Appendix D - ETSS Cybersecurity Questionnaire.xlsx

This file is a Cybersecurity Questionnaire (Appendix D - ETSS Cybersecurity Questionnaire) developed by the Rhode Island Department of Health for vendors responding to the Prescription Drug Monitoring Program (PDMP) RFP 27007077. The questionnaire is a comprehensive assessment tool designed to evaluate vendor cybersecurity posture and compliance with information security standards. Vendors are required to complete the Security Questionnaire tab by providing responses to approximately 60 questions across multiple security domains, including risk assessment data for various engagement types (CI, GSPG, AC, AT, AU, CM, IA, IR, MA, MP, PE, RA, SA, SC, SI, CL, DR, PNS, SCDM, DPS, and ADI categories). The questionnaire uses two response formats: Yes/No dropdown selections and free-text answers. Critical questions assess whether vendors possess active FedRamp authorization, current-year ISO 27001/27002 certification, SOC 2 Type 2 attestation, SAS70, SSAE16, or PCI attestation, with provisions for bridge letters if attestations are not within the current year. The proposal due date is November 23, 2026 at 11:00 AM EST, with the initial contract period running from approximately January 1, 2027 through April 30, 2028, and options for up to four additional 12-month renewal periods.

The questionnaire requires vendors to provide detailed information on security governance, including written information security policies, Security System Plans (SSPs), access management procedures, user authentication and authorization processes, multifactor authentication (MFA) requirements, least privilege principles, security awareness training programs, audit logging processes, change management procedures, incident response plans, vendor management protocols, network security measures, patch management, vulnerability scanning, disaster recovery plans, data center security, employee background checks, and compliance with industry-specific standards such as HIPAA. Vendors must demonstrate operational security capabilities regarding system maintenance, media protection and data destruction, physical and environmental security, risk assessment methodologies and frequency, penetration testing practices, software acquisition security evaluations, and confidentiality policies. The questionnaire also includes a data breach disclosure question requiring vendors to report any previous security incidents and their remediation. Pricing terms are firm and fixed unless otherwise indicated, and vendors must maintain specific insurance coverage including Technology Errors and Omissions ($5,000,000 per occurrence and annual aggregate) and Information Technology Cyber/Privacy coverage ($5,000,000 per occurrence and annual aggregate) for those accessing Protected Health Information. The State will withhold a 0.33 percent contract administrative fee from all invoices.