41NHA-S3992 - PEBP - Attachment 4.6.4. - Cloud Hosting Questionnaire.xlsx
XLSX spreadsheet 23 KB Posted
- Attached to
- Nevada State Pharmacy Benefit Manager
- Solicitation number
- 41NHA-S3992
- Issued by
- Nevada
About this file
This document is a Cloud Hosting Questionnaire (Attachment 4.6.4) for the Nevada Health Authority's (NVHA) procurement of a Pharmacy Benefit Manager (PBM) solution under RFP 41NHA-S3992 for the Public Employees Benefits Program (PEBP). The questionnaire is designed to evaluate how offerors will meet NVHA and State of Nevada security requirements for cloud-hosted PBM services. Rather than restating all mandatory Statement of Work requirements, the questionnaire focuses on architecture, implementation approach, and security risk validation. Responses must address the exact service offering proposed for NVHA/PEBP, and offerors are required to provide concise answers in the designated Answer column, with documentation either included in the proposal or identified for later submission. The questionnaire aligns with SOW Section 26 (Security & IT Solutions requirements), State of Nevada cloud baseline S.5.06.01, GovRAMP compliance requirements, and applicable State cloud third-party risk and authorization management protocols.
The questionnaire comprehensively addresses security and privacy, identity management, vulnerability and application security, logging and incident response, availability and continuity, and system integration requirements specific to PBM operations. Key areas of focus include data segregation and protection (at rest, in transit, and during loss prevention), GovRAMP status and independent security assurance documentation, multi-factor authentication and role-based access controls, vulnerability management with remediation timeframes (15 days for Critical, 30 days for High, 90 days for Medium), incident notification within 24 hours of discovery, business continuity and disaster recovery with defined RTO/RPO objectives, and controls over claims processing, eligibility data, member digital services, reporting exports, and AI/machine-learning functionality. The questionnaire emphasizes that all personnel accessing NVHA data must operate within the United States unless specifically approved in writing, and that NVHA data cannot be used for secondary purposes such as marketing, profiling, research, product development, or AI training without explicit written authorization. Offerors must also demonstrate transition and portability capabilities to ensure NVHA data, configurations, and audit records can be transferred to a successor contractor at contract end.
View the file
Other files
Show all 22
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions & Sources NVHA PEBP PBM Cloud Hosting Questionnaire - Instructions & Sources
| Item | Guidance |
| Purpose | Attachment 4.6.4 is intended to collect information needed to evaluate the proposed PEBP PBM cloud solution and validate how the offeror will meet NVHA and State security requirements. It is not intended to restate every mandatory SOW requirement. |
| How to respond | Provide concise responses in the Answer column. Where a question requests documentation, identify the document and include it with the proposal or indicate when it will be provided. Responses should apply to the exact service offering proposed for NVHA/PEBP. |
| Relationship to SOW | Section 26 of the SOW contains the mandatory Security & IT Solutions requirements. This questionnaire focuses on architecture, implementation approach, evidence, and areas where NVHA needs enough detail to evaluate security risk and readiness. |
| GovRAMP | Cloud-hosted services must comply with the State of Nevada Cloud Third-Party Risk and Authorization Management Program and applicable GovRAMP verification, authorization, continuous-monitoring, reporting, and remediation requirements. Offerors should identify the exact proposed product/service and current GovRAMP status. |
| State cloud baseline | State of Nevada S.5.06.01 establishes baseline cloud expectations including applicable State/Federal requirements, risk assessment, MFA, least privilege, encryption, data-location protections, and agency ISO review. |
| Avoid duplication | Where the SOW already imposes a specific requirement (for example security-incident notification or vulnerability-remediation timeframes), the questionnaire asks the offeror to confirm capability and explain implementation rather than restating the full contract language. |
| Primary references | PEBP PBM SOW Sections 2, 6-8, 10-16, and 20-27; State of Nevada S.5.06.01 Cloud Services; applicable Nevada Cloud Third-Party Risk and Authorization Management / GovRAMP requirements; NVHA security and privacy requirements. |
| PBM-specific focus | Because this procurement supports PEBP pharmacy benefits for public employees, retirees, and dependents, responses should account for PHI/PII, real-time point-of-sale claims, eligibility and accumulator data, prior authorizations, retail/mail/specialty pharmacy services, member portals/mobile apps, help-desk and call-center records, manufacturer assistance and value-based purchasing arrangements, reporting, and continuity of pharmacy services. |
Cloud Hosting Questionnaire
| RFP 41NHA-S3992 | |||
| NVHA PEBP PBM RFP Attachment 4.6.4. - Cloud Hosting Questionnaire | |||
| Area | Topic | Specific concerns | Answer |
| Security and Privacy | Data segregation | How will you separate and segregate NVHA data from other customers' data, including production, backup, replication, development, test, and reporting environments? | |
| Data-at-rest protection | Where will NVHA data be stored, including primary, backup, archive, and disaster-recovery locations? Identify the cloud provider(s) and U.S. region(s). | ||
| What encryption standards are used for NVHA data at rest, and how are encryption keys generated, stored, rotated, and protected? | |||
