Request for Proposal NERC Alert System

July 11, 2012

Prepared By:

Justin Lofquist
Project Manager

3353 Peachtree Road NE Suite 600, North Tower Atlanta, GA 30326 404-446-2560 | www.nerc.com

Table of Contents

TableofContents............................................................................................................................1 1. Overview.................................................................................................................................5 1.1. Introduction.....................................................................................................................5 . 1.2. BusinessProcessDescription...........................................................................................5 1.3. BusinessObjectives..........................................................................................................7 2. FunctionalRequirements........................................................................................................7 2.1. UserRoleDefinitions........................................................................................................8 2.2. UserPermissionsDefinitions(TableprovidedinAppendix)............................................9 2.3. RolesandPermissionsRequirements..............................................................................9 SystemAdministratorRole...................................................................................................10 PrimaryComplianceContactRole........................................................................................10 2.4. BusinessObjects.............................................................................................................11 2.5. AlertRequirements........................................................................................................12 Creation.................................................................................................................................12 ModificationsandLinkstootherAlerts................................................................................12 Targeting...............................................................................................................................13 Distribution/AlertNotification............................................................................................13 ViewingAlerts.......................................................................................................................14 PrintingAlerts.......................................................................................................................15 2.6. AcknowledgementRequirements..................................................................................15 Configuration........................................................................................................................15 Acknowledgement................................................................................................................16

NERCAlertSystemRFPApril2012REV.:1

2.7. ResponseRequirements.................................................................................................16 Configuration........................................................................................................................16 Responses.............................................................................................................................17 LockedResponses.................................................................................................................18 Approval................................................................................................................................18 PeriodicResponses...............................................................................................................18 2.8. OnboardingRequirements ...........................................................................................19 . 2.9. RemindersandNotificationsRequirements..................................................................19 2.10. AdministratorRequirements......................................................................................20

UserManagement................................................................................................................20 2.11. 3. ReportingRequirements............................................................................................20

NonFunctionalRequirements..............................................................................................22 3.1. SecurityRequirements...................................................................................................22 3.2. AuditingRequirements..................................................................................................22 3.3. SystemRequirements....................................................................................................23 3.4. ExternalInterfaceRequirements...................................................................................23 3.5. PerformanceRequirements...........................................................................................24 3.6. LookandFeelRequirements..........................................................................................24 3.7. ApplicationProgrammingInterface(API)......................................................................24 3.8. DataRequirements........................................................................................................24 3.9. BrowserSupportRequirements.....................................................................................25 3.10. 3.11. MaintainabilityRequirements....................................................................................25 SystemAvailability,DataRetentionandRecovery....................................................26

4.

ProjectRequirements...........................................................................................................26 4.1. General...........................................................................................................................26

NERCAlertSystemRFP7/11/12

4.2. Assumptions...................................................................................................................27 4.3. Constraints.....................................................................................................................27 5. QualityControlDeliverables.................................................................................................27 5.1. Overview........................................................................................................................27 5.2. PreliminaryDesignandReview......................................................................................28 5.3. FinalDesign....................................................................................................................28 5.4. Code,UnitTestingandIntegrationTesting...................................................................29 5.5. PreproductionFunctionalTest......................................................................................29 5.6. DeliveryandProductionStartUp..................................................................................29 5.7. FinalAcceptance............................................................................................................30 5.8. Documentation..............................................................................................................30 5.9. Training...........................................................................................................................31 6. Warranty,SupportandMaintenance...................................................................................31 6.1. Warranty........................................................................................................................31 6.2. Support...........................................................................................................................31 6.3. Defects ...........................................................................................................................32 . 6.4. Enhancements................................................................................................................33 7. SubmissionInformation........................................................................................................33 7.1. EstimatedDeliveryandImplementationSchedule .......................................................33 . 7.2. SelectionSchedule.........................................................................................................34 7.3. ClarificationsProcess......................................................................................................34 7.4. Qualifications.................................................................................................................35 . 7.5. FormatforProposal.......................................................................................................35 7.6. ContractTerms...............................................................................................................36 7.7. Budgets...........................................................................................................................36 7.8. EvaluationCriteria..........................................................................................................37
3 NERCAlertSystemRFPApril2012REV.:1

7.9. AwardorRejectionofBids.............................................................................................38 8. Appendices............................................................................................................................38 8.1. Acronyms,Abbreviations,andDefinitions ....................................................................38 . 8.2. RolesandPermissions....................................................................................................40 8.3. SupplementalData.........................................................................................................41 8.4. AlertHandlingLevels......................................................................................................42 8.5. SampleAlertEmailNotification.....................................................................................43

NERCAlertSystemRFP7/11/12

1. Overview

1.1.

Introduction

ThemissionoftheNorthAmericanElectricReliabilityCorporation(NERC)istoimprovethe reliabilityandsecurityofthebulkpowersystem(BPS)inNorthAmerica.NERC accomplishedthismissionthroughenforcingcompliancewithmandatoryReliability Standards,conductingeducationandtrainingactivities,performingReliabilityand Adequacyassessments,analyzingevents,monitoringtheBPS,andprotectingcritical infrastructure. Relatedtothismission,NERCdevelopsAlertsbasedoninformationgatheredthrough variousresources,includingRegisteredEntities,governmentandindustrypartners,and othersources.TheseAlertsaremanagedthroughtheNERCAlertsystem. ThepurposeoftheNERCAlertSystemistodistributeandmonitorthestatusofNERC Alerts.TheNERCAlertsystemisalsoutilizedfortrackingandreportingofNERCAlerts. ThecurrentNERCAlertSystemisawebbasedsystem,andwhilefunctional,thesystem doesnotmeettheoperationalneedsandrequirementsofNERCsReliabilityRisk Management(RRM)andElectricitySectorInformationSharingandAnalysis(ESISAC)staff. Thecurrentsystemisveryrigidanddifficulttocreatealerts.Reportsonpublishedalertsare generatedonlybythevendor. NERCisissuingaRequestforProposaltoreplacetheexistingNERCAlertsystem.The currentNERCAlertsystemisawebbasedsystem,andwhilefunctional,thesystemdoes notmeetthecurrentoperationalneedsandrequirementsofNERCsReliabilityRisk Management(RRM)andElectricitySectorInformationSharingandAnalysis(ESISAC)staff. ThenewAlertSystemwillallowNERCtoissueandtrackthestatusofissuedAlerts. Likewise,thesystemwillprovidethefunctionalitytogeneratevariousreports. NERCspreferenceisthatthesystembeaturnkeyorcustomdevelopedsolutionshosted onNERCinfrastructureandcomaintainedbythevendorandNERC.NERCinfrastructureis developedonMicrosofttechnologiesandSharePointistheprimaryplatformforenterprise applicationdevelopment.Ifthesolutioniscustomdeveloped,NERCwouldstronglydesire itbebuiltonSharePoint.However,NERCwillconsiderotheroperationaloptions. 1.2. Business Process Description

Aspartofitsnormalcourseofbusiness,NERCofteneitherdiscovers,identifies,oris providedwithinformationthatiscriticaltoensuringthereliabilityoftheBPSinNorth America.Inordertoeffectivelydisseminatethisinformation,NERCutilizesAlerts,which aredesignedtoprovideconcise,actionableinformationtotheelectricityindustry.As definedinitsRulesofProcedure,NERCAlertsaredividedintothreedistinctlevels,as follows:

5 NERCAlertSystemRFPApril2012REV.:1

Level1(Advisories)Advisoriesarepurelyinformational,intendedtoadvisecertain segmentsoftheowners,operatorsandusersoftheBPSoffindingsandlessonslearned. Level2(Recommendations)RecommendationsarespecificactionsthatNERCis recommendingbeconsideredonaparticulartopicbycertainsegmentsofowners, operators,andusersoftheBPSaccordingtoeachentitysfactsandcircumstances. Level3(EssentialActions)EssentialActionspresentspecificactionsthatNERChas determinedareessentialforcertainsegmentsofowners,operators,orusersoftheBPS totaketoensurethereliabilityofthebulkpowersystem.SuchEssentialActionsrequire NERCboardapprovalbeforeissuance. RegisteredEntitieswhoreceiveLevel2(Recommendations)andLevel3(EssentialActions) Alertsevaluateandtakeappropriateaction.TheseRegisteredEntitiesprovidereportsof actionstakenandprovidetimelyupdatesonprogresstowardsresolvingtheissues addressedintheAlert,inaccordancewiththereportingdate(s)specifiedbyNERC. TheAlertssystemallowsNERCRRMandESISACpersonneltosendoutalertnotificationsto predefinedmembersandallowmemberstoviewandmangeAlertacknowledgementsand responses.Alertsareacknowledgedbyatleastonememberoftherecipiententity.Alert notificationswillbesentoutviaemail,andoptionallyShortMessageService(SMS),inorder toprovidethebestpossiblemechanismtoensuretimelyresponses.Entitymembership managementisperformedbytheentitysPrimaryComplianceContact(PCC)ordesignee. TheAlertSystemAdministratorhastherightstomanagethePrimaryComplianceContact information. ThetypicallifecycleofanAlertconformstothefollowingprocess: 1) NERCandESISACstaffscreateanAlertbyenteringalertcontentintothesystem. AttachedtothisAlertareseveralattributes,includingadistributionlist,theAlertlevel, whetherthealertneedstobeacknowledgedand/orrespondedto,thequestionsan entitymustanswerwhenresponding,andthefrequencywithwhichtheresponse reminderswillbesent.Atanypoint,theAdministratorcanpreviewtheAlerttoverify layoutandcontentareaccurate. 2) OncetheAlertispublished,anotificationissenttoallmembersofthedistributionlist. 3) Arecipientofthealertnotificationwillclickonalinkembeddedintheemailwhichwill navigatetotheAlertsystem,wheretheywillloginandviewtheAlert.Memberswill havetheability,basedonauthoritylevel,toprinttheAlertfordistribution. 4) Ifapplicable,userswithexplicitauthority,(CompanyOfficerordesignee),representing theentireentity,willthenacknowledgereceiptoftheAlert(someAlertswillnotrequire

