure zero or near zero tolerance for loss,

corruption or duplication of data if recovered after RPO threshold

c. Failover i. Explain your capability to support an expected Class of Service of 'Gold', with

a minimal Monthly Downtime Target, and a Monthly Reliability Target that minimizes downtime occurrences. The solution should also be available 24 hours a day, 365 days a year except for regularly scheduled maintenance windows (e.g., 99.99% uptime rate). The failover tolerance requirement is based on a component or application failure but not a disaster event. Note: For Disaster Recovery, see RTO

ii. Note: Redundant Processing Systems - To the greatest extent possible, and where practical, single points of potential failure in hardware and network components should be eliminated

5. DISASTER RECOVERY a. Recovery Time Objective (RTO)

i. Explain your capability to support a period of time the business can operate without the application/product during a disaster event and what the recovery window may be (e.g., between 2 and 3 hours)

b. Recovery Point Objective (RPO) i. Explain your capability to meet or exceed the point in time, prior to a disaster,

that application and system data will be restored to once it has been recovered and the estimated maximum amount of time required

c. Data Backup & Restore – Explain your capabilities in regards to the following:

SECTION II - SCOPE



Phoenix, AZ 85003


i. Meeting or exceeding the same requirements as for RTO and RPO ii. Meeting the current standard, which is a full data backup each week and

transaction logging daily iii. For recovery, synchronizing data with upstream and downstream

dependencies with other systems in order to be able to interact correctly

d. Recovery Environment i. Explain your capability to provide for application recovery including

environment (i.e., application has been recovered, validation testing has occurred and was successful within the required recovery timeframe)

6. OTHER OPERATIONAL CAPABILITIES a. Enterprise/System Architecture

i. Describe your solution’s current architecture and future roadmap

b. Interoperability i. Explain your capability to support API to allow other applications to ‘talk’ to

your solution and support future integration (e.g., with other law enforcement agencies)

c. Performance i. Explain how User-System interactions that can be performance challenged

(e.g., complex searches and database updates, uploading large attachments or content, etc.) in some applications, are optimized in your solution

d. Portability i. Explain your capability in deploying secure access to your solution from

different devices with different operating systems (e.g., hardened laptops, desktops, smart phones, tablets, etc.)

e. Reliability i. Explain your overall capability in ensuring data accuracy and completeness

when entering data and completing reports as well as passing information to ancillary/downstream systems and interfaces

f. Scalability i. Explain how your solution can handle a wide variety of system configuration

sizes and requirements. Ex., the current hardware must be capable of supporting the anticipated loads (e.g., capacity) for PPD which may expand to meet potential future growth rate. Although the total PPD user base includes approximately 4000 staff, each respondent should anticipate a user base growth (e.g., ~5% per year)

g. Upgradability i. Explain how patches are installed to your solution. If the patches are in the

form of a Service Pack (e.g., servers, etc.), estimate the length of time required to apply

h. Installability i. If applicable, explain the Installability of your solution

SECTION II - SCOPE



Phoenix, AZ 85003


i. Browser Support

i. List web browser’s along with versions numbers supported by your solution ii. Explain if and to what extent there is a concern about software compatibility

as the City’s web browser versions and desktop operating systems are updated

j. Data Conversion/Migration i. Explain your approach about data conversion and migration to the new

solution including any available options or alternatives ii. Explain how your solution ensures data integrity during the data

conversion/migration process (e.g., all data and documents are accounted for and no data is ‘lost’ or altered)

SECTION III - SUBMITTAL



Phoenix, AZ 85003


Respondent shall organize and submit their response (printed and electronic) by using the RFI 19-102 Law Enforcement Records Management System Worksheet which already has all content organized in the following tabbed order. Any reference material that is being attached should include a cross-reference to the TAB and RFI Item, to which, it pertains (Ex., TECH TAB RFI 2.A.0 Architectural Diagrams.vsdx). Section II, Scope of Work breakdown of sub-section and corresponding TABs.

