Appendix E - TECHNICAL ASSESSMENT FORM.xlsx
XLSX spreadsheet 39 KB Posted
- Solicitation number
- RFP - 18L - 202512163
- Issued by
- Maine
About this file
This is a Technical Assessment Form for Maine's Lottery Gaming System and Instant Ticket Printing procurement. The document serves as an evaluation tool for assessing bidder proposals against specified technical criteria and requirements. The form is structured to provide a standardized methodology for evaluating vendor qualifications, system capabilities, and compliance with the state's technical specifications for lottery gaming and instant ticket printing operations. The assessment form establishes weighted scoring criteria and evaluation categories that will be used by Maine's procurement team to objectively compare competing proposals and determine which vendor best meets the state's operational and technical needs.
The Technical Assessment Form functions as a critical component of the bid evaluation process, enabling the state to systematically review vendor capabilities in areas such as system functionality, security protocols, reporting capabilities, and printing specifications. This standardized evaluation approach ensures consistent and transparent assessment of all submitted proposals against identical technical benchmarks, supporting the state's selection of the most qualified vendor for delivering lottery gaming system and instant ticket printing services.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Rider D Liquidated Damages.pdf | ||
| Appendix T - BIDDER RESPONSE FORM.xlsx | XLSX spreadsheet | |
| Appendix C - BIDDER CORPORATE CAPABILITY FORM.xlsx | XLSX spreadsheet | |
| RFP 202512163 Lottery Gaming System and Instant Ticket Printing_Final.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
The State of Maine requires Bidders to demonstrate that they (and the products proposed by them) have the appropriate Architecture & Security controls to protect the State’s information assets, and meet all appropriate compliance mandates.
| Bidders are urged to carefully read all the Header Instructions in the individual tabs before responding. Failure to comply with all the Header instructions will adversely affect the Technical Assessment of the Bid. |
| Bidders are instructed to submit (as separate attachments) an Architectural Diagram and full SOC 2 Type 2 audit results relevant to their proposed solution. This will provide additional context for the Technical Assessment. |
Data Compliance
| Data Compliance |
| The State data that is transacted by this RFP has been categorized according to the State’s Data Classification Policy, https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/DataClassificationPolicy.pdf |
The State data subject to this RFP has been classified as having a PII Impact Level of High
| Bidders and their solutions must adhere to applicable State and Federal laws, policies, and standards that corresponds to the PII impact level of the State data that will be transacted by the proposed solution. For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. Either cite a publicly-accessible URL, or enclose a copy with the submission. | |||
| Type of Data | Control (State or Federal Compliance Standard) | Yes/No | Explanation |
| Publicly available information | § NIST 800-171 | ||
| § Maine Freedom of Access Act (Title 1 MRSA c. 13) [note exemptions under Title 8 MRSA section 378-A] | |||
| Confidential Personally Identifiable Information (PII) | § State of Maine Breach Notification Law | ||
| § National Institute of Standards & Technology: NIST SP 800-53 Revision 5 “Moderate” risk controls | |||
| Payment Card Information | § Payment Card Industry Data Security Standard (PCI DSS) v 4.0 | ||
| § Nacha Operating Rules (ACH) | |||
| Federal Tax Information | § Internal Revenue Service Tax Information Security Guidelines for Federal, State and Local Agencies: IRS Pub 1075 | ||
| § IRS Pub 1075 Contractor Language Addendum required | |||
| Personal Information from | § Driver’s Privacy Protection Act (Title XXX) (“DPPA”) 18 U.S.C. Chapter 123, §§ 2721 – 2725 |
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdfhttp://legislature.maine.gov/legis/statutes/10/title10ch210-Bsec0.htmlhttps://nvd.nist.gov/800-53https://www.pcisecuritystandards.org/document_library?category=pcidss&document=pci_dsshttps://www.nacha.org/rules/operating-ruleshttps://www.congress.gov/bill/103rd-congress/house-bill/3355/texthttps://www.irs.gov/privacy-disclosure/safeguards-programhttps://legislature.maine.gov/legis/statutes/8/title8sec378-B.html BoM
| Bill of Materials (BoM) | |
| Bidders must exhaustively list ALL the products that are being proposed as part of this bid. If a product is sold as a single SKU, even if it includes components, list it only once. Example: Salesforce Service Cloud must be listed only once because it is sold as a single SKU. Even though several components makes up the Salesforce Service Cloud, such as, Console, Case Management, Workflow automation, etc. However, Salesforce Maps must be listed independently because it is sold as a distinct SKU. Products must be listed even if they are free downloads. All responses in ALL other tabs must cover ALL the products listed in the BoM here. | |
| Product Name | Product URL |
| Example: Salesforce Cloud | Example URL: https://www.salesforce.com/sales/ |
MaineIT
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. Either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID # | Control | Yes/No | Explanation |
| Hosting | |||
| H1 | Any technical solution must be hosted in a data center. | ||
| H2 | Any hosting provider must provide for back-up and disaster recovery models and plans as needed for the solution. | ||
| H3 | Any hosting provider will abide by NIST best practices for change requests, incident management, problem management, and service desk. | ||
| Application Solution | |||
| A1 | Any solutions Bidder must provide for the backup/recover, data retention, and disaster recovery of a contracted/hosted application solution. | ||
| A2 | Any solutions Bidder must provide for application management and design standard of all technology platforms and environments for the application solution (Development, Staging, Productions, DR, etc.) | ||
| A3 | Any solutions Bidder must engage the State of Maine using Service Level Agreements for system and application performance, incident reporting, and maintenance. See the defaults in the Remote Hosting Policy. | ||
| A4 | The State owns any data they enter, migrate, or transmit into the solution and the Bidder shall allow the State to pull or copy this data at any time free of charge in a format defined by the State. |
https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/RemoteHostingPolicy.pdf Information Security Standards
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. For any evidentiary material, either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID# | Control | Yes/No | Explanation |
| S1 | Bidder provides and maintains a security plan that: |
1. Complies with NIST security requirements;
2. Protects the confidentiality, integrity, and availability of the State’s information systems; and
3. Comply with all applicable federal and state laws and regulations, as well as compliance with all MaineIT contractual requirements and information security policies.
