������������������������� !�"�#�$�����%#�&��!'�(%�)*+,!-.%"/$��0�����#/���#��,/���//)%#��#1���%#�)%2/��3/4�56�7������8�������9��:�8��;<

��:���=>?@�AB�CDEA

�������FGHIJK�LMJNO�PKQIRISNJMNITR�UGLPV�WTJXYZ[P\]TQ̂ SNI_�LMJNR̂J�MRK�[̂ NIĴ �̂XTRNIR̀MNITRXTâJMb̂5�cd�eFfghijkjlmnLj �o ��:�8�FpPq]�r�L̀J_HMSIRbs<o�F[pL;� �9 Ftuvwx6o�8� ��Frry9� ���8 � 9�� ��Fĥ âJz�8� ��{8c��:

���8F]M|MĴR̂�}̂S_TNN~�}MNTOM�X�MJ�rpTJ�̂S~K�̂S_TNN��JT�MJK�TJb~�_�MJ�WTJ�̂S��JT�MJK�TJbz�� ��Frr ���c�Frrz�8�� ��� 9� ���8FY�̂RrgRK��pIâr�̂MJ��RINIM�z�8�� ���5�8�� �F

DRAFT

������� �!"#$�%"����&�����'(�$����)�*�++,&-%$�'���.��/"�01�������&"%(��%2�3"�4�5655789�:�:"+� �������;����*�%��/�<������&�<"�0=��,>$���4����?�

789�:�:"+� �������;����*�%��/�<������&�<"�0>$���4����?�

;����'++� �"��*"%/"��� "�0@��)�=��;���4�5*$A��/�B�%C+DE��+�%$/�������*%�F"/��:"+/%�<�����G������H�I��JK�L���

�M�N�O��P�QOR

����S�O���S�T�U�S�����S�S��J��V�

�WO

�H��M�H��R�������U�M���X��M�Y

��P��MR���S��

�����Z�Y�[�H���N�L��\T�R�S����Y �M���������N�����O �����N�U�� V��

S������X����WO���R���S��O�

���M�����X��G������H�G��U���S6��WO�S��M�]�H��R

����K�LY��̂S���WO�S��M�]�H��R

�����S��������M����H��S�_��WO���M_�

�M�_������

_����RS�H���SO�R���

̀�X���U���

�M��OR���S�

�M���H��R �U �������X���U

O

����������SS6��X���H���̀�U��M��S�

���S����V P�����O� V�M�������U�M��

�H� �S�

����R���H�SO�R���

OM��V��X�S��

�S��M� S�a������ b����LY��̀������ ���R� P� �M���R���X��S�U����U�����P��X��N�O��P6G� �����Y��U�S���S\��WO���R���SK�Zc��M����S�� O�����M��X ���X�S��S�

�SORR

�P��� P�

�M��X��HO

�S�

�����ROS�������U����M[6�����L���

�M�N�O��P�Y��d����G����H����V���R����Z?e�fghg5ijYg[����e�������S�����X�� �VP�G��U���S�c��M���G��O���P�kO�S����� ����ZcGk[

I�I

[�H\ �H�&]* ̂ *̂�_$R\,]H\���̀ ,U_#*abc c_T,�W]̂�$����(�cÎd�

# H�DRAFT

��������������������� ���!"#� �$%&#'# &"('�&!# )&#)*"%'��*�(������%���+������� ���#*���%'!&$#'�&"( #& %��&�*)�)��#��)�������, -� .%/0�1� 23��4 ��� 56�������7

90:890;89<=>?��6 @�%AB��� ���� C D

#�/�'�*E

*F'$GC

H@�I�� ���1 J�7���3 :�������7

I����K�������>?��6 @�%AB��� ���� L�BMN���

O�P�QRST

UVWRXXX -�M

�'�"E)F'!

GC

H@��� �7��� :������7Y�� 4�� I����K�������

90:890;89<=>?��6 @�%AB��� ���� L�BMN���

O�P�QRST

UVWRXXX C D

#�/�'�*E

*F�#GC

H@�52� Z��?�� �������3 ;��7��������� [Z�;\]5̂_̀ abacde:a] 2:4 K�� Ifg948�� �7��� ��?9������ I����������� I�h��� �>6176 @�%AB��� ���� i�j )��/�'�*E ))F'*kC H-�5h�1������ I�������] ̂5_̀ abacde:a] 2:4 K�� Ifg948�� �7��� 9������ I�����������I�h��� �>�?K @�%AB��� ���� l � )��/�'�$E

)�F*�GC

H-�=�7��������7 Z��?��7] ̂5_̀ abacde:a] 2:4 K��Ifg948�� �7��� 9������ I�����������I�h��� �>?��6>�?K @�%AB��� ���� l � )��/�'�$E

)F�$GC

H-�=�7������ 9�m���� 0�� ̂5_̀ abacde:a>�?K @�%AB��� ���� @�% �'�*E�F*#

GC

H-�<��� �����

J�7���3>?��6 @�%AB��� ���� -�M

)'�/�'�"E

)�F�*GC

H@�<�nn3�7� 9� �7������� 9�m����

I����K�������>?��6 @�%AB��� ���� L�BMN���

O�P�QRST

UVWRXXX -�M

�'�"E)F'!

