Non-Functional Requirements Note: For section 3.8, Offerors can address the Non-Functional Requirements at the end of each Non-Functional Requirement category. Offerors do not have to address each Non-Functional Requirement individually. REQ ID Non-Functional Description by Category Functional Requirement Status NFR- AUD Audit and Compliance NFR-AUD-001 The solution comply with Ohio's Ohio Revised Code (ORC) Access logging rules for confidential Proposed information NFR-AUD-002 The solution shall comply with applicable Federal and State of Ohio’s Audit and Compliance requirements Proposed (Please refer to Supplement 2 Section 5 and 7) – NFR-AUD-003 The Solution shall be able to detect security-relevant events that it mediates and generate audit records for Proposed them. At a minimum the events shall include those listed here: - start/stop - user login/logout - session timeout - account lockout - scheduling - node-authentication failure - signature created/validated - Personally Identifiable Information (PII) export - PII import - security administration events - backup and restore NFR-AUD-004 The Solution shall audit all access to protected information in real time Proposed NFR-AUD-005 The Solution shall provide alert mechanism for privacy breaches Proposed NFR-AUD-006 When or an override access is performed, the Solution shall maintain a complete and Proposed “Break-the-Glass” consistent audit trail of the individual who performed the override and the change made (before and after action/state of the record). Offeror Response NFR- BPM Business Process Modeling (BPM) NFR-BPM-001 The Solution shall balance application workflow workload (assigned tasks) based upon user and work unit Proposed queues. Offeror Response NFR-CM Consent Management NFR-CM-001 The Solution track acceptance of informed consent or privacy policies where the Individual or Business Proposed authorizes the terms and conditions contained in the informed consent and privacy policies. Informed consent may include consent for sharing of personal and program transaction based activities with other Individuals, such as a designated legal representative, or a third-party. Offeror Response NFR- DI Data Integration
Non-Functional Requirements Note: For section 3.8, Offerors can address the Non-Functional Requirements at the end of each Non-Functional Requirement category. Offerors do not have to address each Non-Functional Requirement individually. REQ ID Non-Functional Description by Category Requirement Status NFR- AUD Audit and Compliance NFR-AUD-001 The solution comply with Ohio's Ohio Revised Code (ORC) Access logging rules for confidential information Proposed NFR-AUD-002 The solution shall comply with applicable Federal and State of Ohio’s Audit and Compliance requirements (Please refer to Supplement 2 – Section 5 and 7) Proposed NFR-AUD-003 The Solution shall be able to detect security-relevant events that it mediates and generate audit records for them. At a minimum the events shall include those listed here: - start/stop - user login/logout - session timeout - account lockout - scheduling - node-authentication failure - signature created/validated - Personally Identifiable Information (PII) export - PII import - security administration events - backup and restore Proposed NFR-AUD-004 The Solution shall audit all access to protected information in real time Proposed NFR-AUD-005 The Solution shall provide alert mechanism for privacy breaches Proposed NFR-AUD-006 When “Break-the-Glass” or an override access is performed, the Solution shall maintain a complete and consistent audit trail of the individual who performed the override and the change made (before and after action/state of the record). Proposed Offeror Response NFR- BPM Business Process Modeling (BPM) NFR-BPM-001 The Solution shall balance application workflow workload (assigned tasks) based upon user and work unit queues. Proposed Offeror Response NFR-CM Consent Management NFR-CM-001 The Solution track acceptance of informed consent or privacy policies where the Individual or Business authorizes the terms and conditions contained in the informed consent and privacy policies. Informed consent may include consent for sharing of personal and program transaction based activities with other Individuals, such as a designated legal representative, or a third-party. Proposed Offeror Response NFR- DI Data Integration Functional
0A1213_Enterprise%20MDM%20Supplement%201.docx