EXHIBIT J 01.08.18 FINAL.DOCX

EXHIBIT J: INFORMATION SECURITY VENDOR PRODUCT QUESTIONNAIRE
ID Vendor Product Questionnaire
Does the product support the creation of unique user identifiers and associated authentication features that
can be integrated using lightweight access directory protocol and secure lightweight directory access protocol?
Benefitsolver does support unique identifiers. Businessolver’s preference is to use the single sign on protocols below
for connection with directory services. Benefitsolver’s single sign on (SSO) integrations enable employees to log on
to other websites to gather information or complete eligibility information without leaving Benefitsolver or to
seamlessly log in from another application, such as a company intranet. Businessolver provides three methods of SSO
P.1 connectivity into Benefitsolver, including:
 SAML 2.0 Web Browser POST over HTTPS
o Identity Provider (IdP) initiated SSO
o Service Provider (SP) initiated SSO
 Server-side POST over HTTPS
 Sign-on Web Service (SOAP) over HTTPS
Does the product allow configuration of access control groups for unique user identifiers?
P.2
Yes. Access groups can be configured for administrator accounts within the Benefitsolver application. The member
role is a defined set of information based on the defined eligibility groups of the employee.
Is the product capable of demonstrating approval of unique user identifiers by an authorizing party (e.g.,
super user/administrator)?
P.3
Yes. Member accounts are not able to access the System without information being preloaded into the System for
account creation. Administrator accounts are created prior to use and only accounts with specific rights can make
changes to administrator accounts.
Does the product support access restrictions based on group assignments including unique identifiers or
groups which can read, write and execute files, commands or code associated with commands?
Yes. Different levels of authority can be configured for Maricopa County's different administrators. Each
administrator can be given view-only or edit rights for more than 50 available permissions in Benefitsolver. Maricopa
County will be able to define the level of access each of your administrators should have. Your Client Centric Team
P.4
will work with you to define the levels of access for each of your roles and will configure the System accordingly.
Further, certain fields in Benefitsolver are privilege-based and can be assigned on an administrator by administrator
basis. For example, administrators can be given permission to view and/or edit employee election information, or this
permission can be restricted. Access can also be restricted by eligibility group. For example, administrators can have
reporting access, but will only be able to view data on their assigned eligibility group(s).
Does the product allow unique user identifiers to be activated, deactivated, and/or deleted?
Yes. Each user is assigned a unique identifier. User accounts can be activated and deactivated based on your needs.
For employees, once their demographic data is populated in Benefitsolver (either through a census load or manual
P.5 entry), they will be able to create the First Time User process and log into Benefitsolver. Their account can be
automatically deactivated through a census import (such as in the case of a terminated employee) or manually
deactivated directly in Benefitsolver. Administrator accounts can be activated and deactivated at any time directly
within Benefitsolver. Accounts are not typically deleted in order to ensure historical audit history is maintained.
Businessolver does not charge fees for storing terminated or inactive employees.
Does the product support the ability to automatically disable access based on a preset period of time
established by Maricopa County?
P.6 Businessolver does not automatically disable accounts based on client preset period; however, Businessolver does
have the ability to disable accounts. Most individuals access their benefit information a limited number of times
throughout a year and this should be taken into consideration when disabling accounts. Use of an SSO solution
would allow Maricopa County to control login periods.
Page 1

ID Vendor Product Questionnaire
Does the product support audit logging and email notification in the event of account creation, modification,
disabling and termination actions?
P.7
Logging is performed at all layers and can be used to identify whether data was inappropriately altered or
manipulated, the individual who performed the action, and when the data was accessed. Member record transaction
history, member level billing history and system logs for employees and administrators are recorded.
Does the product support automatic logout in the event of inactivity from unique user identifiers?
P.8
Yes. Accounts are automatically logged out after 20 minutes of inactivity.
Does the product allow monitoring and reporting (e.g., email) of system account usage?
P.9
Yes. All account activity is logged within the Benefitsolver Application.
Does the product support automated alerts in the event that a unique user identifier or system account is used
outside of a preset period of time as determined by Maricopa County?