� Business

o Company Profile o Prior Achievements & Roadmap o Professional Service(s) Model o Software Development & QA o Integration Services o Project Schedule/Implementation Approach o Training o Product Support o Audits o Pricing/Licensing Model (included on separate PRC (Pricing) TAB)

� Technical o Software o Infrastructure o Database o Integration and SOA o SaaS o High Availability o Security

� Features � Reporting

o Standard Reporting o Ad Hoc/Custom Reporting o Crime Analysis Reporting o Other

� Interfaces o File Formats and Types o Scheduling o Other o New Interfaces

� Operational o Audit & Control

Record Management Auditability (Audit Trail) File & Interface Integrity

o Security Access Control Asset Classification & Control Electronic Communication Control Error Handling




Phoenix, AZ 85003


Security Logging Segregation of Duties

o Usability Accessibility Attachments Availability Configurability Operability Personalization Privacy Usability/Achievability

o Outage (Business Continuity) Data Backup & Recovery Data Integrity Failover

o Disaster Recovery Recovery Time Objective (RTO) Recovery Point Objective (RPO) Data Backup & Restore Recovery Environment

o Other Operational Capabilities Enterprise/System Architecture Interoperability Performance Portability Reliability Scalability Upgradability Installability Browser Support Data Conversion/Migration

Note: Tabs 8 through 11 do not count towards the 30-page limit.




Phoenix, AZ 85003


1. INSTRUCTIONS Respondents are asked to provide: 1.1. A comprehensive written summary that addresses the Project Objectives and the firm’s

prior achievements in performing similar activities. 1.2. The completed Respondent Contact Information form (see page 5 Item 5 below). 1.3. The electronic copy of the completed RFI 19-102 Law Enforcement Records

Management System Worksheet in Microsoft Excel format.

2. SYSTEM/SOLUTION CAPABILITIES Information must be submitted on the Microsoft Excel spreadsheet. The spreadsheet (RFI 19-102 Law Enforcement Records Management System Worksheet) is available in an editable format at: https://www.phoenix.gov/solicitations Potential vendors responding to this RFI may provide descriptions and answers to the questions using the Worksheet. Example screen shots and sample reports are requested in the worksheet. If attachments are included in the vendor’s response, please label with the section topic followed by the number in the cell. Please note, the inclusion of a function, feature, capability or question in the tables eliciting information does not necessarily mean that it is a definite requirement of the proposed solution. Since this RFI is for informational purposes only, responders are not being evaluated on the information provided in response to this RFI.

3. PREPARATION OF RESPONSE

3.1. All information shall be submitted in accordance with the instructions provided in this document. No submittal shall be altered, amended or withdrawn after the specified submittal due time and date.

3.2. It is the responsibility of all respondents to examine the entire RFI and seek clarification of any requirement that may not be clear and to check all Submittals for accuracy before submitting a response. Respondents are strongly encouraged to:

3.2.1. Consider applicable laws and/or economic conditions that may affect cost, progress, performance, or furnishing of the products or services.

3.2.2. Study and carefully correlate respondent’s knowledge and observations with the RFI document and other related data.

3.2.3. Promptly notify the City of all conflicts, errors, ambiguities, or discrepancies which a respondent has discovered in or between the RFI document and such other related documents.

3.3. The City does not reimburse the cost of developing, presenting or providing any

response to this RFI. Submittals submitted for consideration should be prepared simply and economically, providing adequate information in a straightforward and concise manner. The respondent is responsible for all costs incurred in responding to this RFI.





Phoenix, AZ 85003


All materials and documents submitted in response to this RFI become the property of the City and will not be returned.

4. SUBMISSION OF INFORMATION

Submit only the Submittal Section and all other required documentation, do not submit a copy of the entire solicitation document. Submittals must be in possession of the City on or prior to the exact time and date indicated in the Schedule of Events. Submittals must be submitted via email to [email protected]. Subject of the email must state: RFI 19-102, Submittal.