NERCAlertSystemRFP7/11/12

anacknowledgement).ThisacknowledgementimmediatelyfollowstheAlert notification,typicallywithintwentyfour(24)hours. SomeAlertsmayrequireformalresponses(reportsontheactionstakenagainstthe Alert),usuallywithinsix(6)monthsofacknowledgement.Theseresponsesspecifically addressthequestionsattachedtotheAlert.Theseresponsesarecomposedby authorizedmembersrepresentingaRegisteredEntity. 5) Oncereviewed,anentityrepresentativewillapprovetheresponse.Oncearesponseis approved,itcannolongerbeedited. 6) SomeAlertsmayrequirethatresponsesbefiledperiodicallyuntiladequateresolution oftheAlerthasbeenachievedbytheRegisteredEntity.Theseresponsesaretypically filedonaquarterlyorbiannualbasis. 1.3. Business Objectives

ThebusinessobjectivesforthisprojectareindirectsupportofNERCsstrategicplanto promotereliability,collaborationandlearning. PromoteReliability:TheNERCAlertsystemwillincreasethereliabilityoftheBPSby facilitating: o Thecommunicationoffindings,analysesandrecommendationsregarding specificBPSoperations o TheassurancethatmembersreceiveAlerts o Accountabilityacrosstheindustrybyensuringappropriateresponsesare providedbyRegisteredEntities o Consistencyacrosstheindustryintakingspecifiedactions FosterCollaboration:IncreasedcollaborationamongNERC,RegionalEntitiesand RegisteredEntitieswillresultthroughthecentralizationandsecuredistributionofAlert informationacrossregionsandtheincreasedclarityandstandardizationofprocesses providedbythesoftwaresolution. ServeasaLearningOrganization:ThroughthedevelopmentoftheNERCAlertssystem, NERCwilleffectivelymanagecommunicationsacrossindustryandbeabletoprovide tangible,actionableinsightandguidanceforRegisteredEntities.

2. Functional Requirements

NERCAlertSystemRFPApril2012REV.:1

2.1. User Role Definitions

ThefollowingUserRoledefinitionswillbereferencedwhendescribingtheRolesand PermissionsRequirementspresentedinsection2.3.AdditionalUserRolesmaybedefined duringdetailedrequirementsgathering. InformationTechnology(IT)OwnerNERCITisconsideredtheowneroftheNERC Alertsystem.ITOwnershipresponsibilitiesincludemanagingthetesting,development, deployment,andmaintenanceofthesystem. NERCAlertSystemAdministrator(s) SystemandApplicationAdministratorofthe Alertssystem,primarilyconcernedwithfacilitatingdeploymentofalertstoindustry personnelandglobalusermanagement PrimaryComplianceContact(PCC)forRegisteredEntity Theprimarycontactwithin theRegisteredEntityforuseradministrationwithintheRegisteredEntity.ThePCCis responsibleforensuringthatinformationregardingRegisteredEntitypersonnelis currentandaccurate.Thereis1PCCperRegisteredEntity. AdministratorsforRegisteredEntityAssignedbythePrimaryComplianceContactfor aRegisteredEntitytoperformusermanagementduties.TheAcknowledgeandRespond privilegesareoptionalforanAdministratorandaredesignatedbythePCC. FunctionalGroupMembers EmployeesoftheRegisteredEntity,assignedtoa functionalgroup.Primarilyonlyinvolvedwiththesysteminthattheyreceivealert emailnotificationsandviewalertsthataretargetedattheirfunctionalgroup.The AcknowledgeandRespondprivilegesareoptionalforthisuserroleandaredesignated bythePCCorAdministrator. CompanyOfficer(CO) AssignedbythePCC,theprimaryresponsibilityofthisroleisto approveaRegisteredEntitysresponse.ACompanyOfficehastheabilitytodelegate thisfunction. RegionalEntityStaff ThestafffromtheeightRegionalEntitiesgrantedaccesstothe systembytheNERCAlertsSystemAdministrator. NERCPersonnelNERCemployees ElectricitySectorParticipant memberoftheelectricitysectornotemployedbyNERC, aRegionalEntityorRegisteredEntity NonEROParticipantagovernmentemployeegrantedaccesstotheAlertssystemby theNERCAlertsSystemAdministrator.

NERCAlertSystemRFP7/11/12

2.2.

User Permissions Definitions

ThefollowingUserRoledefinitionswillbereferencedwhendescribingtheRolesand PermissionsRequirementspresentedinsection2.3.Additionaluserpermissionsmaybe definedduringdetailedrequirementsgathering. Add/DeactivateUsersGloballyAddanddeactivateusersgloballyfromthesystem Add/Deactivate/EditLocalUsersTheabilitytoaddanddeactivateanaccountandto edituserprivilegesfromthesystemthatareinausersRegisteredEntity AcknowledgeTheabilitytoacknowledgeanAlert RespondTheabilitytosubmitaresponseforanAlert LockResponsesThisrolegrantstheabilitytolockaresponseinorderthatnochanges aremadepriortoresponseapproval. ViewAlertsTheabilitytoviewAlerts ViewResponsesTheabilitytoviewresponses ViewAcknowledgementsTheabilitytoviewacknowledgements View Dashboards The ability to view dashboard reports of the functional groups a usersregisteredentitybelongsto ReportingTheabilitytoviewAlertsystemreports ManagePCCRecordsTheabilitytoassignthePCCroletoanewlyaddedentity ApproveTheabilitytoapproveAlertresponses
Note:Seeappendix8.2RolesandPermissionsforthedefaultsetof permissionsassignedtorole.

2.3. Roles and Permissions Requirements

2.3.1. Each role has a standard set of permissions. This set of permissions can be modified by the System Administrator. Role modifications will affect the role across the entire system. Therefore, a role cannot have different sets of permissionsfordifferententitiesorfunctionalgroups. 2.3.2. Permissions can be assigned to a user independent of role. For example, the functional group member role does not have acknowledge permission by default.However,anadministratorcangrantaspecificuserthatpermissionso
9 NERCAlertSystemRFPApril2012REV.:1

the user can acknowledge alert, even though the user has only the functional groupmemberrole. 2.3.2.1. A user has the authority to assign or revoke individual permissions to anotheruserbasedontheirownpermissions. 2.3.2.2. Ausermaynotrevokeaspecificpermissionfromauserifthatpermission has been inherited as part of the said users role. For example, an administrator cannot revoke the Acknowledge permission from the PCC, asitispartofPCCrole. 2.3.3. AdditionalcustomrolescanbecreatedwithinthesystembytheNERCSystem Administrator. 2.3.4. Thesystemadministratorcancreateemaillistswhereemailaddressescanbe associatedwithoutrequiringauserbeingcreated(NERCdefinedlists). 2.3.5. Users can have multiple roles within an entity. If there is a conflict of permissions within roles, the effective permissions will be the aggregation o grantedpermissionsamongsttheroles. 2.3.6. A user can assume roles for more than one entity, and those roles can be different. 2.3.6.1. Individual and role permissions do not inherit across entities. For example, if a user is a PCC for entity A (with view dashboard permissions), but only a FGM for entity B, they will not have the view dashboardpermissionforentityB. SystemAdministratorRole 2.3.7. TheSystemAdministratorcanchangethePCCforeachentity. 2.3.8. TheSystemAdministratorwillmanageaccountinformationforthePCCforeach entity.Seesection3.4ExternalInterfaceRequirementsfordetails. PrimaryComplianceContactRole 2.3.9. PCCsmanagecontactandroleinformationforFunctionalGroupMemberswithin theirentity. 2.3.9.1. PCCs can add new users to the system as Functional Group Members withintheirownRegisteredEntities.
NERCAlertSystemRFP7/11/12 10

2.3.9.2. PCCscanforfeittheirPrimaryComplianceContactdesignationtoanother individualwithintheirorganization. 2.3.10. PCCscanacknowledgeanalertthatisassociatedwiththeirRegisteredEntity. 2.3.11. PCCs can delegate their responsibilities to another user within the Registered Entity. 2.3.12. MemberscanholdthisroleformultipleRegisteredEntities. 2.4. Business Objects

Thediagrambelowdescribesthemajorbusinessobjectsinthesystemandtheir relationships.Thoseobjectsindarkbluearestoredintheenterprise.

Alert

Subject Matter Area

Functional Area

Registered Entity

User

Region 2.4.1. UserinformationwillbestoredintheenterpriseActiveDirectory(2003).(See section3.4ExternalInterfaceRequirementsfordetails. 2.4.2. RegisteredEntityinformationwillbestoredintheNERCComplianceRegistry database.Seesection3.4ExternalInterfaceRequirementsfordetails. 2.4.3. ThesystemshallstoreAlertdataincludingbutnotlimitedtoAlertType(Industry Advisory,RecommendationtoIndustry,EssentialAction),TitleofAlert, FunctionalGroupandSubjectMatterAreatowhichitapplies,anddateonwhen theAlertwasdistributed.

