Exhibit E - Technical Requirements Table of...

RFP 10674 – Airport Information Integration Solution

AIR-590 (1-15) E-1 January 2017

Exhibit E - Technical Requirements

Table of Contents

1. Architecture Validation ..................................................................................................... 2

2. Solution Design and Configuration ................................................................................... 10

3. Change Management and Stakeholder Engagement ......................................................... 11

4. Use Case Implementation .................................................................................................. 13

5. Training and Knowledge Transfer ..................................................................................... 16

6. Support and Maintenance .................................................................................................. 17

7. Security Protocol and Business Continuity ....................................................................... 18

8. Glossary ............................................................................................................................. 20


AIR-590 (1-15) E-2 January 2017

1. Architecture Validation

1.1 Solution Components

The following table shows a matrix of open source based components that shall be included and integrated to comprise the Solution.

Category Classification Description Messaging High Speed Durable Messaging A high speed messaging service capable of

high durability Messaging Ultra High Speed Messaging A high speed messaging service suitable for

IoT applications with extremely low latency and smaller payloads

Messaging Standards Compliant Messaging An AMQP compliant messaging service suitable for enterprise application integration

Messaging Global Message Subscriber A subscribing service to ingest messages from various sources into the Solution that allows flexible integration with other messaging technologies

Messaging Global Message Publisher A publishing service to push messages to various targets in the Solution and allows flexible integration with other messaging technologies

Data Hub Database As A Service A virtualized single point database infrastructure capability that provisions and scales databases and data resources as a service. This service must support multiple relational and big data database including Oracle, SQLServer, Cassandra, MongoDB and the Hadoop ecosystem

Data Hub Data Catalog A capability that serves as a single point of truth for all Airport metadata and provides an inventory and the management of all metadata resources for the Airport’s data landscape. The data catalog must also provide capabilities for users, data analysts, data scientists and administrators to query, research, classify and collaborate securely. The data catalog must also provide API’s for data services to access all capabilities.

Services Application Service Delivery Platform

A platform that provides capabilities to manage and deploy services on demand and in real-time at scale. The platform must support the integration of tools for end to end application service development through delivery. The platform must also support on premise, cloud and hybrid hosting models.

Services Application Service Construction Platform

A platform that provides capabilities to develop, construct, mashup and deliver components as services through the Application Service Delivery Platform. This capability must have drag and drop functionality and allows flexible integration of new components into its inventory.

Services Cloud Management Platform A platform that provides capabilities to create cloud infrastructure for the delivery of software services, containers, data services and infrastructure services. The ability to use automation to scale services in real-time is


AIR-590 (1-15) E-3 January 2017

required. The ability to integrate capabilities with the Application Service Construction Platform and the Application Service Delivery Platform is required.

As guidance, note that the Airport has performed several tests and POCs internally to demonstrate and qualify the desired capabilities for the Solution using the following set of open source tools. An acceptable Solution for the Airport may be based on these products or similar/compatible open source capabilities as foundational technologies. Apache Hadoop, Flume, Kafka, Spark, NATS, RabbitMQ, OpenStack, OpenShift, Trove, Cassandra, MongoDB, MySQL. The delivered Software components shall provide all required functionality as listed below.

1.1.1 Flexible ingestion of data from disparate sources with GUI based configuration capabilities

The Solution shall provide intuitive, powerful and advanced technical capabilities for data ingestion for devices (IoT/LoT), data sources and other resources in and around the Airport’s ecosystem. The Solution’s data ingestion capabilities shall:

• Connect, adapt, transform, and enrich data into the Solution • Ingest large volumes of unstructured, structured, streaming, and geo-spatial data from

multiple sources • Leverage messaging services and infrastructure to transform and enhance the flow of

data • Securely accommodate multiple protocols including but not restricted to the

following: HTTP/HTTPS, SOAP, SNMP, SMTP, TCP/IP and Web Sockets • Provide integration between core Airport systems, services, APIs, external systems

and the Solution automatically through discovery and configuration • Provide capabilities to integrate legacy systems that may not have an "out-of-the-

box" connector or adapter • Support process driven data exchange between core systems and the Solution

1.1.2 Integrated messaging service with API support and GUI based management tools

The Solution shall include a modern high speed and lightweight messaging capability with high throughput capacity that ensures message transmission and storage fidelity. The architecture of the messaging capability shall support complex message management schemes along with flexible channel and queue management capabilities. The Solution’s integrated messaging service shall:

• Transform and enrich different sources of data into message packets • Integrate subscription and publishing of messages across all components of the

Solution • Guarantee message delivery, transaction integrity, recovery of messages, message

sequencing (if required), and configurable non-duplication in delivery for queues • Provide patterns for quality of service for message queues, publish-subscribe

(broadcast or multicast), subscriber/consumer location transparency (no dependency on network infrastructure configuration), the use of non-exclusive queues, and the ability to secure the message transport (SSL/TLS)

