Appendix A

Business Web Portal

Functional and Performance Specification

1

Table of Content

Table of Content..........................................................................................21 Document overview............................................................................4

1.1 Purpose.........................................................................................41.2 Project methodology.....................................................................41.3 Target Audience............................................................................41.4 Content and structure of the new portal.......................................41.5 Project methodology.....................................................................5

2 Content and tentative structure of the Business Portal......................62.1 Access to Finance Module.............................................................62.2 Technical Legislation Module........................................................62.5 Information From the European Entrepreneurs Network (EEN)....62.4 Offer / Demand Module.................................................................72.5 Regulatory Activities Module........................................................72.6 Business Info Centre Module.........................................................7

3 General Functional Requirements......................................................93.1 Input data validation.....................................................................93.2 Data deletion................................................................................93.3 Multi-language content.................................................................93.4 Content Management System (CMS)..........................................103.5 Automatic transliteration............................................................103.6 User administration.....................................................................103.7 Portal search and search keywords statistics.............................103.8 Administrative tool for detection of non-functional hyperlinks.. .103.9 Support for printing and export to PDF format...........................113.10 WYSIWYG editor.......................................................................113.11 Summary, keywords and related contents..............................113.12 Document workflows................................................................113.13 Support for various text sizes.....................................................123.14 Scheduled content publishing..................................................123.15 Direct content URLs and sitemap.............................................123.16 Column sorting.........................................................................123.17 Portal statistics.........................................................................123.18 Current position indicator and returning to front page............123.19 Screen resolution and support for mobile devices ..................13

2

3.20 Support for on-line surveys and votes.....................................133.21 Subscription to news and notifications....................................13

4 Safety and Security Requirements...................................................144.1 Restricted website areas, reserved for authenticated users.......144.2 Qualified electronic certificates..................................................144.3 Password strength and security..................................................144.4 Access to restricted areas through secure (https) protocol........154.5 Security and safety of the website..............................................154.6 Audit trail....................................................................................164.7 Antivirus protection.....................................................................16

5 Physical, performance and availability requirements.......................165.1 Hardware requirements..............................................................165.2 System performance...................................................................175.3 Backup procedures.....................................................................175.4 Programming language and development platforms and frameworks.........................................................................................175.5 Compatibility with most popular web browsers..........................175.6 No browser plug-ins requirements on client side........................175.7 Modularity and flexibility.............................................................185.8 Technical support........................................................................185.9 Training.......................................................................................185.10 Technical documentation.........................................................185.11 User documentation.................................................................195.12 Support during the preparation of the joint design phase.......195.13 On-going revision.....................................................................19

3

1 Document overview

1.1 Purpose

The purpose of this document is to specify the Functional and Performance Specifications for Business Portal that is to be delivered by the awarded grantee.

This chapter will describe all necessary functional and performance requirements of the Portal.

The level of detail provided in the RFA package is intended to be necessary and sufficient, but not complete, for the purpose of informing the Applicant on phases and technical specification and requests.

1.2 Project methodology

Potential bidders should keep in mind that development of the Business Portal must include frequent and intensive collaboration with the working group from the Serbian Chamber of Commerce and USAID BEP, which will jointly steer and manage the development of the Portal.

1.3 Target Audience

The target audiences for the Business Portal are companies, (especially SMEs), entrepreneurs, potential investors, foreign companies that operate in Serbia and other interested parties. The new portal will also contain various important information for the young generation, start-up companies, and women businesses and should provide educational material about different business areas, such as access to finance information and support, regulatory framework, international and local tenders, info-service, State support programs, and other important areas information.

1.4 Content and structure of the new portal

The portal’s visual style must be professional and appropriate for the institution it represents, but at the same time modern and attractive to visitors. When designing the visual concept and structure of the new portal and the Business Portal logo, potential bidders should keep in mind modern trends in presenting information on the web, with an emphasis on relevant, brief, clear and easy-to-access information.

In this regard, the ease of navigation through the portal is of particular importance. Potential bidders should also address access to the portal by visitors using mobile devices, including issues such as versatility of screen

4

resolutions, touch-friendly navigation, absence of Flash technology on many mobile platforms, etc.

Due to the large amount of information that will be contained on the portal and the constant need to update content, it is required that the new portal utilize a powerful, flexible, and easy to use content management system (CMS). This aspect of functionality will carry significant weight during the evaluation of proposals.