11

NERCAlertSystemRFPApril2012REV.:1

2.5. Alert Requirements

Creation 2.5.1. UserswithCreateAlertpermissionswillbeabletocopy/pasteormanuallytype alertinformationdirectlyintothealertform. 2.5.2. AfunctionalareaorareasMUSTBESELECTEDforanalert,orthealertcannotbe published. 2.5.3. AlertcreatorswillhavetheabilitytoaddattachmentstotheAlert. 2.5.4. TherewillbeseparatepermissionsforcreatingandpublishingAlerts. 2.5.4.1. Noworkflowwillberequiredtomanagethissubprocess. 2.5.4.2. ThestatusoftheAlertwillbeclearlyvisible(DraftorPublished). 2.5.5. Therewillbe3differenttemplatesthatcorrespondtothelevelofthealert. Modificationofthesetemplateswillbeanenhancementofthesystemnot requiredascustomizablebyasystemuser. 2.5.6. Zerotomultiplequestionscanbecreatedforanalert(See3.7Response Requirements>Configuration).Responsestothesequestionswillalwaysbe required. 2.5.7. TheNERCAlertsystemwillprovidetheabilitytopreviewthealertashowitwill lookwhenprintedbyauserviewingthealert. 2.5.8. TheAlertcreatorcanconfigurewhetheranacknowledgmentorresponseis required. 2.5.8.1. Thereisadefaulttimelineforacknowledgement/response. 2.5.8.2. ThisdefaultcanbeoverwrittenduringtheAlertcreation. 2.5.9. AlertswillbeauthoredbydifferentbusinessunitswithinNERC.Alertsmaybe flaggedforviewingbyonlyspecificbusinessunits. ModificationsandLinkstootherAlerts 2.5.10. Alertscannotbemodifiedaftertheyarepublished.

NERCAlertSystemRFP7/11/12

12

2.5.11. IfanAlertneedstobeupdated,anewalertwillbecreated,withtheabilityto referenceanexistingalert.Thisreferencewillbebidirectional,sobothAlerts (thereferencingandthereferenced)willdisplayalinktotheother. Targeting 2.5.12. Alertsaretargetedtoone,moreorallregisteredfunctions,subjectmatterareas, RegionalEntities,andRegisteredEntities,inanycombination. Forexample,anAlertcanbetargetedforGenerationEngineersbelongingto GeneratorOperatorEntitiesintheNPCCRegion.IfauserbelongstoaGenerator OperatorEntity,butintheWECCregion,theuserwillnotreceivethealert. 2.5.12.1. Selectionoptionsshouldbeasfollows: Selectoneorallentityfunctionalgroupsatonce Deselectoneorallentityfunctionalgroups Selectoneorallsubjectmatterareasatonce Deselectoneorallsubjectmatterareasatonce Selectoneorallregionsatonce Deselectoneorallregionsatonce SelectanindividualRegisteredEntity 2.5.13. NERCDefinedListscanbeaddedtoanalertdistributionlist. Distribution/AlertNotification 2.5.14. AlertNotificationswillbesenttoallFunctionalGroupMemberswhomeetthe targetingcriteria. 2.5.15. AlertemailnotificationswillbesentviaemailandoptionallySMS(configured whencreatingthealert). 2.5.16. Ifauserisamemberofacombinationoffunctionalgroupsandresponsibilities targetedbyanalert,theuserwillonlyreceiveonealertnotification. 2.5.17. Areportwillshowtheemailaddresseswhichhavebouncedonalertemails. 2.5.17.1. Thisreportwillonlybesenttothecreatorofthealertandthesystem administrator. 2.5.17.2. ThisreportcanbeaccessedfromtheAlertDetailscreenbythosewiththe appropriateauthority.
13 NERCAlertSystemRFPApril2012REV.:1

2.5.17.3. AbouncebackreportcanbesenttoallPCCswhoseentityistargetedin theAlert.Thereportwillonlycontainthenamesoftheusersthatare membersofthatentity. 2.5.18. The alert email notification sent out by the system will contain textual informationSeesection8.5SampleAlertEmailNotification. AbriefdescriptionoftheAlert TheAlertlevel RegisteredFunctionstargetedbytheAlert ResponsibilitiestargetedbytheAlert A link to the system login page. Upon successful signin, the user will be directedtothepagedisplayingthealert. ForgetUsername/Passwordinstructions Contactinformationforinquiries 2.5.19. WhenbothanemailandSMSmessagearesent,thealerttextmayvarybetween SMSandemail. 2.5.20. Alertnotificationsaresenttotheemailaddressandphonenumberonthe contactinformationrecord. 2.5.21. Thesystemshallprovidetheabilitytosendmessages/updatesforAlertstoa predefinedgrouporasubsetofagroupwithinthealertdistributionlist(e.g.all thosewhohavenotrespondedtoanalert). 2.5.21.1. Thislistcanbegeneratedfromreports:thesystemwillprovidea mechanismtoconvertthelistofusersonthereporttoadistributionlist. 2.5.21.2. Themessagewillhavecustomcontent. ViewingAlerts 2.5.22. Usershave2viewsofthesystemAlerts.Oneisadetailedviewwhichwillshow allinformationaboutanalert.Thesecondisalistview,whichshowsallalerts theuserhaspermissionstoview,sortedbymostrecentoftop. 2.5.23. Whentheuserclicksthelinkinthealertnotification,onceloggedin,shewillbe directedtothedetailpageofthatalert. 2.5.23.1. Thisdetailviewwillshowthefullcontentofthealert.
NERCAlertSystemRFP7/11/12 14

2.5.23.2. Thedetailviewwillalsodisplayallavailableactionsthatcanbetaken againstthealert(e.g.acknowledge,respond,print) 2.5.23.3. Fromthedetailview,theusercannavigatebacktothelistview. 2.5.24. Thelistviewisthedefaultview 2.5.24.1. Themostrecentlyissuedalertishighlighted 2.5.24.2. Thislistincludesallalertsthatwerepublishedbeforetheentityjoinedthe BES(seesection2.8OnboardingEntities) 2.5.24.3. Basedonsecurity,ausercanseetheirentitysstatusforthatparticular alert(e.g.acknowledged,approved,andresponded). 2.5.24.4. Basedonsecurity,ausercanclickshortcutbuttonsonthelistviewthat takesthemdirectlytotheAlertsacknowledgementform,responseform, referencedalert(ifapplicable)andAlertdetailpage. 2.5.25. Basedonsecurity,whenauserlogsintothesystemitshallclearlystatetheir entitiesstatusforthatparticularalert(e.g.lastupdated,approved,etc),onboth thelistanddetailview. 2.5.26. Viewpermissionsaredifferentthannotificationpermissions:ausercanviewan alertthatshewasnotnotifiedof. 2.5.27. Forusersthataremembersofmultipleentities,thesystemwillindicatefor whichentity(orentities)theAlertwastargeted. PrintingAlerts 2.5.28. SystemuserscanexportalertstoPDFonly.Thisoptionwillberestrictedto thosealertstheyreceive.(Basedontheirroleandalertlevels,usersmaynot receivecertainalertnotificationsand/orviewcertainalerts). 2.5.29. PrintableversionofalertfromAlertSystemwillhavetheexactsamelookasthe Alertasdisplayedonthescreen. 2.6. Acknowledgement Requirements

Configuration 2.6.1. Alert creators can configure a timeframe for an acknowledgement to be received. 2.6.1.1. ThisinformationisincludedintheAlertdetailsandisconfigurableduring
15 NERCAlertSystemRFPApril2012REV.:1

Alertcreation. 2.6.1.2. Defaultacknowledgementiswithin24hours.Acknowledgementwindows willnotvarybyentityortargetedgroupwithinanalert. Acknowledgement 2.6.2. Whenauserentersthesystemtoviewanalert(onthedetailorlistview),there will be an option to acknowledge the alert (if the user has permissions). This optionwillonlybeavailableuntilthealerthasbeenacknowledgedforanentity. 2.6.2.1. If a race condition exists (i.e. 2 users log in at the same time and acknowledge),onlythefirstacknowledgementwillberecorded.Theuser submittingthesecondacknowledgementwillbenotified. 2.6.3. The acknowledgment form will be automatically populated with the following information: NERCComplianceRegistryIDNumber NameofEntityaslistedonNCR PrimaryComplianceContactInfo(name,emailandphone) AcknowledgerscontactInfo(name,emailandphone) 2.6.4. Multipleentitiesmaybeacknowledgedononeform,solongasthe Acknowledgerisamemberofthoseentitiesandissodesignated.Thesystem willlistallEntities(andcorrespondingPCCinformation)towhichthe acknowledgerhasacknowledgementprivileges,withaselectalloption. 2.6.5. Alertacknowledgementandtheresponsibilitytorespondisonlyrequiredfor companies/entitiesthatareactiveatthetimethealertisissued,exceptfor thosealertsflaggedasrequiringactionforanysubsequentonboardedentities (Seesection2.8OnBoardingEntities). 2.6.6. Notallalertsrequireanacknowledgement 2.7. Response Requirements

Configuration 2.7.1. Alert creators can configure a timeframe for an acknowledgement and a responsetobereceived. 2.7.1.1. ThisinformationisincludedintheAlertdetailsandisconfigurableduring
NERCAlertSystemRFP7/11/12 16

Alertcreation. 2.7.1.2. Defaultacknowledgementis60days.Responsewindowswillnotvaryby entityortargetedgroupwithinanalert. 2.7.2. Theresponseformcanbeaccessedfromeitherthedetailorlistviewandwillbe automatically populated. Example of the automatically populated information include: SubjectorAlerttowhichtheresponsepertains Dateandtimeofresponse NCRIDNumberNameofEntityaslistedonNCR PrimaryComplianceContactInfo(Name,Email,PhoneNumber) Responderinformation(Name,Email,PhoneNumber) Required reporting as specified in the questions posed (action taken, progress towardsresolvingissuesraised) 2.7.3. Thealertcreatorwillspecifytheresponsefieldtypewhencreating questions(e.g.textfield,datefield,optiongroup,checkboxes). 2.7.4. Thesystemwillnotallowresponsestohavetieredresponseduedateson multiplequestions. Responses 2.7.5. Entitieswillbeabletomodifytheresponseupuntilitisapproved. 2.7.6. If a user has Respond permissions for multiple entities, she can generate one responseonthebehalfofone,allorasubsetoftheentitiesforwhichsheisa respondent. 2.7.7. Responses cannot be given by multiple Respondents for an entity. So, 2 users may have the right to respond, but only 1 response record is created and modified. 2.7.8. The list of questions on a response form can be exported to Word so that entitiescandistributequestions,compiletheanswers,andthencopy/pastethe answersbackintotheresponseformwithoutretyping. 2.7.9. Thesystemwillallowuserstouploaddocumentsassociatedtothereponse.