P.10
The application is a SaaS platform that is available 24x7 to users with active accounts. Maricopa County will have
access to detailed logs to view who has accessed the system. If Maricopa County utilizes a SSO connection, alerting,
logging, and time restrictions could be established with the SSO owned by Maricopa County.
Does the product allow reporting on a typical usage of unique user identifier or system accounts via electronic
mail.
P.11 Businessolver's best practice is to leverage the System's audit features, including user and page logs. This
eliminates email overload and allows administrators to access the records they are most interested in. User and page
logs will detail the date and time stamp of who accessed the system, what pages they viewed, how long they spent on
each page, etc.
Does the product support reporting on user privileges via electronic mail?
Benefitsolver features an administrator access report. From an employee perspective, access is based on eligibility
P.12
groups, called Structure Groups. This field can be included on numerous standard reports. These reports are generated
within Benefitsolver. Reports can also be scheduled, and the administrator who generated the report will receive an
automatic alert in their email that the report is available in Benefitsolver.
Is the product capable of tracking and monitoring the assignment of privileged roles (privileged roles are
defined as unique user identifiers or system accounts with read, write and execute permissions) via electronic
mail?
P.13
Privileged roles can be established and assigned within Benefitsolver. Benefitsolver features an administrator access
report that can detail who has this level of access. Reports can also be scheduled, and the administrator who generated
the report will receive an automatic alert in their email that the report is available in Benefitsolver.
Does the product support the ability to restrict access to it by Internet Protocol Address?
P.14 Businessolver currently has a development project to provide support for IP filtering within the Benefitsolver
application. Businessolver has worked with clients that restrict access to the application through the use of an SSO
service.
Does the product support assignment of discretionary or mandatory access control?
From an internal perspective, Businessolver utilizes RBAC to ensure that only authorized individuals have access to
the systems and services they need to support the business or services. This occurs through the account setup and
authorization process, as well as through the ongoing reviews that are performed against internal systems.
When a user is created (in Benefitsolver or within our internal systems environment), access is provisioned based on
the role the individual has within the organization. Within Benefitsolver this is defined through permissions
P.15
associated with each company and user account. Individual accounts are created and access is provisioned based on
their role using a role RBAC matrix that aligns with available permission within the System. Access is reviewed and
approved as part of the account setup process. Access that is requested outside of this process or changed at a later
date to align with a different role requires authorization from the user’s manager prior to the access being
provisioned.
Similarly, access is managed to users outside of Benefitsolver in the same manner. This includes provisioning and
deprovisioning of access to ancillary systems, network files shares, and escalated permissions to systems
Page 2

ID Vendor Product Questionnaire
administration functionality. All privileged and escalated permissions also require authorization and approval from
an executive dependent on the type of access being requested.
Does the product support the ability to restrict information flow control on metadata?
Yes. Benefitsolver allows Maricopa County to restrict access based on metadata within the user’s profile. For
P.16
example, an administrator can have reporting permissions, but they can be limited to only report on employees in
their location. Another example, employees can access documents stored in Benefitsolver’s Reference Center, but
their view can be limited to only certain documents based on demographic information stored in their profile.
Is the product capable of preventing encrypted data from bypassing content-checking mechanisms?
P.17
The application performs the encryption methods before storing into the database. As a SaaS platform, Businessolver
maintains the encryption and controls the content-checking mechanisms within the application.
Does the product allow configuration of unique user identifiers and system accounts with different access
permissions separating key functions based on user or group (i.e., separation of duties)?
Yes. Different levels of authority can be configured for Maricopa County's different administrators. Each
administrator can be given view-only or edit rights for more than 50 available permissions in Benefitsolver. Maricopa
County will be able to define the level of access each of your administrators should have. Your Client Centric Team
P.18
will work with you to define the levels of access for each of your roles and will configure the system accordingly.
Further, certain fields in Benefitsolver are privilege-based and can be assigned on an administrator by administrator
basis. For example, administrators can be given permission to view and/or edit employee election information, or this
permission can be restricted. Access can also be restricted by Structure Group. For example, administrators can have
reporting access, but will only be able to view data on their assigned eligibility group(s).