• Handle a minimum of 20,000 messages per second based on a 1Kb payload • Support enterprise class micro-service integration architecture and emerging

integration patterns


AIR-590 (1-15) E-4 January 2017

• Filter, enrich, aggregate, correlate and apply business rules to data streams and messages in real-time

• Cache messages locally when network resources are unavailable to enable delivery to ensure message durability at scale

• Provide the tools or applications required to manage and administer the system through a browser

1.1.3 An enterprise data hub that supports both structured and unstructured data storage using Big Data database technology

The Solution shall use industry standards and widely recognized open Big Data technologies to:

• Provide a data repository for the collection and storage of unstructured, structured,

document, streaming, and geo-spatial data • Provide and support seamless integration with traditional data warehouses, relational

and object databases, file and object storage, data marts and other NoSQL databases • Provide data management services that allow for the creation and deployment of

virtualized views of data from a set of databases • Specify the compute and storage IOPS requirements for the data storage

implementation over 5 years • Provide integrated tools or applications for data discovery and analysis from a single

pane of glass

1.1.4 Integrated content indexing, metadata, taxonomy and browser driven search capabilities

The Solution shall provide tools to allow all content to be searchable via configurable index, metadata and Airport defined taxonomy schemes to support various business units. The content search capabilities integrated within the Solution shall:

• Tag content by type for indexing • Allow metadata of content to be created, managed and referenced by other software

components and services • Provide capabilities to manage keywords and search terms organically in the Solution • Provide integrated tools to facilitate fast search through the big data/NoSQL database

utilizing keywords, indices and metadata

1.1.5 Real-time configuration of data flows, storage and access methods based on business rules and dynamic workflow events

The Airport’s operations interact with people, systems and resources in a way that generates constant experiential and contextual content. The Solution shall provide capabilities to allow the Airport to control the storage, access and scaling of this content in real-time to support the Airport’s operations by:

• Providing tools to control how content is assimilated into file stores, object stores and

the big data/NoSQL database in real-time based on systemic and configurable events and rules

• Providing tools to control how content is retrieved and filtered from file stores, object stores, and the big data/NoSQL database through data services in real-time based on systemic and transactional event rules


AIR-590 (1-15) E-5 January 2017

1.1.6 Integration with Apigee for secure RESTful API proxies and management

The Solution shall:

• Integrate with the Apigee API management platform to allow for secure, managed exposure

of web service end points

1.1.7 Facilitate auto discovery, testing and documentation of API endpoints

In concert with the Apigee integration as well as Solution generated services and their APIs, the Solution shall provide the following capabilities:

• API endpoints when introduced into the platform must be discoverable through the

integrated API management tool • API endpoints must be self-documenting in a way that provides access to documentation

through the integrated API management tool • API endpoints must provide the ability for designers and developers to test behavior upon

discovery through the integrated API management tool • Integrated services catalog by discovering proxies inside Apigee • Integrated services catalog by discovering services managed and orchestrated inside the

Solution

1.1.8 Integrated capabilities to perform real-time complex event processing

The Solution shall:

• Analyze multiple streams of data concurrently in real-time • Define time-based rules to analyze and correlate past and current events within a defined

window • Respond to events based on models that trigger actions or notifications in real-time • Collect, correlate and evaluate unstructured, structured, streaming, and geo-spatial data

against defined rules and thresholds • Provide a real-time analytics dashboard for operational business intelligence related to

complex event processing • Provide capabilities through a library of algorithms to apply complex event processing

capabilities to designated systemic events with measurable and recorded responses and outcomes

• Provide advanced visualization capabilities in association with all complex event processing activities and data

• Provide the ability to integrate third party libraries to provide additional complex event processing capabilities

• Provide integrated complex event processing with workflow capabilities • Provide integrated complex event processing with data and information ingest capabilities • Provide integrated complex event processing with message and notification processing

capabilities • Ensure that complex event processing capabilities accessible via API • Ensure that complex event processing does not impact Solution performance

1.1.9 Integrated automated workflow engine coupled with event processing


AIR-590 (1-15) E-6 January 2017

The Solution shall ensure that complex event processing is integrated seamlessly with the Solution’s workflow automation capabilities. This capability shall be constructed in a way that allows the Solution to:

• Provide event and process automation capabilities through a workflow engine • Provide tools to allow event related actions to be coupled with workflow processes • Provide workflow automation capabilities to link events and processes into tasks • Provide the ability to serialize and de-serialize all events, workflow, jobs and task related

object instantiations through the message service

1.1.10 The ability to serialize and de-serialize all object instantiations through the message service

The Solution shall:

• Provide tools to allow objects to be stored by pushing object state into the messaging service • Provide tools to allow objects to be retrieved from the messaging service without the loss of

fidelity, representation and meaning • Ensure that object instances in all cases retain consistent fidelity, representation and

meaning before, during and after they have been processed by the messaging service

