Public Sector
A plain-language glossary of the technology terms in your next IT solicitation
Short definitions for procurement and program staff who have to evaluate technical proposals.
Procurement officers and program managers evaluate technical proposals all the time without being technologists. Here are short, honest definitions of terms that appear in nearly every IT solicitation.
API. A defined way for one software system to talk to another. If a vendor says a system "has an API," ask for its documentation.
Cloud. Computing resources rented from a provider rather than owned. "Cloud-based" tells you little; ask which provider and who manages what.
SaaS. Software as a service. The vendor runs the software; you use it through a browser. You are buying a subscription and should understand what happens to your data when it ends.
Multi-factor authentication. Logging in requires something beyond a password, such as a code from a phone. Require it.
Encryption at rest and in transit. Data is scrambled when stored and when moving across networks. Both are expected.
Single sign-on. Staff use their existing agency login for the new system. Reduces password sprawl and makes offboarding reliable.
WCAG 2.1 AA. The accessibility standard for web content required under the ADA rule for state and local governments. Require conformance and verify it.
StateRAMP and FedRAMP. Programs that verify a cloud service's security controls against a standard. An authorization is meaningful; "aligned with" is not.
Data ownership. The contract should say the agency owns its data and can export it in a usable format at any time and at contract end.
Service level agreement. The vendor's commitment to availability and response times, with remedies if missed. Vague SLAs are worth little.
Open source. Software whose code is public. Not free of cost to run, but free of license lock-in.
DevSecOps. A set of engineering practices for building and releasing software with security checks built in. Ask what specifically the vendor does.
Sandbox or test environment. A copy of the system for testing without affecting real data. Should not contain real personal data.
We are glad to review draft solicitations with agencies and explain any term that shows up in a proposal.