2-Vendor IT Questionnaire.xlsx
XLSX spreadsheet 26 KB Posted
- Attached to
- Branded Apparel & Webstore
- Solicitation number
- US.252847
- Issued by
- Pennsylvania
About this file
This is a vendor IT questionnaire form for CATA (Consortium for Advanced Transportation Authorities), a Pennsylvania-based government entity, related to a branded apparel and webstore procurement. The questionnaire is designed to evaluate potential software vendors and their products across eight comprehensive sections covering general product information, security and access controls, data and endpoint management, data risk analysis, client requirements, service level agreements, mobile capabilities, and server requirements. Vendors are required to provide detailed responses addressing product development timelines, upgrade frequencies, hosting strategies, integration capabilities, authentication methods, data encryption protocols, disaster recovery plans, compliance certifications, and technical infrastructure specifications. The related solicitation indicates that proposals for the CATA Branded Apparel and Web Store project must be submitted electronically via PennBid no later than 3:00 p.m. EST on Thursday, October 22, 2026, with all proposals remaining valid for ninety calendar days from the closing date.
The questionnaire does not specify pricing terms, contract amounts, or funding sources within its scope, as it functions as a technical evaluation tool rather than a pricing document. Disadvantaged Business Enterprises are encouraged to submit bids and should include copies of current DBE certification under the Pennsylvania Unified Certification Program with their proposals. All proposals are considered public record upon award, and proposers are advised to identify any proprietary or confidential information in their documentation. Any fees incurred from the bidding platform are the responsibility of the awarded firm. The questionnaire requires vendors to address critical compliance and security frameworks including NIST guidelines, SOC2 certifications, SAML/SSO authentication, encryption standards, and multi-factor authentication integration, reflecting CATA's emphasis on robust cybersecurity and data protection in vendor selection.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 1-Branded Apparel RFP 2026.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Insert Product Name Here: |
| Insert Company Name Here: |
CATA VENDOR QUESTIONNAIRE
GENERAL ANSWERS
(Section 1)
| Please answer ALL questions. If a question is not applicable, indicate by N/A. |
| When was the product developed? |
| a. What is the oldest production implementation? |
| How often is the product upgraded? |
| How are product enhancement requests prioritized? |
| Do product customer groups or communities exist? |
| Is the product IPv6 enabled? |
| a. If no, what is the timeframe for enabling IPv6? |
| Describe product's hosting strategy (ex. SaaS, vendor-on-prem, customer-on-prem, hosted, hybrid). Describe the elements the vendor is accountable for.? |
| Does the product support integration with a Log Management System? |
| Does the product integrate with multi-factor authentication implementation (e.g. DUO)? |
| Does the product offer non-production environments (e.g., Test, QA)? |
| a. Is there an additional cost for non-production environment(s)? |
| Does the product need to run with elevated permissions/users, on CATA workstations or servers in order to function as intended? |
| Does the vendor have a Software Bill of Materials? (NIST guidelines) |
| Does the product's installation/patch process require elevated permissions on CATA's workstations or servers? |
| SECURITY, ACCESS AND PRIVACY ANSWERS |
(Section 2)
| Describe in detail the customer authorization process/procedure. |
| a. Is access provisioning role-based? |
| b. Does the product support multiple (high-end) administrators? |
| Does the product require a data feed of any federally-regulated data (e.g. SSN, password, government-issued ID, driver's license, etc.)? |
| Does the product use or support data encryption at rest? |
| Does the product use or support data encryption in flight? |
| Does the vendor require remote access to CATA resources? |
| a. At what point of implementation is access required? |
| b. Is ongoing remote access needed after implementation? |
| Do any elements of the product (mobile or otherwise) cache or pass through any authentication credentials? |
| In what country (or countries) was/is the application source code for the product developed? |
| Describe the security review process for the product's application source code. |
| Is SAML/SSO authentication available and sufficient to authenticate all service modules or components (web applications, smart device apps, etc.)? |
| Identify any other available authentication options. |
| If the product supports SAML/SSO, what attributes need to be released? |
| a. If the product supports direct federation only via SAML, can the product handle multiple certificates (for purposes of seamless expiry/renewal)? |
| Does the product have an SSAE16, SOC2, ISO27018 or equivalent audit report available for review? If so, please attach it or provide an adequate description of the plan. |
| Describe the company's disaster recovery and business continuity plans. |
| Are sub-contractors employed to handle, control, and/or process CATA's data?If so, in what countries are these sub-contractor located? |
| Describe the notification process in the event of a security breach. |
| a. What is the timeframe for notifying CATA of a breach? |
| Does the company agree to maintain network security that minimally includes network firewall provisioning, intrusion detection, and vulnerability assessments? |
| a. Are vulnerability assessments completed in-house or by a 3rd party? |
| b. Will the company share assessment results with CATA? |
| Describe how the product segregates one customer’s data from another. Specifically, would CATA's data reside in the same database tables as other customer’s data, or is it partitioned in a separate database? |