1.1.11 High quality data analysis and visualization tools with self-service capabilities

The Airport requires a Solution that ultimately drives business outcomes and enhances decision support based on real-time information, processed throughout the Airport’s information landscape. In order to achieve this, an integrated capability to visually perform data science and analysis to represent data and various modeling scenarios with data shall be provided as part of the Solution. In addition, data science, business intelligence and operations staff shall have the ability to use these tools for daily tasks and operations. In order to support this business need, the Solution shall:

• Process and model data for evaluating and performing predictive analytics • Analyze data from multiple sources of structured, unstructured, streaming, and geo-spatial

data to identify patterns and trends over time • Perform historical analysis and operationalize results in event processing solutions • Provide analytics tools that leverage Big Data distributed storage and processing • Support geo-spatial data types and time-series analysis • Provide compute, memory and storage requirements to implement the analytics tool • Specify the technical, management and administrative requirements for the analytics tool • Provide self service capabilities for creating and managing data visualizations and

dashboards • Provide integrated capabilities with other parts of the Solution including complex event

processing tools, APIs and data ingestion connectors and endpoints • Provide a distribution capability across the enterprise for serving dashboards, data

visualizations and reports

1.1.12 Tools to enable integrated enforcement and governance for SFO security and access management policies

The Solution shall:

• Provide capabilities across the infrastructure to control authorization and access to data

services supported by the Solution at the component level


AIR-590 (1-15) E-7 January 2017

• Enforce role-based policies for access and authorization to data services and APIs • Create, manage, and administer a governance registry that documents all enforceable

policies within the Solution • Provide monitoring capabilities or integrate with security incident management systems for

the detection of cyber-security attacks or data breaches • Identify the components of the proposed Solution that comply or meet ISO 20000 standards

and explain how the proposed Solution aligns with ISO 20000 standards • Identify the components of the proposed Solution that comply or meet ISO 27001 standards

and explain how the proposed Solution aligns with ISO 27001 standards • Identify the components of the Solution that comply or meet FIPS Standard 140-2, CJIS and

SSAE 16 SOC2 • Securely deploy all data services either on premise or in the cloud with integration to the

Airport’s Apigee account with the proper access control for both internal and externally facing traffic using security policies and rules specified by SFO ITT

1.1.13 Support and integration with SFO’s ServiceNow (Information Technology Service Management - ITSM) and Service Catalog

The Solution shall support integration with the ServiceNow Service Catalog capabilities. ServiceNow is a tool that manages SFO IT processes and service delivery, including processing Airport commission service requests, incident tracking, asset management, change management and mobile management.

The Solution shall: • Create and update Incidents in ServiceNow based on issues raised in the Solution • Create and update Problems in ServiceNow based on issues raised in the Solution • Create and update Knowledge Base entries based on events discovered in the Solution • Support SFO’s ISO20000 Service Management Standards for managing Incidents,

Problems, Knowledge Base and Issues

1.1.14 Comprehensive GUI based administration system that allows the management of the Solution from a centralized portal

1.1.15 Comprehensive GUI based monitoring system to monitor and administer the components of the Solution that integrates with existing SFO monitoring systems

1.1.16 Network infrastructure requirements for SFO build out to support the Solution at scale

The Solution shall:

1.1.16.1 Provide speed and bandwidth specifications for the segmentation of the Solution in the

following three areas: • Content: Data between two endpoints of the logical architecture, i.e. data ingestion

from sensors through to the data store. • Monitoring: Interface capacity requirements to send metadata about the operation of

specific Solution components of the network in support of the Solution’s business operations.

• Internet Pipes: The data being sent to and from the Internet from the Solution.


AIR-590 (1-15) E-8 January 2017

1.1.16.2 Specify the network bandwidth requirements needed to support the designated SLAs for specific components and sub-systems of the Solution including intra-network integration and data center interconnect constraints.

1.1.17 Hardware Infrastructure requirements for SFO build out to support the Solution at scale

1.1.17.1 The Solution shall:

• Deploy on virtual appliance infrastructure and/or virtualized bare metal machines. • Deploy onto public, on premise or hybrid cloud architecture. • Deploy automated methodology in real-time using a Continuous Delivery process

(CD), e.g. Jenkins and a Platform as a Service (PAAS) model, with no risk of downtime or SLA violation.

• Configure in a highly available architecture to maintain uptime and meet SFO defined Service Level Agreements.

• Support server deployments using CentOS or RedHat OS version 7.x or later. Exceptions must be approved by SFO ITT staff.

1.1.17.2 During the Architecture validation the Contractor shall:

• Specify the CPU, memory, disk or storage capacity and IOPS specifications for

computing resources to meet SLA requirements that can be used for an on premise, cloud or hybrid-cloud deployment.

• Specify integration requirements to deploy services in the cloud using Docker or other containerized methods.