Phoenix, AZ 85003


5. RESPONDENT CONTACT INFORMATION The following is provided in an editable format as an attachment. Download all editable documents at https://www.phoenix.gov/solicitations .

Vendors must be registered in the CITY’s procurePHX Self-Registration System at

https://www.phoenix.gov/financesite/Pages/EProc-help.aspx Enter CITY’s Registration System ID Number

Responder certifies that Responder has read, understands, and will fully and faithfully comply with this RFI, any attachments and any referenced documents. Responder also certifies that the prices offered were independently developed without consultation with any of the other Responders or potential Responders.

Authorized Signature and date

Printed Name and Title

RESPONDER’S CONTACT INFORMATION:

Company Name

Address

City, State and Zip Code

Telephone Number

Company’s Toll Free #

Email Address

Website URL


https://www.phoenix.gov/financesite/Pages/EProc-help.aspx

SECTION IV - APPENDIX



Phoenix, AZ 85003


1. CURRENT INTERFACE This appendix provides a composite of the systems and stakeholders, with which, the current RMS exchanges data along with the method of transport in Figure 6 below.

# ORGANIZATION / INTERFACE DESCRIPTION FILE

TYPE 1 Arizona Department

of Transportation (ADOT)

The RMS provides daily Accident reports and associated diagrams to ADOT.

XML

2 CARFAX The RMS provides daily Accident reports and information to ADOT.

XML

3 eCHRIS The City of Phoenix uses eCHRIS as its Enterprise Human Resource system. eCHRIS provides employee information/work assignments used for security access/permissions in the RMS. Information also includes PD divisions, bureau/precincts, work units, squads, and employee id/serial numbers.

CSV

4 Department of Public Safety (DPS)

Exchange arrest information between the RMS and DPS’s Automated Disposition Reporting System (ADRS). The interface imports ‘not referred’ dispositions (i.e., arresting officer determines a charge should not be referred after fingerprinting arrestee on AFIS Live Scan), FBI/SID notifications for the arrestee agency, and Final Dispositions on an arrest reported by other law enforcement agencies, prosecutor, or courts.

XML, TXT

5 Forensics Lab The Phoenix Police Department’s crime laboratory uses JusticeTrax LIMS to integrate evidence tracking, analytical results, reports and lab management information. The purpose of this interface is to send new requests for analysis of evidence to LIMS and retrieve analysis reports, Combined DNA Index System (CODIS) hit notifications, and other dispositions from LIMS in return which are imported into the RMS Incident Module.

XML

6 Lexis/Nexis Community Crime Map

The RMS provides general crime data to the LexisNexis Community Crime Map. This information is provided (www.phoenix.gov/police) for citizens to access crime statistics, crime alerts and mapping. Additional information is provided to the LexisNexis Accurint Crime Analysis Law Enforcement Portal.

???

7 LexisNexis Coplogic DORS

Citizens may report specific crimes using the Citizens Online Police Reporting System (https://www.phoenix.gov/police/policereport) for Incident Reports/Supplements and/or Second-Hand Pawnshop dealers for pawn information. This information is reviewed by department staff and then automatically imported into the RMS Incident Report and Pawn modules.

XML

8 Maricopa County Attorney’s Office (MCAO)

The Phoenix Police Department currently submits cases to MCAO manually as well as utilizing this interface which exports both documents and images (designated by the Court Liaison team) electronically and exports the information directly to MCAO. This interface houses the functionality for MCAO to import to RMS electronically the charge dispositions on cases along with the

XML

http://www.phoenix.gov/police

https://www.phoenix.gov/police/policereport




Phoenix, AZ 85003



TYPE corresponding Court Information Sheet and Property Release forms. This import functionality is not currently supported by the MCAO Karpel system and is not in use.