17

NERCAlertSystemRFPApril2012REV.:1

LockedResponses 2.7.10. Thesystemshallprovidetheabilitytoflagandlockresponsesthatare consideredcomplete. 2.7.11. TheSystemAdministratorhasthepermissionstounlockaresponseforre editing. 2.7.12. InthecasethataresponsehasalreadybeengivenbyanotherRespondentand locked, a message will appear indicating that a response has already been entered and locked by a Respondent for this entity. That response cannot be updatedonlyviewed. 2.7.13. Whentheresponseislocked,allotherusersthathaverespondpermissionsfor thatentitywillbenotifiedthattheresponseisreadyforapproval. Approval 2.7.14. Onlyuserswithappropriatepermissionsmayapprovearesponse. 2.7.15. The Approve option will only be available on the response form once the responsehasbeenlocked. 2.7.16. Oncetheresponsehasbeenapproved,allotheruserswithApprovalpermissions fortheentitywillbenotifiedthattheresponsehasbeenapproved. 2.7.17. AlluserswithApprovalpermissionsshouldreceiveReadyforApprovalemail notificationwhenaresponseisreadytoapprove(i.e.locked). 2.7.18. TheSystemAdministratorwillhavetheabilitytoopentheresponseforre editingaftertheapprovalprocesshasbeencompleted. PeriodicResponses 2.7.19. Somealertsrequirefollowupresponsesonaperiodicbasis(e.g.everyquarter) untiltheentityresolvestheissuesoutlinedinthatAlert. 2.7.20. TherewillonlybeonesetofquestionsacrossallresponseperiodsforanAlert. 2.7.21. Auserwillbeabletoconfigurethefrequencyandtimeframetheentitiesmust adheretofortheseperiodicresponses. 2.7.22. Periodicresponseswillfollowthesameprocessasnonperiodicresponses(e.g. lockingandapproval).
NERCAlertSystemRFP7/11/12 18

2.7.23. Thesystemwilldisplayallresponsestoanalerttogetherinalist,sothatauser canseeanarrativeofanentitysresponsetoanalertovertime. 2.7.24. Thesystemshallprovidetheabilitytolockresponses,sothatnoadditional responsescanbeenteredforaparticularperiod.Forthenextupdateperiod, thepreviousresponsesshallremainlockedandanewresponseperiodshould opentheabilitytorespondagainuntilanotherdate.Thesystemshallprovide theabilitytosupportthisprocessongoing. 2.7.24.1. TheseperiodsareconfigurablewhencreatingtheAlert. 2.7.24.2. Theadministratorcanunlockresponses. 2.7.24.3. NotethisisdifferentthantheLockedResponsesprocessdescribed above. 2.8. On-boarding Requirements

2.8.1. AnAlertcanbeconfiguredsothatanacknowledgementand/orresponseis requiredbyentitiesthatjointheBPSafterthealerthasbeenpublished. 2.8.2. Thesealertsareautomaticallyassociatedtoanentitywhentheentityisfirst registeredwiththesystem. 2.8.3. AnemailisautomaticallysenttothePPCwiththelistofalertsrequiring response,andthealertwillappearonthelistofAlertsforthatentity. 2.8.4. Anentitycanberelatedtoapreviouslyexistingentity.Forexample,anentities mightmergeorbereassignedNCRnumbersduetoownershipchanges.The alerthistoryfortheexpiredentitywillbecarriedover.However,thesealerts willbereset,sothattheywillneedtobereacknowledgedandresponsesre approvedbythenewentity. 2.9. Reminders and Notifications Requirements

2.9.1. ThesystemwillsendanemailremindertolateAcknowledgers,andResponders. 2.9.1.1. Therewillbeadefaultconfigurationastothenumberandscheduleofthe reminders. 2.9.1.2. ThealertcreatorwillbeabletoconfiguretheseremindersduringAlert creation. 2.9.1.3. Reminderstothetargetgrouporsubgroupcanbesentmanuallyaswell (e.g.thosethathavenotyetrespondedtoanAlert).Thiswillnotoverride thereminderschedule.
19 NERCAlertSystemRFPApril2012REV.:1

2.9.2. The system will automatically send an overdue notification to all entities that have not acknowledged and/or responded by the Acknowledge / Response Requireddate/time. 2.9.2.1. Therewillbeadefaultconfigurationastothenumberandscheduleofthe overduenotifications. 2.9.2.2. ThealertcreatorwillbeabletoconfigurethesenotificationsduringAlert creation. 2.9.2.3. Overduenotificationstothetargetgrouporsubgroupcanbesent manuallyaswell.Thiswillnotoverridethereminderschedule.

2.10.

Administrator Requirements

UserManagement 2.10.1. Usermanagementwillbedistributed,sothattheAdministratorrolecanmanage allusersandthePCCforanentitywillmanageusersforthatentity. 2.10.1.1. Alluseractions(rolechanges,reactivations,etc)canbeassignedastasks bythesystemadministratortoaPCC. 2.10.2. UserscanbeassociatedtomultipleRegisteredEntitiesconcurrently. 2.10.3. TheremustbeatleastoneRespondentselectedperSubjectMatterAreaand FunctionalGrouptowhichanentityisassigned. 2.10.4. Usersmustbeassociatedtoatleastonerole. 2.10.5. ContactswithinanEntitycanbemarkedinactive,butthesystemwillnotdelete anyalertorresponseinformationtiedtothesecontacts,includingtheauditlog. 2.10.5.1. UserscanbereactivatedbythePCCorthesystemadministrator. 2.11. Reporting Requirements

Standardreportswillincludebutnotbelimitedtothefollowing: 2.11.1. Acknowledgements,responsesandapprovals Byalertorentity Acrosshistoricaltimeperiods Forperiodicalerts,thiswillbebrokendownbycycle

NERCAlertSystemRFP7/11/12 20

2.11.2. Entitiesthathavenotprovidedacknowledgementsorresponses Byalertorentity Acrosshistoricaltimeperiods Forperiodicalerts,thiswillbebrokendownbycycle 2.11.3. Alerts Listofentitiesissuedthealert Listofalertsissuedtoanentity 2.11.4. Entities Listofnewentitiessinceaparticulardate Listofentitiesandtheirregistrationdates,filteredbydaterange Entitiesthatdonothaveanyassignedusers PercentofAlertsanentityhasbeenlateinacknowledgingorrespondingto 2.11.5. PeriodicAlerts For periodic alerts, the number of cycles an entity has been aware of the alert Listofallperiodicalertsanewlycreatedentitymustsubscribeto 2.11.6. ThesystemshallprovidedashboardsforRegisteredEntities,RegionalEntities, andNERCBusinessOwners,whichdisplayasummaryofinformationregarding alerts(e.g.thenumberofentitiesthathaverespondedversusthepercentthat havenot). 2.11.6.1. Eachdashboardwilldisplayinformationapplicabletotheloggedinuser withregardtotheirroleandpermissions. 2.11.7. Thesystemshallprovideareportthatshowsalluserinformation,includingtheir rolesandcorrespondingpermissions,byentityand/orbyregion. 2.11.8. TheNERCAlertsystemshallprovidetheabilitytoperform,queryandusea reportcreationtooltoproducecustomreports.Examplesofreportsinclude (butarenotlimitedto): NERCAlertsgeneratedforadefinedtimeperiod ResponsesforspecificNERCAlerts ReportsbyRegionalEntities ReportsbyRegisteredEntitytypes 2.11.9. Thesystemshallprovidetheabilitytodownloadreportsinmultipleformats
21 NERCAlertSystemRFPApril2012REV.:1

3. Non-Functional Requirements
3.1. Security Requirements

3.1.1. ThesystemshallmeetallNERCCriticalInfrastructureProtection(CIP)standards asoutlinedandprovidedbyNERCIT. 3.1.2. Whenauserlogsintothesystem,thesystemshallensurethattheuserisonly presentedwiththeaccessasdesignatedfortheiraccount(e.g.buttons/options notavailablefortheiraccessshouldnotbepresented). 3.1.3. NERCITwillhaveadministrative/rootaccesstosystemandsupporting infrastructure. 3.1.4. Thesystemshallusesecureprotocolsforalldatatransfers(e.g.useof encryptionandSSL). 3.1.5. Thesystemshallsupportobjectlevelpermissions(e.g.someusershave permissiontotakespecificactionsonaparticularAlertwhileothersdonot). 3.1.6. Sessiontimeoutissetto45minutes,withawarning5minutebeforethesession expires.Informationnotsavedatthattimewillbelost. 3.1.7. Thesystemshallprovideasecuremeansforuseridentificationretrieval. 3.1.8. Thesystemshallpreventconcurrentloginsessionsforauser. 3.1.9. Thesystemshalllockoutafteraspecifiedtimeperiod. 3.1.10. Thesystemshallpresentanauthorizedusebanner/statementforallusers enteringthesystem. 3.1.11. Thecollectivecontentofoutgoingemails(SubjectplusBody)doesNOTcontain morethanoneofthefollowing:Username,Password,orURLtotheNERCAlert System. 3.2. Auditing Requirements

3.2.1. Thesystemshallprovideasecureaudittrailofallactivities,forallaccounts, takenbyusersonbusinessobjects,includingthedate,typeofaction, description,andtheactinguser,andwhethertheeventwasasuccessorfailure.

