Reference Request for Proposal: Ticketing System for CFA & HPAC Dated: May 18, 2017

Transcription

1 Purchasing Department Mailing Address: 4400 University Drive, Mailstop 3C5 Street Address: 4441 George Mason Boulevard, 4 th Floor, Suite 4200 Fairfax, Va Voice: Fax: RFP ADDENDUM #1 June 15, 2017 Reference Request for Proposal: GMU Title: Ticketing System for CFA & HPAC Dated: May 18, 2017 For Delivery To: George Mason University The following changes are hereby incorporated into the aforementioned RFP: Please make sure to sign and include this addendum and all other addendums issued under this RFP with your offer/proposal. Answers to Questions received by June 07, 2017: Question: Did any vendors of the products & services listed within assist any Mason employees with the content or preparation of this RFP? If so, which vendors? Answer: No, this statement of work (SOW) was developed internally and we did not use an outside source or vendor to assist us in developing the SOW or RFP. Question: Please describe how George Mason University uses Ellucian Advance? Is connection/communication to the system a must have? How does the current system interact with the system? Answer: Communication with Ellucian Advance is preferred. Ellucian Advance is the University s donor management software. It is used by many higher education facilities. It is utilized to track gifts, contact and biographical information, event attendance, and more. Ideally a ticketing system would be able to communicate with Ellucian Advance in order to add track performances attended as well, more than likely under the events field. Question: Can you describe how George Mason University works with Shibboleth or CAS authentication? Is connection/communication to the system a must have? How does the current system interact with the system? Answer: Our current ticketing system is not integrated with Shibboleth, but we have been in talks with GMU ITS and our current provider about how to allow students to obtain their free or discounted tickets online, and Shibboleth is the preferred method by both as a means of determining the students eligibility for the free or discounted tickets and acting as a portal to the ticketing system once their eligibility has been verified. George Mason supports the SAML 2.0 protocol to provide an SSO experience to applications and services. This functionality allows George Mason students and staff to utilize their George Mason issued credentials to access external services without having to provide those credentials directly to external service providers. George Mason currently maintains both a Shibboleth Identity Provider (IdP) and a CAS Identity Provider. The CAS system is able to perform basic authentication services. The Shibboleth system is able to perform the authentication and return additional information about the user including directory information, address, affiliation, and internal ID number. It is our preference that services that will need access to user information interact with the Shibboleth IdP. The Shibboleth IdP is able to interact with other SAML 2.0 systems including those that are not based on the Shibboleth code base.

2 Question: How does Mason envision using "un-print" tickets? Answer: In terms of delivery method, we mean the ability to void or undo the assigned delivery method if the default is set to print and the tickets are printed by mistake. Also, the ability to void barcodes, with an ability to keep track of any voided bar codes. Question: Can you explain the SOC report? Answer: SOC stands for Service Organization Control report. It is an independent auditor report on controls at a service organization. Please refer to guidance in the AICPA s SSAE no.16 for more information. Question: What are eva fees? How are these fees determined? Do they change by event? Who do the fees apply to? Answer: eva is the Commonwealth of Virginia s online, electronic procurement system. They mandate that all of their state agencies, including George Mason University, utilize this system and that any vendors who wish to do business with the University register as a vendor. eva fees are the fees that the Commonwealth of Virginia charges to their agencies and self-registered vendors for utilizing the eva system. They do not change by event and apply to both state agencies who use the eva system to submit purchase orders or issue solicitations and to the vendors who self-register in eva to receive Purchase Orders or solicitations. Self-registration in eva is mandatory for any company who is awarded a contract with George Mason University. For more information concerning eva and the eva fee schedule see the links below: eva Fees: about eva: Question: Can a person go to the university website and buy tickets from any of the venues? In other words: One site for all venues (we brand reservation pages to match the client s pages so we need to know if multiple brands will need to be represented during the reservation/ ticket sales process). Answer: Yes, multiple brands will need to be represented. Currently the Center for the Arts and the Hylton Performing Arts Center are branded separately, ( but there is a possibility that the various academic departments and/or Resident Arts Partners could request their own branding in the future. Question: Can we get more information about TouchNet Ready Partner Program? Is connection/communication to the system a must have? How does the current system interact with the system? Answer: Yes, communication with the TouchNet Ready Partner Program is required. TouchNet currently provides our E-commerce Payment Platform and the vendor s solution must be able to integrate/communication with that platform. All offerors must either be TouchNet Ready Partenrs at time of award or be committed to becoming a TouchNet Ready Partner before funding will be released. Failure to become a TouchNet Ready Partner will result in termination of the offerors contract. Please note that TouchNet will not allow non-touchnet Ready Partners to access their IPS, which is why it is mandatory for our vendors to be Partners. No exceptions will be allowed. Question: We are in the process of building a 2 way API that could be used to accommodate web architecture that meet Web Content Accessibility Guidelines (WCAG) 2.0. Is it sufficient to have a plan to meet the guidelines or do the pages have to be WCAG ready at the time of installation? Answer: Having a plan is generally accepted, provided the plan covers all identified accessibility concerns. The vendor should be prepared to provide a VPAT (VPAT is a voluntary product Accessibility Template)to outline their accessibility compliance, and a demo/sandbox for the Office of Assistive Technology Initiative (ATI) to use to evaluate the actual accessibility of the product. If

