Medical Marijuana Seed to Sale System

The vendor is required to provide software as a service (SaaS) medical marijuana seed-to-sale solution, that will monitor, control, and report activities of authorized growers and processors, dispensaries, laboratories, and research institutions.
- The solution will provide seed-to-sale functionality including real time tracking to monitor, control and report on activities of authorized growers and processors, dispensaries, laboratories, clinical registrants, and academic clinical research centers. 
- Equipment (i.e., printers, scanners, scales, cash drawers, consumables), subscriptions and supplies to support the registration, tracking, dispensing, sales tax calculations and collections, and quality control processes may be purchased as a part of the solution. 
- The solution must ensure ongoing compliance with commonwealth seed-to-sale tracking and monitoring requirements, laws and regulations.
- Seed-to-sale system
•    The commonwealth is seeking a SaaS seed-to-sale system that will be used to monitor, control, and report activities of authorized growers, processors, dispensaries, laboratories, and research institutions.
o    The solution's capacity to collect all data required to be reported by dispensaries, grower and processors, laboratories and patient and caregiver users as it relates to the reporting.
o    The solution ensure that it is up to date, and able to produce required inventory reports
o    The method for data entry (manual, scanning, upload and import spreadsheets) from other sources
o    Recommended and available tools and reporting functions for regulators that manage the assessment of data on inventory, sales, aggregate data, and lab test results.
o    solution data processed and displayed in real time
o    The solution integrates with a user registry solution
o    Provide a general description of the registry solution and the integration points.
o    The solution customizable or standard and what is vendor position
•    The solution custom-developed or based on configurable off-the-shelf and SaaS software
•    There a formalized governance structure
•    The governance structure, are changes considered and dispositioned for each client individually, or do clients compete against each other for consideration of changes
•    The planned downtime associated with the standard annual maintenance schedule.
•    The cause and resolution timeframe of the longest planned and unplanned outages.
•    Outside solutions able to exchange data with the solution
•    The expected and historical solution availability percentage with the solution (ex: expected: 99.999%, past 2 years: 96.8%)
•    The solution currently operational in production
•    The solution as its primary seed-to-sale system
- Security
•    The solution requires multi-factor authentication (MFA) for administrative access
•    Strong user passwords and password maximum age (days) enforced
•    The solution sends audit logs to a cloud-based commonwealth SIEM
•    The solution suffered a data breach in the past, and if so, how many records were breached 
•    The times between breach occurrence, breach discovery, and remediation
•    A web application firewall (WAF) protecting the solution
•    The solution scanned for vulnerabilities on a recurring basis.