Addendum - 3.pdf
PDF 147 KB Posted
- Attached to
- RFI No. DMS-2324-073
- Solicitation number
- RFI-08672
- Issued by
- Leon County, Florida
About this file
This document is an Addendum to a Request for Information (RFI) issued by the Florida Department of Management Services (DMS) for Governance, Risk, and Compliance (GRC) platform solutions under RFI No. DMS-23/24-073. The RFI seeks information from vendors on GRC platform solutions that could potentially be used by Florida state agencies and local governments. The addendum provides answers to 24 questions received from respondents, covering topics such as the anticipated procurement timeline, contract value, current vendors, pricing options, compliance standards, technical requirements, and hosting preferences. The RFI is for planning purposes only and does not represent a solicitation for offers, but the information gathered may be used to develop a future solicitation.
The RFI indicates that Florida does not currently have a GRC solution in place, but is interested in solutions that can support a federated, multi-tenant model to serve the state's approximately 35 agencies and 500 local governments. The state is seeking cloud-based solutions that can integrate with various other IT systems and data sources, and comply with state-specific cybersecurity and data management requirements. Respondents are asked to provide information on pricing structures, compliance standards, technical capabilities, and implementation approaches.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFI Addendum - 1.docx | DOCX document | |
| Addendum - 2.pdf | ||
| RFI - DMS-2324-073 - GRC Platform.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Governance, Risk, and Compliance Platform Solutions
Request for Information (RFI)
DMS-23/24-073
Addendum No. 3
DMS-23/24-073 Addendum No. 3 Page 2 of 5
RFI Addendum No. 3
Request for Information (RFI) No. DMS-23/24-073 is hereby amended, as noted below. Additions are underlined, and deletions are stricken; each respectively highlighted.
In the event of a conflict between previously released information and the information contained herein, the information herein shall control. The information included in this addendum is now made part of the RFI.
RFI No. DMS-23/24-073 is hereby amended as follows:
I. Provides answers to questions received on the following page.
REMAINDER OF PAGE INTENTIONALLY LEFT BLANK
DMS-23/24-073 Addendum No. 3 Page 3 of 5
REQUEST FOR INFORMATION NO.: DMS-23/24-073
Governance, Risk, and Compliance Platform Solutions
QUESTIONS AND ANSWERS
Note: All written questions are reproduced in the same format as submitted by the Respondent.
NO. QUESTION ANSWER
1.
If this RFI greenlights a solicitation, what is the estimated timeframe for procurement?
Not a solicitation for offer, the information gathered from this RFI may be used to develop a future solicitation.
2.
What is the anticipated contract value?
Unknown at this time
3.
Is there a current vendor providing these services? If so, how may I obtain copies of any incumbent contract documents?
No current vendor or solution in place at this time.
4.
Do you want information on our stance on pricing options or recommendations on the best way to price this type of solution?
Both.
5.
Will Department of Management Services be the administering this program for Florida agencies?
Yes.
6.
Based on the new platform, what are your expectations for the new GRC system?
See section III Goals of the RFI.
7.
Are you currently using any CSF? NIST?
FedRamp, low, med, or high? FISMA?
Complete listings and standards?
Yes, Chapter 60-GG2 Florida Administrative Code, the Cybersecurity Rule is based on NIST CSF. Additional requirements are detailed in section 282.318, Florida Statutes.
8.
Does any operational procedures exist today under the current system in use? Please explain?
We do not have a current solution in use today.
9.
What's the current GRC solution today?
There is not a current GRC solution.
DMS-23/24-073 Addendum No. 3 Page 4 of 5
10.
How are you currently testing your controls?
Manual sampling? Please explain?
Manual
11.
What are your scan tools? Vulnerability & Threat Management today?
Various tools throughout the enterprise
12.
Anything about the current environment you can share?
Federated model – solution needs to support multi-tenancy functionality
13. How many third party vendors do you service?
14. Please offer the SLA requirements on the new platform?
15 How many different office locations contain systems and data that are applicable?
Federated model – solution needs to support multi-tenancy functionality. There are approximately thirty-five agencies in scope. However, we would be interested in seeing information on solutions that could cover GRC for the entire state which would include around 500 local governments.
16 What is the number of system endpoints are in scope?
Unknown at this time, but there are approximately 100,000 employees that work for the State of Florida.
17 Is there a central location that manages all systems including the network?
Most, but not all network traffic routes through the State Network managed by the Department of Management Services.
18 Does FL DMS have a current GRC platform?
If so, provide the GRC tool.
No, we do not have a GRC solution in place at this time.
19 What compliance standards does the FL DMS required to stay compliant with?
Chapter 60-GG2 Florida Administrative Code, the Cybersecurity Rule is based on NIST CSF. Additional requirements are
DMS-23/24-073 Addendum No. 3 Page 5 of 5 detailed in section 282.318, Florida Statutes. See also section IV Response Submission, B GRC Platform Information, Compliance (I and k)
20 Are the applicable IT systems and data sources on premise, in the cloud or mixed?
Shared data/resource center and public cloud.
21 Does FL DMS have a preferences between an on premise or cloud platform for the GRC solution?
Cloud
22 Will any other vendors or third-party solutions be used in accordance to the GRC solution.
Asset management solutions, Attack Surface Mangement, CMDB, EDR, etc
23 Where will the data be hosted? Is there a separate environment for operational technology resources?
Data collected by the solution should be hosted by the provider in the cloud. Would be interested to see if there is a way to link back to agency repositories to avoid duplication of artifacts.
24 Does Florida DMS have a current consultant providing Enterprise Risk Management (ERM) services that would support this GRC implementation? If not, does the department anticipate or will they consider issuing a separate solicitation for ERM support services?
No.
Not at this time.
End of Addendum 3.
File details come from the government source that posted it. Updated .