3 the VPAT and test are in alignment, and the plan has reasonable goals and timelines, the product is usually approved. ATI will still ask to do testing as the new features are incorporated. Please note that WCAG and Section 508 are not the same. WCAG specifically references websites and webbased content, while Section 508 references websites, web-based content, desktop applications, telecommunication devices, and other types of hardware devices (e.g., scanners, copiers, etc.). WCAG v2.0 is separated into 3 levels (A must do, AA should do, and AAA nice if you can). The parts of Section 508 addressing web-based content (as it is written now) are closely aligned with Level A. Most organizations have adopted both Section 508 and WCAG 2.0 Level AA as the standards they are incorporating into their IT Accessibility policies. The Section 508 Refresh/Reauthorization, which will go into effect as of Jan 2018, actually incorporates parts of WCAG 2.0 Level AA. Question: p.9 / X.A.19 Do you know what version of SOC you will need? (SOC 1, SOC 2, or SOC 3)? And is this a requirement for winning this bid? Answer: It is a requirement for the winning bid. SOC 1 Type II is required from the selected ticketing vendor. If data is hosted by a subservice provider, they should have a SOC 2 Type II report. Question: p.14 / XVI.B.4 What is FERPA? What is the Government Data Collection and Dissemination Practices Act? What do these require? Answer: FERPA is a federal law that protects the privacy of student education records and it stands for The Family Educational Rights and Privacy Act. For more information: Question: P. 4 IX. Background: - Total tickets broken down by phone, web, box office? Answer: Center for the Arts : Box Office 83, 685*; Phone (handled by current provider) 2,195; Internet 20,799 *all subscriptions handled through the box office : Box Office 78,870*; Phone (handled by current provider) 1,680; Internet 18,096 *all subscriptions handled through the box office : Box Office 75,751*; Phone (handled by current provider) 1,444; Internet 24,911 *most subscriptions handled through the box office is the first year subscribers were able to fully renew or purchase online. Hylton Performing Arts Center : Box Office 46,913*; Phone (handled by current provider) 1,333; Internet 12,732 *all subscriptions handled through the box office : Box Office 52,909*; Phone (handled by current provider) 1,343; Internet 20,219 *all subscriptions handled through the box office : Box Office 45,545*; Phone (handled by current provider) 1,071; Internet 18,515 *most subscriptions handled through the box office is the first year subscribers were able to fully renew or purchase online. Question: Total tickets broken down by single, subscriptions, comps? Answer:

