OIT RFI Simons Rec Center Project - Addendum #2

ADDITIONAL IT STANDARDS
DATA REQUIREMENTS, ADDRESSING, DIGITAL AND WEB CONTENT
ACCESSIBILITY
If applicable, applications or solutions proposed by vendors must be in alignment
with these City's Standards:
Section 1
Data Requirements Standards - All City solicitations that include the purchase of
software or services relating to information systems must incorporate the
requirements of this policy. This document defines standards to guide
implementation of the following current and future policies covering third-party
access to City information:
- Data Access Requirements for Third Party Systems
- Master Data Requirements
- Metadata Standards
- Date Formats
- Common Data Elements for Geospatial Data
- Data Protection and Retention
Section 2
Addressing Standards should be adopted for use within all database systems,
applications or tables that maintain a property address.
Section 3
General Technical Standards - The City's standard non-functional requirements
for IT systems ensure that information systems are resilient and secure so that the
City's information is safeguarded, and its staff can continue operations (as supported
by IT systems) in the event of a disaster.
Section 4
Digital Standards provide the design, code, and content guidelines for City
website and web application development;
Section 5
Web Content Accessibility Standards - All sites produced by vendors for the
City, regardless of the hosting environment, shall conform to the Web Content
Accessibility Guidelines (WCAG) 2.1 AA. These guidelines will make content
more accessible to a wider range of people with disabilities.

Section 6
Security Addendum - All City Data and the systems on which they reside must be
protected in accordance with City security and privacy documentation and system
risk, to include, at a minimum, adequate safeguards for the following:
Confidentiality, which means preserving authorized restrictions on access and
disclosure, based on the security terms found in this contract, including means for
protecting personal privacy and proprietary City Data;
Integrity, which means guarding against improper information modification or
destruction, and ensuring information non-repudiation and authenticity; and
Availability, which means ensuring timely and reliable access to and use of City
Data.

Section 1
Third Party Data Access Standards
SOP No: SOP Type: Family: Internal [ ] Version:
1010 Standard System and Services External [x] 1.0
Acquisition (SA)
Category: Originating Unit(s): Effective Date: Review Cycle:
System Acquisition Enterprise Architecture 8/24/2020 Annual
Supersedes: Forms: Attachments: Contact:
N/A [ ] Yes [x] No [ ] Yes [x] No Chief Enterprise Architect
Contents
1 Purpose ...................................................................................................................................................... 1
2 Scope........................................................................................................................................................... 2
3 Policy ........................................................................................................................................................... 2
4 Standards ................................................................................................................................................... 2
5 Roles and Responsibilities........................................................................................................................ 6
6 Compliance ................................................................................................................................................ 6
7 Guidance .................................................................................................................................................... 7
8 Waivers ....................................................................................................................................................... 7
9 Definitions .................................................................................................................................................. 7
10 Authority ..................................................................................................................................................... 7
11 Related Links .............................................................................................................................................. 7
12 Change Log ................................................................................................................................................ 8
13 Approval ..................................................................................................................................................... 8
1 Purpose
* Ensure City ownership of data in proprietary systems.
1

* Assist decision makers, project teams, procurement, and legal departments by
clearly defining the expectation of data ownership in vendor systems and related
data access capabilities to be considered before choosing a solution.
2 Scope
All City solicitations that include the purchase of software or services relating to
information systems must incorporate the requirements of this policy.
3 Policy
This document defines standards to guide implementation of the following current and
future policies covering third-party access to City information:
* System and Services Acquisition.
4 Standards
4.1 Data Access Requirements for Third-Party Systems
The City considers all information that is generated or stored in third-party information
system to be City property.
In accordance, the City requires perpetual, non-proprietary means to access data in third-
party systems implemented by the Applicant or associated Parties.
Examples of non-proprietary means include:
1. A documented and secured web-based Application Programming Interface that
meets City standards. The Current City standard API specification is RESTful web
services with JSON payload.
2. Secure access to databases using non-proprietary client software that follows ODBC
specifications. Documentation of database elements that store City data. Open
Database Connectivity is the City's standard API for directly accessing database
management systems.
3. Secure access to file systems where City information is stored.
4. Other means of securely providing third-party system data to the City, including
exporting flat files.
Proposals shall include a statement of the Applicant's ability to provide access to data in
the context of the choices above. The City may consider alternative means on a case-by-
case basis.
If these means of access are available through proprietary components of the third-party
system, the vendor shall provide, free of charge, an agreed upon amount of service
Third Party Data Access Standards 2