NERCAlertSystemRFP7/11/12 22

3.2.2. Allsystemerrorswillbelogged,andadistributionlistforerrornotificationswill bemaintainedbythesystem. 3.3. System Requirements

3.3.1. Businessobjects(includinguseraccounts)willbeexportabletoMicrosoftExcel, includingbutnotrestrictedtolistsofUsers,Alerts,RegisteredEntities,Regional Entitiesandfunctions. 3.3.2. SecurescriptingandNERCcodingpracticeswillbeimplementedacrossthe entiresystem,includingtheuseofthelatestversionofC#ifpossible. 3.3.3. TheapplicationuserinterfaceshallbewebbasedandaccessibleviatheInternet. 3.3.4. Thesystemshallsupportdatavalidationforalldataentry. 3.3.5. The user will be able to copy/paste information into the form in addition to manuallyenteringtext. 3.3.6. TheNERCALERTS.COMdomainwillbeusedtosendoutalertsfromthe ALERTS@NERCALERTS.COMaddress. 3.3.7. TheNERCAlertsystemmustadheretoNERCCIPstandardsandNERCinternal standardsandpolicies(tobeprovidedtovendor). 3.3.8. Thesystemshallprovidetherobustsearchingcapabilities,includingbutnot restrictedto: RegisteredEntitySearch(Name,NCRNumber) Alert(Name,AlertNumber) Users(FirstName,LastName,EmailAddress) 3.3.9. Thesystemshallprovidedetailedonlineandsearchablehelpfiles. 3.3.10. Thesystemshallidentifyeachbusinessobjectbyauniqueidentifier. 3.3.11. Thesystemshallprovidetheabilitytostoreusercreatedfields. 3.3.12. ThesystemshallsupportanautomatedandcustomizableworkflowforAlert types. 3.4. External Interface Requirements

3.4.1. Forusermanagement,thesystemshallintegratewithaNERCdeveloped applicationinterfacethatexposesActiveDirectory2003totheenterprise.User

23 NERCAlertSystemRFPApril2012REV.:1

managementfunctionswillbeexposedtotheAlertsAdministratorthrough screensdevelopedaspartofthisproject.Thosescreenswillincludepassword management,activatingandinactivatingusers,andmodificationofprofile information. 3.4.2. ThesystemwillinteractwiththeComplianceRegistrydatabaseinorderto retrieveacurrent,activelistofRegisteredEntities.TheAlertssystemwill respondinnearrealtimetochangesintheRegistrydatabase,includingaddition ofnewentitiesandthoseinactivated. 3.5. Performance Requirements

3.5.1. Alertemailnotificationsshouldbesentimmediatelyuponpublication. 3.5.2. Thesystemwillbeabletosendanemailnotificationrequestwithupto20,000 recipientstoanemailserver. 3.5.3. Thesystemwillbecapableofsupportingupto2,000concurrentusers. 3.5.4. Thesystemshallsupportanaverageresponsetimeoflessthan3secondsunder peakoperatingsituationswhenexecutedontheproductioninfrastructure. 3.5.5. Theaverageresponsetimeforallreportrequestsshallbe10secondsorlessfor synchronousand5minutesorlessforasynchronoustasksontheproduction infrastructure. 3.6. Look and Feel Requirements

3.6.1. Site look and feel will be identical to the NERC web site and approved by the NERCCommunicationsGroup.Astylingguidewillbeprovided. 3.7. Application Programming Interface (API)

3.7.1. Thesystemshallofferdirectdatabaseaccess. 3.8. Data Requirements

Pleasenote,allvolumesdescribedbelowshouldbeconsideredestimates,not upperlimits. 3.8.1. DatashallbestoredinasecureRDBMS.

NERCAlertSystemRFP7/11/12 24

3.8.2. TheNERCAlertsystemshallsupportaminimumof20,000activeuseraccounts, withaprojectedyearlygrowthof10%. 3.8.3. TheNERCAlertsystemshallsupportaminimumof20,000inactiveuser accounts,withaprojectedyearlygrowthof5%. 3.8.4. Theysystemshallsupportaminimumof5,000registeredentities,witha projectedyearlygrowthof5%. 3.8.5. TheNERCsystemwillgenerateapproximately30alertsayear,with20,000 acknowledgementsandresponses. 3.8.6. Thesystemshallprovideadequatecapacitytoarchive10yearsofdataandthe abilityforinstantretrievalofsuchdatawhennecessary. 3.9. Browser Support Requirements

3.9.1. Thesystemshallsupportthebrowsersthatmakeup90%+ofinternetusageat thetimeofprojectinitiation. 3.9.1.1. Thesystemshallsupportthemostcurrentversionofthesebrowsersthat havebeenonthemarketforminimum6months. 3.10. Maintainability Requirements Indesigningtheapplicationarchitecture,ahighdegreeofconsiderationshallbegivento thelongtermmaintainabilityofthesystem.Considerationstolongtermenhancement, troubleshooting,interchangeabilityandrepairofthesystemisofmostimportance.The objectiveistominimizefuturemaintenancelabor,materialcostsandresources. 3.10.1. Standardcomponents,includingopensourcesolutionsthathavebeenaccepted andtestedbythesoftwareindustry,maybeused. 3.10.2. Asoftwarepreventativemaintenancescheduleshallbedevelopedandapproved byNERC. 3.10.3. Nononstandardcomponentorpracticeshallbeusedwithouttheexplicit approvalofNERC. 3.10.4. Thereshallbeameanstoverifythereleaseandversionofthesystems componentsthathavebeendeployedtotheproductionenvironment.

25

NERCAlertSystemRFPApril2012REV.:1

3.10.5. Upgradestothehostoperatingsystemorhostdatabaseshallnotrequire changestotheapplication. 3.11. System Availability, Data Retention and Recovery

TheNERCAlertsystemisconsideredamissioncriticalsystem,andthereforethefollowing requirementswillbeimplementedaspartoftheapplication. 3.11.1. Recoveryofsystem,dataandinterfaceswithin2hours. 3.11.2. ThedisasterrecoveryprocesswillbejointlydevelopedbyNERCandthevendor.

4. Project Requirements
4.1. General

4.1.1. ItisexpectedthattheVendorsupplyprojectmanagement,businessanalysis, andtestingservicesfortheproject.NERCwillsupplyITresourcestoadviceand aidwithintegration,alongwithprojectmanagementforengagementoversight. 4.1.1.1. Additionalbusinessanalysiswillbeperformedbytheselectedvendorin ordertogatheradditionaldetailsnotoutlinedinthisRFP.Thisincludes interviewingtwobusinessunitswithatotalofapproximating10users. 4.1.1.2. VendorprojectmanagementeffortswillalignwithNERCproject managementmethodology,whichincludesthefollowingprocessesand artifacts: Communicationsmanagementandstatusreporting Issuetrackingandriskmanagement Scopecontrol Activityplanningandresourceloading Qualityplanningandcontrol Changecontrolmanagement 4.1.1.3. NERCPMOwillprovideprojectoversightandcontrol,whilefacilitating communicationsbetweenthevendorandtheNERCorganization. 4.1.2. Vendorwillbeprovidedinitialseeddatatobeloadedintothesystem.
NERCAlertSystemRFP7/11/12 26

4.1.3. RemotevendoraccessintoallNERCsystemenvironmentswillconformtoNERC ITstandards. 4.1.3.1. Thevendorshallprovideamethodologytobeusedtoconformtothe securityproceduresenforcedbyNERC.Themethodologymustaddress useraccess,protectionagainstviruses,accidentaldisturbancesofthe databaseandothercontaminatingsoftware. 4.1.4. VendorwillberequiredtoperformanExtraction,TransformationandLoad(ETL) ofdatafromtheexistingAlertsSystem.Supportforanyerrorsencountered duringtheprocesswillbesuppliedbyNERCstaff. 4.2. Assumptions

4.2.1. ThevendorwillbeprovidedagroupofAlerttemplateswhoselookandfeelwill bemimickedonthenewsystem. 4.2.2. NERCwillprocurethehardwarerequiredtoimplementthesystem,with specificationguidanceprovidedbythevendor. 4.3. Constraints