| Data-in-transit protection | How will NVHA data be securely transmitted between NVHA, the PBM solution, pharmacies, providers, member-facing digital services, financial institutions, and other authorized contractors or third parties? Identify supported secure transfer methods and protocols. | ||
| How are APIs, interfaces, and file transfers authenticated, authorized, encrypted, validated, and monitored? | |||
| Other data protection | What data loss prevention, exfiltration detection, or bulk-export controls are available for sensitive data? | ||
| Identify any subcontractor, subprocessor, hosting provider, affiliate, specialty/mail pharmacy, call-center provider, or other third party that may access, process, store, transmit, or support NVHA data, and describe the access provided. | |||
| How do you enforce NVHA's restriction against secondary use of NVHA data, including marketing, profiling, independent research or analytics, product development or improvement, or AI/model training without written authorization? | |||
| Describe data retention, legal hold, return, and secure destruction capabilities, including backups, archives, extracts, and subcontractor-held copies. | |||
| GovRAMP and Assurance | GovRAMP | Identify the exact proposed cloud service offering and its current GovRAMP status. Provide the applicable GovRAMP listing or supporting documentation. | |
| If the proposed offering does not currently hold the GovRAMP status required by Nevada, describe your plan and timeline to meet the applicable State on-ramp, assessment, continuous-monitoring, and remediation requirements. | |||
| Confirm that the GovRAMP scope covers the same service, hosting environment, regions, and material third-party dependencies proposed for NVHA. Identify any differences. | |||
| Independent assurance | Provide the most recent security assurance documentation applicable to the proposed solution (e.g., SOC 2 Type II, HITRUST, penetration-test summary, or equivalent). Identify the scope and period covered. | ||
| Describe any material findings, exceptions, or open corrective actions from recent independent assessments that affect the proposed service. | |||
| Security documentation | Confirm that you can provide the System Security Plan or equivalent, Incident Response Plan, BCP/DR plans, current architecture and data-flow diagrams, vulnerability and secure-development documentation, material third-party inventory, and GovRAMP evidence/status required by the SOW. | ||
| Identity Management | Authentication and SSO | Can the solution integrate with NVHA identity services for SSO? Identify supported standards (e.g., SAML 2.0/OIDC) and provisioning capabilities. | |
| How is MFA enforced for remote access, privileged/administrative access, and access to systems containing PHI or PII? | |||
| Access control | Describe role-based access controls and how least privilege and minimum necessary are enforced for NVHA/PEBP, vendor, call-center, clinical, pharmacy, and technical users. | ||
| How are user accounts provisioned, modified, periodically reviewed, and promptly disabled following termination, reassignment, or loss of business need? | |||
| How are privileged, service, API, and other non-human accounts controlled, monitored, and credentialed? | |||
| Personnel security | Describe background screening, security/privacy training, confidentiality requirements, and access authorization for personnel with access to NVHA systems or data. | ||
| Confirm that personnel performing contracted services or accessing, processing, transmitting, storing, administering, or supporting NVHA data will operate within the United States unless specifically approved in writing by NVHA. Identify any proposed exception. | |||
| Vulnerability and Application Security | Vulnerability management | Provide an overview of your vulnerability management program, including infrastructure, applications, APIs, libraries, dependencies, and cloud configuration. | |
| How frequently are vulnerability scans and security assessments performed? | |||
| Describe your remediation process and confirm your ability to meet the SOW maximum remediation timeframes of 15 days for Critical, 30 days for High, and 90 days for Medium vulnerabilities. | |||
| How are exceptions handled when a vulnerability cannot be remediated within the required timeframe, including compensating controls and corrective action plans? | |||
| Penetration testing | How often is independent penetration testing performed, what is included in scope, and can you provide the most recent executive summary and remediation status? | ||
| Describe the process by which NVHA or its authorized assessor may review, validate, conduct, or coordinate security testing of the proposed solution. | |||
| Secure configuration | What hardening standards or secure configuration baselines are used, and how are unnecessary services, ports, protocols, default accounts, and insecure configurations controlled? | ||
| Application security | Describe your secure software development lifecycle, including code review, security testing, dependency management, secrets management, and release controls. | ||
| How do you address OWASP application and API security risks and third-party/open-source software vulnerabilities? | |||
| Change management | How are material software, infrastructure, hosting, integration, third-party, or security-control changes evaluated, tested, approved, documented, and communicated to NVHA before implementation? | ||
| How are development, testing, training, and production environments separated, and under what circumstances, if any, is NVHA production data used outside production? | |||
| Logging, Monitoring and Incident Response | Audit logging | What user access, authentication, privileged activity, administrative actions, configuration changes, API/interface activity, and data-access events are logged? | |
| What information is captured in audit logs, how long is it retained, and how are logs protected from unauthorized modification or deletion? | |||