4 Center for the Arts : 183 events (8 of which were print-the-house/comp only events) Single tickets-41,828 Subscription tickets 19,268 Comp tickets 45,942 Ticket Revenue - $2,316, : 172 events (7 of which were print-the-house/comp only events) Single tickets-38,453 Subscription tickets 16,724 Comp tickets 37,326 Ticket Revenue - $2,092, : 207 events (30 of which were print-the-house/comp only events) Single tickets-40,458 Subscription tickets 15,408 Comp tickets 53,728 Ticket Revenue - $2,146, Hylton Performing Arts Center : 140 events (11 of which were print-the-house/comp only events) Single tickets-28,154 Subscription tickets 5,622 Comp tickets 28,376 Ticket Revenue - $947, : 184 events (11 of which were print-the-house/comp only events) Single tickets-42,253 Subscription tickets -6,210 Comp tickets 26,981 Ticket Revenue - $1,309, : 162 events (7 of which were print-the-house/comp only events) Sold tickets-37,098 Subscription tickets 5,404 Comp tickets 20,248 Ticket Revenue - $1,193, Question: P. 5 X. Statement of Needs (A.1) - How is GMU currently communicating with Ellucian Advance? - What is Ellucian Advance & what is GMU trying to accomplish by using it Answer: Communication with Ellucian Advance is preferred. Ellucian Advance is the University s donor management software. It is used by many higher education facilities. It is utilized to track gifts, contact and biographical information, event attendance, and more. Ideally a ticketing system would be able to communicate with Ellucian Advance in order to add track performances attended as well, more than likely under the events field. Question: - How is GMU currently communicating with Banner? - What is Banner & what is GMU trying to accomplish by using it? Answer: Banner ERP is the system currently utilized by HR for hiring, by the Registrar for tracking students class registration and progress, and for Fiscal Services to track and assign debits and credits to all of the various departments and schools within the university. Our current ticketing system does not currently communicate with Banner ERP. We have partnered with the Office of Student Involvement in co-producing some events in our venues, and there is a desire on their end to be able to allow the students to register for an event, or obtain tickets to a performance using the students Banner interface. There is also a desire on their end to be able to deposit the ticket sales directly into an assigned GMU account number. Banner interface with the ticketing system is not a requirement, but we would like to know if the possibility exists.

5 Question: P. 5 X. Statement of Needs (A.2) - Does GMU's current provider provide all workstations? - Does GMU's current provider provide all hardware (ie. scanners, CC swipes)? Answer: The current provider provides the majority of our workstations and other equipment (scanners, CC swipes, etc.) Question: - Does GMU rent workstations from current provider? - Does GMU rent hardware (ie. scanners, CC swipes) from current provider? Answer: We currently rent 6 workstations from our current provider, due to the fact that we are required to keep all ticketing business separate from our university provided computers for PCI compliance. Since these needs are recent and weren t included in the original contract, we are renting the additional work stations. Question: - Does GMU's current provider provide maintenance & support on all workstations? - Does GMU's current provider provide maintenance & support on all other hardware? Answer: Yes, our current provider provides both onsite and remote maintenance and support for all workstations and other hardware. Question: P. 6 X. Statement of Needs (A.5n) - Is GMU currently integrated with Shibboleth? - If not integrated, how does GMU currently handle student tickets? Answer: Our current ticketing system is not integrated with Shibboleth, but we have been in talks with GMU ITS and our current provider about how to allow students to obtain their free or discounted tickets online, and Shibboleth is the preferred method by both as a means of determining the students eligibility for the free or discounted tickets and acting as a portal to the ticketing system once their eligibility has been verified. Currently, students must come to the Ticket Office with their student IDs two Tuesdays prior to each event in order for us to verify their eligibility and issue the free/discounted tickets. Students who are not able to come to the Ticket Office in person may submit a form ( with their class schedule as an alternative. Question: P. 6 Statement of Needs (A.5o) - Is Web Content Accessibility Guidelines (WCAGS) the same as Section 508? Answer: The WCAGS is the WC3 web guidelines that provide a practical interpretation of how to implement the requirements from Section Question: P.6 Statement of Needs (A.6b) - How does GMU currently export data (and in what format)? Answer: We can currently export data from either the ticketing system or a remote reporting portal as a PDF file, Excel file, CSV file, XLSX, or HTML (Embed Only - in BETA). Question: P. 7 X. Statement of Needs (A.10) - Would it be a problem if GMU bought workstations and supported them locally? (costs can be discussed) Answer: It would depend on the cost. Any solutions must be PCI compliant for the purposes of credit card processing, cardholder data, or related items. Question:- What is an over-ride card?