GC

H@�<������� I����K�������

90:890;89<=>?��6 @�%AB��� ���� L�BMN���

O�P�QRST

UVWRXXX kAP )O� �'�*E�F��

GC

H@�_� Ig5 ̂��1 o� ̂5_̀ abacde:a>�?K @�%AB��� ���� i�j )��/�'�*E ))F'#kC H-�

*+,-.�/�0 �1� ��0 1���,-+/2-+3��14 5�� !�"�����" 6$��77��898:;�<&9:6=�>5?*+,-.�@���A������+ �����������(��0 1�B�A�2� ����1����

3��14 5�� !�"�����" C�!$������"����D"EFGH�IJKFLLL M�$�N���898O;7&9<�P=�>5?0�

1��Q���� ���R������

�S�T+UVWXWYZ[0WS\0@���

�2*-�@/.������1�0� ��2� �2�]� �̂�3��14 5�� !�"�����" _�"�:���898N;&̀9̀�P=�>M?0 �a�1��,B�1���1�@̂

�S�T+UVWXWYZ[0WS�\0@���

2*-�@/.������1�0� ���2� 2�]� �̂�3��14 5�� !�"�����" _�"�:���898N;8&̀b�P=�>M?,1�B�����,�

]�1��S�T+UVWXWYZ[0WS�\0@���

�2*-�@/.������1�0� ���2� 2�]� �̂�3B�� 5�� !�"�����" 5���̀���898:;79&9<�6=>M?,�)1� �1�� �/,�)1� ��A��

��/,�BBA��

�3��14 5�� !�"�����" C�!$������"����D"EFGH�IJKFLLL M�$�N���898O;7&9<�P=�>5?,����

c����d� ��2�� �c2��B�����]��,�A�1������ �3��14 5�� !�"�����" M�$�N���898O;7&9<�P=�>5?d� �R������

��2� ����1���� ��/�e0/�eR/�f 3��14 5�� !�"�����" C�!$������"����D"EFGH�IJKFLLL g���87��898:;�̀&8NP=�>5?d� 1��d� ���1����

S�T+UVWXWYZ[0WS�\0@���

2*-�@/.������1�0� ���2� 2�]� �̂�3��14 5�� !�"�����" h�i�78��898:;�79&̀<6=�>M?d�A�������0 �]�����0�c�� �/��e0/�eR/�f 3��14 5�� !�"�����" =�%�j��898:;�:&̀9P=�>5?

U��� \cB� k�e�A�� ����� ��0� �c�@��� �l\0@m��� 2*-�@n.������1�0� ��2� �2�]� �̂��l-\/Yo ,m p��?����&>q����rsq��qt 7 uvwxyuvz {� ������"�������#����� �����$��i�����|��$�"��?�!$�����#��������p��?����sf�1���� �2� ����1���� �/��e0��eR��f }����?%$�&�6"%rs~t = ���$�� uvwxyuvz0� 1��Q���� ���R������

� }����?%$�&�����rs���;s���qt = ���$�� uvwxyuvz

��%��������& '()*�+,-*.�/0,1234 56)7(-)* 89:;<89=>��� ���?�� ����� �A�%���

�� '()*�+,-*.�/0,�1234 56)7(-)* BCDEBFGH����

�����������������I@�������������������������

������� '()*�+,-*.�/0,�1234 56)7(-)* BCDEBFGH��

����J ������K�����

�� '()*�+,-*.�/0,�1234 56)7(-)* BCDEBFGH������

��L�������

���M�%N��%NO�%@� '()*�+,-*.�/0,�1234 56)7(-)* BCDEBFGH$ K��������K����

���O����

���"�KO& '()*�+,-*.�PQR*)12Q)ST�2Q)SQ4 56)7(-)* BCDEBFGH@

���J

����� '()*�+,-*.�/0,�1234 56)7(-)* BCDEBFGH@����

�� '()*�+,-*.�/0,�1234 56)7(-)* BCDEBFGHU$K?��L��

�� '()*�+,-*.�/0,�1234 56)7(-)* BCDEBFGHU$K?��@�������������������I���L���

������V����N� ��$�������������������������������� '()*�+,-*.�/0,�1234 56)7(-)* BCDEBFGHK��������������K��������������K����

������ '()*�+,-*.�/0,�1234 56)7(-)* BCDEBFGH�������%������������

���M�%N��%NO�%@� '()*�+,-*.�/0,�1234 56)7(-)* BCDEBFGH�������O����

�������K������������

����M�%N�%NO�%@� '()*�+,-*.�/0,�1234 56)7(-)* BCDEBFGH�������������

�������������L�������

���M�%N��%NO�%@� '()*�+,-*.�/0,�1234 56)7(-)* BCDEBFGH>��� ��� W�N

���L#��������$A����

����M�%N�M%NOM%@� '()*�+,-*.�/0,�1234 56)7(-)* BCDEBFGH X*YZR[������� W�N

��� L�� ���\]�̂Y7Y�Y_Y()Ỳ)*�(0�7Ỳ)*

� )*+,-./01,/-02 3� ���4���� �� 5� �' �6��� �������

AGREEMENT EXCEPTIONS

REQUEST FOR PROPOSAL, REQUEST FOR QUALIFICATION, REQUEST FOR LETTER OF INTEREST

The completed form should be submitted with the solicitation response. If not submitted with solicitation response, it shall be deemed an affirmation by the Vendor that it accepts contract terms and conditions stated in the solicitation.

The Vendor must provide on the form below any and all exceptions it takes to the contract terms and conditions stated in the solicitation, including all proposed modifications to the contract terms and conditions or proposed additional terms and conditions. Additionally, a brief justification specifically addressing each provision to which an exception is taken should be provided.

☐ The Vendor takes no exceptions to the contract terms and conditions stated in the solicitation.

☐ The Vendor takes the following exceptions to the contract terms and conditions stated in the solicitation: (use additional forms as needed; separately identify each article/section number)

Vendor Name: Click or tap here to enter text.

Form Date 9/9/24

Term or Condition Article / Section

Insert proposed modifications to the contract terms and conditions or proposed additional terms and conditions Provide brief justification for proposed modifications

Click or tap here to enter text. Click or tap here to enter text. Click or tap here to enter text.

