10-RFP2009 - Part G - Attachment L - City of Alexandria Cloud Vendor Assessment Tool (On Premise).xlsx
XLSX spreadsheet 22 KB Posted
- Solicitation number
- 2009
- Issued by
- Alexandria City, Virginia
About this file
This document is a Cloud Vendor Assessment Tool utilized by the City of Alexandria as part of a Request for Proposal (RFP) for a Computer-Aided Dispatch/Automatic Vehicle Location (CAD/AVL) system replacement for DASH (Dash Bus Service). The assessment tool is designed to evaluate vendor capabilities across multiple security and operational dimensions to ensure the selected cloud-based solution meets the City's stringent requirements for managing transit operations, real-time bus tracking, wayside displays, schedule adherence monitoring, performance reporting, incident management, and customer communications. The evaluation framework does not specify explicit response dates, due dates, site visits, or bidder conferences within this document; however, it establishes comprehensive criteria that vendors must address to demonstrate compliance with the City's security posture and operational standards.
The assessment tool encompasses nine major evaluation categories: Development Environment, Software Compatibility, Authentication/Authorization/Accounting, Software Development Lifecycle (SDLC), Business Continuity Planning, Change Management, Data Security, Database Management, Disaster Recovery Planning, Physical Security, and Policies/Procedures/Processes. Vendors are required to provide detailed responses demonstrating compliance with industry standards such as NIST, CIS, and NSA guidelines; support for standards-based single sign-on and Active Directory integration; encryption of data in transit and at rest; documented business continuity and disaster recovery plans with annual reviews; formal incident response procedures; and secure coding practices with both internal and external security reviews. The document does not address pricing terms, set-asides, incumbent information, or specific funding amounts; rather, it serves as a technical and security evaluation mechanism to assess vendor qualifications prior to contract award.
View the file
Other files
Show all 25
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Development Environment | Vendor Answers | Additional Information | ||
| DEVE-01 | Does your development environment comply with a configuration baseline based on expert sources (NIST, CIS, NSA, etc.)? If so, can you share which guidelines with which they are compliant? | |||
| DEVE-02 | What controls are in place to detect and prevent malicious code tampering? | |||
| DEVE-03 | Describe or provide a reference to your media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures. | |||
| Software Compatability | Vendor Answers | Additional Information | plan on | |
| COMP-01 | Is your product regularly tested for compatibility with current security patches for major software (e.g. Windows)? If so, how frequently? And with which software? | |||
| COMP-02 | Which third-party frameworks does your product require? | |||
| COMP-03 | Which third-party libraries does your product leverage internally? Should a security update become available for a library, how long does integration and distribution of the updated library take? | |||
| Authentication, Authorization, and Accounting | Vendor Answers | Additional Information | ||
| HLAA-01 | Can you enforce password/passphrase complexity requirements provided by the City? | |||
| HLAA-02 | Describe or provide a reference to the types of authentication, including standards-based single-sign-on (SSO, InCommon), that are supported by the product. | |||
| HLAA-03 | Describe or provide a reference to the authentication and authorization systems such as Active Directory, Kerberos (what version) or a institution centralized authorization service that work with your application. | |||
| HLAA-04 | Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication? | |||
| HLAA-05 | Does your system have the capability to log security/authorization changes as well as user and administrator security events (e.g., login failures, access denied, changes accepted), and all requirements necessary to implement logging and monitoring on the system? | |||
| SDLC | Vendor Answers | Additional Information | ||
| SDLC-01 | What processes are in place to ensure secure coding practices are integrated into the SDLC? | |||
| SDLC-02 | Are processes in place to ensure proper version control? If so, can you share what versioning software and/or service you use? | |||
| SDLC-03 | If a code repository is utilized, what processes are in place to prevent sensitive information from appearing in version control? | |||
| SDLC-04 | Will implementation involve code customization or modification? If so, can you provide a brief summary of the scope of the customization? | |||
| SDLC-05 | Does your application contain any web application components? If so, how do you address the OWASP Top 10 (or similar risk compilations) from a development perspective? | |||
| SDLC-06 | How often is your product reviewed internally for secure coding practices? If so, can the results be provided? | |||
| SDLC-07 | How often is your product reviewed by an external entity for secure coding practices? If so, can the results be provided? | |||
| SDLC-08 | What mechanisms are in place to facilitate reporting of vulnerabilities in your product? | |||
| SDLC-09 | What are the remediation process and customer expectations if a vulnerability is reported? | |||
| Business Continuity Plan | Vendor Answers | Additional Information | ||
| HLBC-01 | Do you have a documented Business Continuity Plan (BCP)? If so, can it be shared? | |||
| HLBC-02 | Is there a documented communication plan in your BCP for impacted clients? | |||
| HLBC-03 | Are all components of the BCP reviewed at least annually and updated as needed to reflect change? | |||
| HLBC-04 | Does your organization conduct an annual test of relocating to this alternate site for business recovery purposes? | |||
| Change Management | Vendor Answers | Additional Information | ||
| HLCH-01 | Do you have a Change Management Plan? If so, can it be shared? | |||
| HLCH-02 | How and when will the City be notified of major changes to your environment that could impact our security posture? | |||
| HLCH-03 | Do you have documented procedures on how security risks are mitigated until patches can be applied? If so, can it be shared? | |||
| HLCH-04 | Do procedures exist to provide that emergency changes are documented and authorized (including after the fact approval)? If so, can it be shared? | |||
| Data | Vendor Answers | Additional Information | ||
| HLDA-01 | Is sensitive data encrypted in transport and at-rest? | |||
| HLDA-02 | What data backup, restoration, or fail-over mechanisms are provided with your software? What third-party tools or mechanisms are recommended? | |||
| Database | Vendor Answers | Additional Information | ||
| HLDB-01 | What types of databases does your product support? | |||
| HLDB-02 | Does the database support encryption of specified data elements in storage? | |||
| HLDB-03 | If built into the product, do you currently use encryption in your database? | |||
| HLDB-04 | Should database migration be necessary (e.g. the database host or OS becomes deprecated) do you provide a mechanism to facilitate the transition? | |||
| Disaster Recovery Plan | Vendor Answers | Additional Information | ||
| HLDR-01 | Do you have a Disaster Recovery Plan (DRP)? If so, can it be shared? | |||
| HLDR-02 | Are any disaster recovery locations outside the United States? If so, please provide the locations. | |||
| HLDR-03 | Are all components of the DRP reviewed at least annually and updated as needed to reflect change? | |||
| Physical Security | Vendor Answers | Additional Information | ||
| HLPH-01 | Does your organization have physical security controls and policies in place? If so, can it be shared? | |||
| HLPH-02 | Are employees allowed to take home customer data in any form? | |||
| Policies, Procedures, and Processes | Vendor Answers | Additional Information | ||
| HLPP-01 | Can you share the org chart, mission statement and policies for your information security unit? | |||
| HLPP-02 | Are information security principles designed into the product and / or SDLC lifecycle? | |||
| HLPP-03 | Do you have a formal incident response plan? If so, can it be shared? | |||
| HLPP-04 | Do you have a documented information security policy? If so, can it be shared? |
File details come from the government source that posted it. Updated .