| How can NVHA obtain relevant audit logs or reports for investigation, compliance, oversight, and audit purposes? | |||
| Monitoring | Describe continuous security monitoring and threat-detection capabilities, including detection of unauthorized access, anomalous behavior, malicious activity, and indicators of compromise. | ||
| Incident response | Describe your incident response process and escalation procedures for incidents affecting NVHA systems, operations, or data. | ||
| Confirm your ability to notify NVHA of an actual or suspected security incident without unreasonable delay and no later than 24 hours after initial discovery, and to provide progressive updates without waiting for investigation completion. | |||
| How will you preserve evidence, support forensic analysis, cooperate with NVHA and regulatory/legal activities, and provide root-cause and corrective-action information following an incident? | |||
| How are incidents involving subcontractors, subprocessors, hosting providers, or other third parties incorporated into your notification and response process? | |||
| Availability and Continuity | Availability | State the proposed availability SLA for mission-critical PEBP PBM components, describe how availability is measured, and explain how the proposed service levels align with the SOW and Performance Guarantee requirements. | |
| Describe redundancy, capacity management, DDoS protection, fault tolerance, and other measures used to maintain availability of pharmacy claim processing, member-facing services, and related PBM functions. | |||
| Describe planned-maintenance procedures, standard notification lead times, emergency-maintenance handling, and measures used to minimize impact to PEBP members and pharmacy operations. | |||
| Describe outage notification and escalation procedures, including how operational outages are distinguished from or escalated as potential security incidents and how NVHA will receive timely status updates. | |||
| Business continuity / disaster recovery | Provide the RTO and RPO proposed for the PBM claims platform and other mission-critical components, including eligibility, prior authorization, member-facing services, mail/specialty pharmacy operations, and reporting. | ||
| How frequently are BCP/DR plans tested, and can you provide the most recent test results, identified gaps, and remediation status? | |||
| Describe backup protections, including encryption, access restrictions, immutability/isolation, restoration testing, and ransomware recovery capabilities. | |||
| How will the solution maintain pharmacy claim adjudication, eligibility, accumulators, prior authorization, member support, and other critical PEBP PBM services during a major outage, cyber incident, or regional disruption? | |||
| PEBP PBM System and Integrations | PBM architecture | Provide a high-level description of the proposed PBM architecture, system boundaries, hosting model, major components, and shared-security responsibilities. | |
| External connections | Identify external systems and organizations that will connect to the solution, including NVHA/PEBP, pharmacies, switches/clearinghouses, providers, medical administrators, eligibility or accumulator contractors, navigation or care-management contractors, specialty or mail pharmacy partners, reporting contractors, HR systems, financial institutions, and other authorized third parties. Describe the connection method for each. | ||
| Claims and eligibility | Describe security controls protecting real-time POS claim adjudication, eligibility and accumulator data, prior authorization data, and pharmacy/member data throughout processing. | ||
| PBM configuration | How are changes to claims-processing rules, pricing, benefit configuration, formulary or clinical edits, member cost-sharing, overrides, prior-authorization logic, and other sensitive PBM configuration restricted, approved, priced where applicable, tested, and audited? | ||
| Transaction traceability | Can an individual claim or prior-authorization transaction be traced end-to-end, including user/service activity, interfaces, edits, overrides, decisions, and configuration changes that affected the result? Describe the audit trail available to NVHA. | ||
| Member digital services / help desk | Describe controls protecting member portals/mobile apps, secure messaging, shipment notifications, call recordings, case notes, emails, faxes, portal inquiries, and other service records containing NVHA data, including authentication, access, disclosure minimization, retention, monitoring, and secure disposal. | ||
| Reporting and exports | Describe controls over ad hoc reports, scheduled reports, analytics extracts, bulk downloads, manufacturer-assistance or value-based purchasing data exchanges, and other exports containing NVHA data, including how authorized recipients and minimum-necessary data are enforced. | ||
| AI / automated decision support | Identify any AI, machine-learning, predictive analytics, generative AI, algorithmic decision-making, or automated decision-support functionality used in the proposed solution or contracted services, including prior authorization, care coordination, clinical analytics, or member/service functions. Describe its purpose, data use, human oversight, auditability, and third-party providers. | ||
| Confirm that NVHA data will not be used to train, retrain, fine-tune, or improve an AI/ML model without express written authorization and describe the technical and contractual controls used to enforce this restriction. | |||
| Transition and portability | Describe how NVHA data, configurations, claims history, prior authorizations, audit records, reporting data, and integration information can be exported and transferred to NVHA or a successor contractor at contract end without service disruption. Include how user, privileged, service, API, file-transfer, certificate, token, key, and other access mechanisms are revoked or transitioned when no longer required. |
File details come from the government source that posted it. Updated .