2. BRFSS Technical Assessment Form-Final.xlsx
XLSX spreadsheet 41 KB Posted
- Attached to
- (BRFSS) Data Collection and Management
- Solicitation number
- RFP - 10A - 202510143
- Issued by
- Maine
About this file
This is a Technical Assessment Form for the State of Maine Department of Health and Human Services, Maine Center for Disease Control and Prevention, for RFP# 202510143 regarding Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management services. The form serves as an evaluation instrument requiring bidders to demonstrate appropriate architecture, security controls, and compliance with state and federal mandates to protect information assets. Bidders must submit responses across multiple assessment categories including Data Compliance, Bill of Materials, MaineIT requirements, Information Security Standards, Cloud Service Provider requirements, and NIST requirements. The assessment requires Yes/No responses with supporting evidence for each control, covering areas such as data classification compliance (PII Impact Level Low), hosting requirements, application solution management, security incident reporting within 24 hours, authentication integration with Microsoft Active Directory and Okta Platform, vulnerability scanning, configuration management, and physical and environmental protection. All proposed products must be exhaustively listed with URLs, and all responses must address every product included in the Bill of Materials submission.
The Technical Assessment Form emphasizes compliance with specific state and federal standards including NIST 800-171, NIST SP 800-53 Revision 5, Maine Freedom of Access Act, State of Maine Breach Notification Law, Privacy Act of 1974, HIPAA, and HITECH Act requirements. Bidders must provide evidence through published policies, regulatory compliance audit reports, or publicly-accessible URLs, or enclose supporting documentation with their submission. The form requires bidders to submit an Architecture Diagram as a separate attachment to provide context for the assessment. Responses lacking supporting evidence for any Yes/No answers will be deemed incomplete and adversely affect the bid's technical evaluation. The assessment covers critical areas including backup and disaster recovery capabilities, application management standards across development, staging, and production environments, Service Level Agreements per MaineIT's Remote Hosting Policy, data ownership and exportation rights for the State, security plans compliant with NIST requirements, subcontractor safeguards, and cyber risk appetite statements approved by company leadership.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 4. BRFSS Cost Proposal Form-Final.xlsx | XLSX spreadsheet | |
| 1. RFP 202510143 BRFSS Data Collection_Final.docx | DOCX document | |
| 3. BRFSS Proposed Services Response Form-Final.docx | DOCX document | |
| 5. QA Summary RFP 202510143 BRFSS_Final.xlsx | XLSX spreadsheet | |
| QA Summary RFP 202510143 BRFSS Additional Questions FINAL.xlsx | XLSX spreadsheet | |
| 5. QA Summary RFP 202510143 BRFSS_Final.xlsx | XLSX spreadsheet | |
| 3. BRFSS Proposed Services Response Form-Final.docx | DOCX document | |
| 4. BRFSS Cost Proposal Form-Final.xlsx | XLSX spreadsheet | |
| 1. RFP 202510143 BRFSS Data Collection_Final.docx | DOCX document | |
| QA Summary RFP 202510143 BRFSS Additional Questions FINAL.xlsx | XLSX spreadsheet | |
| 2. BRFSS Technical Assessment Form-Final.xlsx | XLSX spreadsheet | |
| 2. BRFSS Technical Assessment Form-Final.xlsx | XLSX spreadsheet | |
| 3. BRFSS Proposed Services Response Form-Final.docx | DOCX document | |
| 4. BRFSS Cost Proposal Form-Final.xlsx | XLSX spreadsheet | |
| 1. RFP 202510143 BRFSS Data Collection_Final.docx | DOCX document |
Show all 15
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
State of Maine Technical Assessment Form
RFP# 202510143
Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management
| The State of Maine requires Bidders to demonstrate that they (and the products proposed by them) have the appropriate Architecture & Security controls to protect the State’s information assets, and meet all appropriate compliance mandates. |
| Bidders are urged to carefully read all the Header Instructions in the individual tabs before responding. Failure to comply with all the Header instructions will adversely affect the Technical Assessment of the Bid. |
| Bidders are instructed to submit (as a separate attachment) an Architecture Diagram of their proposed solution. This will provide additional context for the Technical Assessment. |
Data Compliance State of Maine Technical Assessment Form
RFP# 202510143
Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management
| Bidder Name: |
| Point of Contact including phone number and email address: |
| Data Compliance |
| The State data that is transacted by this RFP has been categorized according to the State’s Data Classification Policy, https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/DataClassificationPolicy.pdf |