| DATA/ENDPOINT ANSWERS |
(Section 3)
| Identify the third-party product(s) that integrate with the product out of the box. |
| Identify the secure transfer methods available for the transfer of data from CATA to the product. |
| Identify the available methods/formats for exporting data out of the product. |
| Does the product require Java Runtime or other browser plugins? |
| Does the product cache any data on client or endpoint device(s)? |
| Does the client or endpoint client software auto-update? |
| Does the product require data from CATA? |
| a. If yes, identify and describe data elements required (e.g., name, ID number, email, etc.). |
| b. Can select data be stored locally rather than hosted? |
| What is the required frequency of the data feeds (real time, nightly, weekly, monthly, ad hoc)? |
| Describe the process for data extraction (repatriation), destruction, etc. upon termination of contract/service with CATA. |
| a. What formats are available for data extraction? |
| Are API’s available for data mobility? |
| Describe your data retention policy. |
| Does your product use, disclose, maintain, or transmit health information? For the purposes of this review, "health information" is defined as any information, including genetic information, whether oral or recorded in any form or medium, that relates to the past, present, or future physical or mental health or condition of an individual; the provisions of health care to an individual; or the past, present, or future payment for the provision of health care to an individual. |
| DATA RISK ANALYSIS ANSWERS |
(Section 4)
| What is your file retention policy? |
| a. When are personally identifiable records destroyed? |
| Is any portion of work or business conducted from countries outside of the US? If so, list which countries and any relevant details about their roles. |
| Is any data storage located outside of the US? |
| Are any portions of service operations outsourced to a third party or subcontractors? |
| a. If so in what countries are those third parties or subcontractors located? |
| b. Who are the third parties or subcontractors and what services do they provide? |
| What data are shared with third parties? |
| Who has access to stored sensitive data, including any third parties or subcontractors? |
| What compliance or auditing frameworks are in place to protect data (ex. NIST 800-53, ISO 27000, NIST CSF, CIS, SOC2) ? |
| Describe the security and privacy controls in place for the vendor's "work-from-home" associates to ensure the confidentiality and integrity of personally identifiable information and CATA data? |
| CLIENT REQUIREMENTS ANSWERS |
(Section 5)
| Does your product require the user’s workstation to install a client? |
| a. What client Operating Systems does your product support? |
| b. To what component tier does it connect to (application, database, reporting, other)? |
| c. Is the connection between the client and server encrypted? |
| d. What 3rd party components are required on the client? |
| If no client is required what is the recommended browser? |
| SERVICE LEVEL ANSWERS |
(Section 6)
| Does your company have a Service Level Agreement? If so please attach. |
| Describe the process for submitting bugs and enhancement requests. |
| Describe the product's problem resolution process. |
| Describe the company's process to ensure 24x7 availability/access to the product. |
| a. What are the return-to-service timeframe guarantees? |
| b. Describe the process regarding which customers get restored first. |
| How often and what time of the day do planned outages for upgrades and patches occur? |
| Describe your data center(s). |
| a. Where are they located? |
| b. Are there multiple redundant data centers? |
| c. Is there failover? If so, describe how it fails over. |
| What is the data RPOs (Recovery Point Objectives) and RTOs (Recovery Time Objectives) that your system is architected for? |
| MOBILE ANSWERS |
(Section 7)
| Is the application mobile responsive? |
| Is there an iOS native app? |
| Is there an Android native app? |
| Who deploys the app to the App store? Is the app deployed with the vendor license or is a CATA license required to deploy the app? |
| What usage statistics are available for the native app? |
| Please describe how the authentication works for the native app. Can SAML2 be used for this authentication? |
| Do the native apps have the exact same functionality as the web and/or client based application? If not, please articulate the differences |
| Do any elements of your solution (mobile or otherwise) collect and share user information such as geo-location, device ID, etc.? |
| SERVER REQUIREMENTS ANSWERS |
(Section 8)
| What components are required for your product- how many tiers (web, application, reporting, batch, database, other)? |
| What 3rd party server components are required? |
| What are the hardware requirements for your product (RAM, CPU,etc.)? |
| What are the storage requirements for your product? |
| Does your product have support for running in a virtualized server environment.? If yes please list supported enviornments. |
| Does your product support running in a containerized environment? |
| What Operating System is/are recommended/supported for each server component tier of the product? |
| Does the product utilize a database? |
| a. What DBMS products are supported (Oracle, MySQL, SQL Server, NoSQL, etc.)? |
| What server component tiers do you recommend running on the same server vs. running on other servers? |
| Does your product support the database running on a separate shared database infrastructure? |
| What Operating System and/or database platform do you develop on? |
| Do you have an environment that mimics your recommended customer environments? |
| a. If so, how is it configured? |
| Describe the backup requirements for your product and for each of its component tiers. |
List
| Answers |
| YES |
| NO |
| N/A |
File details come from the government source that posted it. Updated .