1.5 Project methodology

Potential bidders should keep in mind that development of the new portal should follow an “agile software development methodology”, including frequent and intensive collaboration with the Serbian Chamber of Commerce and the USAID Business Enabling Project, which will jointly steer and manage the development of the new Portal. Potential bidders are expected to be very flexible and willing to experiment and occasionally modify the design and organization of the portal in order to achieve optimal usability and relevance of information for portal visitors. Potential bids should pay careful attention on the design of the Portal as this aspect of functionality will carry significant weight during the evaluation of proposals.

5

2 Content and tentative structure of the Business Portal2.1 Access to Finance Moduleo Information about all financial institutions in Serbia sorted by types (list of banks, leasing companies,

factoring companies, microfinance institutions, donors, State institutions, foreign sources of financing, venture capital firms, and others, with the links to their websites and basic information about types of product they offer)

o Overview of possible sources of financing, sorted by business status, type of business, location, financing need, ownership structure (women businesses). An example of this type of overview can be seen at http://www.grants-loans.org/index.php

o Educational material about optimizing the business financing, with definitions and clarification of all sources of financing (mostly pdf files, which need to be visible and easy to access)

o Online financial ratios calculator. An example can be seen at http://www.a-systems.net/calculator/o Cash flow forecast forms (Description: An online excel sheet for the financial statement forecast)o Materials drafted by the Serbian Chamber of Commerce and the USAID Business Enabling Project related to

access to finance subjects (mostly pdf files)o Other educational materials for improving access to finance and finance skills2.2 Technical Legislation Module (mostly pdf files, texts and graphs)o Unique market information – Text explanations about what is the unique market and info about which

products can be sold at the market and under which conditionso CE mark and Serbian mark of conformity – Description of CE mark, purpose, what is Serbian mark of

conformity and how it is usedo Groups and lists of products that are subject to CE markingo EU directives and local legislationo FAQ sectiono Useful links and contactso Guidelines and other useful materials related to the technical legislation2.5 Information From the European Entrepreneurs Network (EEN)o Enabling of the option to search profiles from the EEN, based on defined criteria (type, subsector, period,

6

keyword)o Option to fill in the form for requesting a contact with the foreign partner, over the SCC.2.4 Offer / Demand Module (application finished by the SCC, needs to be integrated on the

new platform)o Search option for the offer/demand based on defined criteria (type, subsector, period, keyword)o Input and update of the offer/demando Main page of the portal should display last entered 5 - 10 records. Only narrative of the information should

be displayed, with the option to read more.o Complete record should only be displayed to authenticated users.2.5 Regulatory Activities Module (application finished by the SCC, needs to be integrated on

the new platform)o Online inclusion of the businesses in the regulatory activities of the SCC, and raising the transparency of

the activitieso Option to fill in the form with the following chapters: Law, description of the problem with the

implementation of the Law, amendment proposal, contact of the user. The proposal will be censured by the moderator and approved/not approved to be visible on the portal. The proposal is then forwarded to the relevant sector of the SCC which is obligated to give the opinion on the proposal

o This module is divided into three (3) segments:o Changes to the Law and By-Lawo Public Discussionso Initiative

User should have the posibility to see all published information. However if the user wants to be active in public discusions, he / she should log to the portal using qualified electronic certificate. Module should enable access to all versions of the certificates issued by acredited certification bodies in the Republic of Serbia (PKS, PTT, MUP, Halcom).

2.6 Business Info Centre Module Part of the portal that should provide external users with an efficient mechanism to pose questions to the

Chamber’s Business Info Center. These queries and the answers should, in time, result to the establishment of a knowledge base that will be searchable and viewable by users.

7

The external part of the application should contain basic information on how the BIS operates and the modes for posing questions (via a query form, by e-mail, or by telephone). Only already answered questions may be posted on the external part of the portal.

The query form shall contain required fields such as Title, Content, User’s E-mail Address, and Telephone Number (which may not necessarily be required). When the question is entered into the form, the system must provide feedback on whether the query was received successfully (‘Thank you for your query, the answer will be sent to the e-mail address you provided by…. The question and answer will also be posted on the portal.’) The question may not be posted on the portal unless it has been answered.

