2026 WVCSF spreadsheet.xlsm

18 KB Posted

Attached to
Addendum No 4-Governance, Risk and Compliance Auto Platform
Solicitation number
CRFQ 0231 OOT2700000002 5
Issued by
Kanawha County, West Virginia

About this file

Written by GovTribe AI ·

This is a cybersecurity maturity assessment spreadsheet related to Addendum No. 4 for a Governance, Risk and Compliance Automation Platform procurement by the State of West Virginia. The document serves as a framework evaluation tool containing 23 standardized cybersecurity requirements mapped across five functional categories: Govern, Identify, Protect, Detect, and Respond. The requirements align with established cybersecurity frameworks and assess organizational maturity across critical areas including legal and regulatory compliance management, risk appetite establishment, organizational leadership accountability, cybersecurity integration in human resources practices, supplier management and third-party coordination, asset inventory maintenance, vulnerability identification and validation, data protection and backup procedures, physical access controls, incident detection and declaration, and information sharing protocols. Additionally, the framework includes organizational modernization opportunities related to cloud services adoption and digital transformation of paper-based processes.

The spreadsheet employs a structured evaluation methodology with each requirement assigned a unique identifier, mapped to specific framework standards (such as GV.OC-03, ID.AM-01, PR.DS-01), and marked with maturity indicators. All 23 requirements are flagged as framework elements rather than specific contract line items, suggesting this document functions as a standardized assessment tool for evaluating vendor or organizational cybersecurity capabilities rather than a traditional procurement document with pricing, timelines, or award specifications. The document version 12.4.0.3 provides the baseline assessment criteria for the governance, risk, and compliance automation platform evaluation, with each requirement designed to verify organizational understanding and implementation of cybersecurity best practices across supply chain management, asset management, data protection, and incident response protocols.

View the file

Other files

File Type Posted
Addendum No 1_028.pdf PDF
Final_CRFQ_0231_OOT2700000002_1_WV_CRFQ_FORM.PDF PDF
Addendum No 2_014.pdf PDF
Final_CRFQ_0231_OOT2700000002_2_WV_CRFQ_FORM.PDF PDF
Final_CRFQ_0231_OOT2700000002_4_WV_CRFQ_FORM.PDF PDF
Final_CRFQ_0231_OOT2700000002_3_WV_CRFQ_FORM.PDF PDF
Final_CRFQ_0231_OOT2700000002_5_WV_CRFQ_FORM.PDF PDF
CRFQ OOT2700000002 BID DOCUMENTS.pdf PDF
Addendum No 3_006.pdf PDF
Addendum No 4_004.pdf PDF

On GovTribe

Work with this file

  • Download the original file
  • Contacts named in this file
  • Similar government files
  • Ask GovTribe AI about this file
Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Standard Requirements

