3-Appendix C Security and Compliance Questionnaire.xlsx

This is a Security and Compliance Questionnaire appendix for Montgomery County, Pennsylvania's Human Capital Management (HCM) Platform and Implementation Services procurement. The questionnaire establishes comprehensive security, compliance, and operational requirements that prospective vendors must address across multiple control domains. Key requirements include obtaining SOC 2 Type II certification within the last 12 months, implementing role-based or attribute-based access control with SSO capabilities supporting SAML 2.0 and OIDC, and deploying encryption standards including TLS 1.2+ for data in transit and AES-256 for data at rest. Vendors must also comply with privacy and legal requirements including data processing agreements with subprocessor lists, GDPR and CCPA compliance processes, and 12-hour breach notification protocols from discovery. Additionally, vendors are required to maintain disaster recovery capabilities with an 8-hour recovery time objective and 1-hour recovery point objective, with documented testing within the last 12 months.

The questionnaire further mandates that vendors demonstrate robust application security practices including vulnerability management with defined SLAs (7 days for critical issues, 30 days for high-priority items), annual third-party penetration testing, and static and dynamic scanning integrated into CI/CD pipelines. Logging and audit requirements include immutable administrative activity logs with export capabilities for eDiscovery purposes. Accessibility standards must meet WCAG 2.2 AA conformance with current VPATs provided. Vendors must maintain specified insurance coverage including cyber liability and professional liability policies with documented minimum limits, carrier information, and expiration dates. All vendor responses require submission of detailed information, supporting attachments, and documentation across certification, control, privacy and legal, disaster recovery, application security, logging and audit, and accessibility domains.