Click or tap here to enter text. Click or tap here to enter text. Click or tap here to enter text.

Click or tap here to enter text. Click or tap here to enter text. Click or tap here to enter text.

Click or tap here to enter text. Click or tap here to enter text. Click or tap here to enter text.

Click or tap here to enter text. Click or tap here to enter text. Click or tap here to enter text.

Click or tap here to enter text. Click or tap here to enter text. Click or tap here to enter text.

Click or tap here to enter text. Click or tap here to enter text. Click or tap here to enter text. DRAFT

Responses Success: All data is valid!

Numeric Text

Status Bid/No Bid Decision # Item Item Description Quantity

Required Unit of Measure Unit Price Notes for Buyer Total Extended Amount

Not Bidding No Bid #0-1 New Hire COBRA/Domestic Partner Notices Enter the proposed annual price for New Hire COBRA/Domestic Partner

Notices.

5 Annual -

Not Bidding No Bid #0-2 Initial COBRA/Domestic Partner Notices at Separation of Employment/Qualifying Event

Enter the proposed annual price for Initial

COBRA/Domestic Partner Notices at Separation of Employment/Qualifying

Event.

5 Annual -

Not Bidding No Bid #0-3 COBRA Monthly Billing

Enter the proposed monthly price for COBRA Billing. Unit Price shall be inclusive of the 2% administrative service fee for COBRA and Domestic Partner Monthly Billing and the mailing costs.

60 Month -

Not Bidding No Bid #0-4 Domestic Partner Monthly Billing

Enter the proposed monthly price for Domestic Partner Billing. Unit Price shall be inclusive of the

2% administrative service fee for COBRA and

Domestic Partner Monthly Billing and the mailing costs.

60 Month -

Not Bidding No Bid #0-5 Retiree Monthly Billing Enter the proposed monthly price for Retiree Billing.

60 Month -

Not Bidding No Bid #0-6 Patient Protection and Affordable Care Act

(PPACA) 1095-C Forms

Enter the proposed annual price for Patient Protection and Affordable Care Act (PPACA) 1095-C Forms.

5 Annual -

Basket Total $ 0.00

Grand Total $ 0.00

CRIMINAL HISTORY SCREENING PRACTICES CERTIFICATION

The completed form should be returned with the Vendor’s submittal. If not provided with the submittal, Vendor must submit the form within three business days after County’s request. Vendor may be deemed nonresponsive for failure to fully comply within the stated timeframe.

Section 26-125(d) of the Broward County Code of Ordinances (“Criminal History Screening Practices”) requires that a Vendor seeking a contract in the amount of $100,000 or more with Broward County shall certify:

A. Vendor has implemented, or will implement upon award of the contract, policies, practices, and procedures regarding inquiry into the criminal history of an applicant for employment, including a criminal history background check of any such person, that preclude inquiry into an applicant's criminal history until the applicant is selected as a finalist and interviewed for the position.

B. This requirement shall apply only to positions located within the United States that will foreseeably perform work under a contract with Broward County.

C. The failure of Vendor to comply with Section 26-125(d) at any time during the contract term shall constitute a material breach of the contract, entitling Broward County to pursue any remedy permitted under the contract and any other remedy provided under applicable law.

D. If Vendor fails to comply with Section 26-125(d) at any time during the contract term, Broward County may, in addition to all other available remedies, terminate the contract and Vendor may be subject to debarment or suspension proceedings consistent with the procedures in Chapter 21 of the Broward County Administrative Code.

By signing below, Vendor certifies that it is aware of the requirements of Section 26-125(d) of the Broward County Code of Ordinances and certifies the following: (check only one box below).

☐ Vendor certifies that, for positions located within the United States that will foreseeably perform work under a contract with Broward County, it has implemented, or will implement upon award of the contract, policies, practices, and procedures regarding inquiry into the criminal history of an applicant for employment, including a criminal history background check of any such person, that preclude inquiry into an applicant's criminal history until the applicant is selected as a finalist and interviewed for the position.

☐ Vendor is exempt from the requirements of Section 26-125(d) of the Broward County Code of Ordinances because Vendor is required by applicable federal, state, or local law to conduct a criminal history background check in connection with potential employment at a time or in a manner that would otherwise be prohibited by this section, or because Vendor is a governmental agency.

Signature: ______________________________

Printed Name: Click or tap here to enter text.

Title: Click or tap here to enter text.

Date: Click or tap to enter a date.

Form Date 9/9/24 https://library.municode.com/fl/broward_county/codes/code_of_ordinances?nodeId=PTIICOOR_CH26PE_ARTVIIICRHICHEMAPVE_S26-125CRHISCPR

DOMESTIC PARTNERSHIP ACT CERTIFICATION

REQUEST FOR PROPOSAL, REQUEST FOR QUALIFICATION, OR REQUEST FOR LETTER OF INTEREST

Refer to applicable section below. Failure to submit this form by stated timeframes may deem the Vendor nonresponsive to the solicitation or ineligible for the Domestic Partnership tiebreaker, as applicable.

Domestic Partnership Responsiveness Requirement (Refer to Instructions to Vendors, if applicable) This completed and signed form should be returned with the Vendor’s submittal. If not provided with the submittal, the Vendor must submit this form within three business days after County’s request. A Vendor shall be deemed non-responsive for failure to fully comply within stated timeframes.

Domestic Partnership Tiebreaker (Refer to Instructions to Vendors, if applicable) To be eligible for the Domestic Partnership tiebreaker, the Vendor must currently offer the Domestic Partnership benefit and the completed form must be returned at the time of solicitation submittal. Vendors who fail to comply with this submittal deadline will not be eligible for the Domestic Partnership tiebreaker.