The State data subject to this RFP has been classified as having a PII Impact Level of Low
| Bidders and their solutions must adhere to applicable State and Federal laws, policies, and standards that corresponds to the PII impact level of the State data that will be transacted by the proposed solution. For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. Either cite a publicly-accessible URL, or enclose a copy with the submission. | |||
| Type of Data | Control (State or Federal Compliance Standard) | Yes/No | Explanation |
| Publicly available information | § NIST 800-171 | ||
| § Maine Freedom of Access Act (Title 1 MRSA c. 13) | |||
| Confidential Personally Identifiable Information (PII) | § State of Maine Breach Notification Law | ||
| § National Institute of Standards & Technology: NIST SP 800-53 Revision 5 “Moderate” risk controls | |||
| § Privacy Act of 1974, 5 U.S.C. 552a. | |||
| § Security regulations from the U.S. DHHS, Administration for Children and Families, Office of Child Support Enforcement Program, Office of Child Support Enforcement (OCSE) | |||
| Personal Health Information (PHI) | § Health Insurance Portability and Accountability Act of 1996: HIPAA | ||
| § State of Maine HIPAA BAA required | |||
| § The Health Information Technology for Economic and Clinical Health Act HITECH |
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdfhttp://legislature.maine.gov/legis/statutes/10/title10ch210-Bsec0.htmlhttps://nvd.nist.gov/800-53https://www.justice.gov/opcl/privacy-act-1974https://www.hhs.gov/hipaa/for-professionals/privacy/index.htmlhttps://www.maine.gov/dhhs/sites/maine.gov.dhhs/files/inline-files/Business-Associate-Agreement.pdfhttps://www.hhs.gov/hipaa/for-professionals/special-topics/hitech-act-enforcement-interim-final-rule/index.html BoM State of Maine Technical Assessment Form
RFP# 202510143
Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management
| Bidder Name: | |
| Bill of Materials (BoM) | |
| Bidders must exhaustively list ALL the products that are being proposed as part of this bid. If a product is sold as a single SKU, even if it includes components, list it only once. Example: Salesforce Service Cloud must be listed only once because it is sold as a single SKU. Even though several components makes up the Salesforce Service Cloud, such as, Console, Case Management, Workflow automation, etc. However, Salesforce Maps must be listed independently because it is sold as a distinct SKU. Products must be listed even if they are free downloads. All responses in ALL other tabs must cover ALL the products listed in the BoM here. | |
| Product Name | Product URL |
| Example: Salesforce Cloud | Example URL: https://www.salesforce.com/sales/ |
MaineIT State of Maine Technical Assessment Form
RFP# 202510143
Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management
| Bidder Name: | |||
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. Either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID # | Control | Yes/No | Explanation |
| Hosting | |||
| H1 | Any technical solution must be hosted in a data center. | ||
| H2 | Any hosting provider must provide for back-up and disaster recovery models and plans as needed for the solution. | ||
| H3 | Any hosting provider will abide by NIST best practices for change requests, incident management, problem management, and service desk. | ||
| Application Solution | |||
| A1 | Any solutions Bidder must provide for the backup/recover, data retention, and disaster recovery of a contracted/hosted application solution. | ||
| A2 | Any solutions Bidder must provide for application management and design standard of all technology platforms and environments for the application solution (Development, Staging, Productions, DR, etc.) | ||
| A3 | Any solutions Bidder must engage the State of Maine using Service Level Agreements for system and application performance, incident reporting, and maintenance. See the defaults in the Remote Hosting Policy. | ||
| A4 | The State owns any data they enter, migrate, or transmit into the solution and the Bidder shall allow the State to pull or copy this data at any time free of charge in a format defined by the State. |
https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/RemoteHostingPolicy.pdf Information Security Standards State of Maine Technical Assessment Form
RFP# 202510143
Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management
| Bidder Name: | |||
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. For any evidentiary material, either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID# | Control | Yes/No | Explanation |
| S1 | Bidder provides and maintains a security plan that: |
1. Complies with NIST security requirements;
2. Protects the confidentiality, integrity, and availability of the State’s information systems; and
3. Comply with all applicable federal and state laws and regulations, as well as compliance with all MaineIT contractual requirements and information security policies.
