8-RFP-26-00336 Vendor Security Outsourcing Questionnaire.xlsx
XLSX spreadsheet 29 KB Posted
- Attached to
- Integrated Technical Resources Hub
- Solicitation number
- RFP-26-00336
- Issued by
- Hillsborough County, Florida
About this file
This is a Vendor Security Outsourcing Questionnaire for the Hillsborough County Board of County Commissioners in Florida, related to the procurement of a cloud-hosted integrated technical resources hub for the Development Services Department. The questionnaire serves as a security compliance evaluation tool to assess vendor capabilities and readiness to handle sensitive county data. The three-year contract is valued at $194,150.00 and requires vendors to demonstrate comprehensive security postures across infrastructure, data management, access controls, and incident response capabilities.
The questionnaire requires vendors to address 40 detailed general security questions and 34 specific security requirements aligned with NIST SP 800-53 standards and national security frameworks. Key requirements include mandatory data residency in the continental United States, encryption of data in transit and at rest, integration with Hillsborough County's Azure Identity Management system, annual third-party security assessments compliant with SSAE16 SOC 2 or FedRAMP standards, and background screening of all personnel with access to sensitive information. Vendors must also comply with applicable federal regulations including HIPAA, FERPA, IRS Publication 1075, FBI/CJIS standards, and if applicable, submit to FBI fingerprinted background checks and execute CJIS Security Addendum agreements. The questionnaire establishes that Hillsborough County retains sole ownership of all data, maintains audit rights, and requires secure data destruction processes consistent with DOD 5015.2 standards upon contract termination.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 3-Substitute W9 Form.pdf.pdf | ||
| 4-Direct Deposit Authorization Form 5.15.2025.pdf.pdf | ||
| 5-RFP-26-00336 Insurance Requirements.pdf | ||
| 2-Insurance Certificate.doc.doc | DOC document | |
| 10-RFP-26-00336 AI Security Questionnaire.xlsx | XLSX spreadsheet | |
| 6-RFP-26-00336 Attachment A - Cybersecurity Requirements.pdf | ||
| 1-Drug Free Workplace Form.doc.doc | DOC document | |
| 9-RFP-26-00336 Integrated Technical Resources Hub.pdf | ||
| 7-RFP-26-00336 Vendor Security Software Questionnaire.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Syst. & Serv. Acquisition P&P
VENDOR SECURITY & COMPLIANCE QUESTIONNAIRE - OUTSOURCED
Name: Email: Phone: Date:
Company Name: Company Website:
| Company Address: | ||||
| PLEASE PLACE AN "X" IN EITHER YES, NO, OR N/A AND PLEASE PROVIDE COMMENTS AS YOU DEEM APPROPRIATE | YES | NO | N/A | Comments |
| General Questions | ||||
| G1. Do you have staff dedicated to physical and/or information technology security? Please explain. | ||||
| G2. What type of interfaces do you support? Do you have documentation? | ||||
| G3. What is the reliability/uptime of your environment (do you meet the 5 9's)? (Please add comments) | ||||
| G4. Is there regularly scheduled downtime for maintenance? If so, what is that timeframe? | ||||
| G5. Can you share your backup and recovery procedures? | ||||
| G6. Can you share your disaster plan with us and is it tested? | ||||
| G7. What is your privacy policy? (Please add comments) | ||||
| G8. Can you provide your physical security policies? | ||||
| G9. Please describe the layers of security to the physical access to the servers that Hillsborough County data would reside on. | ||||
| G10. Is Hillsborough County allowed to do periodic site visits to see the physical structure? | ||||
| G11. Do the servers reside, that are hosting and backing up the software, on shore? | ||||
| G12. Is there a government certified cloud? | ||||
| G13. What is your policy for background check for your employees? Who has access to sensitive information? | ||||
| G14. How do you enforce security processes for integrations with third parties? | ||||
| G15. Is there a certification process to ensure that third party applications are secure and won't allow intruders to get into your environment through one of these partners? | ||||
| G16. How do you protect sensitive data in storage infrastructure? | ||||
| G17. What audit logs are available? | ||||
| G18. How is the data encrypted? Is it encrypted at rest, in transition, and for disposition? | ||||
| G19. What type of encryption do you use for the transfer of information (via emails, etc.) | ||||
| G20. What are your layers of security (including network, application, etc.)? | ||||