The Domestic Partnership Act, Sections 16½- 150 through 16½-165, Broward County Code of Ordinances (the “Act”) requires any Vendor contracting to provide goods or services to the County in an amount over $100,000 to provide benefits to registered domestic partners of its employees on the same basis as the Vendor provides benefits to its employees’ spouses, with certain exceptions as provided by the Act.

For all submittals over $100,000, the Vendor, by virtue of the signature below, certifies that it is aware of the requirements of Broward County’s Domestic Partnership Act, Section 16½-157, Broward County Code of Ordinances, and certifies the following: (check only one below)

☐ The Vendor currently complies with the requirements of the County’s Domestic Partnership Act and provides benefits to Domestic Partners of its employees on the same basis as it provides benefits to employees’ spouses.

☐ The Vendor will comply with the requirements of the County’s Domestic Partnership Act at time of contract award and provide benefits to Domestic Partners of its employees on the same basis as it provides benefits to employees’ spouses.

☐ The Vendor will not comply with the requirements of the County’s Domestic Partnership Act at time of award.

☐ The Vendor does not need to comply with the requirements of the County’s Domestic Partnership Act at time of award because the following exception(s) applies: (check only one below).

☐ The Vendor employs less than five (5) employees.

☐ The Vendor does not provide benefits to employees’ spouses.

☐ The Vendor is a governmental entity, not-for-profit corporation, or charitable organization.

☐ The Vendor is a religious organization, association, society, or non-profit charitable or educational institution.

https://library.municode.com/fl/broward_county/codes/code_of_ordinances?nodeId=PTIICOOR_CH16_1-2HURI_ARTVIIIDOPAAC_S16_1-2_-157COCOPREQBEDOPA

DOMESTIC PARTNERSHIP ACT CERTIFICATION

☐ The Vendor provides an employee the cash equivalent of benefits. (Attach a notarized affidavit in compliance with the Act stating the efforts taken to provide such benefits and the amount of the cash equivalent).

☐ The Vendor cannot comply with the provisions of the Domestic Partnership Act because it would violate the laws, rules or regulations of federal or state law or would violate or be inconsistent with the terms or conditions of a grant or contract with the United States or the State of Florida. (State the law, statute or regulation and attach explanation of its applicability).

Signature: ______________________________

Printed Name: Click or tap here to enter text.

Title: Click or tap here to enter text.

Date: Click or tap to enter a date.

Form Date 9/9/24

YES/NO Comments

5 Provide the following:

a) Workflow diagram of stored or transmitted information (for SaaS and

Hosting Services only)

6 b) Security / Network Architecture diagram (for SaaS and Hosting

Services only)

7 c) Secure Coding standard (for Application Development Services only)

8 d) Application Security Program standard (for Application Development

Services only)

9 Audit Reporting Requirements Does your organization have a current System and Organization

Controls (SOC) 2, Type II report, inclusive of all five Trust Service

Principles (Security, Availability, Processing Integrity, Confidentiality, and

Privacy)?

( Note: For any SaaS or hosted application, the SOC report should be for the organization or application specifically, not the datacenter only.)

10 Does your organization have a current Payment Card Industry (PCI) certification (e.g., Attestation of Compliance (AOC), Self-Assessment

Questionnaire (SAQ))?

11 Will the product or solution process or collect credit card information?

12 Does your organization maintain a file integrity monitoring program to ensure critical file system changes are monitored and approved with respect to confidential County data?

13 Has your organization had a Risk Assessment performed in the past five years by an external auditor in conjunction with the HIPAA Security rule?

14 Does your organization maintain current HIPAA specific policies and procedures in conjunction with the HIPAA Security Rule?

15 Does your organization have a designated HIPAA Security and Privacy

Officer(s)?

16 Does your organization provide HIPAA Security training to your employees at time of hire and at least annually thereafter?

17 Has your organization appointed a central point of contact for security coordination?

18 Does your organization have an expected timeframe to respond to initial contact for security related issues? Provide timeframe.

Enterprise Technology Services

ETS Vendor Security Questionnaire (VSQ): Vendor is required to submit a completed ETS Vendor Security Questionnaire (VSQ) (for applicable solution – services, hardware, and/or software). If a response requires additional information, attach additional pages with the required additional information with the additional pages and information labeled to match the applicable question number. If not provided with the submittal, the Vendor must submit within three business days after the County's written request.

The Vendor Security Questionnaire (VSQ) assesses the Vendor’s security policies and/or system protocol and to identify any potential security vulnerabilities. The County will review the

Vendor’s VSQ response; any identified security concerns will be disclosed to the Evaluation Committee. Unresolved security concerns shall be considered by the Evaluation Committee as part of its final evaluation and may affect the Vendor’s evaluation.

As the Vendor's authorized representative, I attest that any and all statements, oral, written or otherwise, made in support of the Vendor's response, are accurate, true and correct. I also acknowledge that inaccurate, untruthful, or incorrect statements made in support of the Vendor's response may be used by the County as a basis for rejection, rescission of the award, or termination of the contract and may also serve as the basis for debarment of Vendor pursuant to PART XI of the Broward County Procurement

Code.

Vendor Name:

Vendor Type (Manufacturer, Reseller, Other? If Other, specify.):

Vendor Contact Person's Name / Title /

Email Address:

Product Name / Description:

Solicitation Number and Title

(If applicable):

For each applicable section, complete the matrix by using the dropdown option to select YES or NO. Use "Comments" section to provide as much explanation as possible to clearly support your response. Additional pages may be attached to provide further detail, but any attachments should be referenced in "Comments" section. Select "N/A" if a question within a given section is not applicable.

