PEBC Employee Benefits Enrollment Application and Database Software Maintenance and Support. PEBC Maintenance and Support includes troubleshooting, modifying, upgrading, maintaining, improving security, and enhancing systems and applications which may be running in a production environment. This software is written in C#, housed in Azure, and the data is housed in a SQL Server database. PEBC provides healthcare benefits administrative services for Dallas County, Tarrant County, Denton County, Parker County and the North Texas Tollway Authority. Files are received weekly from each entity related to the health insurance being provided to employees and retirees. These files are reviewed, loaded and processed into the database using the Benefits Administration Software. • The software uses rules engines and stored procedures to: o identify errors in the data; o make corrections; o prepare the information for submittal to insurance providers; and o process files containing information on tax saver and/or health savings plans that are submitted to vendors. • In addition to traditional software maintenance activities of bug fixes, patches, etc., the vendor will also: o provide software development services as needed for development of new features o perform modifications required due to regulatory changes or plan changes of customer entities o Maintain the Azure environment from the standpoint of provisioning users, removing users, ensuring updates to the environment are made using a process that ensure the system continues to operate accurately and performance meet PEBC needs. • Security of the system is critical. This requires: o The vendor to possess and exercise expertise in Microsoft Azure security best practices around, but not limited to: ▪ Network segmentation, ▪ Network Security Groups, ▪ Azure Security Center, ▪ Data security/encryption ▪ Identity management, ▪ Virtual machine hardening, and ▪ Endpoint access control. • All application development must, at a minimum, adhere to the standards outlined in the Open Web Application Security Project’s (OWASP) Application Security Verification Standard (ASVS) at Level 2. • All code changes must be scanned for vulnerabilities before being put to User Acceptance Testing to ensure any weaknesses are addressed. Additionally, all software in use must remain current to provide a secure environment so the vendor will be responsible for ensuring that occurs. Additional responsibilities include documenting and managing the process for adding new users to the system and removing users when requested by PEBC. Th...
