JFS OIS FY26 Clarity Software as a Service Enterprise Portfolio Management- Cost Summary Offerors are to provide proposed cost in their quote following the format provided in the table below. Offerors are to use their professional comprehension of the effort required to propose the best cost and include all- inclusive rates to perform the services described in this RFQ. No separate travel expenses or any other type of reimbursable expenses will be paid under the contract that results from this RFQ. The cost
This document outlines security requirements for contractors developing, maintaining, or hosting applications for the Ohio Department of Job and Family Services (ODJFS). Key requirements include data encryption in transit and at rest, data execution prevention (DEP), address space layout randomization (ASLR), secure enclaves for cloud environments, unique user sessions, access control checks, input validation, hardening configurations, component identification and provision of supported versions at contract conclusion, disabling auto-complete and caching for sensitive data, avoiding redirects, audit logging requirements (including user account management, application errors, security policy modifications, and access to personally identifiable information), audit log retention, aggregation, and analysis, and secure transmission of audit logs to ODJFS tools. Annual audits (AICPA SSAE No. 18, SOC 1 Type 2 and SOC 2 Type 2 reports, and SOC 1 Type 1 for financial transactions) are required for cloud-based or contractor-hosted solutions. The contractor is responsible for all audit costs and must provide results within 30 days of completion. The state may audit controls and security measures without notice. Prohibition of using production data in non-production environments is also stated. DevOps vulnerability scanning, penetration testing, release and change management, and use of cloud-agnostic products and services are also required. Specific development methodologies (e. g. , . NET, Java, Salesforce) and tools (e. g. , Git, Azure DevOps, Jenkins, Copado, ServiceNow) are mentioned. Database read replicas and data dictionaries are also required. Infrastructure as code (IAC) is preferred, using declarative definition files where possible.