DEVB TC(W) No. 8/2025, Annex A
DWSS tender requirements checklist
This checklist turns Annex A of DEVB TC(W) No. 8/2025 into the items a DWSS tender and proposal must show: proposal contents, access, security, backup, availability, delivery timeline, project team, handover and AI. Each line gives its clause number so you can check it against the circular. Kodifly builds SpatialSense to meet them.
How to use this checklist
Paragraph 11 of the circular tells the employer and consultants to write the contract specification from Annex A, the reference specification. Annex A is the basic requirement. The contract can add more if justified. The contract specification and the employer's representative prevail over this page.
Contractors submit the DWSS proposal within eight weeks of commencement (Annex A 3.1.2). The employer's representative reviews it against the contract specification and seeks the employer's endorsement before accepting it (paragraph 13). Use the lists below as a first pass on a tender or a proposal.
Key limits and deadlines
The numbers that most often decide whether a system complies.
| Requirement | Clause | Value |
|---|---|---|
| Live demonstration | 3.1.1 | Within one month of commencement |
| DWSS proposal | 3.1.2 | Within eight weeks, or as agreed |
| Commissioning | 3.1.3 | Within three months, or as agreed |
| Uptime | 2.4.4 | 99.9% during working hours |
| Disaster recovery | 2.4.5 | Full access within 12 hours of a major hosting disaster |
| Recovery Point Objective | 2.4.6 | Not more than 24 hours |
| Network encryption | 4.1.1 | At least 256-bit SSL |
| Backup retention | 4.2.3 | At least three versions for at least 12 months |
| Audit trail retention | 4.3.1 | At least six months |
| Data to third parties and iCWP | 1.7.2 | Available by API within 24 hours |
| Photograph size | 7.4.8 | Under 1 MB each, or as agreed |
| Handover copy | 11.2.1 | Within one month after the maintenance certificate |
Clause-by-clause checklist
Tick each line against the proposal.
Proposal contents (3.1.2, 1.5.2, 2.3.2)
- Design of forms, records, reports and dashboards, and workflow processes with allowable times
- Interfacing protocols with smart site data systems, platform architecture and network configuration
- Hosting environment, delivery schedule and user acceptance criteria
- Backup and disaster recovery plan, and security assurance plan
- Every AI feature documented, within the employer's privacy and security policies (1.5.2)
- Up-to-date independent auditor reports for cloud hosting, such as ISO/IEC 20000 or 27017 (2.3.2)
Access (1.6, 5.6, 5.7)
- Desktop or laptop browser over HTTPS, with no other software or licences (1.6.1)
- English display and input, and Traditional Chinese if the employer's representative asks (1.6.2)
- Native iOS and Android app using camera, GPS, messaging and notifications (1.6.3)
- Offline cache that syncs once a connection returns (5.7.3)
- Mobile device management, with unregistered devices blocked (5.6)
Security and audit (4.1, 4.3, 5.3)
- Encryption in transit and at rest (4.1.2)
- IT security audits against Security Regulations Chapter IX and the DPO Baseline IT Security Policy (4.1.4)
- Two-factor log-in and re-authentication before submission or approval (5.3.1, 5.3.3)
- Audit trail of add, edit and delete actions, with log records submitted every three months (4.3.1, 4.3.2)
Backup and recovery (4.2, 2.4)
- Automatic daily, weekly and monthly incremental backups (4.2.1)
- Monthly off-site full backup including audit trails (4.2.2)
- Restoration test at acceptance and every 12 months (4.2.6)
- Redundant infrastructure and planned maintenance outside working hours (2.4.1, 2.4.2)
Project team and handover (3.2, 11.2, 11.3)
- Professional-rank project team member and a resident site staff member appointed by the employer's representative (3.2.1, 3.2.2)
- Offline, password-protected handover copy with open-format databases such as SQLite (11.2.1, 11.2.2)
- Each record exported as a PDF named by its unique identifier, with a document register (11.2.3, 11.2.4)
- Data and IP vested in the HKSAR Government (11.3.3, 11.3.4)
What Kodifly puts in the proposal
SpatialSense is built to Annex A, and Kodifly delivers the software, devices and installation as one project.
Annex A, built in
Live demonstration within one month
Web, iOS and Android apps
Security, backup and audit trail
Six mandatory modules
Smart Document Management
AI assistant for site records
API to iCWP
Tender checklist, answered
Where do the DWSS requirements come from?
Annex A of DEVB TC(W) No. 8/2025 is the reference specification. Paragraph 11 tells the employer and consultants to refer to it when writing the contract specification.
What must the DWSS proposal contain?
Annex A 3.1.2 lists ten items, from form and dashboard design to the security assurance plan. AI features must be documented too (1.5.2), and cloud hosting needs independent auditor reports (2.3.2).
Does the DWSS need a mobile app?
Yes. Annex A 1.6.3 requires a native app on iOS and Android that uses the device camera, GPS, messaging and notifications.
What are the AI requirements?
Contractors must incorporate appropriate AI within the DWSS (1.5.1). All AI features must comply with the employer's data privacy and security policies and be documented in the proposal (1.5.2). Detailed mandatory requirements will come in a separate circular on AI applications.
What must be handed over at completion?
An offline, password-protected copy not later than one month after the maintenance certificate, with databases in open formats, records as PDFs named by identifier, and a document register (11.2.1 to 11.2.4).
Related guides
Run your tender through this checklist
Send us the contract and the tender date. We will show SpatialSense against each clause.