SECTION 1: SOFTWARE-AS-A-SERVICE (SaaS) / HOSTING / APPLICATION DEVELOPMENT SERVICES /

MANAGED OR PROFESSIONAL SERVICES

No. Area Question Vendor Response

REQUIRED RESPONSE: Will your organization provide SOFTWARE-AS-A-SERVICE (SaaS)? (e.g. Software-as-a-service/SaaS, application, website)

REQUIRED RESPONSE: Will your organization provide HOSTING SERVICES?

REQUIRED RESPONSE: Will your organization provide APPLICATION DEVELOPMENT SERVICES? (e.g. on-premise, mobile, web, or other custom code)

REQUIRED RESPONSE: Will your organization provide MANAGED OR PROFESSIONAL SERVICES

(UNSUPERVISED BY COUNTY PERSONNEL)?

( Note: "Managed or Professional Services" used herein refers to unsupervised (by County personnel) installation, configuration, consulting, maintenance or monitoring of County systems, applications or infrastructure related to your organization's proposed solution.)

STOP: If you selected NO for Questions 1 through 4 above, PROCEED TO SECTION 2.

Supporting Documentation

(Upon County's request)

Payment Card Industry (PCI) environments - Applicable only if

Organization or its proposed subcontractor processes or collects credit card information.

Electronic Protected Health

Information (ePHI) -

Applicable only if Organization has access to or will be hosting or storing County ePHI.

Roles & Responsibilities

Vendor Security Questionnaire (VSQ)

Page 1 of 9 Last Updated: 04/29/2025

19 Does your organization define the priority level of an issue (e.g., minor

vs. major, 0-4 scale, etc.)? Describe.

20 Does your organization have an expected Service Level Agreement

(SLA) to implement changes needed to fix security issues according to priority level? Describe.

21 Does your organization's product have Single Sign-on (SSO) and

Federated Identity Enablement integration options (e.g., support for standards like SAML v2 and OAuth 2.0, active directory)? Describe.

22 Does your organization use web services and/or data import/export functions (e.g., API, FTP)? Describe.

23 Will third parties, such as IT service providers have access to the

County's data that is stored or transmitted by your organization?

24 Does your organization have a Disaster Recovery and Continuity of

Operations plan that includes third-party dependencies to ensure critical business functions can continue even during a major disruption?

25 Does your organization outsource any aspect of the service to a third party?

26 Does your organization utilize any off-shore resources for development?

Provide location(s).

27 Does your organization build the application in-house?

28 Does your organization share customer data with or enable direct access by any third-party?

29 Will any proposed subcontractors process, access, transmit or store any

County data?

30 Do all proposed subcontractors contractually comply with your organization's security standards for data processing?

31 Does your organization regularly audit your critical vendors? Describe.

32 Information Security Policy &

Procedures

Does your organization have documented standard policies and procedures for security and compliance?

33 Risk Assessment Does your organization have a process that addresses: (a) the identification and measurement of potential risks with mitigating controls

(measures taken to reduce risk), and (b) the acceptance or transfer (e.g.

insurance policies, warranties, etc.) of the remaining (residual) risk after mitigation steps have been applied?

34 Regulatory Compliance Is the product or solution currently certified by any security standards?

(e.g., PCI-DSS, HIPAA). Provide proof of compliance documentation.

35 Does your organization have a documented process to identify new laws and regulations with IT security implications (e.g., FIPA, new state breach notification requirements, monitoring newsletters, webinars, security or regulatory forums, etc.)?

36 Has your organization experienced a data breach within the past five years that legally required reporting under applicable law?

37 Does your organization have procedures for preservation of electronic records and audit logs in case of litigation hold?

38 Have employees and proposed subcontractors received formal information security awareness training? Provide frequency.

39 Have your organization's security policies and procedures been communicated to your employees?

40 Are periodic security reminders provided to your organization's employees?

41 Background Checks Does your organization perform background checks (e.g., credential verification, criminal history, credit history) to examine and assess an employee’s or proposed subcontractor's work and criminal history?

42 Are individuals who would have access to the County's data subjected to periodic follow-up background checks?

43 Prior to Employment - Terms and

Conditions of Employment

Are employees and proposed subcontractors required to sign a non-disclosure agreement and/or confidentiality form upon initial employment?

44 If so, are employees and proposed subcontractors required to sign the non-disclosure agreement annually?

45 Does your organization require that all equipment of any terminated employee or subcontractor is returned and that their user ID is disabled in all systems and badges and/or keys are returned?

46 Upon transfer, is existing access reviewed for relevance for employees and subcontractors?

47 Secure Areas Does your organization have effective physical access controls (e.g., door locks, badge /electronic key ID and access controls) in place that prevent unauthorized access to facilities and a facility security plan?

48 Is a locked screensaver displayed on unattended workstations?

49 Do personnel abide by a clean desk policy to remove and secure sensitive/confidential information from their workspace at the end of the work day?

50 Does your organization have a contingency plan in place to handle emergency access to facilities?

During Employment – Training, Education & Awareness

Roles & Responsibilities

Federated Identity Management and

Web Services Integration

External Parties

Termination or Change in

Employment

Page 2 of 9 Last Updated: 04/29/2025

51 Are physical access controls authorized? Describe who is responsible for managing and ensuring that only appropriate persons have keys or codes to the facility and to locations within the facility with secure data.

52 Are there policies and procedures to document repairs and modifications to physical components of the facility that are related to security?

53 Are employees or subcontractors permitted access to customer environments from your physical locations only?

54 Are systems and networks that host, process, and/or transfer confidential information "protected" (i.e., isolated, logically or physically separated) from other systems and/or networks?

