Specifications include, but are not limited to: System Requirements 1. The IIS used to replace the legacy HIR shall meet all CDC functional standards in the version 4.1 and be a fully developed COTS system that has been similarly implemented in other jurisdictions. The Offeror shall establish this IIS software as fully developed by evidence of the IIS deployment in other state, local, or territorial health departments meeting these standards. The State requires there should be no or very minimal custom software development to make the system compliant with these functional standards. Offerors shall identify in written proposals the percentage of system configuration versus expected minimal amount of system development in order to successfully deploy the complete IIS for Hawaii. Vendor proposals may not exceed five-to-ten percent (5-10%) of system custom development in these written proposals. 2. The Offeror shall provide the cloud hosting services in a secure environment and may elect to provide these hosting services directly or subcontract with a separate cloud hosting services provider as identified in proposals. The hosting services must be compliant with industry standards, and the Offeror shall provide an annual SOC2 compliance report for State review. 3. This data shall be backed up and protected under industry standards. The Offeror shall perform biennial Disaster Recovery testing to the State’s specifications and shall submit all results to the State for approval and formal sign-off. The Offeror shall perform security evaluations, including annual security reviews, and bi-annual assessments and shall submit all reports and findings to the State prior to the end of the contract period.