2. BRFSS Technical Assessment Form-Final.xlsx
XLSX spreadsheet 41 KB Posted
- Attached to
- (BRFSS) Data Collection and Management
- Solicitation number
- RFP - 10A - 202510143
- Issued by
- Maine
About this file
This is a Technical Assessment Form for the State of Maine Department of Health and Human Services in response to RFP# 202510143 for Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management services. The assessment form requires bidders to demonstrate that their proposed solutions and products possess appropriate architecture and security controls to protect the State's information assets and comply with all applicable state and federal mandates. Bidders must complete comprehensive technical assessments across multiple control categories including data compliance, hosting requirements, application solutions, information security standards, cloud service provider requirements, and NIST requirements. All responses must be accompanied by a separate architecture diagram of the proposed solution, and bidders are instructed to list exhaustively all products proposed in a Bill of Materials section, with each product identified by name and URL. The form emphasizes that any Yes/No responses without supporting evidence will be deemed incomplete, and evidence may include published policies, regulatory compliance audit reports, or publicly accessible URLs.
The technical assessment addresses data classified as having a Low PII Impact Level under the State's Data Classification Policy and requires compliance with applicable federal standards including NIST 800-171, NIST SP 800-53 Revision 5, the Privacy Act of 1974, HIPAA, and the HITECH Act, as well as state requirements including the Maine Freedom of Access Act and the State Breach Notification Law. Bidders must demonstrate compliance with 19 specific Cloud Service Provider requirement controls, 12 NIST requirement controls covering areas such as physical and environmental protection, awareness and training, incident response, and supply chain risk management, plus additional controls for hosting, application solutions, and information security standards. The form requires authentication capabilities with both Microsoft Active Directory and Okta Platform using OpenID 2.0, OAuth 2.0, or SAML 2.0, and mandates that all data be hosted within the Continental United States with annual SSAE-18 SOC 2 Type 2 audits. No pricing, award dates, or incumbent information is included in this technical assessment document.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 2. BRFSS Technical Assessment Form-Final.xlsx | XLSX spreadsheet | |
| 1. RFP 202510143 BRFSS Data Collection_Final.docx | DOCX document | |
| 4. BRFSS Cost Proposal Form-Final.xlsx | XLSX spreadsheet | |
| 3. BRFSS Proposed Services Response Form-Final.docx | DOCX document | |
| 5. QA Summary RFP 202510143 BRFSS_Final.xlsx | XLSX spreadsheet | |
| QA Summary RFP 202510143 BRFSS Additional Questions FINAL.xlsx | XLSX spreadsheet | |
| 5. QA Summary RFP 202510143 BRFSS_Final.xlsx | XLSX spreadsheet | |
| 3. BRFSS Proposed Services Response Form-Final.docx | DOCX document | |
| 4. BRFSS Cost Proposal Form-Final.xlsx | XLSX spreadsheet | |
| 1. RFP 202510143 BRFSS Data Collection_Final.docx | DOCX document | |
| QA Summary RFP 202510143 BRFSS Additional Questions FINAL.xlsx | XLSX spreadsheet | |
| 2. BRFSS Technical Assessment Form-Final.xlsx | XLSX spreadsheet | |
| 3. BRFSS Proposed Services Response Form-Final.docx | DOCX document | |
| 4. BRFSS Cost Proposal Form-Final.xlsx | XLSX spreadsheet | |
| 1. RFP 202510143 BRFSS Data Collection_Final.docx | DOCX document |
Show all 15
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
State of Maine Technical Assessment Form
RFP# 202510143
Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management
| The State of Maine requires Bidders to demonstrate that they (and the products proposed by them) have the appropriate Architecture & Security controls to protect the State’s information assets, and meet all appropriate compliance mandates. |
| Bidders are urged to carefully read all the Header Instructions in the individual tabs before responding. Failure to comply with all the Header instructions will adversely affect the Technical Assessment of the Bid. |
| Bidders are instructed to submit (as a separate attachment) an Architecture Diagram of their proposed solution. This will provide additional context for the Technical Assessment. |
Data Compliance State of Maine Technical Assessment Form
RFP# 202510143
Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management
| Bidder Name: |
| Point of Contact including phone number and email address: |
| Data Compliance |
| The State data that is transacted by this RFP has been categorized according to the State’s Data Classification Policy, https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/DataClassificationPolicy.pdf |
The State data subject to this RFP has been classified as having a PII Impact Level of Low