55 Are internal and external networks separated by firewalls with access policies and rules?

56 Data Security Are development and test environments separate from production environments to protect production applications from inadvertent changes or disruption?

57 Does your organization apply database and application logical segregation of customer data?

58 Is this a multi-tenant solution?

59 Will County’s data be co-mingled with data of any other customer?

60 Does your organization provide a means to encrypt data at rest (e.g., AES)?

61 Will County’s data be processed, accessed, transmitted or stored through an off shore environment (e.g., outside continental U.S, Alaska, Hawaii)?

62 Does your organization provide a means to encrypt County confidential information in transit? Describe controls that are in place to protect confidential information when transferred (e.g., encryption).

63 Is there a standard approach for protecting network devices to prevent unauthorized access/network related attacks and data-theft (e.g., firewall between public and private networks, internal VLAN, firewall separation, separate WLAN network, secure portal, multi-tenancy, virtualization, shared storage, etc.)?

64 Does your organization use email encryption to protect sensitive/confidential information when communicating with third parties

(e.g., IT vendors)?

65 Are employees permitted to work remotely from a facility not owned or leased by the organization?

66 Are encrypted communications required for all remote connections?

67 Does your organization use a secure VPN connection with third parties

(e.g., IT vendors)?

68 Does your organization have protections in place for ensuring secure remote access (e.g., up-to-date antivirus, posture assessment, VPN enforcement, split tunneling)?

69 Is there a formal (documented, approved, published, communicated, and implemented) remote access policy?

70 Can your organization restrict access to the solution to and from the

County's network in a "deny all, permit by exception" configuration (i.e., whitelist County IP addresses only)?

71 Does the software or solution perform audit logging? Describe.

72 Does the software or solution allow for the configuration of audit log retention for a minimum of 90 days or more?

73 Does the software track events for user activity (e.g., failed/successful logins, privileged access)? Describe.

74 Does your organization perform periodic vulnerability scans on your IT systems, networks, and supporting security systems? Provide frequency.

75 Are internal or proposed subcontractors vulnerability assessments automated?

76 Does your organization have a security patch management cycle in place to address identified vulnerabilities?

77 Does your organization provide disclosure of vulnerabilities found in your environment and remediation timelines?

78 Does your organization notify customer of applicable patches?

79 Are third party connections to your network monitored and reviewed to confirm only authorized access and appropriate usage (e.g., with VPN logs, server event logs, system, application and data access logging, automated alerts, regular/periodic review of logs or reports)?

80 Does your organization monitor your systems and networks for security events? Describe monitoring (e.g., server and networking equipment logs such as servers, routers, switches, wireless APs, monitored regularly).

81 Does your organization periodically review system activity? Provide frequency.

82 Does your organization have a formal access authorization process based on "least privilege" (i.e. employees are granted the least amount of access possible to perform their assigned duties) and "need to know"

(e.g., access permissions granted based upon the legitimate business need of the user to access the information, role-based permissions, limited access based on specific responsibilities, network access request form)?

Application and Information Access

Control - Confidential System

Isolation

Audit Logging

Vulnerability Assessment and

Remediation

Security Monitoring

Identity & Access Management

Page 3 of 9 Last Updated: 04/29/2025

83 Are systems and applications configured to restrict access only to authorized individuals (e.g., use of unique IDs and passwords, minimum password length, password complexity, log-in history, lockout, password change, expiration)?

84 Is there a list maintained of authorized users with general access and administrative access (e.g., active directory user lists within a confidential application, a spreadsheet of users, a human resources file)?

85 Does your organization maintain a list of "accepted mobile devices"

(e.g., smart phones, cell phones) and are these devices tracked and managed (e.g., Mobile Device Management)?

86 Is a Data Loss Prevention (DLP) in place to prevent the unauthorized distribution of confidential information?

87 Is software installation for desktops, laptops, and servers restricted to administrative users only?

88 Does software or system have automatic logoff for session inactivity?

89 Does your organization control and monitor access to application source code in a secure manner?

90 Does your organization deny developers access to production environments, as well as to any environments containing customer data?

91 Are user IDs for your system uniquely identifiable?

92 Does your organization have any shared accounts? Describe.

93 Will your organization allow remote access from proposed subcontractors to the County network, with immediate deactivation after use?

94 Can service accounts be configured to run as non-privileged user (i.e., non-Domain Admin)?

95 Is Multi-Factor Authentication (MFA) required for employees/contractors for remote access to production systems?

96 Is Multi-Factor Authentication (MFA) included as a feature in the proposed system?

97 Entitlement Reviews Does your organization have a process to review user accounts and related access (e.g., manual process of reviewing system accounts to user accounts in AD for both users and privileged access, such as admins, developers, etc.)?

98 Is antivirus software installed and running on your computers and supporting systems (e.g., desktops, servers, gateways, etc.)?

99 Is this antivirus product centrally managed (e.g., monitored to verify all endpoints have functional agents, agents are up to date with the latest signatures, etc.)? Explain your policies and procedures for management of antivirus software.

100 Does your organization have a process for detecting and reporting malicious software?

101 Does your organization have any Intrusion Protection System (IPS) in place for your environment?

102 Are employees prevented from using personally owned smart phones or mobile devices to connect to the organization's network?

103 Does your organization have procedures to protect documents and computer media (e.g., tapes, disks, hard drives, etc.) from unauthorized disclosure, modification, removal, and destruction?

104 Is confidential data encrypted when stored on laptop, desktop, server hard drive, flash drive, backup tape (i.e., data at rest)?

105 Are backup archives stored externally / offsite from your facility?

106 Secure Disposal Are there security procedures (e.g., use of secure wiping, NIST 800-88, etc.) for the decommissioning (replacement) of IT equipment and IT storage devices that contain or process confidential information?