9 Maricopa County Sheriff’s Office (MCSO)

Phoenix Police Department personnel can enter duplicate information into the MCSO Pre- Booking application today. The use of this interface provides staff with the ability to enter booking information into the RMS which can be reused when completing the final Incident Report (IR). Once the booking information is entered and approved by Central Booking staff, it is exported to MCSO electronically. When approved by MCSO, the MCSO Booking Number, Common Case Number, Arrest PDF, Form IV PDF, and Final Acceptance XML is electronically imported into the RMS and available for internal use and distribution to external law enforcement agencies as needed.

XML

10 Finance Department

PPD currently issues Notice of Violations to citizens and ticket information is sent to the Finance Department to assist in collection and payment of unpaid tickets.

DAT

11 Phoenix Municipal Court (PMC)

The RMS provides daily data and reports to PMC and their Court Management System (CMS) e.g., Citations data and documents (ATTC, non-booked/booked), Booking Dockets and documents

XML, PDF, JPEG, TXT

12 Phoenix Police Department (PPD)

Partners with ITS to administer, operate, and maintain RMS to ensure compliance with federal and state statutes as well as city ordinances in support of law enforcement. This includes but is not necessarily limited to: • the entry and tracking of information on Citation and

Booking reports • the production of the court docket thrice daily and sent

over to Central Booking and then in turn to PMC and PPO as well as a designated printer housed in the PMC building

• the entry and tracking of information on Accident reports

• providing detectives’, a notification in the Case Management module of any audio, photo, and/or video evidence uploaded to the document management system (AppXtender/WebXtender)

• the utilization of AFIS Live Scan technology for fingerprinting which is provided along with demographic information to the DPS AFIS system and then in turn to the Arizona Disposition Reporting System (ADRS)

• the import of vehicle Boot and Tow information from PMC, which creates a BOLO Boot and Tow record that is accessible for both downtown operations unit Notice of Violation (NOV) procedures and staff department wide

The following corresponds to the bullet points in the adjacent column to the left • N/A • PDF, JPEG • N/A • TXT • XML • TXT • XML




Phoenix, AZ 85003



TYPE • the import of data and booking images from the state-

wide mugshot system, ImageWare housed at DPS, into the RMS Booking module

13 Phoenix Police Department PMB Warehouse

Property entered with the Incident Report (IR) in the RMS is provided, in real time, to the PTS system (internal Property and Evidence tracking). PTS provides the ability for users to wirelessly scan property movement at the PMB warehouse to ensure appropriate chain of custody in evidence

XML

14 Phoenix Police Department Code Enforcement Unit (CEU)

Vehicle impound information is collected in the RMS as part of the Incident Report (IR) and associated Easy Forms. Information entered in the RMS is provided electronically to the CEU Vehicle Impound System to continue the ability to provide invoices, generate letters/reports, and provide billing notifications to residents and contracted tow companies

SQL

15 Phoenix Prosecutor’s Office (PPO)

The RMS provides daily data, documents and photos to PPO and their Criminal Records Information Management Exchange System (CRIMES) and Electronic Prosecutor Records Organization System (ePRO). E.g., Citation documents and data (non-booked/booked), Incident Report documents and data, Accident Reports, Booking Dockets and Booking documents and photos In addition, PPD send multiple CSV files containing data not provided in the incident, citation and crash XML files

XML, PDF, JPEG

16 Versaterm CAD PPD uses Versaterm’ s CAD system to track all calls for service which is information that is sent over automatically and imported into the RMS. In the case where the calls for service incident has a disposition of ‘R’ for a report required, the RMS automatically creates a skeleton Incident Report with general information already completed. This allows department staff to view CAD information in the RMS and use that information to easily create the start of their Incident Report. Calls for Service (CFS) Reporting: A unidirectional transfer of calls for service (CFS) data elements from the Versadex CAD to RMS. Integrated CAD/RMS permits bidirectional exchange of CFS data, enabling RMS master indices to import direct or indirect matches to CAD.