| S2 | Bidder ensures that any agent or subcontractor of the bidder to whom the State provides access agrees to the same restrictions and conditions that apply through this Agreement and agrees to implement reasonable and appropriate safeguards to ensure the confidentiality, integrity, and availability of the State’s information systems. |
| S3 | Bidder will report a security incident that occurs on the Agency’s information systems that may affect the Agency or State of Maine systems to the CISO within 24 hours of discovery in accordance with the terms of the MaineIT Non-Disclosure Agreement (Attachment D). |
| S4 | Provide the stated cyber risk appetite statement that has been approved by the board/leadership of your company. |
Cloud Service Provider Reqs State of Maine Technical Assessment Form
RFP# 202510143
Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management
| Bidder Name: | |||
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. For any evidentiary material, either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID # | Control | Yes/No | Explanation |
| CSP1 | General Architecture Principles | ||
| CSP2 | All products proposed must be able to authenticate natively with both Microsoft Active Directory, and the Okta Platform (OpenID 2.0, Oauth 2.0, SAML 2.0) | ||
| CSP3 | System and Services Acquisition Policy and Procedures (SA-1) | ||
| CSP4 | Application Deployment Certification Policy | ||
| CSP5 | Digital Accessibility and Usability Policy | ||
| CSP6 | Remote Hosting Policy | ||
| CSP7 | Data Exchange policy | ||
| CSP8 | Information Security Policy | ||
| CSP9 | Access Control Policy | ||
| CSP10 | Access Control Procedures for Users | ||
| CSP11 | Risk Assessment policy | ||
| CSP12 | Vulnerability Scanning Procedure | ||
| CSP13 | Security Assessment and Authorization Policy | ||
| CSP14 | System and Information Integrity Policy | ||
| CSP15 | Configuration Management Policy | ||
| CSP16 | GenAI Policy (if applicable to this bid) | ||
| CSP17 | Site-to-site VPN | ||
| CSP18 | Vendor Identity System Integration Policy | ||
| CSP19 | Prohibited Technologies Policy |
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Farchitecture%2Fdocuments%2FGeneralArchitecturePrinciples.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283462187%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=hPw50eOA1Pw%2FS7R%2FsUilpZ4BKgn7UYAxzEcMekJd1Hw%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FRiskAssessmentPolicy%26Procedure.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283506985%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=DX8YitoGyojwrLOCZ%2BhltBROyt1iHfTszY6y8smDuQ0%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FVulnerablityScanningProcedure.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283511966%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Upbkei0Hmg5zbmM%2F4ADQiV8j4DcYlZfyJjqxWD8n%2FyE%3D&reserved=0https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/SecurityAssessmentAuthorizationPolicy.pdfhttps://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FSystemInformationIntegrityPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283521918%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=DhV6plvPwGgyPGWwZxIMl8vB%2FBUwhqWZjudSIJoS2Z8%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FConfigurationManagementPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283526900%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=2%2BbyzrG%2BhVzJEKIyrEZ3Zv5DXOy%2BwiqEpAWjk9a4g%2FE%3D&reserved=0https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/GenAIPolicy.pdfhttps://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/SiteToSiteVPNPolicy.pdfhttps://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/VendorIdentitySystemIntegrationPolicy.pdfhttps://www.maine.gov/oit/prohibited-technologieshttps://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fsites%2Fmaine.gov.oit%2Ffiles%2Finline-files%2Fsystem-services-acquisition-policy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283467162%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=S7J%2FjMIY1e6DijINzpo1K5R4fY3roSfTuNwDwpO1%2FNA%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FApplication-Deployment-Certification.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283472139%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=yBtVAz176L3Cag78nRWojRHWkHQ5Gba07JE%2FMQkxSsI%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FDigitalAccessibilityPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283477122%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=ub%2B%2F1cpCnNM4PoKAbhPUZ%2FluONQHbeK6j1rVOKXnaxk%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FRemoteHostingPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283482097%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=MR40mMW77Gu8X2QN8pjKM5bjP7DoRO%2BhfOhk0p1phTg%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FDataExchangePolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283487078%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=XTBYIGil6RMH8SmClnRcxTO7y9cEatf1EofD0QHPqMc%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FSecurityPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283492057%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=b%2FXvhpG1sp2fZIgpQx%2BwB7ZGRubGu7dN9sYBjFVRs%2BU%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FAccessControlPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283497031%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=foTOPC7xuTna00%2FTXggz7Rahs9XTpw5BSrCgrBmNZ9Y%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FAccessControlProceduresForUsers.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283502010%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=lO0DXc6NgpCav9iZYOLgMBuFsfmIFC8OiDtOvv%2BgOX8%3D&reserved=0 NIST Requirements State of Maine Technical Assessment Form
RFP# 202510143
Behavioral Risk Factor Surveillance System (BRFSS) Data Collection and Management
| Bidder Name: | |||
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. For any evidentiary material, either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID # | Control | Yes/No | Explanation |
| N1 | Physical and Environmental Protection | ||
| N2 | Awareness and Training | ||
| N3 | Planning | ||
| N4 | Audit and Accountability | ||
| N5 | Personnel Security | ||
| N6 | Contingency Planning | ||
| N7 | PII Processing and Transparency | ||
| N8 | Identification and Authentication | ||
| N9 | Incident Response | ||
| N10 | System and Communications Protection | ||
| N11 | Maintenance | ||
| N12 | Media Protection | ||
| N13 | Supply Chain Risk Management | ||
| N14 | Any Other Relevant Comment |
File details come from the government source that posted it. Updated .