23672RFRAmendment6.docx

23672RFR

AMENDMENT 6 – 11/14/2023

Please ignore the prior amendment regarding Section 7 and note that Section 6 is being replaced in full by the following.

6. Physical and Technical Security Requirements

The Bidder must submit a written statement that they will maintain compliance with the best practices contained in the National Institute of Standards and Technology (NIST) Special Publication 800-53 Current Revision, “Security Controls for Federal Information Systems”, Annex 2, “Moderate-Impact Baseline” NIST 800-53 (Moderate Level) (Current Revision) regarding the physical and technical security of DOR Information, which can be found at https://doi.org/10.6028/NIST.SP.800-53r5. Also, the Bidder must comply with the requirements of the Internal Revenue Service Publication 1075, which can be found at Publication 1075 - Tax Information Security Guidelines, and must be FedRAMP Certified for all cloud-based systems.

If the Bidder is unable to comply with any of the controls contained in the above documents at the time the Contract is executed, the Bidder must work with DOR to provide any compensating controls that they have in place for review and acceptance, develop a compliance plan for meeting those controls that they are unable to compensate or meet, and to put in place compensating controls deemed necessary by DOR prior to the contract execution.

Bidders are not required to submit plans, policies or similar documentation specified in this section with their Response, but the selected Bidder must provide such documentation for DOR’s review and approval prior to Contract execution.

Upon selection, Bidder will be required to provide a completed “Security Questionnaire” as part of DOR’s Vendor Risk Management assessment prior to contract execution. The Security Questionnaire does not need to be submitted as part of Bidder’s Response.