Is the product capable of restricting access based on role or group (e.g., group account policy)?
P.19
Yes. Maricopa County will have control over which administrators have access to County data, as well as the specific
level of access they will be granted.
Is the product capable of logging unsuccessful logon attempts and automatically disabling unique user
identifiers or system accounts based on a present number of unsuccessful attempts as defined by Maricopa
County?
P.20
Yes. Unsuccessful login attempts are logged within the System. By default, Benefitsolver will lockout accounts after
five unsuccessful attempts.
Does the product support configuration of a logon banner prior to permitting access that has content defined
by Maricopa County?
Yes. Communications throughout the login page and welcome pages can be configured. In addition, during the first
time user process, employees will be prompted to agree to electronic signature language. Should the County need to
make a change to this language, your Client Centric Team can easily configure the language at any time.
Employees will be asked to certify the e-signature each time a change is made to the text upon next log in. Once they
P.21
agree, a PDF of the e-signature text is generated, automatically attached to the employee’s documents, and a
transaction will display in the employee’s history.
When an employee first logs in to Benefitsolver, they can also be presented with an Electronic Notice Consent form
that states that they will be receiving documents electronically along with instructions on how to access
documentation in Benefitsolver. The employee must then answer “yes” or “no” as to if they agree. A copy of this
electronic signature is date and time stamped and placed on their Personal Documents in Benefitsolver for future
access.
Does the product support logging of last successful and unsuccessful logon attempt for unique identifiers?
P.22
Yes. Successful and Unsuccessful login attempts are logged within the System.
Is the product capable of restricting the number of sessions that are allowed to be accessed as defined by
Maricopa County?
P.23
Businessolver has made the decision to allow multiple sessions based on client feedback about the application.
Sessions are restricted by a session id and once closed the session id cannot be reused.
Page 3

ID Vendor Product Questionnaire
Is the product capable of locking a session automatically after a preset period of time as defined by Maricopa
County?
P.24
No Maricopa does not define the timeout of a session. . Sessions are locked after 20 minutes of inactivity.
Is the product capable of requiring all transactions have an associated unique user identifier or system account
prior to transaction initiation?
Yes. Before a user can log into Benefitsolver, they must have a user ID and password. Administrator user IDs and
passwords are provisioned by an administrator with this level of access. Regarding employee access, once the
P.25 employee is entered into Benefitsolver (either through an automatic census import or through manual entry by an
administrator), the employee will be able to log in to Benefitsolver. To log in to Benefitsolver the first time,
employees will be directed through the first time user process that requests the employee’s SSN (or employee ID),
date of birth, and company key (unique identifier defined by Maricopa County). Once verified, the employee reviews
and accepts the configurable electronic signature language and sets up their desired username, password, and security
phrase.
Is the product capable of tagging information with access permission rights, so that the information can only
be viewed with proper credentials regardless of where it is stored?
P.26
Yes. The document center and the reference center provide permission rights to restrict who can access the
information by access or structure group. In addition, communications, media, etc. placed throughout Benefitsolver
can have visibility restrictions as well.
Is the product capable of restricting remote access except through approved Maricopa County mediums such
as the Virtual Private Networking (VPN) infrastructure?
P.27
If Maricopa County implements and uses a SAML SSO connection, they can utilize it to restrict remote access.
Businessolver currently has a development project to provide support for IP filtering within the Benefitsolver
application.
Is the product capable of restricting wireless access except through approved Maricopa County wireless
solutions? (See Maricopa County Information Security Policy on Wireless).
P.28
The Benefitsolver application is a SaaS solution which users connect to through the internet via browser. Because of
this, the System will not be hosted on site, but instead within Businessolver’s data centers.
Is the product capable restricting unique user identifiers' access to other unique user identifiers' information,
directory structure, etc. unless otherwise permitted by a user with super user/administrative access?
