3-Information Technology Requirement Security Worksheet.xlsx
XLSX spreadsheet 24 KB Posted
- Attached to
- Project Management & Analytics Software (PMAS)
- Solicitation number
- 25-0137-2
- Issued by
- Chatham County, Georgia
About this file
The document is an IT Security Worksheet for a Project Management and Analytics Software (PMAS) Request for Proposal (RFP) issued by Chatham County, Georgia. The county is seeking a comprehensive software solution to improve project oversight, accountability, and efficiency, with vendors required to complete a detailed security assessment covering multiple domains including network security, application security, data storage security, access management, physical security, and disaster recovery capabilities. The worksheet requires vendors to provide detailed responses using a specific coding system (F, CO, CU, TP, R, NA) for each security requirement, with annotations for modification hours and implementation details.
The security worksheet is extensive, covering 40+ specific security requirements across categories such as functional capabilities, network infrastructure, data protection, access controls, and incident response. Vendors must demonstrate compliance with industry standards, including potential certifications like SSAE16, HIPAA, PCI DSS, ISO 27001, and NIST/FISMA. Key focus areas include single sign-on capabilities, cloud or on-premise deployment, data center location within the United States, encryption methods, user access management, background checks, administrative controls, and comprehensive disaster recovery and business continuity planning. Chatham County emphasizes robust security protocols, requiring vendors to provide detailed explanations of their technical and operational security controls.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 1-Attachments A - I (Fillable) with Notary Fields.pdf | ||
| 4-RFP 25-0137-2 PMAS.pdf | ||
| 2-ICS Vendor Policy - Signature Line.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
IT Requirement Questions
| Proposers must use one code only per requirement. The following answer key must be used when responding to the requirements. (F=Fully provided out of the box, CO=Configuration set up required no change to source code, CU=Customization, TP=Third Party Product indicate the name of the Third Party in the comments column, R=provided with reporting tool, NA=not available) | Response | Modules Required | Comments |
| Functional Requirements - General | |||
| Does the application support single sign on? If so, please list the connection methods used (i.e. Active Directory etc.)? | |||
| Is your solution cloud base or on-premise? | |||
| Does your solution have an API? | |||
| Is your data center housed in the U.S.? | |||
| Network | |||
| Does your software need internet access? | |||
| List of all systems included for the buildout (Client Systems, Servers, Network Services). | |||
| Include the operating system for each system or network device. | |||
| What IP s, ports and urls will the devices need to access? | |||
| Are there any ports needed for local access? | |||
| Will it need remote access by the vendor? If so, please explain. | |||
| a. Is the vendor managing this system? | |||
| b. What is the vendors maintenance plan for operating system updates? | |||
| c. What is the vendors maintenance plan for software updates? | |||
| d. What is the on-call support for these systems? | |||
| e. Is vendor using a remote software tool to manage this system? If yes, name of the software. | |||
| Are there any devices needed for this application? If so, will these devices need to be added to the County Domain? | |||
| Can the system (if domain joined) support Chatham County baseline configurations and Group Policies? | |||
| Can the system support end-point protection tools provided by Chatham County? |
ITSecurityQuestions
| Requirement Criticality | Ranges=High, Medium, Low | ||||||
| Company Response | Annotation location for the responses, if not applicable based on questions utilize N/A for placeholder | ||||||
| Modification Hours | If changes can be made to meet various requirements, what is the time requirement needed | ||||||
| Security Requirements | |||||||
| Category | Reference Number | Functional Requirements | Requirement Criticality | Company Response | Mod Hours (how long to modify) | Module(s)/Sub-module(s) Required to Fulfill Requirements | Comments |
| Network Security | NS-1 | Can you provide sanitized copies of system architecture diagrams and data flow diagrams, as they pertain to the service being provided? | Medium | ||||
| NS-2 | Do you use firewalls to enforce segmentation between trusted and untrusted networks? | High | |||||
| NS-3 | If you require remote connectivity to the Chatham County Network to access our data, or to perform support/administration tasks, do you enforce secure remote access controls? If so, can you provide details?(Chatham County does not permit vendor supplied remote access solutions on County systems) | Low | |||||
| NS-4 | Do you use strong encryption to protect information in transit? If so what do you utilize? (i.e. TLS 1.2 or higher with AES if browser based, Software Tool) | High | |||||
| Application Security | AS-1 | Do you follow a formal software development process that includes application security requirements? Please Explain. | Low | ||||
| AS-2 | Do you use non-production systems for testing, prohibiting the storage and use of production data on those non-production (i.e. test and development) systems? | High | |||||
