1. EXECUTIVE READINESS SNAPSHOT Analysis boundary: Complete supplied CityTransit solicitation package and bidder evidence listed in the four input packages. RFP completeness status: COMPLETE for the supplied example. Deadline / submission constraints: Searchable PDF via procurement portal by 16 October 2026 at 12:00 CET; technical response maximum 50 pages; pricing only in the supplied workbook. Requirement count: 10 atomic submission/response requirements, plus the supplied weighted evaluation model. Critical unresolved items: - R-005 ISO 27001 certification is UNSUPPORTED. SOC 2 Type II is not equivalent evidence. - R-006 90-day implementation requires an approval decision. Prior 75-day performance does not authorize a new contractual promise. - R-007 third comparable reference is PARTIALLY SUPPORTED because the RFP does not define comparability and the third supplied example is private-sector. - R-008 pricing workbook remains an administrative completion action. Draft-readiness status: BLOCKED. Explanation: The bid can be planned, but the supplied material shows an explicit mandatory certification requirement that the bidder does not meet and no supported alternative or buyer-approved exception is supplied. This is a drafting-readiness decision only, not a bid/no-bid or award prediction. 2. REQUIREMENT CONTROL MATRIX | Requirement ID | Parent Requirement | Source Locator | Atomic Requirement | Logic / Dependency | Type | Classification | Weight | Evidence Status | Evidence Reference | Commitment Type | Owner | Next Action | Drafting Impact | |---|---|---|---|---|---|---|---|---|---|---|---|---|---| | R-001 | SSO | Mandatory req. 1 | Support SAML 2.0 OR OIDC | OR preserved | Technical | Mandatory | Technical 35% | SUPPORTED | Product Security Guide v6.2 | TECHNICAL | Solution Architect | Use supported claim | Low | | R-002 | MFA | Mandatory req. 2 | MFA for privileged users | None | Security | Mandatory | Security 20% | SUPPORTED | Product Security Guide v6.2 | SECURITY/PRIVACY | Security Lead | State IdP-integration boundary | Low | | R-003 | Data residency | Mandatory req. 3 | EU data residency | None | Security | Mandatory | Security 20% | SUPPORTED | Hosting Architecture v4 | SECURITY/PRIVACY | Security Lead | Confirm proposal wording | Low | | R-004 | Availability | Mandatory req. 4 | Contractual SLA at least 99.9% | Minimum 99.9% | Service | Mandatory | Technical 35% | SUPPORTED | MSA Schedule B | SERVICE/SLA | Legal/Contracts Counsel | Approve contract wording | Medium | | R-005 | Certification | Mandatory req. 5 | Bidding entity holds ISO 27001 | Current-state qualification | Eligibility | Mandatory | Security 20% | UNSUPPORTED | No ISO certificate; SOC 2 only | CERTIFICATION/ELIGIBILITY | Security Lead | Capability-gap escalation | BLOCKING | | R-006 | Implementation | Mandatory req. 6 | Complete within 90 calendar days | Contract-signature dependency | Delivery | Mandatory | Implementation 15% | REVIEW REQUIRED | DR-8 shows 75-day prior delivery | DELIVERY | Delivery Director | Approve or reject 90-day commitment | High | | R-007 | References | Mandatory req. 7 | Three comparable deployments within five years | Count = 3 | Experience | Mandatory | Experience 10% | PARTIALLY SUPPORTED | CS-17, CS-21, CS-31 | CERTIFICATION/ELIGIBILITY | Bid Manager | Confirm comparability definition | High | | R-008 | Pricing | Mandatory req. 8 | Pricing only in supplied workbook | Exclusive format | Administrative | Administrative | Price 20% | REVIEW REQUIRED | Pricing approved, workbook incomplete | PRICING | Finance Lead | Complete workbook | High | | R-009 | Page limit | Mandatory req. 9 | Technical response max 50 pages | Maximum 50 | Administrative | Administrative | None | UNKNOWN | No draft yet | NONE | Bid Manager | Add page-control gate | Medium | | R-010 | Submission | Mandatory req. 10 | Searchable PDF via portal by deadline | Format + channel + deadline | Administrative | Administrative | None | REVIEW REQUIRED | Submission rule only | NONE | Bid Manager | Final submission checklist | High | 3. EVIDENCE & COMMITMENT LEDGER | Ledger ID | Related Requirement IDs | Claim Allowed by Evidence | Evidence Source | Evidence Access | Evidence Strength / Limitation | Proposed Commitment | Approval Required | Approver / Owner | Safe Wording Boundary | |---|---|---|---|---|---|---|---|---|---| | L-001 | R-001,R-002 | Supports SAML/OIDC and privileged MFA via supported IdP integration | Security Guide v6.2 | INSPECTABLE | Strong for described integration only | Technical support statement | No new commercial approval | Solution Architect / Security Lead | Do not imply unsupported IdPs | | L-002 | R-003 | EU hosting is available in eu-west-1 | Hosting Architecture v4 | INSPECTABLE | Supports stated hosting region | Residency commitment | Yes | Security Lead | Do not claim broader sovereign controls | | L-003 | R-004 | Standard SLA is 99.9% | MSA Schedule B | INSPECTABLE | Supports standard contractual