Laserfiche WebLink
RFP-2 – Scope of Work <br />RFP# PWD 25.604 City of Pleasanton, CA RFP-2 | Page 24 <br /> <br />Category Description <br />Office productivity software Office 2016 through O365 <br />Email system Microsoft 365 <br />Supported browsers for <br />internal staff <br />Current versions of Edge (Chromium), Chrome, Firefox, Safari <br />Supported browsers for <br />external facing systems <br />Current versions of Edge (Chromium), Chrome, Firefox <br />Monitoring and Logging Contractor shall provide audit logs of user and admin activity, with City access <br />for review. Logs should be retained for at least 3 years and be exportable to <br />City’s SIEM. Continuous performance and security monitoring are required, with <br />immediate notification to City IT of outages or suspicious activity. accepted <br />formats (syslog/CEF/JSON), log delivery method (push/pull), log scope (app, <br />admin, API, integration, and infrastructure components), and access method <br />(API/portal) for City review. <br />Vulnerability and Penetration <br />Testing <br />Quarterly vulnerability scans and annual third-party penetration testing, with <br />summary results shared with City IT. Critical vulnerabilities to be patched within <br />defined timeframes. Explicit patch SLAs (e.g., Critical ≤15 days, High ≤30, <br />Medium ≤60), scanning coverage (app, OS, containers, cloud), proof of <br />remediation, and that third-party pen test executive summaries + mitigation <br />plans will be shared <br />Uptime monitoring 24×7 synthetic and real-user monitoring with alerting to City contacts, aligned <br />with the Software-as-a-Service service levels defined in 2.4.2.1, below. <br />Server Patching Schedule Monthly - also require emergency out-of-band patching for zero-days and <br />advance coordination with City <br />Systems Management Tools Who does what (Contractor vs. City) for any on-prem components (e.g., <br />collectors, gateways). Specify configuration management (e.g., <br />Intune/SCCM/Ansible), baseline hardening, and access controls <br />Server Management The Contractor shall manage all AMI application servers and required <br />gateways/collectors (cloud, on-prem VMware vSphere, or IaaS), including CIS- <br />level hardening, monthly patching with out-of-band zero-day updates, AV/EDR, <br />backups meeting City RPO/RTO, and 24×7 health monitoring with alerting. A <br />clear RACI and change management aligned to City maintenance windows are <br />required, with remediation of Critical/High vulnerabilities within City-defined <br />SLAs <br />Table 2 - IT Environment Standards <br />2.4.2. Software-as-a-Service Applications <br />Final terms, conditions and specifications of the SaaS agreement will be negotiated with the Proponent. The <br />following will be the basis for what is included in the agreement. <br />Page 232 of 443