Appendix E - EXAMPLE Technical Assessment Form.xlsx
XLSX spreadsheet 42 KB Posted
- Solicitation number
- RFP - 12A - 202605090
- Issued by
- Kennebec County, Maine
About this file
Technical Assessment Form Summary
This is an Appendix E Example Technical Assessment Form for the State of Maine's ReEmployME Application Support, Maintenance, and Enhancement contract opportunity. The form establishes comprehensive requirements for bidders to demonstrate that their proposed solutions and products possess appropriate architecture and security controls to protect Maine's information assets and meet all applicable compliance mandates. Bidders are required to submit responses covering all products listed in their Bill of Materials (BoM) and provide an Architecture Diagram of their proposed solution. The assessment covers multiple control categories including data compliance requirements aligned with Maine's Data Classification Policy, hosting specifications, application solution standards, information security standards based on NIST frameworks, cloud service provider requirements, and general NIST requirements. Each control requires bidders to respond with Yes/No answers supported by comprehensive explanations and evidence, which may include published policies, regulatory compliance audit reports, or publicly-accessible URLs.
The data compliance section requires bidders to identify the PII Impact Level (None, Low, Moderate, or High) and address applicable state and federal compliance standards including NIST 800-171, Maine Freedom of Access Act, NIST SP 800-53 Revision 5, Privacy Act of 1974, PCI DSS v 4.0, IRS Publication 1075 for federal tax information, HIPAA with Maine's required Business Associate Agreement, FERPA, and the Driver's Privacy Protection Act. Hosting requirements mandate data center hosting with backup, disaster recovery models, and NIST best practices for change requests, incident management, and service desk operations. Application solutions must provide backup, recovery, data retention, disaster recovery, Service Level Agreements, and ensure the State retains ownership of all data with the ability to export at any time in State-defined formats. Cloud service provider controls require native authentication with Microsoft Active Directory and Okta Platform (OpenID 2.0, OAuth 2.0, SAML 2.0) and compliance with 19 specific MaineIT policies spanning system acquisition, deployment certification, digital accessibility, remote hosting, data exchange, information security, access control, risk assessment, vulnerability scanning, security assessment authorization, configuration management, GenAI applicability, site-to-site VPN, vendor identity system integration, and prohibited technologies. NIST requirements address physical and environmental protection, awareness and training, planning, audit and accountability, personnel security, contingency planning, PII processing and transparency, identification and authentication, incident response, system and communications protection, maintenance, media protection, and supply chain risk management.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Copy of Copy of RFP12A20260509 Vendor Questions Public version full v3.xlsx | XLSX spreadsheet | |
| Appendix G - Cost Proposal Worksheet.xlsx | XLSX spreadsheet | |
| Appendix I - ME IT Non-Disclosure Agreement (NDA).docx | DOCX document | |
| RFP 202605096 ReEmployME Case Management System_Final.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
The State of Maine requires Bidders to demonstrate that they (and the products proposed by them) have the appropriate Architecture & Security controls to protect the State’s information assets, and meet all appropriate compliance mandates.
| Bidders are urged to carefully read all the Header Instructions in the individual tabs before responding. Failure to comply with all the Header instructions will adversely affect the Technical Assessment of the Bid. |
| Bidders are instructed to submit (as a separate attachment) an Architecture Diagram of their proposed solution. This will provide additional context for the Technical Assessment. |
Data Compliance
| Data Compliance |
| The State data that is transacted by this RFP has been categorized according to the State’s Data Classification Policy, https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/DataClassificationPolicy.pdf |
RFP Coordinator: (1) Please fill out the PII Impact Level in the next line. (2) Then delete the rows below that do not apply to this RFP. (3) Finally, delete this line.
