3-14 Attachment - Prerequisite Assessment.pdf
PDF 173 KB Posted
- Attached to
- Master Agreement AZ|CTR077082
- Contract number
- CTR077082
- Issued by
- Arizona
About this file
This document is a Request for Proposal (RFP) issued by the Arizona Department of Administration's State Procurement Office, specifically Solicitation No. BPM006719 for Statewide Emergency Response Services and Solutions. The solicitation involves the Arizona Department of Homeland Security (AZDOHS) Cyber Command, which has established a NIST SP 800-53 Revision 5 based process for assessing risk associated with data storage, processing, and transmission by various service vendors.
The RFP requires offerors to complete an AZRAMP Level 1 Prerequisite Control Sheet as Attachment 14 if they will handle state-provided data, with the assessment focusing on infrastructure security controls for Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) vendors. Specifically, offerors must submit a Microsoft Excel spreadsheet detailing their security measures, potentially including a System Security Plan (SSP), policies, and procedures. AZDOHS Cyber Command will evaluate these submissions and provide recommendations to the Procurement Officer, with the assessment results potentially impacting an offeror's eligibility for contract award. The document notes that 1596 Strategic Response Solutions, LLC will complete the AZRAMP Level 1 Prerequisite Control Sheet at the Task Order level, if required.
View the file
Other files
Show all 24
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Request for Proposal
Solicitation No. BPM006719
Statewide Emergency Response Services and Solutions
Arizona Department of Administration State Procurement Office
Solicitation Attachment – Prerequisite Assessment of Arizona Baseline Infrastructure Security Controls | Revision No. 2 | Revised 09-24
Attachment 14 – Prerequisite Assessment of Arizona Baseline Infrastructure Security Controls
To be susceptible for award of Contracts for services that will require Contractor to handle Data provided by State, Offerors are required to complete the AZRAMP Level 1 Prerequisite Control Sheet provided below and submit as Attachment 14 - Prerequisite Assessment as part of the Offer.
Arizona Department of Homeland Security (AZDOHS) Cyber Command has established a NIST SP 800-53 Revision 5 based process to assess risk associated with storing, processing, and transmitting State of Arizona Data with Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) vendors.
The State Data Classification Policy (8110) and a Confidentiality, Integrity, Availability (CIA) model are used to determine which level of assessment to administer for the vendor’s Infrastructure / IaaS. A Microsoft Excel spreadsheet is currently used for each level of assessment.
The solicitation requires the Offeror to complete the AZRAMP Level 1 Prerequisite Control Sheet, which can be found at:
● https://azdohs.gov/sites/default/files/azramp-level-1-prerequisite-control-sheet_0.xlsx
● Contractor is required to provide any requested documentation including System Security Plan (SSP), policies, and procedures supporting the review of the assessment.
AZDOHS Cyber Command will evaluate and rank submitted AZRAMP Level 1 Prerequisite Control Sheets for completeness, attention to detail, and understanding of NIST security controls and framework. AZDOHS Cyber Command will forward assessment results and recommendations to the Procurement Officer. Results of these IT security control reviews are for internal use only and will not be shared with responding bidders, but may impact the Offeror’s susceptibility for award.
All Offerors must complete the assessment above, and upload with their Offers as Attachment 14 - Prerequisite Assessment. This task is a mandatory requirement for an Offeror to be susceptible for award.
Based on Answer to Question number 57, 1596 Strategic Response Solutions, LLC will complete the AZRAMP Level 1 Prerequisite Control Sheet at the Task Order level, if required.
57 1596 Strategic Response Solutions LLC
Answer to question 18 states "There is no IT portion to this solicitation. Only would be in how data relates to specific task orders and storing data." Whereas the solicitation states offerors are required to "Submit a completed Arizona Baseline Infrastructure Security Controls Pre-Requisite (35 questions) assessment spreadsheet (Attachment 14 - Prerequisite Assessment of Arizona Baseline Infrastructure Security Controls) in the .xls format as part of their proposal. This task is not a mandatory requirement unless applicable."
Additionally, attachment 14 states "To be susceptible for award of Contracts for services that will require Contractor to handle Data provided by State, Offerors are required to complete the AZRAMP Level 1 Prerequisite Control Sheet provided below and submit as Attachment 14 - Prerequisite Assessment as part of the Offer." Given the Task Order requirements would specify the IT requirements, and conflicting instructions as to when the documentation is required (i.e. within 45 days of award/with proposal) are offerors required to complete the AZRAMP Level 1 Prerequisite Control Sheet at this stage of the procurement process?
If the future Task Order has IT requirements, the Offeror will have the opportunity to complete the AZRAMP sheet. As for the submission, it is not required as a submission.
https://azdohs.gov/information-security-policies-standards-and-procedures https://azdohs.gov/sites/default/files/azramp-level-1-prerequisite-control-sheet_0.xlsx
File details come from the government source that posted it. Updated .