6 Answer: Provided by our current provider, it s a plastic card with a barcode that s attached to a dummy event in the ticketing system that can be used by Front of House staff if there are problems scanning a patron s ticket. Basically, it allows us to keep an accurate count if a ticket won t scan and we can t read the barcode number. Question: P.9 X. Statement of Needs (20) - Mentions Attachment B (VPAT) but Attachment B is the sample contract. Can I have a copy of VPAT? - Mentions Attachment C but no Attachment C was included. Can I have a copy of Attachment C? Answer: VPAT is a voluntary product Accessibility template. This is the Office of Assistive Technology Initiative s guidance for vendors - Guidance-for-Vendors.docx- which should provide the information needed to create/complete one. We have attached a copy of our VPAT Guidance for Vendors to assist with our requirements. Question: Shibboleth and CAS are both built on and support different standards and protocols for authentication. Please provide the specific standards and protocols supported by George Mason University or complete technical specifications if possible. If the student indicator to be passed as a part of the authentication is restricted to one specific product or protocol, please include that and any additional details about the payload to be exchanged as a part of the authentication as well. Answer: George Mason supports the SAML 2.0 protocol to provide an SSO experience to applications and services. This functionality allows George Mason students and staff to utilize their George Mason issued credentials to access external services without having to provide those credentials directly to external service providers. George Mason currently maintains both a Shibboleth Identity Provider (IdP) and a CAS Identity Provider. The CAS system is able to perform basic authentication services. The Shibboleth system is able to perform the authentication and return additional information about the user including directory information, address, affiliation, and internal ID number. It is our preference that services that will need access to user information interact with the Shibboleth IdP. The Shibboleth IdP is able to interact with other SAML 2.0 systems including those that are not based on the Shibboleth code base. In order to provide authentication into the service and allow George Mason users to utilize the George Mason credentials, the system must support SAML 2.0 and be able to connect and interact with our Shibboleth IdP. Our supported protocol for authentication is SAML 2.0. The student indicator is passed via the Shibboleth IdP. As part of the authentication, the application may have access to additional information about the student including name, address, and affiliation(s).we are not aware of any other way to confirm eligibility without confirming the student s identity via login. One of the returned attributes will indicate if the student is currently enrolled or eligible to enroll. Question: What solution of TouchNet is GMU using? Answer: TouchNet Marketplace Suite and TouchNet Payment Gateway are the TouchNet solutions in use that are relevant to this RFP. Third parties must integrate to these solutions through TouchNet s Ready Partner program. Question: Page 5 Question 5(b) describe Internet interaction between internet site and customer please provide clarification as to what you re looking for here. Answer: Describe the "customer experience". Will the internet interaction be branded as CFA and Hylton, or will the customer realize that they have been taken to the vendor's website for the transaction (if they are). What is the "ease of use", and are there any features of interaction that are unique to the vendor s product, or are of particular benefit to people with any type of disability or impairment. Question: Page 6 Question 5(n) Any ability for Mason students to obtain free tickets online without any service fees, and using Shibboleth or CAS authentication as a means of verifying students