Questions that are received via bis@pks.rs and info@pks.rs, the content of the e-mail received should be downloaded into the database and shown in the internal part of the application so that it becomes available for additional processing using the CMS.

Questions that are posed by telephone, the call center operators must have access through the CMS to a query form identical to that available to users in the external part of the application.

The internal part of the application must have the following access levels: BIS Administrator; BIS Operator; SCC Support Service Operator (the person who will enter the answer to a question posed); and SCC Support Service Officer (the person who will verify whether the answer to the question is satisfactory). Active Directory access credentials should preferably be used to define access levels, but the application should additionally allow the user rights to be set. Possibility of defining which SCC members will be able to give answers to questions as well as delegating multiple members to avoid problems where an Officer is absent must be enabled.

After an answer is verified by the Officer, the answer will be posted on the appropriate part of the portal and the application will be required to automatically e-mail the user the answer to his or her question. Additionally, the application should be able to automatically identify a processed query has been processed, so that SCC staff have information as to whether a query has been processed. The e-mail responding to the query should be pre-defined, i.e. in addition to the answer to the question, the BIS should be able to include into these e-mails such pre-defined text paragraphs containing e.g. information about important upcoming events at the SCC, services, etc.

The Administrator should also be able to categories questions to ensure the knowledge base is laid out as clearly as possible. The Administrator should also be able to add new categories.

After a question is forwarded to the appropriate support service unit, the application should preferably be able to automatically send a reminder after a pre-set interval (24 or 36 hours) to the section, the BIS Administrator and the BIS Operator in case the query has not been processed. The application should be

8

able to allow changing this reminder interval. The query should constantly ‘move’ through the application to allow automatic recording of data as to

when the query was received, when it was sent to the appropriate section, when the unit responded, and when the response was sent to the external user.

The portal should at all times enable data to be filtered by different criteria:o Number of queries received at various intervals;o Number of queries responded to by each unit at various intervals;o Length of time each query was held by each unit for processing;o Types of external users.

NOTE: This only tentative structure that will be further discussed during the joint design phase3 General Functional Requirements3.1 Input data validation The portal must perform input data validation on the server side and clearly notify users of validation errors in

case of:o Mandatory fields that are not populatedo Fields with invalid content (e-mail address without @ sign, etc.)o An alphanumeric field with invalid characterso Numerical fields with text content or out-of-range values (negative numbers, etc.)o Date fields with inconsequent or impossible values (end date before starting date, future dates in some cases,

etc.) In case of detected errors in input data fields, the system has to clearly mark the fields that do not pass validation,

without losing content/values of correct fields.3.2 Data deletion All user actions resulting in data deletion have to be preceded with confirmation question (“Are you sure that you

want to delete…”). Deleted information/records should never be physically removed from the database, but only flagged as deleted,

so they can be restored/reconstructed if needed.3.3 Multi-language content

9

The portal must support the creation and administration of multi-lingual content, at least in the following languages and alphabets:o Serbian Cyrillico Serbian Latino English

Multi-lingual versions of the portal should not necessarily have identical layout or structure (foreign-language editions typically will be subsets of the Serbian version of the portal).

3.4 Content Management System (CMS) Content management and administration of the Business portal has to be conducted through a flexible and easy-

to-use Content Management System (CMS), which has to fully support Unicode/UTF-8 encoding. During the evaluation of proposals, bidders may be invited to demonstrate the capabilities and features of the

Content Management Systems provided in their respective proposals.3.5 Automatic transliteration from Serbian Cyrillic to Serbian Latin alphabet The portal should support automatic transliteration from Serbian Cyrillic alphabet to Serbian Latin alphabet,

primarily for the content stored within the CMS.3.6 User administration The system administrator must be provided with a functionality to:

o Add new users and set their general informationo Set and reset user passwordso Suspend and reactivate user accountso Remove users

3.7 Portal search and search keywords statistics The system has to support searching the content of the portal by key words, both for articles and attached

documents. The system administrator must be able to produce search statistics by keywords, in order to identify portal

visitors’ interests. The system also has to provide advanced search capabilities, where visitors can narrow the scope of a search,

focus on particular content category, set date ranges, use logical operators (AND, OR) and other usual advanced search mechanisms. This segment of proposed functionality will be particularly valued when evaluating

10

proposals.3.8 Administrative tool for detection of non-functional hyperlinks The portal administrator must be able to trigger detailed system-wide checks of all HTML contents (articles, news

etc.) in order to detect existence of non-functional (dead) hyperlinks. The list of non-functional hyperlinks should be provided in the form of reports, specifying the contents containing

dead hyperlinks, information if the content is still active or archived and, as precisely as possible, the location of the dead hyperlink in the text.