| Bidders and their solutions must adhere to applicable State and Federal laws, policies, and standards that corresponds to the PII impact level of the State data that will be transacted by the proposed solution. For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. Either cite a publicly-accessible URL, or enclose a copy with the submission. | |||
| Type of Data | Control (State or Federal Compliance Standard) | Yes/No | Explanation |
| Publicly available information | § NIST 800-171 | ||
| § Maine Freedom of Access Act (Title 1 MRSA c. 13) | |||
| Confidential Personally Identifiable Information (PII) | § State of Maine Breach Notification Law | ||
| § National Institute of Standards & Technology: NIST SP 800-53 Revision 5 “Moderate” risk controls | |||
| § Privacy Act of 1974, 5 U.S.C. 552a. | |||
| § Security regulations from the U.S. DHHS, Administration for Children and Families, Office of Child Support Enforcement Program, Office of Child Support Enforcement (OCSE) | |||
| Personal Health Information (PHI) | § Health Insurance Portability and Accountability Act of 1996: HIPAA | ||
| § State of Maine HIPAA BAA required | |||
| § The Health Information Technology for Economic and Clinical Health Act HITECH |
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdfhttp://legislature.maine.gov/legis/statutes/10/title10ch210-Bsec0.htmlhttps://nvd.nist.gov/800-53https://www.justice.gov/opcl/privacy-act-1974https://www.hhs.gov/hipaa/for-professionals/privacy/index.htmlhttps://www.maine.gov/dhhs/sites/maine.gov.dhhs/files/inline-files/Business-Associate-Agreement.pdfhttps://www.hhs.gov/hipaa/for-professionals/special-topics/hitech-act-enforcement-interim-final-rule/index.html BoM State of Maine Technical Assessment Form
RFP# 202510143
Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management
| Bidder Name: | |
| Bill of Materials (BoM) | |
| Bidders must exhaustively list ALL the products that are being proposed as part of this bid. If a product is sold as a single SKU, even if it includes components, list it only once. Example: Salesforce Service Cloud must be listed only once because it is sold as a single SKU. Even though several components makes up the Salesforce Service Cloud, such as, Console, Case Management, Workflow automation, etc. However, Salesforce Maps must be listed independently because it is sold as a distinct SKU. Products must be listed even if they are free downloads. All responses in ALL other tabs must cover ALL the products listed in the BoM here. | |
| Product Name | Product URL |
| Example: Salesforce Cloud | Example URL: https://www.salesforce.com/sales/ |
MaineIT State of Maine Technical Assessment Form
RFP# 202510143
Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management
| Bidder Name: | |||
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. Either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID # | Control | Yes/No | Explanation |
| Hosting | |||
| H1 | Any technical solution must be hosted in a data center. | ||
| H2 | Any hosting provider must provide for back-up and disaster recovery models and plans as needed for the solution. | ||
| H3 | Any hosting provider will abide by NIST best practices for change requests, incident management, problem management, and service desk. | ||
| Application Solution | |||
| A1 | Any solutions Bidder must provide for the backup/recover, data retention, and disaster recovery of a contracted/hosted application solution. | ||
| A2 | Any solutions Bidder must provide for application management and design standard of all technology platforms and environments for the application solution (Development, Staging, Productions, DR, etc.) | ||
| A3 | Any solutions Bidder must engage the State of Maine using Service Level Agreements for system and application performance, incident reporting, and maintenance. See the defaults in the Remote Hosting Policy. | ||
| A4 | The State owns any data they enter, migrate, or transmit into the solution and the Bidder shall allow the State to pull or copy this data at any time free of charge in a format defined by the State. |
https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/RemoteHostingPolicy.pdf Information Security Standards State of Maine Technical Assessment Form
RFP# 202510143
Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management
| Bidder Name: | |||
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. For any evidentiary material, either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID# | Control | Yes/No | Explanation |
| S1 | Bidder provides and maintains a security plan that: |
1. Complies with NIST security requirements;
2. Protects the confidentiality, integrity, and availability of the State’s information systems; and
3. Comply with all applicable federal and state laws and regulations, as well as compliance with all MaineIT contractual requirements and information security policies.