Yes. Different levels of authority can be configured for Maricopa County's different administrators. Each
administrator can be given view-only or edit rights for more than 50 available permissions in Benefitsolver. Maricopa
County will be able to define the level of access each of your administrators should have. Your Client Centric Team
P.29
will work with you to define the levels of access for each of your roles and will configure the System accordingly.
Further, certain fields in Benefitsolver are privilege-based and can be assigned on an administrator by administrator
basis. For example, administrators can be given permission to view and/or edit employee election information, or this
permission can be restricted. Access can also be restricted by Structure Group. For example, administrators can have
reporting access, but will only be able to view data on their assigned eligibility group(s).
Is the product capable of logging and recording all unique user identifier activity and system account activity?
P.30 Logging is performed at all layers and can be used to identify whether data was inappropriately altered or
manipulated, the individual who performed the action, and when the data was accessed. Member record transaction
history, member level billing history and system logs for employees and administrators are recorded.
Is the product capable of logging and recording all changes which occur on the asset including applications,
databases, and network or system operating systems?
P.31
Logging is performed at all layers and can be used to identify whether data was inappropriately altered or
manipulated, the individual who performed the action, and when the data was accessed. Member record transaction
history, member level billing history and system logs for employees and administrators are recorded.
Is the product capable of logging system and activity transactions including date, time and whether the event
was successful?
P.32
Yes. All touches and changes to the System are time and date stamped with the username of the individual who
initiated the change and the reason a change was made as well as the before and after values. This transparency
Page 4

ID Vendor Product Questionnaire
allows administrators to view what is taking place in the System in real time. Change reports can also be pulled for
either a point in time or a specified time period.
Is the product capable of storing log data on a predefined amount of storage as defined by Maricopa County?
P.33
N/A. All log data is stored within the Benefitsolver application housed in Businessolver’s data centers.
Is the product capable of alerting via email if log data is not successfully recorded?
P.34
Businessolver individuals are alerted if there are issues with the application.
Is the product capable of recording software / hardware errors and when storage capacity has been reached?
The Benefitsolver application is a SaaS solution. All maintenance to the Benefitsolver platform is provided by
Businessolver.
Businessolver engineered our production environment to be flexible, with the ability to grow and expand based on
client needs and usage requirements. Businessolver has created a multi-POD environment which can successfully
load balance application usage across multiple independent and geographically diverse locations, allowing
Businessolver to quickly and significantly expand its production environment when needed. In addition, each of the
PODs has redundancy across all systems, hardware, and software in the event of an individual system component
failing.
Further, Businessolver spends a significant portion of its time during the year preparing for the increased capacity
P.35
requirements and needs from our clients, such as during the fall enrollment period. We also perform extensive
statistical analysis on prior year usage to establish strong current year projections.
Businessolver utilizes multiple external consultants to evaluate and implement technologies that allow for
significantly more capacity than what is projected based on our forecasts and estimates. Businessolver’s load testing
has successfully pushed through traffic during one hour that is twice what it expects to receive during an entire day to
ensure more capacity is available than needed.
During Businessolver’s peak day in 2016, the Benefitsolver platform had over 5.6 million page hits and more than
85,000 unique users in one day; however, Benefitsolver’s multi-POD environment has the capability to support much
greater capacity numbers. Based on our testing, the System has successfully supported our peak day’s traffic on one
POD during one hour. Ensuring that our System can support our peak day’s traffic during a fraction of a day on a
fraction of the hosting infrastructure allows us to ensure that future traffic and capacity needs will be supported.
Is the product capable of logging messages using the “syslog” or “syslog-ng” protocol in compliance with RFC
3164?
P.36
As a SaaS platform, Businessolver maintains all the logging to a centralized logging system.
Does the product support filtering capabilities for all specified log types that are captured by the asset (e.g.,
application, database, network or system operating systems)?
P.37
Businessolver categorizes logs for the System appropriately.
Does the product support time stamps of transactions and events for purposes of logging?
P.38
Yes. All logging events have timestamps attached.
Does the product support data storage using encryption algorithms that exceed the strength of 128-bit
advanced encryption standard?
P.39
Yes. Businessolver utilizes AES-256 for encryption.