1.1.18 Advanced GUI based orchestration and choreographic capabilities to enable development of services and mashups

The Solution shall allow the:

• Creation and management of services and their behavior in association with data sources,

connectors and in real-time usage of a designer tool • Compilation, building, testing and deployment of services and components • Combination of service entry points to create mashups and composite services and APIs to

augment pre-existing capabilities

1.1.19 Encryption for data at rest and data in flight throughout the ecosystem

The Airport operates in an environment that consists of sensitive data. The Solution shall support data encryption standards for data in flight and at rest in a way that significantly protects data to ensure the safety of passengers, the City of San Francisco, employees, tenants, airlines and the SFO community at large. The Solution shall demonstrate that all components and services that encompass its standard operations are secure. The Solution shall provide:

• Tools to encrypt and decrypt data stored inside the enterprise data hub databases using

industry standard encryption protocols and methodologies • Tools to encrypt and decrypt inbound and outbound data (in flight/transport) for the

enterprise data hub databases using industry standard encryption protocols and methodologies


AIR-590 (1-15) E-9 January 2017

1.1.20 Elastic capabilities to dynamically scale all aspects of the ecosystem in real-time with GUI for configuration

The Solution shall provide: • Tools to allow horizontal scaling of run time configurations for all managed services,

resources and containers in real-time and in response to the Solution’s load requirements and conditions

• Tools to allow vertical scaling of run time configurations for all managed services, resources and containers in real-time and in response to the Solution’s load requirements and conditions

• Tools to dynamically scale all resources and components in the ecosystems such as service instances and threads, database resources, memory allocation, processor allocation etc.

• Virtualized resources to enable system wide elastic capabilities at scale

1.1.21 Capability to provide audit trails, journals and logs for all aspects of the Solution with a GUI for configuration

1.1.22 Intuitive GUI’s throughout the Solution for user driven functionality

The Airport requires a Solution that provides ease of use and the ability to use configuration instead of programming as the delivery mechanism to create and deploy services. The Solution shall provide:

• A standardized user experience that is web based and uses a standard style sheet with

standardize UX components throughout • An intuitive GUI for all aspects and capabilities throughout the Solution


AIR-590 (1-15) E-10 January 2017

2. Solution Design and Configuration

This phase ensures the configuration, set-up, and readiness for use case deployment. This shall include service capabilities to support the delivery of a Solution Design, the Solution Implementation Plan and realization of the Solution Implementation itself, measured by milestones approved by SFO.

2.1 Technical Expertise and Professional Services

2.1.1 Software Development and Service Delivery

The Project Team will provide software development, testing, QA, integration and service transitioning services to support the Solution’s Delivery. These services will be needed to configure the Solution initially and thereafter, deliver the identified use cases in Section 4. Use Case Implementation.

2.1.2 Professional Services

The Project Team shall provide a Professional Service capability to support the delivery of the Solution. The Project Team’s ability to deliver a professional service capability to successfully manage large multi-year enterprise programs, involving various business stakeholders, resulting in a transformative end state shall be demonstrated.

2.2 Solution Design

The Contractor shall produce a Solution design that delivers SFO’s technical requirements. This shall be evidenced through a design of the entire Solution and the development and delivery of use cases. The Solution design shall define capacity requirements for memory, storage and compute to support the Solution’s operation over 5 years after initial implementation.

2.3 Solution Implementation Plan

A delivered solution implementation plan will describe how the Solution is to be deployed including methodology, processes, resource plans and recommended best practices. The Solution Implementation Plan shall detail milestones, deliverables and critical path. At a minimum, it shall address the following areas:

2.3.1 Component and service modeling, design and configuration 2.3.2 Deliver base Solution in SFO’s sandbox environment 2.3.3 Integration with existing SFO systems 2.3.4 Data migration into the enterprise data hub 2.3.5 Testing and quality assurance inside SFO sandbox to validate proposed Solution 2.3.6 Solution transition plan (for migrating artifacts between solution environments) 2.3.7 Risk analysis and mitigation plan 2.3.8 Methodology for conducting a gap analysis to ensure requirements are met


AIR-590 (1-15) E-11 January 2017

3. Change Management and Stakeholder Engagement This continuous program lifecycle phase mandates the integration of the delivered Solution, its use cases, and other business needs with business stakeholders and Airport information systems. This includes, as deliverables, Business Transformation Services and Solution Transition Services.

3.1 Change Management

Provide change management methodology and expertise to ensure transitioning of new capabilities using the Solution in the following areas:

3.1.1 New services created and delivered through the Solution 3.1.2 Business process transformation in response to new capabilities provided by the Solution 3.1.3 Integrated change management processes with the Airports change management practice 3.1.4 Provide guidance on socializing process augmentation with business stakeholders 3.1.5 Manage risks associated with changes stemming from the use of the Solution

3.2 Stakeholder Engagement

Provide leadership and guidance by engaging the Airports business stakeholders and staff to communicate the benefits of the Solution while facilitating the verification of Use Cases and delivered services through the Solution. Support the capture and management of additional requirements to foster ongoing innovation to meet stakeholder needs. The Airport expects that the Stakeholder Engagement process shall result in the Airport’s digital transformation evidenced by an increasing use of the Solution’s services throughout the Airport.