| S2 | Bidder ensures that any agent or subcontractor of the bidder to whom the State provides access agrees to the same restrictions and conditions that apply through this Agreement and agrees to implement reasonable and appropriate safeguards to ensure the confidentiality, integrity, and availability of the State’s information systems. |
| S3 | Bidder will report a security incident that occurs on the Agency’s information systems that may affect the Agency or State of Maine systems to the CISO within 24 hours of discovery in accordance with the terms of the MaineIT Non-Disclosure Agreement (Attachment D). |
| S4 | Provide the stated cyber risk appetite statement that has been approved by the board/leadership of your company. |
Cloud Service Provider Reqs State of Maine Technical Assessment Form
RFP# 202510143
Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management
| Bidder Name: | |||
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. For any evidentiary material, either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID # | Control | Yes/No | Explanation |
| CSP1 | General Architecture Principles | ||
| CSP2 | All products proposed must be able to authenticate natively with both Microsoft Active Directory, and the Okta Platform (OpenID 2.0, Oauth 2.0, SAML 2.0) | ||
| CSP3 | System and Services Acquisition Policy and Procedures (SA-1) | ||
| CSP4 | Application Deployment Certification Policy | ||
| CSP5 | Digital Accessibility and Usability Policy | ||
| CSP6 | Remote Hosting Policy | ||
| CSP7 | Data Exchange policy | ||
| CSP8 | Information Security Policy | ||
| CSP9 | Access Control Policy | ||
| CSP10 | Access Control Procedures for Users | ||
| CSP11 | Risk Assessment policy | ||
| CSP12 | Vulnerability Scanning Procedure | ||
| CSP13 | Security Assessment and Authorization Policy | ||
| CSP14 | System and Information Integrity Policy | ||
| CSP15 | Configuration Management Policy | ||
| CSP16 | GenAI Policy (if applicable to this bid) | ||
| CSP17 | Site-to-site VPN | ||
| CSP18 | Vendor Identity System Integration Policy | ||
| CSP19 | Prohibited Technologies Policy |
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Farchitecture%2Fdocuments%2FGeneralArchitecturePrinciples.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283462187%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=hPw50eOA1Pw%2FS7R%2FsUilpZ4BKgn7UYAxzEcMekJd1Hw%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FRiskAssessmentPolicy%26Procedure.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283506985%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=DX8YitoGyojwrLOCZ%2BhltBROyt1iHfTszY6y8smDuQ0%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FVulnerablityScanningProcedure.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283511966%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Upbkei0Hmg5zbmM%2F4ADQiV8j4DcYlZfyJjqxWD8n%2FyE%3D&reserved=0https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/SecurityAssessmentAuthorizationPolicy.pdfhttps://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FSystemInformationIntegrityPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283521918%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=DhV6plvPwGgyPGWwZxIMl8vB%2FBUwhqWZjudSIJoS2Z8%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FConfigurationManagementPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283526900%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=2%2BbyzrG%2BhVzJEKIyrEZ3Zv5DXOy%2BwiqEpAWjk9a4g%2FE%3D&reserved=0https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/GenAIPolicy.pdfhttps://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/SiteToSiteVPNPolicy.pdfhttps://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/VendorIdentitySystemIntegrationPolicy.pdfhttps://www.maine.gov/oit/prohibited-technologieshttps://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fsites%2Fmaine.gov.oit%2Ffiles%2Finline-files%2Fsystem-services-acquisition-policy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283467162%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=S7J%2FjMIY1e6DijINzpo1K5R4fY3roSfTuNwDwpO1%2FNA%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FApplication-Deployment-Certification.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283472139%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=yBtVAz176L3Cag78nRWojRHWkHQ5Gba07JE%2FMQkxSsI%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FDigitalAccessibilityPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283477122%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=ub%2B%2F1cpCnNM4PoKAbhPUZ%2FluONQHbeK6j1rVOKXnaxk%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FRemoteHostingPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283482097%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=MR40mMW77Gu8X2QN8pjKM5bjP7DoRO%2BhfOhk0p1phTg%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FDataExchangePolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283487078%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=XTBYIGil6RMH8SmClnRcxTO7y9cEatf1EofD0QHPqMc%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FSecurityPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283492057%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=b%2FXvhpG1sp2fZIgpQx%2BwB7ZGRubGu7dN9sYBjFVRs%2BU%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FAccessControlPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283497031%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=foTOPC7xuTna00%2FTXggz7Rahs9XTpw5BSrCgrBmNZ9Y%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FAccessControlProceduresForUsers.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283502010%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=lO0DXc6NgpCav9iZYOLgMBuFsfmIFC8OiDtOvv%2BgOX8%3D&reserved=0 NIST Requirements State of Maine Technical Assessment Form
RFP# 202510143
Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management
| Bidder Name: | |||
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. For any evidentiary material, either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID # | Control | Yes/No | Explanation |
| N1 | Physical and Environmental Protection | ||
| N2 | Awareness and Training | ||
| N3 | Planning | ||
| N4 | Audit and Accountability | ||
| N5 | Personnel Security | ||
| N6 | Contingency Planning | ||
| N7 | PII Processing and Transparency | ||
| N8 | Identification and Authentication | ||
| N9 | Incident Response | ||
| N10 | System and Communications Protection | ||
| N11 | Maintenance | ||
| N12 | Media Protection | ||
| N13 | Supply Chain Risk Management | ||
| N14 | Any Other Relevant Comment |
File details come from the government source that posted it. Updated .