accounts to be used solely for programmatic retrieval of data. The vendor will contractually
agree to provide access to data when a given vendor system is replaced or usage is
terminated.
Electronic documents stored in proposed third-party systems shall be exportable in non-
vendor proprietary formats, including but not limited to:
* Adobe PDF
* Text
* JPEG
* PNG
* Semi-structured documents may be exported in XML or JSON format.
Proposals shall indicate the Applicant will provide data architecture documents including
entity relationship diagrams documenting semantic and logical data relationships, along
with a data dictionary describing datasets and data attributes. See the section entitled
Metadata Standards for details. Revised documents must be provided to the City should
any relevant changes occur.
4.2 Master Data Requirements
The City's master data strategy includes initiatives to provide vendors with a single source
of authoritative data, and for vendor systems to in turn contribute authoritative data back
to the City's enterprise data warehouses. Accordingly, the City requests the Applicant's
proposal include the following:
1. Language indicating that City authoritative data shall be leveraged in the proposed
solution if such data exists. City authoritative data is cataloged at
https://metadata.phila.gov which must be used as a reference for this activity.
2. The Applicant's plan shall include the identification of all new datasets generated or
stored in third-party information systems implemented under the scope of the
proposed project. The plan must include metadata creation as per City Metadata
Standards outlined in the next section.
3. Language indicating that the Applicant shall support the City as needed to meet
data governance requirements including assistance with metadata creation and
mentoring City Data Stewards on appropriate data usage and sensitivity.
In addition to the above, the Applicant shall provide references or case studies exhibiting
integration with data warehouses developed in-house, or with other customers.
Systems integration software code developed by the Applicant or related parties is subject
to RFP Section 2.4.4: Software Source Code.
Third Party Data Access Standards 3

4.3 Metadata Standards
To ensure appropriate use and interpretation of all vendor-supplied data in City systems,
the City requires that Applicants provide the following minimum metadata documentation:
1. An overview of the dataset including its scope, purpose, and context for the
intended use.
2. A detailed description of the development process for creating the data, including
data sources and/or data collection methods; algorithmic, analytical, or manual
transformations of the raw data; documentation of any excluded, removed, or
redacted data; and any other relevant elements that contributed to the end data
product.
3. Documentation of the dates when data was collected, or the timeframe
represented.
4. A Data Dictionary documenting the following information for each field in the
dataset:
1. The raw field name
2. A human-readable title for that field
3. The type of data stored in that field (e.g., string, integer, GUID, etc.) along
with any relevant details such as length, precision, geometry type, grid
resolution, as applicable
4. A complete definition of any coded values
5. Identified primary and foreign keys (if applicable)
6. Any other descriptive information relevant to interpreting the data such as
the universe, timeframe, or exclusions specific to a given field.
7. Additional details about geospatial data, described below.
4.4 Common Data Elements for Geospatial Data
The City has defined common data elements, defined below, for data that can be
associated with a geographic location within the City. The City requires that Applicants
conform to the following standards:
4.4.1 Addresses
See OIT Address Standards in Related Links, Below
All systems that process or store address data must use the City's Address Information
System (AIS) for Philadelphia based address standardization, validation, or geocoding.
4.4.2 Land Records
The City has created a standard Property Identification Number (PIN) used to uniquely
identify parcels, condominiums, land rights, and easements. All systems that handle land
Third Party Data Access Standards 4

