1-RFI 400-26 SEC IT Vendor Technology Assessment.pdf
PDF 145 KB Posted
- Solicitation number
- RFI 400-26 SEC
- Issued by
- Nueces County, Texas
About this file
This is a Request for Information (RFI) issued by the City of Amarillo, Texas, seeking vendor responses regarding centralized irrigation control and remote management technologies for parks and related municipal facilities. The RFI solicits information from irrigation control system manufacturers, vendors, and authorized representatives capable of providing systems for remote monitoring, scheduling, and controlling irrigation controllers, flow meters, valves, and associated field equipment. The document does not specify quantities, response dates, due dates, site visits, bidder meetings, award dates, or contract terms, as it functions as a technology assessment questionnaire rather than a formal procurement notice with binding timelines or conditions.
The assessment document focuses on three primary evaluation areas: technology capabilities, cybersecurity standards, and audit and compliance requirements. Vendors are required to address system architecture, interoperability with municipal systems including ERP and GIS platforms, performance metrics with uptime guarantees, data portability standards, support and maintenance protocols, redundancy and disaster recovery strategies, and technology lifecycle management. Cybersecurity responses must demonstrate adherence to frameworks such as NIST CSF and ISO/IEC 27001, data encryption standards, incident response procedures, vulnerability management processes, multi-factor authentication support, and third-party risk management. Compliance inquiries address regulatory certifications (SOC 2, HIPAA, CJIS, PCI DSS), audit logging capabilities, independent security assessments, real-time compliance reporting, policy governance, risk assessment frequency, and data retention and destruction procedures. No pricing information, set asides, incumbent vendor details, funding sources, or contract award amounts are specified in this technology assessment document.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
City of Amarillo Vendor Technology Assessment
Technology Questions
1. System Architecture o Provide a high-level architectural diagram of your solution, including key integrations with other systems.
o Is your system hosted on-premises, in the cloud, or via a hybrid model?
o What are the scalability capabilities of your solution to meet future needs?
2. Interoperability o How does your solution integrate with municipal systems, including ERP, GIS, or other specialized city software?
o Do you provide APIs for third-party integrations? If so, describe their functionality and security measures.
3. Performance Metrics o What uptime guarantee does your system offer?
o What mechanisms are in place for real-time performance monitoring?
o Provide details on your system's load-testing results and capacity limits.
4. Data Portability o Describe the process for exporting data from your system.
o How do you ensure data remains usable and complies with city standards during transitions or upgrades?
5. Support and Maintenance o What is the frequency of system updates and patches?
o Describe your customer support model, including service level agreements
(SLAs) for issue resolution.
o What is your escalation process for technical issues?
6. Redundancy and Disaster Recovery o What is your system’s backup and disaster recovery strategy?
o Provide an overview of the redundancy mechanisms in place to ensure system availability.
7. Technology Lifecycle o What is the typical lifecycle of your solution, and how do you manage end-of-life transitions?
o How do you ensure ongoing compatibility with evolving technologies?
Cybersecurity Questions
1. Security Frameworks and Standards o What cybersecurity frameworks (e.g., NIST CSF, ISO/IEC 27001) does your organization adhere to?
o Describe your compliance with state and federal cybersecurity regulations applicable to municipal systems.
o How does your solution align with best practices for securing critical infrastructure?
2. Data Security o Describe how your solution ensures data confidentiality, integrity, and availability.
o What encryption standards are used for data at rest and in transit?
o How does your system handle sensitive and personally identifiable information
(PII)?
o Do you conduct regular data classification and access control audits? If so, provide an overview of your process.
3. Incident Response o Provide a detailed description of your incident response plan (IRP).
o What is your typical response time for addressing cybersecurity incidents?
o Describe the process for notifying the city during a security breach or incident.
4. Vulnerability Management o What tools and processes are used for vulnerability scanning and patch management?
o How often are vulnerability scans and penetration tests conducted on your systems?
o How do you address zero-day vulnerabilities?
5. Access Management o Describe your authentication mechanisms, including multi-factor authentication
(MFA) and Single Sign-On (SSO) support.
o Does your system support SSO integration with widely used identity providers
(e.g., Microsoft Azure AD, Okta, Google Workspace)? If so, describe the configuration process and supported protocols (e.g., SAML, OAuth, OpenID Connect).
o How is access to systems and data logged and monitored?
o What role-based access control (RBAC) measures are implemented?
o Explain your approach to managing inactive or compromised user accounts.
5. Third-Party Risk o How do you vet and monitor third-party vendors accessing the city’s data or systems?
o What are your policies for ensuring subcontractors comply with your cybersecurity standards?
6. Training and Awareness o What cybersecurity awareness training do you provide for users of your system?
o Do you conduct phishing simulations or other user-testing mechanisms?
Audit and Compliance Questions
1. Regulatory Compliance o What certifications (e.g., SOC 2, HIPAA, CJIS, PCI DSS) does your solution hold?
o How do you ensure compliance with municipal, state, and federal regulations, including FOIA requests?
2. Audit Trail o Describe your system's audit logging capabilities.
o How are audit logs protected against tampering?
o How long are logs retained, and what retrieval mechanisms are provided for auditing?
3. Independent Assessments o Do you undergo regular independent security assessments? If so, can you share the most recent assessment report?
o Are you willing to allow third-party audits of your system by city-appointed assessors?
4. Monitoring and Reporting o How do you provide real-time compliance status reporting?
o Can your system generate custom compliance reports for city auditors?
o What dashboards or visualization tools do you offer for monitoring compliance and security?
5. Policy and Governance o Provide examples of policies governing your security and compliance programs.
o How often are these policies reviewed and updated?
o How do you ensure that your employees adhere to compliance requirements?
6. Risk Assessments o How frequently do you conduct internal risk assessments of your systems?
o What is your process for addressing risks identified during assessments?
7. Data Retention and Destruction o What are your policies and procedures for data retention?
o How do you securely destroy data when it is no longer needed?
| Technology Questions |
| Cybersecurity Questions |
| Audit and Compliance Questions |
File details come from the government source that posted it. Updated .