Does the product support utilization of hashing and/or generally accepted digital signature based technology to
provide non-repudiation of logs stored or transmitted from the asset including applications, database, and
network or system operating systems?
P.40
Businessolver has logs stored in multiple locations; local storage and to a central location. This allows Businessolver
to understand if there is an issue with logs in the System. Businessolver does not hash logs.
Page 5

ID Vendor Product Questionnaire
Does the product support the retention of log data for a preset period of time (in storage) as defined by
Maricopa County?
To assist businesses with meeting their regulatory requirements, Businessolver maintains information for eight years.
P.41
Employee election and demographic information is maintained actively on the System throughout the Contract
period. Logging information is actively maintained for a period of six months. If log history is desired after six
months, this information can be retrieved through Businessolver’s archives for up to eight years. Physical backups
and logical system backups are maintained in storage and retained for a period of eight years.
Does the product require unique user identification before access is granted to an asset including applications,
databases, network or system operating platforms?
P.42
Yes. Businessolver utilizes role based access to ensure that only authorized individuals have access to the systems
and services they need to support the business or services. This occurs through the account setup and authorization
process as well as through the ongoing reviews that are performed against internal systems.
Does the product require unique system identification before system-to-system access is allowed?
P.43 Businessolver maintains all systems. If there is a requirement to access a third-party system, there is a system to
system identifier utilized. These third-party connections would be for Maricopa County carriers to provide specific
functions such as eligibility of insurance forms.
Is the product capable of establishing user accounts based on unique attributes such as last names, initials, etc.
at the discretion of Maricopa County?
Employees typically set up their own username and password through the first time user process. To log in to
Benefitsolver the first time, employees will be directed through the first time user process that requests the
employee’s SSN (or employee ID), date of birth, and company key (unique identifier defined by Maricopa County).
Once verified, the employee reviews and accepts the configurable electronic signature language and sets up their
P.44
desired username, password, and security phrase.
However, Benefitsolver can support Maricopa County -defined user names and passwords if required. In this case,
upon initial login, the employee would be prompted to change their password.
As an ongoing requirement, all employees are required to log in to the System using their username and password. If
single sign on is used, they can be authenticated through another site, such as a company intranet.
Is the product capable of restricting the permanent use of a unique user identifier that has already been used?
P.45 Benefitsolver supports unique identifiers, such as SSN or unique user ID; this could be an employee identification
number, for example. The only limitation to using a unique identifier is that they must be unique to only one
individual; user identifiers cannot be reused in order to maintain data integrity of Maricopa County’s member records.
Does the product require the authentication of a unique user identifier prior to permitting access to the
requested resource?
Yes. Once demographic data is populated in Benefitsolver (either through a census load or manual entry), employees
P.46 will be able to create the First Time User process and log into Benefitsolver. This process requests the employee’s
SSN (or employee ID), date of birth, and company key (unique identifier defined by Maricopa County). Once
verified, the employee reviews and accepts the configurable electronic signature language and sets up their desired
username, password, and security phrase. Administrator accounts are provisioned by another administrator with this
level of authority.
Is the product capable of supporting password strings of at least 15 characters during password
authentication?
P.47
Yes. The default minimum password length in Benefitsolver is eight characters; however, this is configurable and can
be made longer to meet the needs of Maricopa County. Benefitsolver can support requirements such as 15 characters.
Is the product capable of enforcing password complexity which requires the use of at least 1 uppercase, 1
lowercase, 1 special character, and 1 number?
P.48
Yes. Businessolver can customize a password policy that will meet the password requirements above.
Page 6

ID Vendor Product Questionnaire
Is the product capable of enforcing that new passwords for unique user identifiers cannot use previous
password sequences where at least 6 characters are being reused?
P.49
Yes. Businessolver can customize a password policy that will meet the password requirements above.
Does the product support password storage using at least 128-bit advanced encryption standard?
P.50
Yes. Passwords to the Benefitsolver application are stored in an encrypted format using a one-way, salted sha-256
password hash.
Is the product capable of expiring passwords and requiring unique user identifiers to change their password
after a preset period of time not to exceed 365 days and at the discretion of Maricopa County?
