076-Exhibit D-Data Security Questionnaire.pdf
PDF 227 KB Posted
- Solicitation number
- 2136099
- Issued by
- Clinton County, New York
About this file
This is a Data Security Questionnaire and Attestation form for the New York State Unified Court System (UCS) Office of Court Administration, required as Exhibit D for the comprehensive item banking software solution RFP (OCA-DGCP-076). The form serves as a mandatory security compliance document that vendors must complete and submit to demonstrate their ability to protect UCS data throughout the contract term, which spans five years beginning October 1, 2026. The questionnaire requires vendors to attest to specific security controls and infrastructure standards, including data encryption at rest, restricted physical and electronic access to servers, multi-factor authentication for offsite access, automated device management and patching, anti-virus protection, firewall and intrusion detection systems, and secure file transfer protocols. Vendors must also declare whether they use custom software and confirm compliance with cloud storage requirements, including FedRAMP certification or CJIS Security Policy guidelines if data will be stored in the cloud. The form requires completion by the vendor's IT security contact and submission with a signature and date; if the organization's security posture changes during the contract period, UCS must be notified via email to ocadatastartrequest@nycourts.gov within 14 days.
The questionnaire additionally establishes mandatory data breach response protocols, requiring vendors to deliver immediate notice to UCS upon any suspected or confirmed breach, including dates, scope, affected individuals, and remediation steps. Vendors must comply with all statutory and regulatory breach notification requirements at their own expense and provide written status reports to UCS on a routine schedule. The form is valid for the duration of the agreement once completed and serves as the security baseline for all vendor operations involving UCS assessment item data and examination development systems.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| DRAFT RFP 076 Exhibit A Pricing Sheet.xlsx | XLSX spreadsheet | |
| 076 Preliminary Bid Results001.pdf | ||
| Attachment IV.pdf | ||
| AMENDED RFP 076 Exhibit A Pricing Sheet.xlsx | XLSX spreadsheet | |
| Amendment #1 to OCA-DGCP-076 ADA .pdf | ||
| Attachment III.pdf | ||
| OCA-DG~1.PDF | ||
| Attachment I.pdf | ||
| RFP 076 QA_final ADA .pdf | ||
| AMENDE~1.PDF |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ensure it remains secure from vulnerabilities.
OR
Organization Name:
IT Security Contact Name:
Title:
Phone Number:
Email address:
Please indicate security compliance by checking the appropriate boxes below.
UCS data will be encrypted at rest.
Physical access to servers is restricted to appropriate personnel and access to the physical location is logged.
Electronic access to UCS data will be restricted to only those who need it.
All computers, workstations, and servers on this network are accessible only to organization personnel and require authentication, using at a minimum a unique User ID and Password.
Offsite access is not permitted OR Offsite access requires two factor authentication
All devices accessing UCS data are actively managed and are automatically updated. The devices regularly check in, in order to apply operating system and application patches.
All devices accessing UCS data must run anti-virus software with the latest patches and signatures.
Downloading of data to local drives and portable devices is prohibited by (select one):
IT restrictions Written policy
All devices accessing UCS data must auto-lock after a reasonable period of inactivity with PIN or password required to unlock.
File transfers of individual-level data (if required) will be completed via secure methods such as SFTP or encrypted e-mail.
Custom software is maintained and supported with necessary updates, upgrades, and bug fixes to
Our organization does not use custom software.
The network has a firewall, virus monitoring, and intrusion detection systems.
If OCA data will be stored in the cloud:
All cloud servers are located in the United States OCA data will not be stored in The cloud provider is FedRamp certified OR the cloud The cloud provider meets CJIS Security Policy guidelines
Upon a suspected or confirmed Data Breach, Organization shall:
Deliver immediate notice to UCS indicating the dates(s) and scope of the breach and the number and identity of any individual(s) whose Data was, or was believed to be, breached.
Take immediate steps to mitigate and remediate any Data Breach, including, but not limited to, complying, at its sole cost and expense, with all statutory and/or regulatory data breach notification requirements which may arise in connection therewith
Report such steps to UCS in writing on a routine schedule and as may otherwise be requested by UCS
If the organization no longer meets the above, UCS will be notified via email to ocadatarequest@nycourts.gov within 14 days. Otherwise, this form shall be valid for the duration of the agreement.
Signature Printed Name Date
EXHIBIT DFor Internal Use Only: Agreement #
New York State Unified Court System Data Security Questionnaire and Attestation
Untitled
| Image Field0: |
| IT Contact Name: |
| IT Contact Title: |
| Phone Number: |
| email address: |
| Organization Name: |
| Agr#: |
| B5: Off |
| B6: Off |
| B7: Off |
| B0: Off |
| B1: Off |
| B2: Off |
| B3: Off |
| Printed Name: |
| Date: |
| B13: Off |
| B14: Off |
| B15: Off |
| B16: Off |
| B17: Off |
| B21: Off |
| B18: Off |
| B25: Off |
| B8: Off |
| B4: Off |
| B29: Off |
| B12: Off |
| B9: Off |
File details come from the government source that posted it. Updated .