Questions_Regarding_15BCTS18Q00000044.pdf

Questions Regarding 15BCTS18Q00000044 (CTS in Spokane, WA.)

Questions:

What is considered a covered information system?

o We store client demographics in ETO (cloud-based and FedRAMP certified) o Do we need dual authentication for ETO?

o We store client information on our file server, but access is controlled by user-rights.

o The file server access is only allowed if on our network, do we need dual-authentication for this?

o We are in the process of selecting an EHR system, will this be considered a covered information system?

· Presently, we cannot audit who access files in the BHRD, is having the access restricted sufficient?

· For ETO there is no failed login attempt report, is that acceptable?

· We use Kill Disk to sanitize our hard drives when a system is retired, is this sufficient?

Response: A covered system is, “Any information system used for, involved with, or allowing, the processing, storing, or transmitting of DOJ Information.” This definition can be found on page 22 of the solicitation. In terms of specific system requirements, please refer to clause DJAR-PGD-15-03

Security of Department Information and Systems located on pages 22 through 26 of the solicitation.

All requirements are provided in this policy, along with technical information. Whatever system a company is proposing to utilize, must meet or exceed these standards. Supporting documentation must be submitted and labeled, as noted in the Technical Quotation documentation.