24673RFRAmendment.docx
DOCX document 14 KB Posted
- Attached to
- Expert Witness and Consultant Services
- Solicitation number
- BD-23-1028-DR129-DR129-88047
- Issued by
- Suffolk County, Massachusetts
About this file
This document is an amendment to a Request for Response (RFR) issued by the Massachusetts Department of Revenue (DOR) for Expert Witness and Consultant Services. The amendment updates Section 7 of the RFR, which covers the physical and technical security requirements for the contract. The Bidder must maintain compliance with the National Institute of Standards and Technology (NIST) Special Publication 800-53 "Moderate-Impact Baseline" security controls and the requirements of Internal Revenue Service Publication 1075. The Bidder must also be FedRAMP Certified for any cloud-based systems. If unable to fully comply, the Bidder must work with DOR to provide compensating controls and a compliance plan prior to contract execution. The Bidder is not required to submit the security documentation with their response, but must provide it for DOR's review and approval before contract execution.
The Bidder will also be required to complete a Security Questionnaire as part of DOR's Vendor Risk Management assessment prior to contract execution. This Security Questionnaire does not need to be submitted with the Bidder's response.
View the file
Other files
Show all 25
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
24673RFR
AMENDMENT – 11/6/2023
Section 7 is being replaced in full by the following.
7. Physical and Technical Security Requirements
The Bidder must submit a written statement that they will maintain compliance with the best practices contained in the National Institute of Standards and Technology (NIST) Special Publication 800-53 Current Revision, “Security Controls for Federal Information Systems”, Annex 2, “Moderate-Impact Baseline” NIST 800-53 (Moderate Level) (Current Revision) regarding the physical and technical security of DOR Information, which can be found at https://doi.org/10.6028/NIST.SP.800-53r5. Also, the Bidder must comply with the requirements of the Internal Revenue Service Publication 1075, which can be found at Publication 1075 - Tax Information Security Guidelines, and must be FedRAMP Certified for all cloud-based systems.
If the Bidder is unable to comply with any of the controls contained in the above documents at the time the Contract is executed, the Bidder must work with DOR to provide any compensating controls that they have in place for review and acceptance, develop a compliance plan for meeting those controls that they are unable to compensate or meet, and to put in place compensating controls deemed necessary by DOR prior to the contract execution.
Bidders are not required to submit plans, policies or similar documentation specified in this section with their Response, but the selected Bidder must provide such documentation for DOR’s review and approval prior to Contract execution.
Upon selection, Bidder will be required to provide a completed “Security Questionnaire” as part of DOR’s Vendor Risk Management assessment prior to contract execution. The Security Questionnaire does not need to be submitted as part of Bidder’s Response.
File details come from the government source that posted it. Updated .