| G21. What devices are you using to stop intruders from getting in through your perimeter? | ||||
| G22. Do you have strong network firewalls? How are they kept updated? | ||||
| G23. How do you monitor events? | ||||
| G24. Do you have a SIEM or Log Management software in place? | ||||
| G25. What security process do you have for your virtualization environment? | ||||
| G26. How are you testing for vulnerabilities and fixing them? | ||||
| G27. What type of standards are you following for Access control? | ||||
| G28. How is the provisioning of users done? | ||||
| G29. Who manages the credential management process? | ||||
| G30. How much control will Hillsborough County have? | ||||
| G31. How is the secure login handled? Is there a dedicated VPN? | ||||
| G32. Is there a federated identity process and how is that managed? Hillsborough County uses Azure. | ||||
| G33. Can open ID's be used for registration and authentication? | ||||
| G34. Does security ownership transfer to the infrastructure provider? How do you ensure protection against key vulnerabilities like XSS, SQL injection, CSRF, Session Management, etc.? | ||||
| G35. What happens in case of a breach? Who's responsible? | ||||
| G36. Do you use vulnerability scanning tools and services to find vulnerabilities with the infrastructure environment? | ||||
| G37. What is the process of remediating or blocking those vulnerabilities? | ||||
| G38. Will you allow Hillsborough County to run our own vulnerability assessment tools? We currently have CISA running weekly vulnerability tests on our IP addresses. | ||||
| G39. What type of encryption is applied to related mobile apps (if any)? | ||||
| G40. Can you provide three customer IT department references that we can contact? | ||||
| Security Requirements - Where applicable national standard references are included | ||||
| 1. An information security policy based on industry acceptable standards and frameworks, is in place, has been approved by management and has been communication to employees, contractors, and individuals on behalf of the organization. (NIST SP 800-53 Access Control) | ||||
| 2. Security roles and responsibilities of employees, contractors, and individuals working on behalf of the organization are defined and documented in accordance with the organizations information security policy. (NIST SP 800-53 Access Control) | ||||
| 3. An information security awareness and training program has been established and routinely provides general awareness and role specific (e.g., secure coding, CJIS, etc.) security training to all employees. (NIST SP 800-53 Awareness and Training) | ||||
| 4. Background screenings of employees, contractors and individuals working on behalf of the organization are performed to include criminal, credit, professional / academic, references and drug screenings. (NIST SP 800-53 Personnel Security) | ||||
| 5. The organization will (1) locate all production and disaster recovery data centers that store, process, or transmit Hillsborough County data only in the continental United States, (2) store, process and transmit Hillsborough County data only in the continental United States, and (3) locate all monitoring and support of all the cloud computing or hosting services only in the continental U.S. (Hillsborough County Policy) | ||||
| 6. The system/solution/service provides password protection and security controls to prevent unauthorized access to or use of the system, data, and images. Proposed system solutions will ensure Industry best practices for security architecture & design. (NIST SP 800-53 Configuration Management) | ||||
| 7. The system/solution/service has capability to integrate with the Hillsborough County’s Identity Management system. (Azure) (NIST SP 800-53 Identification and Authentication) | ||||
| 8. No data of any kind shall be transmitted, exchanged or otherwise passed to or accessed by other vendors or interested parties except on a case-by-case basis as specifically agreed to in writing by the Hillsborough County. |
(NIST SP 800-53 System and Communications Protection)
| 9. The system/solution/service will encrypt sensitive data in transit and at rest using industry standard encryption protocols. (NIST SP 800-53 System and Communications Protection) |
| 10. All data will be stored, processed, and maintained solely on designated servers and that no data at any time will be processed on or transferred to any portable or laptop computing device or any portable storage medium, unless that storage medium is in use as part of the organization’s designated backup and recovery processes. |
(NIST SP 800-53 Media Protection)
