41NHA-S3992 - sPBM - Attachment 4.5.4. - Cloud Hosting Questionnaire.xlsx
XLSX spreadsheet 23 KB Posted
- Attached to
- Nevada State Pharmacy Benefit Manager
- Solicitation number
- 41NHA-S3992
- Issued by
- Nevada
About this file
This document is a Cloud Hosting Questionnaire (Attachment 4.5.4) issued by the Nevada Health Authority (NVHA) as part of RFP 41NHA-S3992 for a Nevada State Pharmacy Benefit Manager (PBM) contract. The questionnaire is designed to evaluate proposed PBM cloud solutions and validate offeror compliance with NVHA and State of Nevada security requirements. Rather than restating all mandatory Scope of Work (SOW) requirements, the questionnaire focuses on architecture, implementation approach, and areas requiring sufficient detail for NVHA to evaluate security risk and readiness. Offerors must provide concise responses addressing specific concerns across nine primary areas: Security and Privacy, GovRAMP and Assurance, Identity Management, Vulnerability and Application Security, Logging/Monitoring and Incident Response, Availability and Continuity, PBM System and Integrations, and Transition and Portability. The questionnaire explicitly addresses PBM-specific requirements including protection of Protected Health Information (PHI) and Personally Identifiable Information (PII), real-time point-of-sale claims processing, eligibility and prior authorization data, integration with MCOs/pharmacies/providers, and continuity of pharmacy services.
Responses must demonstrate compliance with State of Nevada baseline cloud expectations established in S.5.06.01, applicable GovRAMP verification and authorization requirements, and mandatory SOW sections covering security, privacy, availability, incident notification, and vulnerability remediation timeframes (15 days for Critical, 30 days for High, 90 days for Medium vulnerabilities). Offerors must confirm the ability to meet SOW minimums including 99.9% monthly availability, 24-hour security incident notification, and provide documentation such as System Security Plans, Incident Response Plans, Business Continuity/Disaster Recovery plans, current architecture diagrams, vulnerability management documentation, and independent security assurance documentation (SOC 2 Type II, HITRUST, or equivalent). The questionnaire requires specific detail on data segregation across production/backup/test environments, encryption standards for data at rest and in transit, MFA enforcement, role-based access controls, personnel security screening for U.S.-based personnel, continuous security monitoring, audit logging and retention, Business Continuity/Disaster Recovery Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), and restrictions on secondary use of NVHA data including prohibition of AI/ML model training without express written authorization.
View the file
Other files
Show all 22
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions & Sources NVHA PBM Cloud Hosting Questionnaire - Instructions & Sources
| Item | Guidance |
| Purpose | Attachment 4.5.4. is intended to collect information needed to evaluate the proposed PBM cloud solution and validate how the offeror will meet NVHA and State security requirements. It is not intended to restate every mandatory SOW requirement. |
| How to respond | Provide concise responses in the Answer column. Where a question requests documentation, identify the document and include it with the proposal or indicate when it will be provided. Responses should apply to the exact service offering proposed for NVHA. |
| Relationship to SOW | Section 14 of the SOW contains the mandatory Security & IT Solutions requirements. This questionnaire focuses on architecture, implementation approach, evidence, and areas where NVHA needs enough detail to evaluate security risk and readiness. |
| GovRAMP | Cloud-hosted services must comply with the State of Nevada Cloud Third-Party Risk and Authorization Management Program and applicable GovRAMP verification, authorization, continuous-monitoring, reporting, and remediation requirements. Offerors should identify the exact proposed product/service and current GovRAMP status. |
| State cloud baseline | State of Nevada S.5.06.01 establishes baseline cloud expectations including applicable State/Federal requirements, risk assessment, MFA, least privilege, encryption, data-location protections, and agency ISO review. |
| Avoid duplication | Where the SOW already imposes a specific requirement (for example 24-hour security-incident notification, vulnerability remediation timeframes, or 99.9% availability), the questionnaire asks the offeror to confirm capability and explain implementation rather than restating the full contract language. |
| Primary references | PBM SOW Sections 1.3, 2.1, 4.4, 5.3, 7.5.4, 12.5, 14, 19.1, and 20; State of Nevada S.5.06.01 Cloud Services; applicable Nevada Cloud Third-Party Risk and Authorization Management / GovRAMP requirements; NVHA security and privacy requirements. |
| PBM-specific focus | Because this procurement supports Nevada Medicaid pharmacy operations, responses should account for PHI/PII, real-time point-of-sale claims, eligibility and prior authorization data, MCO/pharmacy/provider integrations, help-desk records, reporting, program-integrity needs, and continuity of pharmacy services. |
Cloud Hosting Questionnaire
| RFP 41NHA-S3992 | |||
| NV PBM RFP Attachment 4.5.4. - Cloud Hosting Questionnaire | |||
| Area | Topic | Specific concerns | Answer |