3.3 Program Management

Provide expertise and methodologies through the delivery of a program management practice to ensure overall execution of the program into production in alignment with the Solution’s specifications. This mandates professional leadership and accountability from the Project Team in alignment with the objectives for realizing the goals of this program as well as the Airport’s strategic goals.

3.4 Business Transformation Services

Provide service delivery capabilities to support ways for SFO to transform its business through the configuration, development, orchestration, delivery and integration of new services with existing applications, databases and data streams using the Solution.

The delivered Solution shall provide SFO with capabilities to augment its current business services. The evidence of these capabilities shall be demonstrated by producing transformational business outcomes and results through the configuration, development and delivery of composite services in combination with existing business application, services and capabilities.

Produce evidence of these capabilities in support of the requirements in Section 5. Training &

Knowledge Transfer.

Delivery of Business Transformation Services shall include:

3.4.1 A methodology to deliver new data services in response to business opportunities, disruptions and ongoing requirements


AIR-590 (1-15) E-12 January 2017

3.4.1.1 Business Service Delivery models to produce and transition new solutions into production

3.4.1.2 Integration of new services with existing applications, databases, data streams and data stores to create new capabilities

3.4.1.3 Validated business outcomes from new services that provide evidence of transformative value

3.4.2 Solution Transition Services

Solution Transition Services provide evidence detailing the Solution’s Operational Capability Model including methodology, processes, resources and recommended best practices that will be used within ITT to deliver new services.

Solution Transitioning Services provide services to transition custody and operational capabilities of the successfully delivered Solution to SFO staff. After transition, SFO staff should be fully capable of configuring, developing and deploying new and existing services using the Solution’s components.

The Solution Transition Services shall provide:

3.4.2.1 Standard operating procedures to manage the entire Solution infrastructure 3.4.2.2 Actionable resource management processes for managing the Solution’s

infrastructure assets and resources along with best practices 3.4.2.3 Recommended best practices adopted for BizOps and continuous services delivery 3.4.2.4 Continuous integration process including rapid deployment through automation

for Platform as a Service (PAAS) and/or Infrastructure as a Service (IAAS) components and other frameworks (e.g. Jenkins, Ansible, Salt etc.) for both on premise and cloud resource management and delivery

3.4.2.5 Standards and processes to conduct operational monitoring of the Solution and instrumentation to ensure that new services adhere to SFO’s ITIL Service Design and Transition, Planning and Support processes

3.4.2.6 Fulfillment of the SLA/OLA - Proposed solution shall fulfill all specifications and defined metrics for service levels, operational levels and key performance indicators. Contractor shall demonstrate that the Solution satisfies the agreed upon SLA/OLA’s.

a. Solution Service Level Agreement (SLA)

The Solution shall be designed and implemented to provide:

• 99.997% uptime for all deployed Solution components and run time

services • High availability micro service architecture • Redundancy of major components and end points • Message processing capacity to meet latency limits of 100 milliseconds or

less • CEP speeds and capacity limits of 100 milliseconds or less

b. Solution Operational Level Agreement (OLA)

The Solution’s (configuration and deployment) shall provide:

• 99.997% uptime for all deployed environment components • The ability to provide redundancy across geographic locations, network

segment and servers if the solution uses a cloud or hybrid cloud model


AIR-590 (1-15) E-13 January 2017

• Run time event processing that can meet latency requirements (as defined by SFO on a per service basis)

• Monitoring services to measure operational KPIs (used to verify SLA compliance)

• Continuous Integration and Continuous Delivery (CI/CD) of services • Scheduled system updates and patching to ensure optimal operational state

c. The Solution’s design shall account for high availability and resiliency for all

mission critical data services, including horizontal scalability and elasticity where resources can be allocated in real-time according to demand. The design shall enable innovation and ensure sustainability, where growth and maintenance are managed to accommodate evolving business processes and disruptions.

d. Document how the Solution meets all defined SLA/OLA terms of agreement. e. Enable operational delivery of well-defined services (data services, messages,

outputs or applications) in compliance with requisite SLAs to support requirements.

f. Certify effective delivery of data services and applications so that all

requirements within each phase are met, develop and use a traceability matrix to show compliance with requirements and SLA/OLA objectives and ensure that KPI’s correctly measure and report targeted process metrics. The certification of matrixed requirements and deliverables will be used to measure completion of contractual objectives and transitioning the deliverables to subsequent phases.

3.4.2.7 Patterns to ensure services that are developed operate securely in alignment

with the requirements specified in Section 7. Security Protocol and Business Continuity, Section 7.1.

4. Use Case Implementation

The following phase mandates the implementation of each of the use cases in the Solution’s Production environment. This shall include the confirmation of detailed requirements, design, development and delivery of individual Use Cases and a Project Implementation Blueprint for the delivery of Use Cases. 4.1 Service Implementation Blueprint for delivery of Use Cases

The blueprint shall include an end-to-end lifecycle methodology that addresses requirements management, through delivery and validation of a Use Case, transitioned through all requisite environments. The service implementation blueprint shall clearly document methodology for the following lifecycle activities:

• Requirements gathering, analysis and confirmation • Service Architecture and Design • Service Development • Service Testing, Verification and Validation • Service Transitioning


AIR-590 (1-15) E-14 January 2017

The following environments shall be used to transition all Use Cases from inception to final production release:

• Sandbox/Development • Testing/Quality Assurance • Staging • Production

The following table lists Use Cases that the Airport has defined as critical for its digital transformation using the Solution.