107 Separation of Duties Are duties separated (e.g., front desk duties separated from accounting, data analysts access separated from IT support), where appropriate, to reduce the opportunity for unauthorized modification, unintentional modification, or misuse of your IT assets?

108 Change Management Do formal testing and change management procedures exist for networks, systems, desktops, software releases, deployments, and software vulnerability during patching activities, changes to the system, changes to the workstations and servers with appropriate testing, notification, and approval, etc.?

109 In the event of a major security incident or data breach, do you provide the County a third-party digital forensics/incident report?

110 Does your organization identify, respond to, and mitigate suspected or known security incidents (e.g., incident form completed as a response to each incident)?

111 Does your organization have a formal incident response and data breach notification plan and team?

112 Is evidence properly collected and maintained during the investigation of a security incident (e.g., employing chain of custody and other computer forensic methodologies that are monitored by internal and/or external parties)?

113 Are incidents identified, investigated, and reported according to applicable legal requirements?

114 Are incidents escalated and communicated? Describe.

115 Do you have a contingency plan in place to handle emergency access to the proposed solution?

Identity & Access Management

Antivirus

Network Defense and Host Intrusion

Prevention Systems

Media Handling

Incident Management

Page 4 of 9 Last Updated: 04/29/2025

116 Does your organization have a mechanism to back up critical IT systems and County data? Describe.

117 Does your organization periodically test your backup/restoration plan by restoring from backup media?

118 Does your organization have a disaster recovery plan?

119 Are disaster recovery plans updated and tested at least annually?

120 Do any single points of failure exist that would disrupt functionality of the proposed product or service?

121 Does your organization have any product pre-release security threat modeling in place (e.g., secure coding practice, security architecture review, penetration testing)?

122 Does your organization maintain an end-of-life-schedule for the proposed software product or solution?

123 Is the product engineered as a multi-tier architecture design?

124 Is any proposed product or service within three years of end of life?

125 Crypto Materials and Key

Management

Does your organization have a centralized key management program in place (e.g., any Public Key Infrastructure (PKI), Hardware Security

Module (HSM)-based or not, etc.) to issue certificates needed for products and cloud service infrastructure?

126 Is the software currently certified by any security standards? (e.g., OWASP, NIST). List standards.

127 Has the software been developed following secure programming standards like those in the OWASP Developer Guide?

128 Does your organization use automated tools for security testing or code reviews to identify security vulnerabilities (e.g., brute force, injection, buffer overflows)?

129 Does your organization perform security testing based on industry standards (e.g., OWASP Top 10, SANS Top 25)?

130 Does your organization remediate all vulnerabilities identified prior to production deployment?

131 Is your organization outsourcing any aspect of the service to a third party?

132 Is the product engineered as a multi-tier architecture design?

133 Does your organization have capability to respond to and update product for any unforeseen new regulatory requirements?

134 Does your organization's development and testing teams receive training specific to application security? Describe.

135 Does your organization's development team use a development framework? List development languages and framework.

136 Does your organization follow secure coding development standards?

137 Does your organization have a security methodology for continuous maintenance of the application and applicable components?

138 Does your organization review security at each phase of the software development life cycle?

139 Does your organization use an industry standard methodology for conducting security testing? Describe.

140 Does your organization use automated tools for security testing or code reviews to identify security vulnerabilities (e.g., brute force, injection, buffer overflows)?

141 Does your organization perform security testing based on industry standards (e.g., OWASP Top 10, SANS Top 25)?

142 Does your organization use an independent third party for periodic security penetration testing?

143 Does your organization perform peer code reviews on source code prior to production deployment?

144 Does your organization remediate all vulnerabilities identified prior to production deployment?

145 Is your organization outsourcing any aspect of the development to a third party?

146 Will the County receive a copy of the source code?

147 Is GenAI used as a component of or in the research, development, or production of this solution or service?

148 Is GenAI used in any way to provide ongoing support to this system or solution (e.g., client chatbot for support requests)?

149 Does the proposed product or solution use a GenAI model that was developed in house?

150 Does the proposed product or solution use a GenAI model that was developed by a third party (e.g., ChatGPT)?

151 Does this solution interface with a third-party GenAI product?

152 Does this solution interface with any free or open source GenAI components?

153 Does your organization have policies and procedures including governance, privacy and security implemented to validate information generated by the GenAI for accuracy?

154 Is data labeling used to identify content generated by the GenAI product or solution?

155 Are data sources (e.g., social media, news articles, scientific journals) used in the GenAI model verified to ensure content provided is accurate?

156 Will County data be used to train or fine tune the GenAI model used in this solution?

Product Security Development

Lifecycle

Disaster Recovery Plan & Backups

Secure Software Design/Testing

Application Development Services -

This section is applicable only if

Organization is providing Application

Development Services (e.g. on-premise, mobile, web, or other custom code)

Generative Artificial Intelligence

(GenAI) - Refers to artificial intelligence technology that can produce various types of content such as text, images, music, videos, code, etc., based on inputs or prompts to create derived synthetic content beyond analyzing or acting on existing data.

Page 5 of 9 Last Updated: 04/29/2025

157 Does your organization have a standard in place to update data used in the GenAI model frequently (e.g., weekly, monthly, quarterly) to ensure data integrity?

158 Does your organization have established copyright and authorized use for all data used to develop and operate the GenAI model to prevent copyright violations?

159 Is PII information handled or stored by this GenAI solution?

160 Will any County data be stored or accessed by the GenAI component?

161 Does your organization perform continuous monitoring to detect GenAI model drift (i.e., degradation of model performance due to changes in data, or relationships between input and output variables)?

162 Does your organization have security controls implemented to secure the confidentiality of data entered in the GenAI product or solution?