Question_IdQuestion_Group_HeadingSimple_QuestionRequirement_TitleAnswer_TextMark_For_ReviewIs_QuestionIs_RequirementIs_MaturityIs_ComponentIs_FrameworkAnswer_IdCommentAlternate_JustificationComponent_Guid
1000673GovernLegal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managedGV.OC-03UFalseFalseTrueFalseFalseFalse4067400000000-0000-0000-0000-000000000000
1000677GovernRisk appetite and risk tolerance statements are established, communicated, and maintainedGV.RM-02UFalseFalseTrueFalseFalseFalse4066400000000-0000-0000-0000-000000000000
1000683GovernOrganizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improvingGV.RR-01UFalseFalseTrueFalseFalseFalse4066200000000-0000-0000-0000-000000000000
1000686GovernCybersecurity is included in human resources practicesGV.RR-04UFalseFalseTrueFalseFalseFalse4065800000000-0000-0000-0000-000000000000
1000693GovernCybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externallyGV.SC-02UFalseFalseTrueFalseFalseFalse4067500000000-0000-0000-0000-000000000000
1000695GovernSuppliers are known and prioritized by criticalityGV.SC-04UFalseFalseTrueFalseFalseFalse4067200000000-0000-0000-0000-000000000000
1000699GovernRelevant suppliers and other third parties are included in incident planning, response, and recovery activitiesGV.SC-08UFalseFalseTrueFalseFalseFalse4067600000000-0000-0000-0000-000000000000
1000702IdentifyInventories of hardware managed by the organization are maintainedID.AM-01UFalseFalseTrueFalseFalseFalse4065500000000-0000-0000-0000-000000000000
1000703IdentifyInventories of software, services, and systems managed by the organization are maintainedID.AM-02UFalseFalseTrueFalseFalseFalse4066700000000-0000-0000-0000-000000000000
1000705IdentifyInventories of services provided by suppliers are maintainedID.AM-04UFalseFalseTrueFalseFalseFalse4065200000000-0000-0000-0000-000000000000
1000706IdentifyAssets are prioritized based on classification, criticality, resources, and impact on the missionID.AM-05UFalseFalseTrueFalseFalseFalse4066300000000-0000-0000-0000-000000000000
1000709IdentifyVulnerabilities in assets are identified, validated, and recordedID.RA-01UFalseFalseTrueFalseFalseFalse4065900000000-0000-0000-0000-000000000000
1000717IdentifyThe authenticity and integrity of hardware and software are assessed prior to acquisition and useID.RA-09UFalseFalseTrueFalseFalseFalse4066600000000-0000-0000-0000-000000000000
1000718ProtectCritical suppliers are assessed prior to acquisitionID.RA-10UFalseFalseTrueFalseFalseFalse4067000000000-0000-0000-0000-000000000000
1000720IdentifyImprovements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third partiesID.IM-02UFalseFalseTrueFalseFalseFalse4066000000000-0000-0000-0000-000000000000
1000721IdentifyImprovements are identified from execution of operational processes, procedures, and activitiesID.IM-03UFalseFalseTrueFalseFalseFalse4067100000000-0000-0000-0000-000000000000
1000728ProtectPhysical access to assets is managed, monitored, and enforced commensurate with riskPR.AA-06UFalseFalseTrueFalseFalseFalse4065400000000-0000-0000-0000-000000000000
1000731ProtectThe confidentiality, integrity, and availability of data-at-rest are protectedPR.DS-01UFalseFalseTrueFalseFalseFalse4065700000000-0000-0000-0000-000000000000
1000734ProtectBackups of data are created, protected, maintained, and testedPR.DS-11UFalseFalseTrueFalseFalseFalse4065300000000-0000-0000-0000-000000000000
1000736ProtectSoftware is maintained, replaced, and removed commensurate with riskPR.PS-02UFalseFalseTrueFalseFalseFalse4067300000000-0000-0000-0000-000000000000
1000737ProtectHardware is maintained, replaced, and removed commensurate with riskPR.PS-03UFalseFalseTrueFalseFalseFalse4066100000000-0000-0000-0000-000000000000
1000755DetectIncidents are declared when adverse events meet the defined incident criteriaDE.AE-08UFalseFalseTrueFalseFalseFalse4066900000000-0000-0000-0000-000000000000
1000766RespondInformation is shared with designated internal and external stakeholdersRS.CO-03UFalseFalseTrueFalseFalseFalse4066500000000-0000-0000-0000-000000000000
1000777OrganizationalOrganization identifies opportunities for system modernization using Cloud servicesGV.OC-06UFalseFalseTrueFalseFalseFalse4065600000000-0000-0000-0000-000000000000
1000778GovernOrganization identifies paper based forms and processes for digital modernization opportunitiesGV.OC-07UFalseFalseTrueFalseFalseFalse4066800000000-0000-0000-0000-000000000000

Framework Question_Id Question_Group_Heading Simple_Question Requirement_Title Answer_Text Mark_For_Review Is_Question Is_Requirement Is_Maturity Is_Component Is_Framework Answer_Id Comment Alternate_Justification Component_Guid

Version

Version
12.4.0.3

File details come from the government source that posted it. Updated .