4-RFP26001 EXHIBIT A-2.docx
DOCX document 27 KB Posted
- Attached to
- CAMA and Property Tax System
- Solicitation number
- RFP 26001
- Issued by
- Ada County, Idaho
About this file
This document is an Exhibit A-2 I.T. Questionnaire, likely associated with Ada County, Idaho's procurement of a Computer-Assisted Mass Appraisal (CAMA) and Property Tax System. The comprehensive security questionnaire is designed to assess potential vendors' cybersecurity practices, data protection protocols, and overall security posture for a software implementation project. The document is structured to gather detailed information across multiple security domains, including general vendor information, security policies, data protection, access control, network infrastructure security, incident response, compliance, and additional vendor capabilities.
The questionnaire does not specify exact pricing terms, but it indicates a rigorous vendor qualification process that requires extensive documentation of security practices, compliance certifications, and risk management protocols. Vendors must demonstrate capabilities in areas such as data encryption, multi-factor authentication, vulnerability management, incident response planning, and adherence to data protection regulations. The document suggests that while comprehensive security responses are crucial, they will not automatically disqualify vendors, but will be carefully evaluated to ensure alignment with the county's security standards and operational requirements for the CAMA and Property Tax System implementation.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 2-RFP26001 Proposal Response Cover Sheet.pdf | ||
| 1-RFP26001 Specifications.pdf | ||
| 3-RFP26001 EXHIBIT A-1.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
EXHIBIT A-2
I.T. QUESTIONNAIRE
1 Opening Statement Thank you for your interest in partnering with us. As part of our commitment to maintaining a secure environment for our customers, employees, and business operations, we kindly request your cooperation in completing this security questionnaire. Your responses will help us assess your security practices and ensure alignment with our security standards. We understand that each organization's cybersecurity posture is unique, and we respect the diversity of approaches taken to ensure security. Your answers, or lack thereof, will not disqualify you from being considered as a potential vendor; instead, they will be taken into careful consideration, reflecting our dedication to fostering transparency, collaboration, and a shared commitment to enhancing security practices. Please provide detailed and accurate information for each question. If a question is not applicable, please indicate so. Your cooperation is highly appreciated.
2 General Information
2.1 Vendor Information
a. Vendor Name:
b. Contact Name:
c. Contact Email:
d. Contact Phone Number:
e. Physical Address:
2.2 Business Background
| a. Briefly describe your company’s core product/services: |
| b. Will your product/service be hosted on-premises, or provided as a SaaS Solution? |
| c. In the event of troubleshooting/maintenance, will you need remote access or a maintenance call? |
| d. How many years has your company been in operation? |
| e. Do you have any industry certifications or accreditations related to security? If yes, please specify: |
3 Security Policies and Procedures
3.1 Security Policies
a. Do you have documented security policies and procedures? If yes, please provide a summary or attach relevant documentation:
| b. How frequently are your security policies reviewed and updated? |
| c. Do you have a password policy? If yes, please list the requirements you enforce. |
3.2 Data Protection/Access
a. Do you collect, store, or transmit personally identifiable information (PII)?
b. Is PII stored on-premises or in a cloud location? If applicable, what geographic location do you use when storing PII?
c. Can PII be accessed remotely? If yes, please provide details:
d. What types of devices do your users use to collect, store, or transmit PII from?
e. How do you provide users access to PII?
f. How do you ensure the confidentiality, integrity, and availability of sensitive data belonging to your customers and partners?
| g. Describe your data retention and disposal practices: |
| h. Do you monitor all devices connected to systems, software, and networks? |
| i. Do you encrypt data-at-rest and in-transit? If yes, please provide details: |
| j. Is multi-factor enforced for authentication? |
| k. Do you limit the access according to the principle of least privilege? |
4 Access Control
4.1 User Access
| a. How do you manage user access to your systems and data? |
| b. Do you implement role-based access control? If yes, please describe: |
4.2 Authentication and Authorization
| a. What methods of authentication do you employ for accessing your systems and applications? |
| b. How do you handle user authorization and privilege escalation? |
5 Network and Infrastructure Security
5.1 Security Applications and Tools
a. Do you utilize firewalls and intrusion detection/prevention systems to protect your network? If yes, please provide details:
b. Do you install and manage antimalware and endpoint security on all devices?
c. Do you utilize a VPN for all your remotely connected devices?
5.2 Vulnerability Management
| a. How do you identify and address vulnerabilities in your systems and applications? |
| b. How often do you conduct security assessments, such as vulnerability scans and penetration tests? |
| c. Do you have a decommissioning process for end-of-life product? If yes, please provide details. |
d. How do you secure web applications from SQL injection and cross-site scripting attacks?
e. How do you monitor for DDoS attacks?
f. Do you use TLS and SSH certificates to ensure data exchanges are secure?
g. Do you work with third-party vendors? If yes, how do you assess their security posture?
6 Incident Response and Business Continuity
6.1 Incident Response
| a. Do you have an incident response plan and team? |
| b. How often do you test your incident response process? |
| b. Describe your process for detecting, reporting, and responding to security incidents: |
| c. Have you experienced any significant security breaches in the past? If yes, please provide details: |
6.2 Business Continuity
a. How do you ensure business continuity in the event of a security incident or other disruptions?
b. Do you incorporate DDoS and other cyber-attacks as part of your business continuity plan?
c. What is your maintenance schedule for updating/patching, is there a possibility of downtime?
7 Compliance and Auditing
7.1 Compliance
| a. Are you compliant with relevant data protection and privacy regulations? If yes, please specify: |
| b. Have you undergone any third-party security audits or assessments? If yes, please provide details: |
7.2 Contractual Obligations
a. Are you willing to sign a security agreement that outlines your commitment to maintaining a secure environment for our partnership?
8 Interfacing with the Software
8.1 Reporting
a. Is there the ability to do Ad-Hoc reporting? If yes, what reporting tools are required?
8.2 Database Access
a. If the software is delivered as on-prem, can we query the database directly?
b. If the software is delivered as SaaS, do you have any APIs that can be used to query the database? Is there documentation for these APIs?
9 Additional Information
9.1 References
a. Can you provide references from other clients whom you have worked in a similar capacity?
9.2 Insurance
| a. Do you carry cybersecurity insurance coverage? If yes, please provide details: |
| b. Do you have a vendor risk management program? If yes, please provide details: |
9.3 Security Training
a. Do you provide security awareness training to your employees? If yes, please describe the training program:
EXHIBIT A-2 – PAGE 1
File details come from the government source that posted it. Updated .