| AS-3 | Do you perform security reviews of your application source code? | Medium | |||||
| AS-4 | Do you support web services in addition to batch processes for data transfers? | Low | |||||
| AS-5 | What operating system is the software application compatible with? | High | |||||
| AS-6 | Software or application must support user-defined security levels (i.e. Role Based Security) | High | |||||
| AS-7 | Software or application must support full audit trail of user based actions. This includes, but not limited to, version history of modifications, Login, Logoff, Document upload/download, pages visited, time of use | High | |||||
| Data Storage Security | DS-1 | Will you be storing Chatham County data or configuration information on your infrastructure? If so, data at rest encryption must meet industry recognized standards to include use of AES encryption algorithms. | Medium | ||||
| DS-2 | Do you store any data outside the continental United States? (Hosting facility is required to store all Chatham County data in the United States) | High | |||||
| DS-3 | Do you purge application data according to a defined data retention schedule? | Medium | |||||
| DS-4 | Will Chatham County data be captured/stored in backups? If so, please indicate how you will secure the data. | Medium | |||||
| DS-5 | Do you sub-contract other third parties to store, process or dispose of Chatham County data? If so, how do you ensure those subcontractors are secure? | High | |||||
| DS-6 | Will Chatham County data be stored or processed with other customer data on servers? If so, how do you segment/separate the data? | High | |||||
| Security Policies and Procedures | SP-1 | Have you formally assigned personnel or third party organizations the responsibility of overseeing your company's security program? | Low | ||||
| SP-2 | Do you have current, documented policies and procedures that include the following: |
1) Information Security Policy
2) Incident Response Policy and Supporting Procedures
3) Change Control Policy and Supporting Procedures
4) Acceptable Use Policy
5) Privacy Policy
| 6) Flaw Remediation Policy | High | |||
| SP-3 | Do you perform background checks and or credit checks for all users with access to confidential information? | Medium | ||
| Access Management | AM-1 | Please describe your process to grant, modify, review and terminate user access. | Low | |
| AM-2 | How do you control administrative access? | Medium | ||
| AM-3 | Do you require all users to have unique user accounts on systems that store, access and or transmit Chatham County data? | Medium | ||
| AM-4 | Do you enforce strong authentication controls, including complex passwords and multifactor authentication? | Medium | ||
| AM-5 | Will you have staff or consultants in foreign countries with the ability to access Chatham County data? | High | ||
| AM-6 | Can you produce audit trails that will tie any system activity back to an individual? | Low | ||
| AM-7 | Do you securely configure (harden) systems and devices using industry standard baselines? Systems and devices include: |
1) Clients
2) Servers
3) Databases
4) Applications
| 5) Network Devices | Medium | |||
| AM-8 | Does your application or software maintain all intended functionality on hardened system that is utilizing Defense Information System Agency Security Technical Implementation Guides (DISA STIGS)? | High | ||
| AM-9 | Do you maintain vulnerability management procedures that include identifying and remediating technical vulnerabilities? | High | ||
| AM-10 | Do you have a documented change control process? | Medium | ||
| AM-11 | Does the solution provide access only via secure and encrypted site and authenticated login and password through Active Directory or Azure AD integration? | High | ||
| AM-12 | Do you maintain and monitor current virus protection software? | High | ||
| Physical Security | PS-1 | Does your data center have any security certifications? If so can you provide them? | Low | |
| PS-2 | Hosting facility is required to meet industry security standard controls in accordance with NIST-800-53 or similar control guidelines for physical security. | Medium | ||
| Security Incident Response | SR-1 | Please describe (high level) the technical and operation controls you have implemented to help you detect and respond to security events and incidents? | Medium | |
| SR-2 | How frequently do you log and review security-related events? Do you have the capability of sharing these logs with Chatham County? | Low | ||
| Security Assessments | SA-1 | How often do you conduct internal security controls assessments? | Medium | |
| SA-2 | How often do you conduct internal network and application penetration testing? | Low | ||
| SA-3 | Does you organization have system and or process certifications, including one or more of the following? If applicable, please provide current attestations. |
1) SSAE16/SysTrust
2) HIPAA
3) PCI DSS
4) FERPA
5) ISO 27001
6) NIST/FISMA
7) CJIS
| 8) Other | Medium | |||
| Disaster Recovery and Business Continuity | DR-1 | Do you have a disaster recovery plan (DRP) and a business continuity plan (BCP) for all systems and business processes supporting Chatham County Data? | Medium | |
| DR-2 | Have you tested the BCP and DRP for the services provided to Chatham County? | Low | ||
| DR-3 | What is your expected recovery time objective (RTO) and recovery point objective (RPO)? | Low | ||
| DR-4 | Data back-up schedule needs to be provided. | Low |
File details come from the government source that posted it. Updated .