The State data subject to this RFP has been classified as having a PII Impact Level of [Select One: None, Low, Moderate, High]
| Bidders and their solutions must adhere to applicable State and Federal laws, policies, and standards that corresponds to the PII impact level of the State data that will be transacted by the proposed solution. For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. Either cite a publicly-accessible URL, or enclose a copy with the submission. | |||
| Type of Data | Control (State or Federal Compliance Standard) | Yes/No | Explanation |
| Publicly available information | § NIST 800-171 | ||
| § Maine Freedom of Access Act (Title 1 MRSA c. 13) | |||
| Confidential Personally Identifiable Information (PII) | § State of Maine Breach Notification Law | ||
| § National Institute of Standards & Technology: NIST SP 800-53 Revision 5 “Moderate” risk controls | |||
| § Privacy Act of 1974, 5 U.S.C. 552a. | |||
| § Security regulations from the U.S. DHHS, Administration for Children and Families, Office of Child Support Enforcement Program, Office of Child Support Enforcement (OCSE) | |||
| Payment Card Information | § Payment Card Industry Data Security Standard (PCI DSS) v 4.0 | ||
| § Nacha Operating Rules (ACH) | |||
| Federal Tax Information | § Internal Revenue Service Tax Information Security Guidelines for Federal, State and Local Agencies: IRS Pub 1075 | ||
| § IRS Pub 1075 Contractor Language Addendum required | |||
| Personal Health Information (PHI) | § Health Insurance Portability and Accountability Act of 1996: HIPAA | ||
| § State of Maine HIPAA BAA required | |||
| § The Health Information Technology for Economic and Clinical Health Act HITECH | |||
| Affordable Care Act | § Internal Revenue Service Tax Information Security Guidelines for Federal, State and Local Agencies IRS Pub 1075 | ||
| § Minimum Acceptable Risk Standards for Exchanges MARS-E 2.2 | |||
| Medicaid Information | § Medicaid Information Technology Architecture MITA3.0 | ||
| § Code of Federal Regulations 45 CFR 95.621 | |||
| Student Education Data | § Family Educational Rights and Privacy Act: FERPA | ||
| Personal Information from | § Driver’s Privacy Protection Act (Title XXX) (“DPPA”) 18 U.S.C. Chapter 123, §§ 2721 – 2725 | ||
| Other: describe | [List what’s applicable or delete this line.] |
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdfhttps://www.hhs.gov/hipaa/for-professionals/special-topics/hitech-act-enforcement-interim-final-rule/index.htmlhttps://www.irs.gov/privacy-disclosure/safeguards-programhttps://www.cms.gov/files/document/mars-e-v2-2-vol-1final-signed08032021-1.pdfhttps://www.medicaid.gov/medicaid/data-systems/medicaid-information-technology-architecture/medicaid-information-technology-architecture-framework/index.htmlhttps://www.govinfo.gov/app/collection/cfr/2017/title45https://studentprivacy.ed.gov/ferpahttps://www.congress.gov/bill/103rd-congress/house-bill/3355/texthttp://legislature.maine.gov/legis/statutes/10/title10ch210-Bsec0.htmlhttps://nvd.nist.gov/800-53https://www.justice.gov/opcl/privacy-act-1974https://www.pcisecuritystandards.org/document_library?category=pcidss&document=pci_dsshttps://www.nacha.org/rules/operating-ruleshttps://www.irs.gov/privacy-disclosure/safeguards-programhttps://www.hhs.gov/hipaa/for-professionals/privacy/index.htmlhttps://www.maine.gov/dhhs/sites/maine.gov.dhhs/files/inline-files/Business-Associate-Agreement.pdf BoM
| Bill of Materials (BoM) | |
| Bidders must exhaustively list ALL the products that are being proposed as part of this bid. If a product is sold as a single SKU, even if it includes components, list it only once. Example: Salesforce Service Cloud must be listed only once because it is sold as a single SKU. Even though several components makes up the Salesforce Service Cloud, such as, Console, Case Management, Workflow automation, etc. However, Salesforce Maps must be listed independently because it is sold as a distinct SKU. Products must be listed even if they are free downloads. All responses in ALL other tabs must cover ALL the products listed in the BoM here. | |
| Product Name | Product URL |
| Example: Salesforce Cloud | Example URL: https://www.salesforce.com/sales/ |
MaineIT
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. Either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID # | Control | Yes/No | Explanation |
| Hosting | |||
| H1 | Any technical solution must be hosted in a data center. | ||
| H2 | Any hosting provider must provide for back-up and disaster recovery models and plans as needed for the solution. | ||
| H3 | Any hosting provider will abide by NIST best practices for change requests, incident management, problem management, and service desk. | ||
| Application Solution | |||
| A1 | Any solutions Bidder must provide for the backup/recover, data retention, and disaster recovery of a contracted/hosted application solution. | ||
| A2 | Any solutions Bidder must provide for application management and design standard of all technology platforms and environments for the application solution (Development, Staging, Productions, DR, etc.) | ||
| A3 | Any solutions Bidder must engage the State of Maine using Service Level Agreements for system and application performance, incident reporting, and maintenance. See the defaults in the Remote Hosting Policy. | ||
| A4 | The State owns any data they enter, migrate, or transmit into the solution and the Bidder shall allow the State to pull or copy this data at any time free of charge in a format defined by the State. |
https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/RemoteHostingPolicy.pdf Information Security Standards
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. For any evidentiary material, either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID# | Control | Yes/No | Explanation |
| S1 | Bidder provides and maintains a security plan that: |
1. Complies with NIST security requirements;
2. Protects the confidentiality, integrity, and availability of the State’s information systems; and
3. Comply with all applicable federal and state laws and regulations, as well as compliance with all MaineIT contractual requirements and information security policies.