UC-ID Use Case Description Business Service Domain UC-01 Airport Information

Backbone

Capabilities to provide the Airport with the ability to visualize and analyze real-time operational data though a single pane of glass for data and software services throughout the Airport’s technology and operations landscape. Capabilities to leverage Social media feeds and other data sources to measure airport service performance and perception in guest facing operations. Collection of metrics to produce real-time KPI dashboards. Services to support the Single Pane of Glass for real-time monitoring of network, telecomm, servers and system infrastructure.

Service Delivery and Performance Management

UC-02 Airport Information Broker

Capabilities to provide the Airport with the ability to manage and distribute data through APIs in order to augment its vision to provide a safe and exceptional passenger travel experience. This must include Apigee integration. Capability to provide business partners with opportunities to deliver passenger facing apps and services.

Products and Services

UC-03 Security Operations Capabilities to use real time operational data for camera analytics, doors, badges, and perimeter event detection to improve safety response procedures at SFO.

Security and Safety Identity and Access Management

UC-04 Flow Management Services

Capabilities for the Airport to ingest, manage and effectively process movement data generated throughout the Airport’s perimeter to make real-time operational decisions and store the data in order to utilize its patterns for analytical modeling for decision support. Capabilities to leverage flight and other data sources to estimate taxi service rates against passenger demand in real-time. Capabilities to leverage public-Wi-Fi usage, location based services, best route,

Enterprise Information Management Landside Operations Passenger Assistance Passenger Processing Landside Operations Concessions and Guest Services Business Intelligence and Data Science


AIR-590 (1-15) E-15 January 2017

and queue wait times to determine estimated time to get to gate. Capabilities to prevent or reduce outages, enhance passenger facing services, meet real-time demand for passenger services.

UC-05 Sustainability and Energy Management

Capabilities to leverage Building Information Model coupled with energy controls, HVAC and remote sensors to drive efficiency. Capabilities to leverage carbon footprint analysis, community socio-economic development, and environmental compliance.

Sustainability Enterprise Asset Management

UC-06 Universal Accessibility

Capabilities to provide access to resources and assets such as wheelchairs for the disabled. Capabilities to support ADA compliance throughout the airport. Capabilities to support innovations to aid terminal navigation for the disabled passenger.

Passenger Assistance Passenger Processing Security and Safety

UC-07 Geo Spatial Services Capabilities to leverage and federate the Airport’s master Geo-Spatial data and supports the management of Geo-Spatial data to comply with SFO's Building Inventory Model (BIM).

Enterprise Asset Management Enterprise Information Management

UC-08 Baggage Handling Services

Capabilities to track and communicate baggage data through the entire baggage lifecycle that complies with IATA-753 regulations. Capabilities to support operational baggage management.

Baggage Management

UC-09 Data Landscape Foundation

Foundational service capabilities to support the airports data landscape.

Data Services Landscape

UC-10 Messaging Landscape Foundation

Foundational service capabilities to support the airports messaging services landscape.

Messaging Services Landscape

UC-11 Application Services Foundation

Foundational service capabilities to support the airports application services landscape.

Application Services Landscape


AIR-590 (1-15) E-16 January 2017

5. Training and Knowledge Transfer

For the Knowledge Transfer component, the Contractor shall deliver and manage through the final phase of the contract term, agile methodologies, blueprints, templates, patterns, best practices, plans and schedules for the Solution’s delivery model, support and maintenance activities showing support and management of implementation risks and critical paths. The delivered Knowledge Transfer component shall provide coverage for at least the following areas: • Agile Service Delivery Models • Service Modeling and Integration Patterns • Data Science Service Delivery Models • Messaging Service Delivery Models • Infrastructure Service Delivery Models • Service Costing and Revenue Models • Training and Knowledge Transfer • Solution Maintenance and Support Delivery • Remediation and Corrective Action

For the Training component, at a minimum, the Contractor shall:

5.1 Provide on-site engineering and project management staff to design and implement the Solution and its Use Cases, and provide the requisite design, implementation training and knowledge transfer to SFO staff

5.2 Enhance SFO staff skills and capabilities to effectively deliver, transition and operate the services enabled by the Solution

5.3 Ensure and certify that SFO staff acquire requisite knowledge for Solution design, development and implementation (includes debugging and fix deployment) after training and knowledge transfer delivery

5.4 Provide training and knowledge transfer to SFO staff in the delivery of new services via the Solution, maintaining the operations of the Solution, and scaling the virtual, physical and network infrastructure to ensure Solution’s operational demands are met

5.5 Identify various types of training and knowledge transfer categories to include the following: • Integration Architect (complex event processing, service orchestration, choreography and mashups) • System Administrator • Software Engineer • Help Desk and Support • Cloud Solutions Architect (continuous delivery, artifact control and governance) • Data Management (data governance and master data management) • Data Science (data analytics, data mining, competitive intelligence) • Business Intelligence (data visualization, information analysis and decision support)


AIR-590 (1-15) E-17 January 2017

The following table is a guideline for identifying user group roles. The Airport may adjust the numbers based on the selected solution and final detail implementation and resource plan developed by the selected vendor.