4.3.1. Vendorwillnothaveaccesstoproductiondata.

5. Quality Control Deliverables

5.1. Overview

Design,development,testanddeliverycoverthebulkoftheactivitiesofthevendorforthis project.Theseactivitiesaredefinedtoincludetheformallydefined"lifecycle"activitiesof: PreliminaryDesign FinalDesign CodeandunitTest IntegrationTest FunctionalTest DeliveryandStartUp Acceptance 5.1.1. Inspections,demonstrationsandtestingbyNERCwillberequiredperiodically duringtheprojecttomonitoritsprogress.Theuseofaniterativedevelopment methodologysuchasAgilewouldmeetthisrequirement.
27 NERCAlertSystemRFPApril2012REV.:1

5.2. Preliminary Design and Review

Thepreliminarydesignisaconceptuallevelviewoftheelementsofthesystemwherethe selectedvendordevelopsafunctionalspecificationofthesystemfromtheuser's perspective.AfterthesedesignsandspecificationsarereviewedbyNERCtheywillserveas thebasisforthesystem. 5.2.1. DuringthepreliminarydesignthecontractoristopresentNERCwithitsintended systemdesign,codestructureanddesignpatternstobeused,system wireframes,developmentmethodologies,andidentifyissuestoberesolved. 5.2.2. Thisdesignphaseshallalsoincludeareviewofatleast: Userfunctiondescriptions Wireframelayouts Softwarearchitectureandinterfaces Anyupdatestoreliability,expansionorcapacityissues Informationneeds AcceptanceTestProcedure(ATP)basedonthefunctionalspecifications

5.2.3. TheATPshalladdressafullfunctionsoftwaretestofthewebsitetoverify design,workmanshipandperformance.Thisincludestestmethodologyand setup,evaluationcriteria,individualfunctiontests,sequencetestsandtest report.Thetestingprocedureshallberequiredinordertoadequacymonitor phasesofthesystemdevelopmentandinstallation. 5.2.4. ThereviewshallbeconductedbyNERCandheldnotmorethan<timeline dependant>weeksafter"NoticetoProceed"isissuedtothecontractor. 5.3. Final Design

Thefinaldesignactivitieswillbuildonthebaselineestablishedinthepreliminarydesign phase. 5.3.1. ThefinaldesignwillconcludewithatechnicaldesignreviewbyNERCincluding butnotlimitedto: Reviewofalldocumentation Finalscreenlayoutsincludingfinalbrandingdetailsandformats ReviewoftheAcceptanceTestProcedure Reviewofsoftwarearchitecture,transactionsanddata Applicationdevelopmentandimplementationschedule

NERCAlertSystemRFP7/11/12

28

5.3.2. Thefinaldesignshallbeconductedwithin2weeksofthepreliminarydesign reviewfortheNERC'sapproval. 5.4. Code, Unit Testing and Integration Testing

5.4.1. TheNERCprojectteamshallparticipateinperiodicreviewsofthesoftwarecode development.Thisreviewshallincludebothdesigncharacteristicsandqualityof workmanship. 5.4.2. Unittestsshallbewrittenasameanstoregressiontestandmaintainthe system.Aminimumof85%codecoverageisrequired.Unittestsshallbe includedaspartofthesolutiondeliverableandbepartofthesystemregression test. 5.4.3. TheAcceptanceTestProcedureshallbecompletedinthisphaseandreadyfor review,approvalandacceptancebyNERCsprojectteam. 5.4.4. Aspartofdevelopment,thevendorwillberesponsibleforperforming integrationtestingbetweenthesystemandanyexistingsysteminterfacesas required. 5.5. Pre-production Functional Test

5.5.1. Uponcompletionofthesystem,aNERCwitnessedfunctionaltestshallbe conductedandsuccessfullycompletedpriortodeliverytotheNERC.Thistest shallbeconductedinahardwareenvironmentthatrepresentstheproduction environment. 5.5.2. TheacceptancecriteriaestablishedintheAcceptanceTestProcedurewillbe usedtoevaluatethecomplianceofthewebsitetotheoriginalspecifications. 5.5.3. Thesystemmustdemonstratethecapabilitytoperformtherequiredfunctions underloadsdefinedinsection3.5PerformanceRequirements.Likewise,the systemmustdemonstratethecapabilitytooperateattherequiredspeedsand performattherequiredthroughputs. 5.5.4. Duringthisphase,thesystemshallpassathoroughaformalapplication vulnerabilitytestingassessment. 5.5.5. Completenessofdocumentationshallalsobeevaluatedatthistime. 5.6. Delivery and Production Start-Up

5.6.1. AlldeliverablesshallbedeliveredelectronicallyonNERCapprovedmedia,to NERCpriortoproductionstartup.Itemsdeliveredshallincludeunittests,test resultsanddocumentation.

29 NERCAlertSystemRFPApril2012REV.:1

5.6.2. Productionstartup(definedasdeploymentofcodeanddataintothe productionenvironmentandbringingthesolutiononline)shallbeginafterthe functionaltesthasbeensuccessfullyexecuted. 5.7. Final Acceptance

5.7.1. Afterthesystemhasbeeninstalledintheproductionenvironment,the AcceptanceTestProcedureusedintheFunctionalTestwillbeusedalongwith anyrevisionsresultingfromthattest. 5.7.2. Thesystemmustdemonstratethecapabilitytoperformtherequiredfunctions underloadsdefinedinsection3.5PerformanceRequirements.Likewise,the systemmustdemonstratethecapabilitytooperateattherequiredspeedsand performattherequiredthroughputs. 5.7.3. Finalcompletenessofdocumentationshallbeevaluatedatthistime. 5.7.4. Thesystemmustbeabletosustainadutyandreliabilitytestof<NUMBER>() consecutivedaysconductedbyNERCITpersonnel.Ifthedutyandreliabilitytest isinterruptedduetoserioussoftwarefailuresthetestmustberestartedafter correctiveworkhasbeenperformedbythevendor.Aserioussoftwarefailure shallbeconsideredtobewheneveritisnotpossibletoperformasystem functionorrenderapagewithouterror. 5.7.5. Successfulcompletionofthistestaswellascompletionofanydefinedtraining mustoccurbeforethewebsiteisacceptedbyNERC.Currently<MONTH> through<MONTH>of2011asscheduledforfinaltestandtraining. 5.8. Documentation 5.8.1. Documentationdescribingtheinterfacespecificationsandoperationaswellas trainingmanualsarerequired. 5.8.2. Documentsshallbedeliveredelectronically.DocumentsshallusetheMicrosoft WordformatandbedeliveredinWordandasaPDF. 5.8.3. Outlinesanddetailsofdocumentationandtrainingmanualsshallbereviewed andapprovedbyNERCduringthedesignphases.

NERCAlertSystemRFP7/11/12

30

5.9. Training 5.9.1. Thecontractorshalldevelopandconductatrainingprogramwhichwillenable NERCmembers'personneltooperate,maintainandupdatevendordeveloped portionsofthesystem. 5.9.2. TrainingshallprovideoperationalinstructionforNERCpersonneltounderstand andexecuteanycustomfunctionalityprovidedbythevendor.Trainingshallbe conductedonasystemwhichemulatestheactualproductionsystemandwhere traineescanworkataworkstationrepresentativeoftheactualsystem. 5.9.3. Forbiddingpurposesestimatethenumberoftraininghourstonotexceedtwo (2)days.Trainingshallbecompletednolaterthan1weekbeforeproduction deployment.TrainingwillbeheldpreferablyatNERC'sAtlantaofficesattimes thataremutuallyagreedupon.

6. Warranty, Support and Maintenance

6.1. Warranty

6.1.1. Thesystemisexpectedtobefreefromdefect.Thevendorshallassumeall responsibilitiesforworkmanship. 6.1.2. Acompletewarrantypackageforthesystemshallbeprovidedbythevendor. Defectresolutionshallbecompletedintotalaspartofthispackage. 6.1.3. NERCreservestherighttorejectanydeliveredsolutionthatdoesnotsatisfythe requirementsoutlinedinthisdocument.Thevendorwillhaveaprescribedtime torectifytheshortcomings,atnocosttoNERC.If,aftertheallocatedtime,the systemstilldoesnotmeetsystemrequirements,NERCreservestherightto rejectdeliveryofthesystem. 6.2. Support

Thevendorwillnothaveaccesstoproductiondata.Therefore,supportshallbeajoint effortbetweenNERCandthevendor. 6.2.1. Thevendorshallberesponsibleforsupportingthetriageofalldefectsandfixing thosedefectsdeemedtobefunctionalandcoveredwithintheStatementof Work. 6.2.1.1. Thevendorshallkeeponlineatestenvironmentthatsubstantiallymimics production,includingdata,inordertoperformhighlyresponsive troubleshooting.
31 NERCAlertSystemRFPApril2012REV.:1

6.2.2. NERCwillberesponsibleforallhardware,networkandotherinfrastructure support. 6.2.3. ThevendorshallworkcooperativelywithNERCtoidentifyandresolveany performanceissuesanddatabasetuningefforts. 6.3. Defects

6.3.1. Defectsshallbeclassifiedwithprioritylevelsof15andshallberesolvedbased onpriority.Theresolutionofoutstandingdefectsshallbeperformedonan ongoingbasisbythevendor. DefectPrioritiesaredefinedas: P1:SystemDown,DataLoss P2:MajorFunctionalityLossnoworkaroundavailable P3:MinorFunctionalityLossworkaroundavailable P4:Cosmeticallfunctionalityavailable P5:Enhancement 6.3.1.1. AnydefectclassifiedasP1willtriggerthenecessityofanemergency release. 6.3.1.2. AnydefectclassifiedasP2willtriggerthenecessitytoschedulearelease tooccurwithin3monthsofthesubmittalofthedefecttothevendor. 6.3.1.3. Allotherdefectsshallbeincludedinscheduledreleases. Maintenancereleasesshallbeoftwotypes: Emergency Scheduled 6.3.2. Allcomponentsinareleaseshallbeversionedsothateachitemplacedintothe productionenvironmentcanbetracedbacktoaspecificrelease. Anemergencyreleaseshallbemadetoaddresssystemfailureswhichresultinthe failureofthebusinessprocessorinthelossoforcorruptionofdata. 6.3.3. Emergencyandscheduledmaintainedreleasesproducedbytheresolution processshallbescheduledfordeploymentinaccordancewithamaintenance plandevelopedbythevendorandapprovedbyNERC.