record related data or documents shall identify property records using the City's Property
Identification Number (PIN).
4.4.3 Geospatial Vector Data
Vector data consists of points, curves (lines), and polygons and derivations thereof as
defined by OGC standards. Systems that store geospatial data in a Relational Database
Management System (RDBMS) shall store the data according to the Open Geospatial
Consortium's (OGC) standards for simple feature access. The City requires
implementations of the OGC standards to follow either the Esri ST_Geometry or PostGIS
Geometry specifications.
Geospatial Vector data stored outside of an RDBMS shall be stored in industry-standard
formats including geojson, shapefile, or ESRI File Geodatabase.
Geospatial Vector data shall include a Coordinate Reference System (CRS) deemed
appropriate for the dataset. The City requires the use of either the NAD83 or WGS84
datum. The epoch date of the chosen datum shall be documented to ensure the City can
perform accurate datum transformations.
4.5 Data Protection and Retention
The Applicant will contractually agree to protect and secure the data in keeping with the
City's security and all applicable regulatory requirements. This includes meeting retention
requirements defined in the data owner's current Record Retention Schedule issued by the
Department of Records. The buyer should seek counsel from the City Solicitor's Office,
Commercial Law Unit to ensure the appropriate data protection and retention language is
in the contract.
Third Party Data Access Standards 5

5 Roles and Responsibilities
Writing Implementing Using Auditing
OIT Enterprise IT Leadership City staff in a IT Leadership
Architecture procurement role,
Software Engineers,
Applicants and
Implementers,
Staff writing
solicitations for
systems will store City
data
6 Compliance
If OIT, through its process for reviewing IT implementations, finds a system to be non-
compliant, OIT reserves the right to:
* temporarily halt or permanently cancel implementations.
* remove associated systems and assets from the City's network.
* order hosting and SaaS providers to quarantine or shut down associated assets.
* suspend any accounts associated with the system.
* perform a security review or forensic analysis on the system.
* take further action as needed.
Personnel that violate this policy may be subject to disciplinary action, up to and including,
termination of employment, in accordance with the disciplinary policies of his or her
agency and, for personnel represented by the Fraternal Order of Police, International
Association of Fire Fighters, District Council 47 or District Council 33, the terms of the
applicable collective bargaining agreement.
If a City contractor or third party user knowingly or negligently commits or permits a
material violation of this policy, the City may terminate the contract in accordance with its
terms, and/or terminate the contractor's or third party user's access to City information
systems and information, in addition to any legal or remedial actions the City may take to
enforce and protect its interests.
Third Party Data Access Standards 6

7 Guidance
Reserved
8 Waivers
Waivers may be requested from the Compliance Office by submitting a justification based
on:
* Substantive business case need(s)
* Demonstration of, or a proposal for, establishment of adequate compensating
controls that provide a suitable alternative to the mandated protection
The Compliance Office will coordinate with the authorizing bodies within OIT to issue a
decision on a waiver for sufficient reasons exercising judgment in the best interests of the
City.
The Compliance Office shall maintain the central repository of all waivers.
9 Definitions
Terms defined in this standard shall have the meanings in this standard that are here
provided. Terms not defined in this standard shall have the meanings contained in City
Policies and Standards Glossary of Terms.
10 Authority
City of Philadelphia Executive Order No. 12-11
11 Related Links
OIT Address Standard
https://phila.city/display/citygeo/Addressing+Standards
Third Party Data Access Standards 7

12 Change Log
Version No. Date Author Description
1.0 8/26/2020 Regis Shogan Initial Version
13 Approval
By direction of the Chief Operating Officer:
(Signed original copy on file)
_______________________________________ ____________________
Sandra Carter Date
Chief Operating Officer
Third Party Data Access Standards 8