3.9 Support for printing and export to PDF format The system has to provide buttons/links that lead to “printer friendly“ versions of the page, as well as the

capability to download articles, news, announcements etc. as PDF documents, which need to follow the original format of the HTML page as closely as possible

3.10 WYSIWYG editor The system must provide content editors with a flexible and easy-to-use WYSIWYG editor which must support at

least:o Letter styles (bold, italics, underline, etc.)o Different types, sizes and colors of fonto Inserting photos/images, including various alignments of images and texto Bullets and numberingo Different paragraph alignments (right, central, left and justified)o Inserting hyperlinkso Content preview before publishing

It is desirable that editor properly handle the cutting and pasting of pre-formatted RTF contents from other applications (Word etc.).

3.11 Summary, keywords and related contents The system must enable the editor to define a summary (“digest”) of the text, which leads to the full article upon

clicking the appropriate hyperlink (“Read more”). Portal editors must be able to define keywords and configure predefined content type (“loan”, “access to finance”,

“state support program”, “interest rate”, “collateral” etc.) for articles and other electronic resources published through CMS, which can later serve for filtering and searching throughout the portal.

11

Portal editors must also be able to cross-link different contents (i.e., “related” links)3.12 Document workflows System has to support content and document workflows, in order to enable authorized persons to review and

approve all resources prior to publishing on the portal. Content approval could be multi-tier (e.g., first approval by an editor, then approval by an editor-in-chief). The

person responsible for approving pending content should be notified by the system, both via e-mail and through a system message upon login to CMS, that new content has been prepared which requires review and approval prior to publishing.

Workflows should not be username based, but role based, so several users can perform an approval task. Typical roles might be:o Data entry associateo Section editoro Portal Editor-in-chiefo Administrator

3.13 Support for various text sizes The portal must allow visitors to change font size via the web browser or alternatively provide specialized controls

on the website to select desired size of the letters (small, medium, large, extra large).3.14 Scheduled content publishing The system needs to enable users to schedule the publishing of articles, news and other digital resources on a

desired date/time. The default publishing schedule should be “immediately”.3.15 Direct content URLs and sitemap Resources on the portal should be directly addressable and with permanent URLS, in order to facilitate efficient

indexing to web spiders. Exceptions are allowed if particular functionality requires elements of the user interface that prevent direct mapping.

In order to facilitate indexing, a direct link to the website map should be available on the front page.3.16 Column sorting When displaying tabular information with many items (e.g., more than 100 items), it is necessary to enable

sorting by desired column to help users find desired information quicker.

12

3.17 Portal statistics The system should provide as detailed analytics and statistics of the visits to the portal as possible. The minimal

acceptable functionality is Google Analytics. It is recommended that the administrator can obtain detailed view/download statistics for every portal resource.

3.18 Current position indicator and returning to front page

The Serbian Chamber of Commerce portal should always clearly indicate to a visitor where he or she is in the organizational structure and hierarchy.

The Business Portal logo, in the upper left corner of the portal, should always act as a “Home” button and always lead to the front page, so a visitor does not have to repeatedly click “Back”.

3.19 Screen resolution and support for mobile devices and visually impaired visitors It is strongly desired that the visual rendition of the portal dynamically adjust to the client’s native screen

resolution and maximize utilization of available screen space. Any unutilized space (borders etc.), if unavoidable, should be evenly distributed on left and right margin of

the screen, so useful content is always centered. It is desirable that the system automatically and without the need of manual design offer a mobile version

of the portal for the visitors accessing the system via mobile web browsers (smart phones, iPads, tablets, etc.). The mobile version should display the website contents in single column, whose width in pixels matches the native screen width of the mobile device.