163 Will the system continue to function if the GenAI service is not available?

164 Does your organization have a procedure implemented to identify, manage, and mitigate GenAI risk?

165 Does your organization perform security testing to identify GenAI specific security vulnerabilities (e.g., data poisoning, prompt injection, model exfiltration)?

166 Are employees allowed to use GenAI technology from a personal device when conducting company business?

167 Has a third party vendor risk assessment been performed on this GenAI solution?

YES/NO Comments

2 Provide the following:

a) Hardware and Software requirements (i.e. Operating System, CPUs, RAM)

3 b) Network connectivity requirements

4 Reseller Will your organization act as a reseller to provide software to the

County? If so, provide manufacturer documentation regarding the security controls of the software and a secure configuration document.

5 Can the application and service accounts used to run the application be configured to run as non-privileged users (e.g., non-Local Administrator rights)?

6 Does software require admin rights to be installed? Describe the level of administrative access the software will need on the County domain.

7 Is remote access required for installation and support? Describe.

8 Can the software be installed on and operated in a virtualized environment?

9 Is third party software (e.g., Java, Adobe, Log4j) required to be installed or embedded within your software for it to work? Provide software and minimum version.

10 Are you using any open source software components (e.g., no paid license) without paid product support? If so, list software components.

11 Will the software remain compatible with all updates and new releases of required third party software?

12 Is the software currently certified by any security standards? (e.g., PCI-

DSS). Provide standards.

13 Has the software been developed following secure programming standards like those in the OWASP Developer Guide?

14 Does your organization use automated tools for security testing or code reviews to identify security vulnerabilities (e.g., brute force, injection, buffer overflows)?

15 Does your organization perform security testing based on industry standards (e.g., OWASP Top 10, SANS Top 25)?

16 Does your organization remediate all vulnerabilities identified prior to production deployment?

17 Is your organization outsourcing any aspect of the service to a third party?

18 Is the product engineered as a multi-tier architecture design?

19 Does your organization have capability to respond to and update product for any unforeseen new regulatory requirements?

20 Does software or solution perform audit logging? Describe.

21 Does software or solution allow for the configuration of audit log retention for a minimum of 90 days or more?

22 Does software have audit reporting capabilities (e.g., user activity, privileged access)? Describe.

23 Does software have a security patch process? Describe your software security patch process, frequency of security patches and upgrade cycle releases.

24 Does your organization support electronic delivery of digitally signed software and upgrades?

Secure Software Design/Testing

Generative Artificial Intelligence

(GenAI) - Refers to artificial intelligence technology that can produce various types of content such as text, images, music, videos, code, etc., based on inputs or prompts to create derived synthetic content beyond analyzing or acting on existing data.

SECTION 2: SOFTWARE INSTALLED IN COUNTY'S NETWORK

No. Area Question Vendor Response

REQUIRED RESPONSE: Will your organization provide SOFTWARE INSTALLED LOCALLY IN COUNTY

NETWORK?

STOP: If you selected NO for Question 1, PROCEED TO SECTION 3.

Supporting Documentation

(Upon County's request)

Software Installation Requirements

Third Party Software Requirements

Audit Logging

Security Updates/Patching

Page 6 of 9 Last Updated: 04/29/2025

25 Does software allow for secure configuration and installation (e.g., OS hardening, disabling unnecessary services, antivirus compatibility)?

26 Will software or solution process or collect credit card information?

27 Does product or solution process, store or transmit confidential data

(e.g., Social Security Number, Date of Birth, Credit Card information)?

28 Does software restrict confidential data (e.g., Social Security Number or

Date of Birth) from being used as a primary identifier?

29 Does software have documentation showing where all confidential data is stored in the application?

30 Does software support encryption of data in motion (e.g., SSL)?

31 Does software support encryption of data at rest (e.g., column-level encryption, files)? List controls.

32 Authentication Does product have Single Sign-on (SSO) and Federated Identity

Enablement integration options (e.g., support for standards like SAML v2 and OAuth 2.0, active directory, etc.)? Describe.

33 Does software provide role-based access control?

34 Is a service account required for this software to run?

35 If so, does the service account require admin rights?

36 Does organization have any product pre-release security threat modeling in place (e.g., secure coding practice, security architecture review, penetration testing, etc.)?

37 Does your organization maintain end-of-life-schedule for the software product?

38 Is product or service within three years of end of life?

39 Regulatory Compliance Is the software or solution currently certified by any security standards

(e.g., PCI-DSS, HIPAA)? Provide proof of compliance documentation.

40 Is GenAI used as a component of or in the research, development, or production of this solution or service?

41 Is GenAI used in any way to provide ongoing support to this system or solution (e.g., client chatbot for support requests)?

42 Does the proposed product or solution use a GenAI model that was developed in house?

43 Does the proposed product or solution use a GenAI model that was developed by a third party (e.g., ChatGPT)?

44 Does this solution interface with a third-party GenAI product?

45 Does this solution interface with any free or open source GenAI components?

46 Does your organization have policies and procedures including governance, privacy and security implemented to validate information generated by the GenAI for accuracy?

47 Is data labeling used to identify content generated by the GenAI product or solution?

48 Are data sources (e.g., social media, news articles, scientific journals) used in the GenAI model verified to ensure content provided is accurate?

49 Will County data be used to train or fine tune the GenAI model used in this solution?

50 Does your organization have a standard in place to update data used in the GenAI model frequently (e.g., weekly, monthly, quarterly) to ensure data integrity?

51 Does your organization have established copyright and authorized use for all data used to develop and operate the GenAI model to prevent copyright violations?

52 Is PII information handled or stored by this GenAI solution?

53 Will any County data be stored or…