| Security and Privacy | Data segregation | How will you separate and segregate NVHA data from other customers' data, including production, backup, replication, development, test, and reporting environments? | |
| Data-at-rest protection | Where will NVHA data be stored, including primary, backup, archive, and disaster-recovery locations? Identify the cloud provider(s) and U.S. region(s). | ||
| What encryption standards are used for NVHA data at rest, and how are encryption keys generated, stored, rotated, and protected? | |||
| Data-in-transit protection | How will NVHA data be securely transmitted between NVHA, the PBM solution, pharmacies, MCOs, providers, and other contractors? Identify supported secure transfer methods and protocols. | ||
| How are APIs, interfaces, and file transfers authenticated, authorized, encrypted, validated, and monitored? | |||
| Other data protection | What data loss prevention, exfiltration detection, or bulk-export controls are available for sensitive data? | ||
| Identify any subcontractor, subprocessor, hosting provider, or third party that may access, process, store, transmit, or support NVHA data, and describe the access provided. | |||
| How do you enforce NVHA's restriction against secondary use of NVHA data, including marketing, independent analytics, product improvement, or AI/model training without written authorization? | |||
| Describe data retention, legal hold, return, and secure destruction capabilities, including backups, archives, extracts, and subcontractor-held copies. | |||
| GovRAMP and Assurance | GovRAMP | Identify the exact proposed cloud service offering and its current GovRAMP status. Provide the applicable GovRAMP listing or supporting documentation. | |
| If the proposed offering does not currently hold the GovRAMP status required by Nevada, describe your plan and timeline to meet the applicable State on-ramp, assessment, continuous-monitoring, and remediation requirements. | |||
| Confirm that the GovRAMP scope covers the same service, hosting environment, regions, and material third-party dependencies proposed for NVHA. Identify any differences. | |||
| Independent assurance | Provide the most recent security assurance documentation applicable to the proposed solution (e.g., SOC 2 Type II, HITRUST, penetration-test summary, or equivalent). Identify the scope and period covered. | ||
| Describe any material findings, exceptions, or open corrective actions from recent independent assessments that affect the proposed service. | |||
| Security documentation | Confirm that you can provide the System Security Plan or equivalent, Incident Response Plan, BCP/DR plans, current architecture and data-flow diagrams, vulnerability management documentation, and material third-party inventory required by the SOW. | ||
| Identity Management | Authentication and SSO | Can the solution integrate with NVHA identity services for SSO? Identify supported standards (e.g., SAML 2.0/OIDC) and provisioning capabilities. | |
| How is MFA enforced for remote access, privileged/administrative access, and access to systems containing PHI or PII? | |||
| Access control | Describe role-based access controls and how least privilege and minimum necessary are enforced for NVHA, vendor, call-center, clinical, and technical users. | ||
| How are user accounts provisioned, modified, periodically reviewed, and promptly disabled following termination, reassignment, or loss of business need? | |||
| How are privileged, service, API, and other non-human accounts controlled, monitored, and credentialed? | |||
| Personnel security | Describe background screening, security/privacy training, confidentiality requirements, and access authorization for personnel with access to NVHA systems or data. | ||
| Confirm that personnel performing contracted services or accessing, processing, administering, or supporting NVHA data will operate within the United States unless specifically approved by NVHA. Identify any proposed exception. | |||
| Vulnerability and Application Security | Vulnerability management | Provide an overview of your vulnerability management program, including infrastructure, applications, APIs, libraries, dependencies, and cloud configuration. | |
| How frequently are vulnerability scans and security assessments performed? | |||
| Describe your remediation process and confirm your ability to meet the SOW maximum remediation timeframes of 15 days for Critical, 30 days for High, and 90 days for Medium vulnerabilities. | |||
| How are exceptions handled when a vulnerability cannot be remediated within the required timeframe, including compensating controls and corrective action plans? | |||
| Penetration testing | How often is independent penetration testing performed, what is included in scope, and can you provide the most recent executive summary and remediation status? | ||
| Describe the process by which NVHA or its authorized assessor may conduct or coordinate security testing of the proposed solution. | |||
| Secure configuration | What hardening standards or secure configuration baselines are used, and how are unnecessary services, ports, protocols, default accounts, and insecure configurations controlled? | ||
| Application security | Describe your secure software development lifecycle, including code review, security testing, dependency management, secrets management, and release controls. | ||
| How do you address OWASP application and API security risks and third-party/open-source software vulnerabilities? | |||
| Change management | How are material software, infrastructure, hosting, integration, or security-control changes evaluated, tested, approved, and communicated to NVHA before implementation? | ||