User Group Estimated Number of Users

Integration Architect (complex event processing, service orchestration, choreography and mashups)

5

System Administrator

5

Software Engineer

25

Help Desk and Support

10

Cloud Solutions Architect (continuous delivery, artifact control and governance)

5

Data Management (data governance and master data management)

5

Data Science (data analytics, data mining, competitive intelligence)

5

Business Intelligence (data visualization, information analysis and decision support)

15

5.6 Provide a Data Scientist to mentor and educate SFO staff 5.7 Provide process governance, training and knowledge transfer to SFO staff and ensure service security

aligns with specifications in Technical Requirements 5.8 Provide training and operational knowledge transfer to include the following technical areas:

5.8.1 SFO technical staff to be trained in:

5.8.1.1 Software developers and engineers 5.8.1.2 Data management and data science team 5.8.1.3 System administrators 5.8.1.4 Service desk team 5.8.1.5 Integration architects 5.8.1.6 Business Intelligence team

5.8.2 Operational capabilities and configuration of the Solution 5.8.3 Service delivery models supported by the Solution 5.8.4 Troubleshooting, enhancing and improving the Solution’s capabilities 5.8.5 Ensuring the secure operation of the Solution and its data 5.8.6 Ensuring that SFO service desk staff are trained and fully capable to support the Solution before

the completion of Phase 3

6. Support and Maintenance The Contractor may propose providing the Support Contracts directly or indirectly as a contracted service with support and maintenance capabilities to include:

6.1 Solution Support


AIR-590 (1-15) E-18 January 2017

The Project Team shall demonstrate expertise and experience in the delivery of competent support capabilities for the objectives outlined in this section for all aspects of the Solution over the contract term. The key components of the support capability to be demonstrated by the Project Team are Technical Expertise and the Solution Support Plan.

6.1.1 Technical Expertise

Contractor shall provide: 6.1.1.1 A list of the Team members and their roles in the Support organization 6.1.1.2 A matrix of support roles to Solution components 6.1.1.3 Written evidence of the experience required for each support role 6.1.1.4 Experienced staff to support the Solution

6.1.2 Solution Support Plan

Provide a Solution Support Plan that ensures that the Solutions technical, service delivery and knowledge transfer requirements are met.

6.2 Maintain a phone line and an email account that enables the Airport to access technical and operation

assistance with 24x7x365 availability. 6.3 Provide ongoing Solution enhancements 6.4 Validation and implementation of new Solution software releases 6.5 Software patches and updates with requisite documentation for supporting environments (e.g. operating

systems, libraries, anti-virus software, etc.), which are implemented on a scheduled basis to resolve ongoing issues and improve reliability, security and performance for the proper operation of Solution

6.6 Ability to submit defects and resolve issues inside the Airport’s ServiceNow system providing full visibility of all issues and defects affecting the Airport’s Solution

6.7 Summary of resolved issues and timing relative to the first 48 hours of when issue was reported 6.8 Processes and protocols to handle all Solution related types, priorities and severities for incidents,

problems/issues, tickets and perform root cause analysis for all Solution and service malfunctions and outages.

7. Security Protocol and Business Continuity

7.1 Secure operational environment that supports service security standards specified as follows:

Service Security Protocol – Contractor shall deliver a Solution that meets SFO’s security governance principles for software services and cloud technology. The Solution shall provide the following capabilities to support secure operation of the entire Solution landscape:

• No non-standard or proprietary communications protocols • A strategy for certificate management and, where applicable, comply with or certify to Federal

Information Processing Standard (FIPS) Publication 140-2 requirements. • Conform to Information Security Management System (ISMS) requirements in ISO27001

standards • Identification, justification and documentation of all external services used for standard

operations, indicating process communication methodology including ports, communication protocols and security protocols used to communicate with such external services as well as authorization and authentication schemes used to interconnect with external services.

• Conform to ISO20000 Information System Service Management System (SMS) requirements • Provide a methodology for testing the security of the Solution’s perimeter that can be used by


AIR-590 (1-15) E-19 January 2017

SFO during and after the contract period • Enforce authorization, authentication and auditing with role-based access control (RBAC) policies

for data services and APIs as required by ISO20000 and ISO27001 • Provide monitoring capabilities or integrate with security incident management systems for the

detection of cyber-security attacks or data breaches • Provide the ability to escrow source code and build environment • If cloud based services are utilized, all components for the latest version of Cloud Security

Alliance (CSA) Cloud Controls Matrix should be submitted. If a cloud based Solution is being proposed, the response shall include the matrix from the link provided with evidence showing how the Solution complies with the matrix. See https://cloudsecurityalliance.org/download/cloud-controls-matrix-v3/.