P.51
Yes. Password expiration is defaulted at 90 days; however, Maricopa County can determine the preferred restriction
level.
Does the product support the use of PKI-based authentication solutions?
Businessolver can accommodate custom data elements for SSO tokens if the partner uses Security Assertion Markup
Language (SAML). For inbound SSO, Businessolver has multiple connection options including a proprietary option
P.52
or the SAML standard. For the first option, which does not use SAML, Businessolver accepts SSN and DOB data
elements. For the SAML option, Businessolver usually uses the employee ID rather than SSN; however, we can
accommodate other data elements/items as SAML attributes. These SAML attributes can be mapped to custom fields
for authentication in our system, if necessary.
Does the product support the use of PKI including validation of certificates through the construction of
certification paths with status information to an accepted trust anchor?
Businessolver can accommodate custom data elements for SSO tokens if the partner uses Security Assertion Markup
P.53 Language (SAML). For inbound SSO, Businessolver has multiple connection options including a proprietary option
or the SAML standard. For the first option, which does not use SAML, Businessolver accepts SSN and DOB data
elements. For the SAML option, Businessolver usually uses the employee ID rather than SSN; however, we can
accommodate other data elements/items as SAML attributes. These SAML attributes can be mapped to custom fields
for authentication in our system, if necessary. This connection can be authenticated using trust certificates.
Does the product support the use of PKI including enforcement of authorized access to the corresponding
private keys?
P.54
Not applicable. Businessolver does not review with client certificates.
Does the product support the use of PKI maps authenticated identities to unique user identifiers?
Businessolver can accommodate custom data elements for SSO tokens if the partner uses Security Assertion Markup
Language (SAML). For inbound SSO, Businessolver has multiple connection options including a proprietary option
P.55
or the SAML standard. For the first option, which does not use SAML, Businessolver accepts SSN and DOB data
elements. For the SAML option, Businessolver usually uses the employee ID rather than SSN; however, we can
accommodate other data elements/items as SAML attributes. These SAML attributes can be mapped to custom fields
for authentication in the System, if necessary.
Is the product capable of masking passwords during system entry? (i.e., shows passwords as ******).
P.56
Yes. Passwords entries are masked by default.
Does the product support cryptographic authentication schemes which are at a minimum in compliance with
FIPS 140-2 (i.e. 128-bit AES for example is acceptable)?
P.57
Yes. Businessolver is compliant with FIPS encryption algorithms.
Is the product capable of separating the administration of the asset from the use of the asset (i.e., Application
Partitioning) including applications, databases, network or system operating platforms?
The Benefitsolver application is based on a three-tier architecture that is completed separate from the Businessolver
P.58 Corporate Environment. The application and its support systems are the only systems located in the environment.
The Benefitsolver application has a DMZ for web presentation, an application layer and a database layer. Systems
Administrators access the application through the backend to maintain the application and systems providing the
service.
Page 7

ID Vendor Product Questionnaire
Further, administrators will have separate accounts for their personal access (for enrollment activities) and the
account they use for system administration. This means administrators will have two user IDs and passwords. Based
on their login, they will be presented with either the administrative experience within Benefitsolver or the employee
experience within Benefitsolver.
Is the product capable of requiring unique user identification and authentication to shared resources, and all
activity and use of the resource is logged, recorded and reported?
All of Businessolver services are delivered from our single-source platform, Benefitsolver, a SaaS based platform that
P.59
is accessible via web browser. This eliminates the need for administrative accounts and passwords to be shared over
multiple systems and eliminates the risk that comes from housing data in multiple systems. Administrators log in to
Benefitsolver with a unique user ID and password. All activity performed under these unique ID’s are logged and
time stamped within the System.
Is the product capable of restricting access from specific sources using specific protocols? Restricted set of
protocols.
P.60
Businessolver restricts ports other than those necessary to provide service for the application. This includes 443, 80,
21, and 827.
Is the product capable of prioritizing services as determined by Maricopa County to enhance performance
(generally only applied to operating platforms)?