| S2 | Bidder ensures that any agent or subcontractor of the bidder to whom the State provides access agrees to the same restrictions and conditions that apply through this Agreement and agrees to implement reasonable and appropriate safeguards to ensure the confidentiality, integrity, and availability of the State’s information systems. |
| S3 | Bidder will report a security incident that occurs on the Agency’s information systems that may affect the Agency or State of Maine systems to the CISO within 24 hours of discovery in accordance with the terms of the MaineIT Non-Disclosure Agreement (Attachment D). |
| S4 | Provide the stated cyber risk appetite statement that has been approved by the board/leadership of your company. |
Cloud Service Provider Reqs
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. For any evidentiary material, either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID # | Control | Yes/No | Explanation |
| CSP1 | General Architecture Principles | ||
| CSP2 | All products proposed must be able to authenticate natively with both Microsoft Active Directory, and the Okta Platform (OpenID 2.0, Oauth 2.0, SAML 2.0) | ||
| CSP3 | System and Services Acquisition Policy and Procedures (SA-1) | ||
| CSP4 | Application Deployment Certification Policy | ||
| CSP5 | Digital Accessibility and Usability Policy | ||
| CSP6 | Remote Hosting Policy | ||
| CSP7 | Data Exchange policy | ||
| CSP8 | Information Security Policy | ||
| CSP9 | Access Control Policy | ||
| CSP10 | Access Control Procedures for Users | ||
| CSP11 | Risk Assessment policy | ||
| CSP12 | Vulnerability Scanning Procedure | ||
| CSP13 | Security Assessment and Authorization Policy | ||
| CSP14 | System and Information Integrity Policy | ||
| CSP15 | Configuration Management Policy | ||
| CSP16 | GenAI Policy (if applicable to this bid) | ||
| CSP17 | Site-to-site VPN | ||
| CSP18 | Vendor Identity System Integration Policy | ||
| CSP19 | Prohibited Technologies Policy |
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Farchitecture%2Fdocuments%2FGeneralArchitecturePrinciples.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283462187%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=hPw50eOA1Pw%2FS7R%2FsUilpZ4BKgn7UYAxzEcMekJd1Hw%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FRiskAssessmentPolicy%26Procedure.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283506985%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=DX8YitoGyojwrLOCZ%2BhltBROyt1iHfTszY6y8smDuQ0%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FVulnerablityScanningProcedure.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283511966%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Upbkei0Hmg5zbmM%2F4ADQiV8j4DcYlZfyJjqxWD8n%2FyE%3D&reserved=0https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/SecurityAssessmentAuthorizationPolicy.pdfhttps://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FSystemInformationIntegrityPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283521918%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=DhV6plvPwGgyPGWwZxIMl8vB%2FBUwhqWZjudSIJoS2Z8%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FConfigurationManagementPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283526900%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=2%2BbyzrG%2BhVzJEKIyrEZ3Zv5DXOy%2BwiqEpAWjk9a4g%2FE%3D&reserved=0https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/GenAIPolicy.pdfhttps://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/SiteToSiteVPNPolicy.pdfhttps://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/VendorIdentitySystemIntegrationPolicy.pdfhttps://www.maine.gov/oit/prohibited-technologieshttps://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fsites%2Fmaine.gov.oit%2Ffiles%2Finline-files%2Fsystem-services-acquisition-policy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283467162%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=S7J%2FjMIY1e6DijINzpo1K5R4fY3roSfTuNwDwpO1%2FNA%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FApplication-Deployment-Certification.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283472139%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=yBtVAz176L3Cag78nRWojRHWkHQ5Gba07JE%2FMQkxSsI%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FDigitalAccessibilityPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283477122%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=ub%2B%2F1cpCnNM4PoKAbhPUZ%2FluONQHbeK6j1rVOKXnaxk%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FRemoteHostingPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283482097%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=MR40mMW77Gu8X2QN8pjKM5bjP7DoRO%2BhfOhk0p1phTg%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FDataExchangePolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283487078%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=XTBYIGil6RMH8SmClnRcxTO7y9cEatf1EofD0QHPqMc%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FSecurityPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283492057%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=b%2FXvhpG1sp2fZIgpQx%2BwB7ZGRubGu7dN9sYBjFVRs%2BU%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FAccessControlPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283497031%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=foTOPC7xuTna00%2FTXggz7Rahs9XTpw5BSrCgrBmNZ9Y%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FAccessControlProceduresForUsers.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283502010%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=lO0DXc6NgpCav9iZYOLgMBuFsfmIFC8OiDtOvv%2BgOX8%3D&reserved=0 NIST Requirements
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. For any evidentiary material, either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID # | Control | Yes/No | Explanation |
| N1 | Physical and Environmental Protection | ||
| N2 | Awareness and Training | ||
| N3 | Planning | ||
| N4 | Audit and Accountability | ||
| N5 | Personnel Security | ||
| N6 | Contingency Planning | ||
| N7 | PII Processing and Transparency | ||
| N8 | Identification and Authentication | ||
| N9 | Incident Response | ||
| N10 | System and Communications Protection | ||
| N11 | Maintenance | ||
| N12 | Media Protection | ||
| N13 | Supply Chain Risk Management | ||
| N14 | Any Other Relevant Comment |
File details come from the government source that posted it. Updated .