| S2 | Bidder ensures that any agent or subcontractor of the bidder to whom the State provides access agrees to the same restrictions and conditions that apply through this Agreement and agrees to implement reasonable and appropriate safeguards to ensure the confidentiality, integrity, and availability of the State’s information systems. |
| S3 | Bidder will report a security incident that occurs on the Agency’s information systems that may affect the Agency or State of Maine systems to the CISO within 24 hours of discovery in accordance with the terms of the MaineIT Non-Disclosure Agreement (Attachment D). |
| S4 | Provide the stated cyber risk appetite statement that has been approved by the board/leadership of your company. |
Cloud Service Provider Reqs
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. For any evidentiary material, either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID # | Control | Yes/No | Explanation |
| CSP1 | General Architecture Principles | ||
| CSP2 | All products proposed must be able to authenticate natively with both Microsoft Active Directory, and the Okta Platform (OpenID 2.0, Oauth 2.0, SAML 2.0) | ||
| CSP3 | System and Services Acquisition Policy and Procedures (SA-1) | ||
| CSP4 | Application Deployment Certification Policy | ||
| CSP5 | Digital Accessibility and Usability Policy | ||
| CSP6 | Remote Hosting Policy | ||
| CSP7 | Data Exchange policy | ||
| CSP8 | Information Security Policy | ||
| CSP9 | Access Control Policy | ||
| CSP10 | Access Control Procedures for Users | ||
| CSP11 | Risk Assessment policy | ||
| CSP12 | Vulnerability Scanning Procedure | ||
| CSP13 | Security Assessment and Authorization Policy | ||
| CSP14 | System and Information Integrity Policy | ||
| CSP15 | Configuration Management Policy | ||
| CSP16 | GenAI Policy (if applicable to this bid) | ||
| CSP17 | Site-to-site VPN | ||
| CSP18 | Vendor Identity System Integration Policy | ||
| CSP19 | Prohibited Technologies Policy |
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Farchitecture%2Fdocuments%2FGeneralArchitecturePrinciples.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283462187%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=hPw50eOA1Pw%2FS7R%2FsUilpZ4BKgn7UYAxzEcMekJd1Hw%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FRiskAssessmentPolicy%26Procedure.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283506985%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=DX8YitoGyojwrLOCZ%2BhltBROyt1iHfTszY6y8smDuQ0%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FVulnerablityScanningProcedure.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283511966%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Upbkei0Hmg5zbmM%2F4ADQiV8j4DcYlZfyJjqxWD8n%2FyE%3D&reserved=0https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/SecurityAssessmentAuthorizationPolicy.pdfhttps://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FSystemInformationIntegrityPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283521918%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=DhV6plvPwGgyPGWwZxIMl8vB%2FBUwhqWZjudSIJoS2Z8%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FConfigurationManagementPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283526900%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=2%2BbyzrG%2BhVzJEKIyrEZ3Zv5DXOy%2BwiqEpAWjk9a4g%2FE%3D&reserved=0https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/GenAIPolicy.pdfhttps://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/SiteToSiteVPNPolicy.pdfhttps://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/VendorIdentitySystemIntegrationPolicy.pdfhttps://www.maine.gov/oit/prohibited-technologieshttps://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fsites%2Fmaine.gov.oit%2Ffiles%2Finline-files%2Fsystem-services-acquisition-policy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283467162%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=S7J%2FjMIY1e6DijINzpo1K5R4fY3roSfTuNwDwpO1%2FNA%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FApplication-Deployment-Certification.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283472139%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=yBtVAz176L3Cag78nRWojRHWkHQ5Gba07JE%2FMQkxSsI%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FDigitalAccessibilityPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283477122%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=ub%2B%2F1cpCnNM4PoKAbhPUZ%2FluONQHbeK6j1rVOKXnaxk%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FRemoteHostingPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283482097%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=MR40mMW77Gu8X2QN8pjKM5bjP7DoRO%2BhfOhk0p1phTg%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FDataExchangePolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283487078%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=XTBYIGil6RMH8SmClnRcxTO7y9cEatf1EofD0QHPqMc%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FSecurityPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283492057%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=b%2FXvhpG1sp2fZIgpQx%2BwB7ZGRubGu7dN9sYBjFVRs%2BU%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FAccessControlPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283497031%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=foTOPC7xuTna00%2FTXggz7Rahs9XTpw5BSrCgrBmNZ9Y%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FAccessControlProceduresForUsers.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283502010%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=lO0DXc6NgpCav9iZYOLgMBuFsfmIFC8OiDtOvv%2BgOX8%3D&reserved=0 NIST Requirements
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. For any evidentiary material, either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID # | Control | Yes/No | Explanation |
| N1 | Physical and Environmental Protection | ||
| N2 | Awareness and Training | ||
| N3 | Planning | ||
| N4 | Audit and Accountability | ||
| N5 | Personnel Security | ||
| N6 | Contingency Planning | ||
| N7 | PII Processing and Transparency | ||
| N8 | Identification and Authentication | ||
| N9 | Incident Response | ||
| N10 | System and Communications Protection | ||
| N11 | Maintenance | ||
| N12 | Media Protection | ||
| N13 | Supply Chain Risk Management | ||
| N14 | Any Other Relevant Comment |
File details come from the government source that posted it. Updated .