For the Security Protocol and Business Continuity Component, at a minimum, the Contractor shall provide the following:

7.2 Business Continuity

The Contractor shall provide a plan to ensure business continuity for the Solution and its services during unplanned and risk events that affect the Solution’s expected run time capabilities and the ability for the Solution to meet defined SLA/OLA’s.

7.3 Continuity of Operations Plan (COOP)

The Contractor shall create, implement and maintain a Continuity of Operations Plan (COOP). Changes to this plan shall be governed and controlled by the Airport’s change management process.

7.4 Service Continuity and Availability Monitoring and Testing

Services shall be monitored for availability and uptime, the results recorded and compared with agreed targets. Unplanned non-availability shall be reported and investigated in ServiceNow to yield necessary actions to be taken to understand and correct availability issues related to all service outage incidents.

The results of all service availability tests shall be recorded. Reviews shall be conducted after each test and after the service continuity plan has been invoked.

A corrective action plan will be required of the Contractor to document each service availability failure, and will be reviewed, approved, implemented and signed off by SFO upon completion of the identified corrective action.

https://cloudsecurityalliance.org/download/cloud-controls-matrix-v3/


AIR-590 (1-15) E-20 January 2017

8. Glossary

ABCT Application Based Commercial Transport Service ACI Airport Council International ACL Access Control List ADA Americans with Disabilities Act ADM Airport Duty Manager Airport San Francisco International Airport AMQP Advanced Message Queuing Protocol API Application Programming Interface ASQ Airport Service Quality (ASQ) scores or Airport Survey BABOK Business Analysis Body of Knowledge (IIBA’s BABOK) BART Bay Area Rapid Transit BI Business Intelligence BIM SFO's Building Inventory Model BizOps Business and Operations BOM Bill of Materials BPEL Business Process Execution Language BPMN Business Process Modeling Notation CEP Complex Event Processing CER Conceptual Engineering Report CIP Continuous Integration Process e.g. Jenkins CJIS Criminal Justice Information Systems CMD Contract Monitoring Division CO2 Carbon Dioxide COTS Custom Off The Shelf products CPU Central Processing Unit CRM Customer Relationship Management CV Curriculum Vitae DevOps Development and Operations E2E End to End EA Enterprise Architecture EC Enterprise Convergence EEO Equal Employment Opportunity EIP Enterprise Integration Patterns (EIP) as defined by

Gregor Hohpe and Bobby Woolf. EONS Economic viability, Operational efficiency, Natural

resource conservation, and Social responsibility. ESB Enterprise Service Bus ETL Extract, Transform and Load FIPS 140 Federal Information Processing Standards 140 FSHP First Source Hiring Program GAAP Generally Accepted Accounting Principles GIS Geographical Information System GTMS Ground Transportation Management System GTU Ground Transportation Unit HCAO Health Care Accountability Ordinance HDFS Hadoop File System HTTP Hyper Text Transfer Protocol HTTPS Secure Hyper Text Transfer Protocol IAAS Infrastructure as a Service


AIR-590 (1-15) E-21 January 2017

IOPS Input Output Operations per second IoT Internet of Things ISO 27000 International Standards Organization ITIL Information Technology Infrastructure Library ITT Information Technology and Telecommunications JMS Java Message Service JSON JavaScript Object Notation KPI Key Performance Indicator LBE Local Business Enterprise LBEUTS Local Business Enterprise Utilization Tracking system LRS Linear Referencing System MCO Minimum Compensation Ordinance MOM Message Oriented Middleware MVP Minimum Viable Product NIST National Institute for Standards and Technology ODI Oracle Data Integrator OLA Operational Level Agreement PAAS Platform as a Service PCI Payment Card Industry PMBS Property Management and Billing system PMBOK Project Management Book of Knowledge PMO Project Management Organization QA Quality Assurance RDM Revenue Development Management REST Representational State Transfer Architectural Pattern RTSM Real-Time Statistical Model SAAS Software as a Service SAML Security Assertion Markup Language SBA Small Business Administration SDK Software Development Kit SDLC Software Development Lifecycle SFFD San Francisco Fire Department DMZ Demilitarized Zone SFO San Francisco International Airport SLA Service Level Agreement SMEs Subject Matter Experts SMTP Simple Mail Transport Protocol SNMP Simple Network Management Protocol SOA Service Oriented Architecture SOAP Simple Object Access Protocol SRR Service Registry and Repository (IBM) SSL Secure Sockets Layer SWOTs Strengths, Weaknesses, Opportunities, Threats TCP/IP Transmission Control Protocol/Internet Protocol TNC Transportation Network Company WGS84 Geo-Spatial Coordinate System using latitude and

longitude XML eXtensible Markup Language

Exhibit E - Technical Requirements Table of...

Documents

Transcript of Exhibit E - Technical Requirements Table of...