| How are development, testing, training, and production environments separated, and under what circumstances, if any, is NVHA production data used outside production? | |||
| Logging, Monitoring and Incident Response | Audit logging | What user access, authentication, privileged activity, administrative actions, configuration changes, API/interface activity, and data-access events are logged? | |
| What information is captured in audit logs, how long is it retained, and how are logs protected from unauthorized modification or deletion? | |||
| How can NVHA obtain relevant audit logs or reports for investigation, compliance, program integrity, and audit purposes? | |||
| Monitoring | Describe continuous security monitoring and threat-detection capabilities, including detection of unauthorized access, anomalous behavior, malicious activity, and indicators of compromise. | ||
| Incident response | Describe your incident response process and escalation procedures for incidents affecting NVHA systems, operations, or data. | ||
| Confirm your ability to notify NVHA of an actual or suspected security incident no later than 24 hours after discovery and to provide ongoing updates without waiting for investigation completion. | |||
| How will you preserve evidence, support forensic analysis, cooperate with NVHA and regulatory/legal activities, and provide root-cause and corrective-action information following an incident? | |||
| How are incidents involving subcontractors, subprocessors, hosting providers, or other third parties incorporated into your notification and response process? | |||
| Availability and Continuity | Availability | State the proposed availability SLA for mission-critical PBM components and describe how availability is measured. Confirm ability to meet the SOW minimum of 99.9% monthly availability. | |
| Describe redundancy, capacity management, DDoS protection, fault tolerance, and other measures used to maintain availability of pharmacy claim processing and related services. | |||
| Describe planned-maintenance procedures and confirm ability to provide at least three calendar days' advance notice unless otherwise approved by NVHA. | |||
| Describe outage notification and escalation procedures, including the ability to report unplanned claims-system interruptions lasting 10 minutes or longer within four hours of discovery. | |||
| Business continuity / disaster recovery | Provide the RTO and RPO proposed for the PBM claims platform and other mission-critical components. | ||
| How frequently are BCP/DR plans tested, and can you provide the most recent test results, identified gaps, and remediation status? | |||
| Describe backup protections, including encryption, access restrictions, immutability/isolation, restoration testing, and ransomware recovery capabilities. | |||
| How will the solution maintain pharmacy claim adjudication, eligibility, prior authorization, and other critical services during a major outage or regional disruption? | |||
| PBM System and Integrations | PBM architecture | Provide a high-level description of the proposed PBM architecture, system boundaries, hosting model, major components, and shared-security responsibilities. | |
| External connections | Identify external systems and organizations that will connect to the solution, including NVHA, MCOs, pharmacies, switches/clearinghouses, providers, Surescripts, financial institutions, and other contractors. Describe the connection method for each. | ||
| Claims and eligibility | Describe security controls protecting real-time POS claim adjudication, eligibility-file ingestion, prior authorization data, and pharmacy/member data throughout processing. | ||
| PBM configuration | How are changes to claims-processing rules, pricing, benefit configuration, PDL/UM edits, overrides, prior-authorization logic, and other sensitive PBM configuration restricted, approved, and audited? | ||
| Transaction traceability | Can an individual claim or prior-authorization transaction be traced end-to-end, including user/service activity, interfaces, edits, overrides, decisions, and configuration changes that affected the result? Describe the audit trail available to NVHA. | ||
| Help desk / call center | Describe controls protecting call recordings, case notes, emails, faxes, portal inquiries, and other help-desk records containing NVHA data, including access, retention, monitoring, and secure disposal. | ||
| Reporting and exports | Describe controls over ad hoc reports, scheduled reports, analytics extracts, bulk downloads, and other exports containing NVHA data. | ||
| AI / automated decision support | Identify any AI, machine-learning, predictive analytics, generative AI, algorithmic decision-making, or automated decision-support functionality used in the proposed solution or contracted services. Describe its purpose, data use, human oversight, auditability, and third-party providers. | ||
| Confirm that NVHA data will not be used to train, retrain, fine-tune, or improve an AI/ML model without express written authorization and describe the technical/contractual controls used to enforce this restriction. | |||
| Transition and portability | Describe how NVHA data, configurations, claims history, prior authorizations, audit records, and other required records can be exported and transferred to NVHA or a successor contractor at contract end without service disruption. |
File details come from the government source that posted it. Updated .