NERCAlertSystemRFP7/11/12

32

6.3.3.1. ThefrequencyofscheduledreleasesshallbeagreedonbyNERCand vendorpriortotheinitialdeployment,withtheopportunitytomodify basedonthevolumeandclassificationofdefects. 6.3.3.2. Amaintenancereleaseshallfollowthesamedevelopment,testingand deploymentguidelinesdefinedinthisdocumentandusedfortheinitial systemdevelopment. 6.4. Enhancements

NERCexpectsthatchangesinfuturebusinesswillrequireenhancementstotheAlerts systemaftertheAlertssystemhasbeendeployedintoproduction. 6.4.1. Theamountoflagbeforeworkingonenhancementrequestsshallbeagreedon byNERCandthevendorduringcontractnegotiations. 6.4.2. Enhancementsshallundergothesamedevelopment,testinganddeployment guidelinesdefinedinthisdocumentandusedforinitialsystemdevelopment.

7. Submission Information
NERCisinvitingseveralcompaniestosubmitbidproposalsforthisproject.Thosewho desiretomakeabidmustmakeanestimatefordeveloping,delivering(includingtraining),a contingencyplantosupportfullsystemavailability,andfiveyearsofsupport,including enhancements,asdescribedinsections6.2Supportand6.4Enhancements.Those desiringtobidshallexercisespecialcareinstudyingthefunctionalandtechnicalpersonnel withintheirorganizationstoensurethattheproductsandservicesofferedareaccurately represented.Ifadecisionismadetosubmitaproposal,theinstructionscontainedherein mustbefollowed. Biddersshallprovideasummaryoftheirqualificationsintheproposalssubmitted.Where thebidderrepresentsapartnership,asummaryofqualificationsforeachofthepartners shallbeincluded.Duringthebiddingprocess,bidders,includingallassociatedparties,may beaskedtosignconfidentialityagreementsassociatedwiththisproject.Thesuccessful bidder,includingallassociatedparties,willberequiredtocomplywithandbesignatoryto thenecessarydataconfidentialityagreement(s)thatprotectsentitiesfrominappropriate releaseofsensitiveelectricsysteminformation. 7.1. Estimated Delivery and Implementation Schedule

ThefollowingschedulehasbeenproposedtosupportNERCsstrategicbusinessobjectives. Ideally,allproposalswillfitwithinthisschedule.Atimelineextendingbeyondthese timelinesmaybeproposed;and,aslongasappropriatejustificationispresented,these proposalswillstillbeconsidered.

33 NERCAlertSystemRFPApril2012REV.:1

Thedeliveryofeachphasewillincludetesting,deployment,documentationandtraining,all tobedeliveredonorbeforethedatespecifiedbelow. ProjectSchedule Action Projectstart Finalacceptance 7.2. Selection Schedule DeliveryDate August15,2012 December31,2012

Thefollowingschedulewillbefollowedduringtheselectionprocess: SelectionSchedule Action RFPPublication Deadlineforsubmitting questionsandclarifications NERCresponsestoclarifying questions RFPResponsesubmission Notificationofwinning vendor 7.3. Clarifications Process July13,2012 July18,2012 Date

July20,2012

July25,2012 August1,2012

AnyquestionsregardingcontentwithintheRFPmaybeemailedto Justin.Lofquist@nerc.net.Ifappropriate,pleaserefertothespecificsectionoftheRFP whensubmittingquestions. QuestionsandanswerswillbedistributedbyJustinLofquisttoallcandidatesthroughemail communications.

NERCAlertSystemRFP7/11/12 34

7.4. 7.5. Qualifications Describeyourexperienceinproducingapplicationsforgovernmentand/or regulatoryentityprojects. Providecurrentreferenceinformationforthreeformerorcurrentclients.Please includetheservicesyourfirmsupplied,andincludeURLsofpublicfacingsitesyour companywasresponsiblefordevelopingifpossible. Brieflydescribeyourfirmsorganizationalcapacitytodevelopthissolution(e.g. staff,equipment,software,physicalspace,officelocation,etc.). Howmanyfulltimestaffdoesyourfirmemploy? Provideacompanyprofile,lengthoftimeinbusinessandcorecompetencies. Brieflydescribethepercentageofyourstaffthatwouldendofworkingonthis projectrelativetoyourentirestaff(usingfulltimeequivalents). Pleasedescribetheorganizationalmakeupoftheteamassignedtotheproject, includingroles,andminimumexperienceofresourcesfillingthoseroles. Brieflydescribeyourfirmsprojectmanagementprocess. Describethepercentoftotalrevenuederivedfromdevelopmentprojectsandother businessventures. Explainyourbusinessmodel. Pleasediscussyourtestingandsupportplan. Pleaseexplainyourservicelevelagreement(SLA)structure. Pleaseprovideanestimatedtimeframeforcompletion.Timeframeswillbepartof thecontractualagreement;therefore,arealistictimeframeforcompletionis requested. Pleasedescribeyourprocessandresponsivenesstorequestsforproduct enhancements,aftertheproducthasgonetoproduction. Pleasedescribeyourprocessforincludeinputfromallbusinessunits.Pleasestate howyouintendtocommunicatewithallbusinessunitsareastogatherallofthe requiredinformation. PleaseprovideyourcompanysTermsandConditions. Format for Proposal

Pleaseusethefollowingasaguidelinetoformatyourproposal: LengthandFontSize: Pleaseusefontsnosmallerthan10point.Maximumproposallengthincludingtitlepage, coverletter,proposal,qualificationsandbudgetshouldnotexceed10pages(notincluding Attachment). TitlePage: Pleaseincludethefollowinginformationonthetitlepage: NERCAlertsProjectProposal

35 NERCAlertSystemRFPApril2012REV.:1

CompanyName CompanyAddress CompanyWebsite PrimaryContact TelephoneNumber EmailAddress

Proposal: Discussyourproposedsolution,includingthefeatures,benefitsanduniquenessofyour solution,includingunderwhatconditionstherequirementsintheRFPcanbemet(i.e hardwarerequirements).Youshouldalsotouchonyourabilitytodelivertheprojectinthe timeframenoted. Qualifications: Providetheinformationrequestedinsection7.4Qualifications. BudgetandFees: Listbudgetsasrequestedabove.Identifystaffyouanticipateworkingontheprojectand theirhourlyratesforworkthatmaybeneeded. PleaselistoutasaseparatelineitemthecosttoimplementSMSfunctionalityaspartofthe finalsolution. Attachments: Pleaseincludeanyadditionalinformation,suchasscreenshotsofothersimilarprojects, whichwillenhanceyourpositionasthemostqualifiedproviderforthissolution. 7.6. Contract Terms

NERCwillnegotiatecontracttermsuponselection.Allcontractsaresubjecttoreviewby NERCslegalcounsel,andaprojectwillbeawardeduponsigningofanagreementor contract,whichoutlinesterms,scope,budgetandothernecessaryitems. 7.7. Budgets

Pleaseprovideacostproposaltoaccomplishthescopeoutlinedbelow.Thebudgetmust encompassallprojectmanagement,design,development,training,documentation,support andsoftwareacquisitionsnecessaryfordevelopmentandmaintenanceofthesolution. Thisprojectwillideallybesetasafixedbidproject.However,additionalcontracttypeswill beentertained,includingcost+incentivefee,cost+sharedvariance,andT&M.

NERCAlertSystemRFP7/11/12 36

7.8.

Evaluation Criteria

ThefollowingcriteriawillformthebasisuponwhichNERCwillevaluateproposals.The mandatorycriteriamustbemetandinclude: Biddersshallsubmitonecopyoftheirproposalinelectronicformat,eitherMicrosoftWord orAdobePDF,nolaterthanJuly31st,2012.Deliverelectronicproposalsto Justin.Lofquist@nerc.net,withthesubjectline<<CompanyName>>sproposalforthe NERCAlertsproject. Yourproposalmustincludeacostproposalasdescribedabove.Allcostsassociatedwiththe deliveryoftheprojectshouldbebrokenoutindetail.Theproposalsshallbesignedbythe personauthorizedtoactforthesubmittingparty.Theproposalshouldalsoindicatethe timeperiodforwhichitisvalid. Proposalsthatmeetthemandatoryrequirements,asstatedabove,willbeevaluatedwith thefollowingcriteria: Proposerunderstandstheprojectandhastheabilitytoperformrequirements(30%) o Understandingprojectobjectives o Overallunderstandingofbusinessrequirements o Understandingofproblemstatementandendstatevision o Completenessofresponsetorequirements o Presentationofvalueaddsandrecommendations o Relevant,unidentifiedproblemsaddressed Proposer'sorganizationandmanagementplan(15%) o Overallprojectorganization(OrgChart) o RolesandResponsibilities o Proposedcommunicationmethods o TeamBalance o Projectschedule ProjectMethodologyandSoftwareDevelopmentLifecycleApproach(15%) o Applicationtothisproject o Phasesclearlydefined o Deliverables,milestonesandkeydecisionpoints o Toolsandtemplates o Highlevelworkplan o Implementationstrategy o Changemanagementapproach o PMDeliverables o Testing/training o QualityAssurance Proposer'scorporateprofile,experienceandpastperformance(15%) o Accreditations/awards
NERCAlertSystemRFPApril2012REV.:1

37

Managementstructure Financialviability Ontimedeliverywithinbudget Overallexposuretogovernmentsector Experiencewithsimilarprojects Clientsatisfaction Qualityofreferencetestimonials Cost(10%) o Initialprojectcost o Recurringcosts o Costjustification TechnicalSolution(10%) o SystemInterface o Informationstorageandretrieval o Overallsystemdesign o AddressestechnicalrequirementsintheRFP o Solutionisworkable o Open,flexibleandscalable o Costeffectivetomaintain CommunicationSkillsandRFPCompliance(5%) o Clarityandreadabilityofwrittenproposal o Completenessofresponse o Overallprofessionalismandquality o o o o o o o Award or Rejection of Bids

7.9.