7 eligibility. Answer: Our current ticketing system is not integrated with Shibboleth, but we have been in talks with GMU ITS and our current provider about how to allow students to obtain their free or discounted tickets online, and Shibboleth is the preferred method by both as a means of determining the students eligibility for the free or discounted tickets and acting as a portal to the ticketing system once their eligibility has been verified. Currently, students must come to the Ticket Office with their student IDs two Tuesdays prior to each event in order for us to verify their eligibility and issue the free/discounted tickets. Students who are not able to come to the Ticket Office in person may submit a form ( with their class schedule as an alternative. George Mason supports the SAML 2.0 protocol to provide an SSO experience to applications and services. This functionality allows George Mason students and staff to utilize their George Mason issued credentials to access external services without having to provide those credentials directly to external service providers. George Mason currently maintains both a Shibboleth Identity Provider (IdP) and a CAS Identity Provider. The CAS system is able to perform basic authentication services. The Shibboleth system is able to perform the authentication and return additional information about the user including directory information, address, affiliation, and internal ID number. It is our preference that services that will need access to user information interact with the Shibboleth IdP. The Shibboleth IdP is able to interact with other SAML 2.0 systems including those that are not based on the Shibboleth code base. Question: Please advise where you store Student ID numbers. Answer: We don t currently store student ID numbers in the ticketing system. They are stored in Banner ERP. We have been in talks with GMU ITS and our current provider about how to allow students to obtain their free or discounted tickets online, and Shibboleth is the preferred method by both as a means of determining the students eligibility for the free or discounted tickets and acting as a portal to the ticketing system once their eligibility has been verified. The other method considered, but not at all preferred, is to receive a CSV file from the Registrar with student IDs, create accounts for them, and allow them to access their accounts online. Currently, students must come to the Ticket Office with their student IDs two Tuesdays prior to each event in order for us to verify their eligibility and issue the free/discounted tickets. Students who are not able to come to the Ticket Office in person may submit a form ( with their class schedule as an alternative. Vendor should provide intended use case as well as implementation details of any access, storage, transit or other use of Student ID Numbers. Question: Question 6(e) - Describe creation of reports of accumulated marketing information. Answer: We want to know what the logistics are for generating marketing information. Are these canned reports? Are the reports driven by criteria that need to be reset each time they are run? Can the reports be easily exported and manipulated? e.g. what steps would it take to (for example) get a list of all of the people who have been subscribers each year for the last 5 years, or a list of people who have attended at least 2 Jeffrey Siegel performances in each of the last three years. Also, what would be the logistics and capabilities of generating targeted patron reports based on sales patterns/history? Question: Please advise what type of marketing info you re looking for. Answer: Targeted patron reports based on previous purchase patterns (genre, holiday, price- point, etc). Ability to generate reports based on whether a patron is a first-time customer, lapsed customer, etc. Question: Whether companies from Outside USA can apply for this? (like, from India or Canada) Answer: Yes, as long as the vendor meets the requirements contained within the SOW and addresses how they will handle tasks remotely, vendors from outside the USA may submit an offer. All offers must be either mailed or hand-delivered we will not accept ed, faxed, or late offers. You must

8 provide a W8 tax form if you are awarded the contract and must be willing to self-register in eva. Question: Whether we need to come over there for meetings? Answer: Currently, there is no requirement that the vendor must meet in person. However, the vendor needs to clearly outline how they will successfully communicate with the end user, who is located in the USA, and troubleshoot any problems and how they will execute their solution. Please address clearly scenarios like language barriers, time differences, troubleshooting, implementation, etc. and how you will handle these things will be located outside of the USA. Question: Can we perform the tasks (related to RFP) outside USA? (like, from India or Canada) Answer: Yes, tasks can be performed outside of the USA but please clearly outline in your proposal how you will execute your solution, meet all of the requirements of the SOW, successfully communicate with the end user, handle time differences and any language barriers, and troubleshoot and resolve issues while being located outside of the USA. Question: Can we submit the proposals via ? Answer: No, you may not submit proposals via or any other electronic method and you may not fax your proposals. GMU will only accept proposals that are mailed or hand delivered to the location on the front page of the RFP at the top of the page. Any proposals that are submitted electronically or faxed or delivered late will be rejected and returned un-opened/un-read and will not be considered. Please sign and include this addendum as part of your offer. In Compliance With this RFP And To All The Conditions Imposed Therein And Hereby Incorporated By Reference, The Undersigned Offers And Agrees To Furnish The Goods/Services required by this RFP at the prices indicated in the pricing schedule, and the undersigned hereby certifies that all information provided below and in any schedule hereto is true, correct, and complete. Name and Address of Firm: Date: By: Title: Fed ID No: Signature: Phone: Sincerely, Katherine Sirotin Asst. Director, Purchasing Purchasing Department George Mason University