26QE004_Attachment 3 _IT Compliance Checklist.xlsx
XLSX spreadsheet 13 KB Posted
- Attached to
- DoDEA - Substitute Caller Automation Software
- Solicitation number
- HE125426QE004
- Issued by
-
Department of Defense Education Activity
About this file
The file is an IT Compliance Checklist for a DoDEA (Department of Defense Education Activity) solicitation for Substitute Caller Automation Software. The checklist outlines comprehensive cybersecurity and data protection requirements for potential vendors, covering critical areas such as data storage, privacy protection, cloud compliance, access control, incident response, and personnel screening.
Key compliance requirements include: storing all DoD data within U.S. territories, encrypting data at rest and in transit, protecting Personally Identifiable Information (PII) and student data, meeting cloud security standards like DoD IL2 and FedRAMP Moderate, implementing multi-factor authentication, maintaining incident response capabilities, supporting secure API integrations, and ensuring all personnel have favorable background investigations. Vendors must provide detailed compliance explanations for any "No" responses, with responses limited to 200 words per requirement, and failure to fully complete the checklist may result in proposal disqualification.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 26QE004_Encl 1_52.209-7.pdf | ||
| 26QE004_Attachment 5_ Pricing Sheet.xlsx | XLSX spreadsheet | |
| 26QE004_Encl 6_52.204-26.pdf | ||
| 26QE004_Attachment 4_Delivery Schedule.xlsx | XLSX spreadsheet | |
| 26QE004_Encl 8_252.239-7009.pdf | ||
| 26QE004_Encl4_Letter of Commitment.pdf | ||
| 26QE004_Encl 3_52.222-56.pdf | ||
| 26QE004_Attachment1_PWS.pdf | ||
| 26QE004_SOL_SF1449.pdf | ||
| 26QE004_Encl 7_52.204-26.pdf | ||
| 26QE004_Encl5_CPARS.pdf | ||
| 26QE004_Encl 2_52.212-3.pdf | ||
| 26QE004_Attachment 2_Technical Objectives.xlsx | XLSX spreadsheet |
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Attachment 3: IT Compliance Checklist | ||
| Instructions: All questions in the Yes/No Column (Column B) must be answered with a Yes or No. If an offeror answers "No" to any of the requirements, the offeror shall provide a detailed explanation of their Compliance Plan in the Description Column (Column C) for each question, not to exceed 200 words per question. If a Description exceeds 200 words, the Government will only evaluate the first 200 words. Failure to answer all questions inthe Yes/No Column (Column B) or required Descriptions to "No" answers in the Description Column (Column C) may result in a proposal being determined unacceptable for award. | ||
| Requirement | Yes/No | If No, Describe Compliance Plan (200 words or less per cell) |
| Data Location & Storage | ||
| All DoD data stored within U.S. or outlying areas | ||
| No storage or processing outside U.S. without written authorization | ||
| Provide documentation and evidence of compliance with data location requirements | ||
| Encrypt data at rest and in transit using FIPS 140-2 validated modules | ||
| PII & Student Data Protection | ||
| Identify all systems and repositories that collect, store, process, or transmit PII | ||
| Comply with FERPA, COPPA, and DoDEA privacy instructions | ||
| Implement safeguards for children's PII including parental consent and data minimization | ||
| Limit access to PII to authorized personnel with need-to-know | ||
| Provide annual privacy and data protection training | ||
| Cloud & IL2 Compliance | ||
| Cloud service provider meets DoD IL2, FedRAMP Moderate PA, and comply with DFARS 252.204-7012 requirements | ||
| DoDEA data isolated and configured to meet DoD security standards | ||
| Compliance with NIST SP 800-171 and RMF | ||
| Continuous monitoring and vulnerability management | ||
| Access Control & Authentication | ||
| Implement role-based access controls (RBAC) | ||
| Multi-Factor Authentication (MFA) for privileged and user access | ||
| Authenticate using Azure AD or Google AD | ||
| Support SSO integration (ClassLink, Google, Azure) | ||
| Incident Response & Reporting | ||
| Report any suspected or confirmed breach of PII within 72 hours | ||
| Maintain Incident Response Plan aligned with DoD and NIST guidelines | ||
| Support forensic analysis and remediation activities | ||
| Documentation & Audits | ||
| Maintain logs of access to PII and audit trails | ||
| Provide annual privacy compliance reports | ||
| Support RMF documentation including SSP, SAR, and POA&M | ||
| Integration & Technical Standards | ||
| Support secure API-based integration or ETL pipelines | ||
| Align with DoDEA data schema and metadata standards | ||
| Use standardized data formats (JSON, XML, CSV) | ||
| Support industry standard rostering (ClassLink, OneRoster) | ||
| Personnel & Subcontractor Compliance | ||
| All personnel hold favorable background investigation or security clearance | ||
| Ensure subcontractors comply with same cybersecurity requirements | ||
| Contractor must report compliance status and any security incidents involving subcontractors or third-party service providers to DoDEA within 72 hours of discovery. | ||
| Report all third party vendors. |
Sheet2
| Yes |
| No |
File details come from the government source that posted it. Updated .