Thecontractwillbeawardedtoonebidder,providedthattheproposalisdeemed reasonableandintheinterestofNERCtoaccept.Thebiddertowhomtheawardis madewillbenotifiedattheearliestpracticaldate.NERCreservestherighttorejectany andallproposalsandtowaiveanyformalityinproposalsreceivedwheneverNERC deemssuchrejectionorwaivertobeinthebestinterestofNERC.

8. Appendices
8.1. Acronyms, Abbreviations, and Definitions

NERC:NorthAmericanElectricReliabilityCorporation

NERCAlertSystemRFP7/11/12

38

BPS:(BulkPowerSystem)Thecollectionofregisteredentitiesthatsupplypowertothe UnitedStates. RegisteredEntity:Anindependentcompanythataidsinservingenergytoconsumers throughtransmissionand/orgenerationofelectricity,andqualifiestobeamemberofthe BES NCR:(NERCComplianceRegistryNumber)AuniquenumberassignedbyNERCtoall RegisteredEntities ES_ISAC:ElectricitySectorInformationSharingandAnalysisCenter RRM:NERCRiskandReliabilityManagementdepartment RegisteredFunction:AfunctionthataRegisteredEntitycanperformwithintheindustry (e.g.GeneratorOwnerGO,GeneratorOperatorGOP).ARegisteredEntitycanperform multipleregisteredfunctions. SubjectMatterArea:Aspecificfunctionthataspecificuserwillperform. FunctionalGroup:AcollectionallusersthataremembersofaRegisteredFunction RegionalStaff:AsystemuserthatisnotassignedtoaNERCRegisteredEntityandis employedbyoneoftheeightNERCRegions. ElectricSectorParticipant:AnyusernotassignedtoaNERCRegisteredEntityandhasbeen vettedbyNERCstaffasamemberoftheelectricsector. GovernmentStakeholderParticipant:GovernmentusersthataredesignatedbyNERCStaff (e.g.:FERC,CanadianGov.,Provinces,States,USDOE) NERCDefinedList:AlistofalertrecipientscreatedbytheNERCAlertSystemAdministrator. Designee:AnyFunctionalGroupMemberthathasbeengivenprivileges,bytheregistered entitysPrimaryComplianceContact(PCC)orAdministrator,toacknowledgeand/or respondforaRegisteredFunctionofaNERCRegisteredEntity NERCAlert:anotificationthatisdistributedtoRegisteredEntitieswhichcontains actionableinformationrelatedtomaintainingthereliabilityoftheBPS.Therearethree typesofNERCAlerts:IndustryAdvisory,RecommendationtoIndustry,andEssentialAction IndustryAdvisory:AtypeofNERCAlertthatispurelyinformationalandisintendedtoalert RegisteredEntitiestoissuesorpotentialproblems.AresponsetoNERCisnotnecessary. Recommendation:AtypeofNERCAlertthatrecommendsspecificactionbetakenby RegisteredEntities;requiresaresponsefromrecipientsasdefinedinthealert.

39

NERCAlertSystemRFPApril2012REV.:1

EssentialAction:AtypeofNERCAlertthatidentifiesactionsdeemedtobeessentialto BPSreliability;requiresNERCBoardofTrusteesapprovalpriortoissuance.Thisalert requiresrecipientstorespondasdefinedinthealert. 8.2. Roles and Permissions

Thefollowingtabledescribestheinitialpermissionsettingsfortheapplication.TheSystem Administratorcanmodifyanyoftheseroles.Additionalrolesandpermissionsmaybedefined duringdetailedrequirementsgathering. RolesandPermissionsMatrix Role

PrimaryComplianceContact

FunctionalGroupMembers

ElectricSectorParticipant

CompanyOfficer

GovernmentStakeholder Participant

SystemAdministrator

Administrator

RegionalStaff

NERCPersonnel

Permission
Add/DeactivateUsers Globally Add/DeactivateUsers Locally EditLocalUserPrivileges Acknowledge Respond LockResponses Public ViewAlerts Private Sensitive Confidential

A A A N N N Y Y Y Y

N RE RE RE RE RE Y RE RE RE

N RE RE N N N Y RE RE AR

N N N RE RE RE Y RE RE AR

N N N N N N Y R R R

N N N RE N N Y RE RE AR

N N N N N N Y AR N N

N N N N N N Y AR N N

N N N N N N Y Y N N

NERCAlertSystemRFP7/11/12

40

Other

N N N N N N N N N N

ViewDashboards ViewAcknowledgements ViewReponses ManagePCCRecords Approvals Reporting AssociateUserstoMultiple Entities CreateAlerts(and ResponseTemplates) PublishAlerts

A A A A N A Y Y Y

RE RE RE N RE RE N N N

RE RE RE N N RE N N N

RE RE RE N RE RE N N N

R R R N N R N N N

N Y N N N N N N N

N N N N N N N N N

N N N N N N N N N

N AL AL N N Y N Y N

N N N N N N N N N

Key AAllrecords ALAllalertsthattheusercreated ARAsRequired NNoaccess OOptional RAllrecordswithintheregion REAllrecordswithintheRegisteredEntity YYes 8.3. Supplemental Data 1. RegionalEntities FRCCFloridaReliabilityCoordinatingCouncil MROMidwestReliabilityOrganization NPCCNortheastPowerCoordinatingCouncil RFCReliabilityFirstCorporation SERCSERCReliabilityCorporation SPPSouthwestPowerPool,RE TRETexasRegionalEntity WECCWesternElectricityCoordinatingCouncil

41 NERCAlertSystemRFPApril2012REV.:1

2. RegisteredFunctions 3. SubjectMatterAreasincluding,butnotlimitedto,thefollowing: 8.4. Public:NoRestrictions.WillbepostedtoNERCs websitealertpage. Private:RestricttoInternalUseandNecessary Consultants/ThirdParty Providers Sensitive:InternalUseOnly(DoNotDistributeOutside YourCompany)
NERCAlertSystemRFP7/11/12 42

BABalancingAuthority DPDistributionProvider GOGeneratorOwner GOPGeneratorOperator IAInterchangeAuthority LSELoadServingEntity PAPlanningAuthority PSEPurchasingSellingEntity RCReliabilityCoordinator RPResourcePlanner RSGReserveSharingGroup TPTransmissionPlanner TOTransmissionOwner TOPTransmissionOperator TSPTransmissionServiceProvider

Security:ChiefSecurityOfficer Security:PhysicalSecurity Security:CyberSecurityControlSystems Security:CyberSecurityCorporateIT Operations:EngineeringSystemOperators Operations:EngineeringSystemOperatorsSystemProtection Operations:EngineeringSystemOperationsTransmissionEngineering Operations:EngineeringGenerationEngineering Operations:EngineeringTransmissionPlanning

Alert Handling Levels

Confidential:LimitedInternalDistributionDecided UponbyanOfficerofthe Company 8.5. Sample Alert Email Notification

From:NERCAlertsDistribution To:NERCAlertsDistribution Subject:ADVISORY:<<insertsubjectline>>(NORESPONSEREQUIRED) Date:Tuesday,April10,20129:01:18AM ANERCIndustryAdvisoryregarding<<insertsubject>>hasbeen issued.ThehandlinglevelforthisalerthasbeensetatgreenPublic:No Restrictions.WillbepostedtoNERC'swebsitealertpage.ThisIndustryAdvisory appliestoAllRegisteredFunctions. Thecontentsofthisalertmaybespecificallyusefultoindividualswiththefollowing responsibilities:PhysicalSecurity,CyberSecurityControlSystems,CyberSecurityCorporate IT,SystemOperators,SystemOperatorsSystemProtection,SystemOperationsTransmission Engineering,GenerationEngineering,TransmissionPlanning,GenerationOperations. ToviewthealertpleaselogintotheNERCSecureAlertSystem (https://www.nercalerts.com/)usingyourassignedusernameandpassword. Ifyouareexperiencingdifficultiesloggingin,orcannotfindyourusernameor password,pleaseclickthe"Forgotmyusernameorpassword"linklocatedonthe loginpage. InquiriesregardingthesubjectmatterofthisIndustryAdvisoryshouldbedirected to: <<entitycontactinformation>> NorthAmericanElectricReliabilityCorporation <<entitycontactnumber>> <<entitycontactemail>>

43

NERCAlertSystemRFPApril2012REV.:1