term | 99.9% SLA | Yes | Legal/Contracts Counsel | Do not exceed 99.9% | | L-004 | R-005 | No ISO 27001 evidence exists | Supplied facts | INSPECTABLE | Negative fact is explicit | None | N/A | Security Lead | Never claim current ISO 27001 | | L-005 | R-006 | Prior 75-day delivery occurred | DR-8 | INSPECTABLE | Experience is not authority to promise 90 days | 90-day delivery | Yes | Delivery Director | Prior performance may support credibility only | | L-006 | R-007 | Two public-sector and one private-sector references exist | CS-17, CS-21, CS-31 | INSPECTABLE | Third example comparability uncertain | Reference submission | Yes | Bid Manager | Do not call CS-31 comparable without basis | 4. GAP CLOSURE QUEUE | Gap ID | Requirement IDs | Gap Type | Missing / Conflict | Closure Route | Owner | Dependency / Deadline | Priority Basis | Blocking Status | |---|---|---|---|---|---|---|---|---| | G-001 | R-005 | Qualification gap | Bidder lacks ISO 27001 | CAPABILITY GAP / UNRESOLVED BLOCKER | Security Lead | Before draft claims | Mandatory | BLOCKING | | G-002 | R-006 | Approval gap | 90-day commitment unapproved | APPROVAL DECISION | Delivery Director | Before implementation section | Mandatory + 15% | CONDITIONAL | | G-003 | R-007 | Evidence interpretation | Third reference comparability unclear | BUYER CLARIFICATION or internal interpretation review | Bid Manager | Before experience section | Mandatory + 10% | CONDITIONAL | | G-004 | R-008 | Administrative | Buyer workbook incomplete | ADMINISTRATIVE FIX | Finance Lead | Before submission | Mandatory | CONDITIONAL | 5. BUYER CLARIFICATION QUESTIONS | Question | Requirement IDs | Why It Matters | Decision / Section Affected | Latest Useful Point | |---|---|---|---|---| | How does CityTransit define a "comparable deployment" for the three-reference requirement? | R-007 | Determines whether CS-31 is usable | Experience / references | Before final reference selection | 6. OWNERSHIP & APPROVAL MAP | Work Item | Requirement IDs | Author | SME / Evidence Owner | Approver | Final Reviewer | Ownership Gap | |---|---|---|---|---|---|---| | Security response | R-001 to R-005 | Bid writer | Security Lead / Solution Architect | Security Lead | Bid Manager | None | | Implementation | R-006 | Bid writer | Delivery Director | Delivery Director | Bid Manager | None | | References | R-007 | Bid Manager | Case-study owners | VP Sales if needed | Bid Manager | Comparability unresolved | | Pricing | R-008 | Finance Lead | Finance Lead | VP Sales | Bid Manager | None | | Final submission | R-009,R-010 | Bid Manager | All owners | VP Sales | Bid Manager | None | 7. RESPONSE ARCHITECTURE - Security and Access: R-001 to R-005. Lead with supported SSO/MFA/residency evidence. ISO 27001 cannot be claimed. - Implementation: R-006. Use DR-8 as experience proof, but leave 90-day wording pending Delivery Director approval. - Experience: R-007. Use CS-17 and CS-21. Do not position CS-31 as comparable until definition is resolved. - Commercial / Pricing: R-008. Keep all pricing in buyer workbook. - Submission Controls: R-009,R-010. Maintain 50-page gate, searchable PDF check, portal/deadline check. 8. REVIEW GATES A. Pre-Writing Control Gate Blockers: G-001. Conditional approvals: G-002, G-003. Evidence: requirement matrix + gap queue. Reviewers: Bid Manager, Security Lead, Delivery Director. B. Draft Evidence & Responsiveness Gate Check every claim against L-001 to L-006, confirm no ISO claim, confirm approved implementation language, confirm page count and reference wording. Evidence: annotated draft + evidence ledger. C. Final Submission Control Gate Check pricing workbook, 50-page limit, searchable PDF, portal upload and deadline. Evidence: final submission checklist. 9. DRAFT-READINESS DECISION Status: BLOCKED. Blocking items: - G-001 / R-005: mandatory ISO 27001 requirement is unsupported with no supplied closure path. Conditions that may remain open during limited planning: - G-002 implementation approval. - G-003 comparability clarification. Items that must be resolved before submission: - ISO 27001 qualification position. - 90-day commitment. - third reference comparability. - pricing workbook. - final format and portal controls. This is not a bid/no-bid recommendation and not an award prediction. 10. NEXT 10 CONTROL ACTIONS 1. Escalate G-001 / R-005 to Security Lead and Bid Manager as a mandatory qualification blocker. 2. Obtain Delivery Director decision for G-002 / R-006. 3. Resolve G-003 / R-007 comparability definition. 4. Complete G-004 / R-008 pricing workbook. 5. Lock approved wording for L-003 / R-004 SLA. 6. Build security response architecture for R-001 to R-005 without unsupported ISO language. 7. Build implementation outline for R-006 using DR-8 only as evidence of prior delivery. 8. Select final references for R-007 after comparability decision. 9. Establish R-009 page-control review. 10. Schedule R-010 final searchable-PDF and portal submission check.