3.20 Support for on-line surveys and votes The system, through the CMS control panel, must provide user-friendly support for designing surveys,

questionnaires and votes on particular topics. The survey designer must support at least the following user interface controls:

o Radio buttons (single choice)o Checkboxes (multiple choices)o Free text fields

Anonymous visitors should be able to participate in on-line surveys, questionnaires and votes. The administrator must be able to get statistical results of the survey/questionnaire/vote in the form of

basic statistical reports, and must be able to download input data as XLS or CSV documents for further

13

processing by specialized statistical tools.3.21 Subscription to news and notifications The system has to enable interested visitors to subscribe to selected categories of content and news

digests, as well as e-mail notifications when a particular section or content of the portal is changed. All subscriptions have to be mandatorily confirmed by sending a response from the registered e-mail address.

Finer granulation of subscription is desirable, so particular user can subscribe, for example, only to information on access to finance but not to other news and / or other updates.

Subscribers must always be able to unsubscribe from receiving news and notifications by sending an email with a particular subject or some similar mechanism, which has to be clearly explained at the end of each e-mail automatically sent by the system.

4 Safety and Security Requirements4.1 Restricted website areas, reserved for

authenticated users The system has to provide support for restricted areas where access is granted only to authenticated users,

who need to previously log-in to the system Login to the system should to be enabled on two ways:

o Username/password authenticationo Authentication via qualified electronic certificates.

Users with special privileges (administrator, website editor-in-chief) must have unrestricted access to all website content.

User authentication must relate individually to each module, in order to have a completely manageable access to the content of the Portal.

4.2 Qualified electronic certificates

The Portal login module (authentication and authorization), should enable qualified electronic certificates of all Certification bodies in the Republic of Serbia

The Portal login module should enable built-in functionality to read the certificate and to storage user information.

4.3 Password strength

14

and security Users’ passwords must adhere to minimal length in characters, where all of the following types of

characters must be present (in any order):a) CAPITAL lettersb) small lettersc) numbersd) special characters

The administrator must be able to configure minimal password length and a password expiration period on the system level. Upon password expiration, the system must not allow a user to set the same password again.

Passwords must not be stored within the system in readable (plaintext) format, but only in MD5 or stronger hash form.

Passwords must never travel through system/network in original (plaintext) format, and particularly not as part of the URL or within the context of communication with other systems.

4.4 Access to restricted areas through secure (https) protocol

Access to restricted areas of the website that require prior authentication/authorization must be implemented using https protocol.

For https access, the web server must be equipped with a server certificate issued by the Serbian Chamber of Commerce. The Serbian Chamber of Commerce will enable usage of such certificate.

4.5 Security and safety of the website

Applicant must take care about providing maximal security for the Serbian Chamber of Commerce portal, with particular emphasis on preventing most common security issues, such as:a) Cross-Site Scripting (XSS)b) Using HTTP GET method for actions that change informationc) User password not meeting recommended strengthd) Trivial password-reset mechanism (security question only, etc.)e) Buffer overrun attacks

15

f) SQL injection attacksg) HTTP request parameters manipulationh) Avoiding authentication (mandatory log-in) when accessing restricted areas of the websitei) Avoiding authorization (checking access privileges of the logged-in user) when accessing restricted

areas of the websitej) Providing directory listing upon non-existing resource requestk) Unprotected exception management (display of software exceptions details to client side)l) “Parameter engineering” through browser tools such as “Firebug”, etc.m) f) Predictable resource locations, etc.

Applicants are expected to provide detailed and precise elaborations of all software and hardware security mechanisms that are envisioned during the implementation of the portal. This segment of the technical proposal will carry critical weight during bid evaluation.

4.6 Audit trail

Any content modification of the portal must be logged into system Security Audit Trail, which has to record at least the following information:a) ID of the changed resourceb) Type of change (addition, modification, deletion)c) Functional context of the portal where the change was initiatedd) Username of person who initiated the changee) Timestamp of the changef) IP address

The system administrator must be able to review the audit log on request, in a comfortable and easy to use manner (manual database queries are not a satisfactory level of functionality).

The system administrator must be able to archive (but not delete) contents of the audit-log which are older than a configured date or configured number of days/months.

4.7 Antivirus protection

The system must perform an antiviral scan of each uploaded attachment in order to lower the risk of malicious or unintentional publishing of electronic content infected by computer virus, Trojans, etc.

16

The antivirus system must be configured for fully automatic operation with scheduled automatic daily updates of the antiviral database, without the need for manual administrator’s actions.