XML

17 Versaterm Mobile This interface allows the RMS to access Versaterm mobile CAD ACJIS/DMV/ALETS/ACIC/NCIC query responses from the RMS Field Based Reporting (FBR) system and allows staff to reuse information queried in CAD directly into the RMS.

Custom

Figure 6 - Current RMS Interfaces by System/Stakeholder 2. GLOSSARY

# TERM/PHRASE DEFINITION 1 ACIC Arizona Crime Information Center 2 ACJIS Arizona Criminal Justice Information System 3 ADOT Arizona Department of Transportation 4 AI Artificial Intelligence




Phoenix, AZ 85003


# TERM/PHRASE DEFINITION 5 AKA Also Known As 6 API Application Programming Interface 7 ASM Automatic Storage Management 8 ATTC Arizona Traffic Ticket and Complaint 9 BI Business Intelligence

10 CAD Computer Aided Dispatch 11 CFS Call For Service 12 CJIS Criminal Justice information Services 13 COTS Commercial-Off-The-Shelf 14 Configuration A capability for certain system settings and preferences that can be

configured by a customer. These settings and preferences may include options, parameters, and data elements which can be accessed, viewed, and maintained by a system administrator or equivalent but only using UI back office tools.

15 Customization Is the capability to make changes to the core of the system including but not necessarily limited to the code base and database in order to provide a capability that is customer specific.

16 CSF Cybersecurity Framework 17 Database

Extensibility Extensibility is a software engineering and systems design principle where the implementation takes future growth into consideration.

18 DHS Department of Homeland Security 19 DOJ Department of Justice 20 DPS Arizona Department of Public Safety 21 eCHRIS City’s (PeopleSoft) Human Resources Information System (eCHRIS) v9.2,

which is the enterprise-wide human capital management system. 22 FBI Federal Bureau of Investigation 23 FIPS Federal Information Processing Standards Publications 24 GJXML Global Justice Extensible Markup Language 25 GUI Graphical User Interface 26 IaaS Infrastructure as a Service 27 ITIL A set of practices for IT service management (ITSM) that focuses on

aligning IT services with the needs of business. 28 ITS Information Technology Services 29 KPI Key Performance Indicator 30 LEITSC Law Enforcement Information Technology Standards Council 31 MCAO Maricopa County Attorney's Office 32 MCSO Maricopa County Sheriff's Office 33 MDC Mobile Data Computer System (f.k.a. MDT - Mobile Data Terminal) 34 MNI Master Name Index 35 MVI Master Vehicle Index 36 NIEM IEPD National Information Exchange Model Information Exchange Package

Documentation 37 NCIC FBI’s National Crime Information Center 38 NIBRS National Incident Based Reporting System 39 NIST National Institute of Standards and Technology 40 NOK Next of Kin 41 OBIEE Oracle Business Intelligence Enterprise Edition 42 ODBC Open Data Base Connectivity 43 OOTB Out Of The Box 44 OSI Open Systems Interconnection




Phoenix, AZ 85003


# TERM/PHRASE DEFINITION 45 OWASP Open Web Application Security Project 46 PaaS Platform as a Service 47 PDF Program Document File 48 PII Personally Identifiable Information 49 PMC Phoenix Municipal Court 50 PPO Phoenix Prosecutor's Office 51 RFI Request For Information 52 RFID Radio Frequency Identification 53 RMS Record Management System 54 ROM Rough Order of Magnitude 55 RTO Recovery Time Objective 56 RPO Recovery Point Objective 57 RP Reporting Party 58 SDK Software Development Kit 59 SLA Service Level Agreement 60 SOA Service Oriented Architecture 61 SAAS Software As A Service 62 TOC Terminal Operator Certification 63 UCR Uniform Crime Reporting

CITY OF PHOENIX POLICE DEPARTMENT REQUEST FOR … 19-102... · RFI ITS 19-102 Law Enforcement...

Documents

Transcript of CITY OF PHOENIX POLICE DEPARTMENT REQUEST FOR … 19-102... · RFI ITS 19-102 Law Enforcement...