11. All Information systems will be configured to industry security best practices (e.g., CIS, NIST, etc.).
(NIST SP 800-53 Configuration Management)
| 12. Anti-Malware and anti-virus software will be installed, running and maintained on all systems. Which ones do you use? (NIST SP 800-53 System and Information Integrity) |
| 13. All physical access to information systems will be controlled and restricted to only those with a need to physically access these systems. (NIST SP 800-53 Maintenance) |
| 14. The system/solution/service will be developed according to secure software development best practices (e.g., OWASP, etc.). (NIST SP 800-53 System and Services Acquisition) |
| 15. Automated and manual software assurance assessment, testing and remediation processes are in place to detect security flaws in the underlying application code that could pose security risks. Can you provide your risk assessment methodology? (NIST SP 800-53 System and Information Integrity) |
| 16. An Annual third party physical and environmental security assessment is conducted of computing environment (i.e. data center) including where members of staff will access Hillsborough County information and resources (Can you provide us with the results of any physical security assessments which have been conducted)? |
(NIST SP 800-53 Physical and Environmental Protection)
17. The system/solution/service’s storage processes, backup storage processes, and security procedures being implemented ensure that there is no loss of data or unauthorized access to the data.
(NIST SP 800-53 Access Control)
18. Firewalls are in place at the network perimeter and between the internal network segment and any DMZ.
(NIST SP 800-53 System and Communications Protection)
19. Systems and applications are patched in a timely manner to ensure critical security and operational patches and fixes are in place to ensure the confidentiality, integrity and availability of the information system.
(NIST SP 800-53 System and Information Integrity)
20. Vulnerability tests (internal/external) are performed on all applications and platforms.
(NIST SP 800-53 Security Assessment and Authorization)
| 21. Online transactions must conform to reasonable commercial security standards and measures. Temporary files for all secure online transactions must be securely and permanently deleted when said transaction is complete. |
| 22. The system/solution/service will comply with the National Institute of Standards and Technology (NIST) Recommended Security Controls for Federal Information Systems and Organizations, Special Publication 800-53 revision 4, for Moderate systems. |
| 23.Independent Security audits of the system/solution/service, processes and data centers used to provide the services/solution are conducted at least annually. Audits are performed in accordance to SSAE16 SOC 2 or equivalent (e.g. FedRAMP) industry security standards. (NIST SP 800-53 Security Assessment and Authorization and Physical and Environmental Protection) |
| 24. The organization will maintain business continuity processes and plans and will provide Hillsborough County with a detailed disaster recovery continuity of operations plan as part of their response. |
(NIST SP 800-53 Contingency Planning)
| 25. The proposal must provide a detailed explanation of the security features that are built into the proposed system/solution/service. |
| 26. The vendor and system/solution/product/ service/proposal will comply with the requirements of the any applicable federal laws/regulations (e.g., HIPAA, FERPA, IRS Publication 1075, FBI/CJIS, SOX, FISMA)? |
| 27. If Federal, state or industry compliance requirements pertain to the data (e.g. CJI, IRS 1075, PHI (HIPAA), SSA, PCI, Etc.) the system/solution/service will comply with the said security policy and industry best practice. |
| 28. If CJI is in scope, organization staff (including employees, contractors and individuals working on behalf of the organization) that come in contact with CJI will pass an FBI fingerprinted background check and sign the FBI/CJIS Security Addendum/ Certification agreement. (CJIS 5.5 compliance) |
| 29. All data received from the Hillsborough County or created, collected or otherwise obtained as part of this agreement will be owned solely by the Hillsborough County and all access, use and disclosure of the data shall be restricted to only that which is required to perform the organization’s duties under this agreement. |
| 30. Processes will be in place to securely destroy or delete Hillsborough County data according to the standards enumerated in D.O.D. 5015.2 from systems or media no longer being used to fulfill the terms of this agreement or upon request from the Hillsborough County. |
| 31. In the event of termination of the agreement, the organization shall implement an orderly return of Hillsborough County assets and the subsequent secure disposal of Hillsborough County assets. |
During any period of suspension, the organization will not take any action to intentionally erase any Hillsborough County Data.
| 32. An incident response plan is in place which includes notifying the Hillsborough County immediately of a known or suspected security or privacy incident involving Hillsborough County Data. (NIST SP 800-53 Incident Response) |
| 33. Do you possess SSAE Certification? |
| 34. Do you permit Hillsborough County the right to audit this information as well as other related security information? |
&F
File details come from the government source that posted it. Updated .