5 Physical, performance and availability requirements

5.1 Hardware requirements

Serbian Chamber of Commerce shall provide all necessary hardware and software platform required to support the performance and availability of the portal.

The Applicant must ensure that the designed portal will work properly on the following specification:o Applicative server: Windows Server 2012 R2 Standard Edition (64-bit)o Web Server: Internet Information Server (IIS) 8.5o Database - SQL Server 2012 Enterprise Edition

Virtual Machine - Hyper-V Server 2008 R2:o cpu: 2x Intel Xeon X5650 2.67 GHzo memory: 12 GB RAMo storage: 100 GB HDD

Having in mind that the entire Information Service of the Serbian Chamber of Commerce is Microsoft based, utilization of Microsoft technologies are preferred.

5.2 System performance

The system must be able to serve 200 concurrent visitors without noticeable degradation of performance or responsiveness.

The system should not imply any artificial limits such as to maximum number of articles, sections, registered users, attachments etc. except objective limits imposed by memory/hard-drive capacity or similar physical constraints.

5.3 Backup procedures

Applicant must implement both automatic and manual backup mechanisms, daily, weekly, monthly and full backup of entire portal content.

17

Backup and restore procedures must be automated and documented so that a reasonably skilled IT person can independently perform both data backup and restore.

5.4 Programming language and development platforms and frameworks

Programming language used for server-side portal development must be industry standard, object-oriented, compiled or scripting language (C#, ASP.net, Java Script, etc.).

5.5 Compatibility with most popular web browsers

The portal must look and feel the same in the following web browsers:a) Mozilla Firefox 3.5 or newerb) Microsoft Internet Explorer 7 or newerc) Apple Safari 5 or newerd) Google Chrome 4 or newere) e) Opera 9 or newer

5.6 No browser plug-ins requirements on client side

The Business Portal must not require plug-ins on the client side (e.g., Adobe Flash, Microsoft Silverlight) in order to properly display content.

Only content types which naturally require client-side plug-ins and CODECs (video streaming, interactive process animations, etc.) may be an exception to this rule.

5.7 Modularity and flexibility

The system must be designed in such manner that additional changes, extensions or removals of functionality affect other components as little as possible.

The system architecture should be designed to minimize the number of places requiring changes when new functionality has to be added or existing functionality has to be changed.

The system must me flexible, adaptable and scalable in order to support long-term traffic increase and/or

18

growth of volume of information within the portal, by simply adding more powerful or additional hardware without the need of major software architecture reengineering.

5.8 Technical support

Awarded Applicant should commit to a one year warranty and two years of software maintenance period, starting after signing the final acceptance form and issuing a “GO LIVE” of the Portal.

The Applicant must guarantee that it will in the period of two (2) years, following the expiry of warranty period, accept all kinds of system maintenance should it be so offered.

The Applicant should as part of their offer specify terms with included time-to-react and time-to-fix if any error in the applicative or system software happened to occur.

5.9 Training The awarded Applicant shall provide necessary training for the members of the Serbian Chamber of

Commerce. The Applicant should provide training plan, training implementation in Serbian language and all instructions

for end users and IT specialists who will participate in the training.5.10 Technical documentation Applicant shall provide complete technical documentation for each module of the Portal including the

documented Portal source code.

5.11 User documentation User documentation shall consist of two manuals. The first, shorter manual should be used as a quick

reminder for users who are already familiar with the Portal. Second manual should include detailed description of all functionalities implemented within the Portal. Both manuals must be made in PDF form in Serbian language. Manuals should be delivered only in electronic form.

5.12 Support during the preparation of the joint design phase During the first stage of the development of the Business Portal, the Grantee shall provide support in the

preparation of joint design phase. This support shall include but not be limited to focus groups, conference calls, meetings etc. with the dedicated members from USAID BEP and the Serbian Chamber of Commerce team.

19

5.13 On-going revision Grantee is obligated to provide mandatory participation and involvement of USAID BEP and the Serbian

Chamber of Commerce team members during the development and implementation of the Portal. Each stage and delivery during the development and implementation must be verified by the USAID BEP and the Serbian Chamber of Commerce with a signed acceptance form.

During the portal development and implementation maximal involvement of the USAID BEP and Serbian Chamber of Commerce members must be ensured.

20