P.61
Businessolver maintains hardware and software to ensure application is available for client use.
Is this product capable of preventing access via Internet Protocol, Service and Port?
P.62
Benefitsolver is a SaaS based platform that is accessible via web browser.
Does this product support checksums and hash values to maintain the integrity of information?
P.63
Businessolver runs checks of the application to ensure that the code being used in the System is confirmed to be
accurate, and there have been no unauthorized changes to the deployed code.
Is this product capable of encrypting data in transit to protect it from unauthorized disclosure?
Yes. Businessolver takes great care with our clients’ data by encrypting data in transit and at rest, and strong
P.64 encryption is leveraged for both. Businessolver requires all PII/PHI transmitted to and from Businessolver systems to
be encrypted during transmission. Businessolver's preference is to transfer files via SFTP (secured via SSH_RSA
key); however, we do support other options for file transfers. The Benefitsolver application is only accessible via
HTTPS, and all traffic is secured with a strong encryption key.
Is this product capable of terminating communications when sessions are completed?
P.65 Benefitsolver utilizes session cookies, and all sessions are terminated when the browser is closed. Further, for security
purposes, Benefitsolver times-out after 20 minutes of inactivity. Once the session is closed, the session ID cannot be
reused.
Can the product be configured to communicate only with specific assets?
P.66
Benefitsolver is a SaaS based platform that is accessible via web browser.
Is the product capable of utilizing PKI infrastructures?
Businessolver can accommodate custom data elements for SSO tokens if the partner uses Security Assertion Markup
Language (SAML). For inbound SSO, Businessolver has multiple connection options including a proprietary option
P.67
or the SAML standard. For the first option, which does not use SAML, Businessolver accepts SSN and DOB data
elements. For the SAML option, Businessolver usually uses the employee ID rather than SSN; however, we can
accommodate other data elements/items as SAML attributes. These SAML attributes can be mapped to custom fields
for authentication in our System, if necessary.
Is the product capable of utilizing only FIPS 140-2 compliant encryption algorithms (e.g., 128-bit AES)?
P.68
Businessolver is compliant with FIPS encryption algorithms and utilizes AES-256.
Page 8

ID Vendor Product Questionnaire
Does the product support the ability to use acceptable mobile code such as Java, JavaScript, ActiveX, PDF,
Postscript, Shockwave movies, Flash animations, and VBScript?
P.69
Benefitsolver is a Java based platform.
Does the product support session authenticity during initialization of sessions (e.g., SSL)?
P.70
Yes. The Benefitsolver web application allows connections using a smart configuration of TLS 1.0, 1.1, and 1.2. The
application starts session handshakes through authenticity.
Does the product support the ability to have vendor’s correct flaws (e.g., security vulnerabilities) including
applications, databases, network and system operating platforms?
P.71
Yes. All maintenance to the Benefitsolver platform is provided by Businessolver.
Is the product capable of being scanned using well-known antivirus systems for malicious code?
P.72
Businessolver has strong anti-virus software on all systems. Sophos Enterprise Security is leveraged in our corporate
network. Virus definitions are updated regularly via updates to the definition file from Sophos. The production
operating system is Linux-based and is protected by a web application firewall (WAF).
Is the product capable of restricting personnel from entering data in the asset based on access control (e.g.,
role-based access)?
Yes. Different levels of authority can be configured for Maricopa County's different administrators. Each
administrator can be given view-only or edit rights for more than 50 available permissions in Benefitsolver. Maricopa
County will be able to define the level of access each of your administrators should have. Your Client Centric Team
P.73
will work with you to define the levels of access for each of your roles and will configure the system accordingly.
Further, certain fields in Benefitsolver are privilege-based and can be assigned on an administrator by administrator
basis. For example, administrators can be given permission to view and/or edit employee election information, or this
permission can be restricted. Access can also be restricted by Structure Group. For example, administrators can have
reporting access, but will only be able to view data on their assigned eligibility group(s).
Does the product have the ability to determine whether or not inputs are valid?
P.74
Yes. Benefitsolver performs input validation within certain fields of the application.
Page 9