Appendix F - ETSS CyberSecurity Questionnaire - Aug 2025 - Copy.xlsx
XLSX spreadsheet 34 KB Posted
- Solicitation number
- RFP27007119
- Issued by
- Rhode Island
About this file
This file is an ETSS CyberSecurity Questionnaire template for the Rhode Island State Alert Warning and Notification System solicitation. The questionnaire is designed for vendors to complete and submit as part of their proposal to Rhode Island Emergency Management Agency (RIEMA) for a cloud-based statewide Alert, Warning, and Notification (AWN) system. The form contains approximately 60 engagement risk assessment data points organized across multiple cybersecurity control categories including Configuration and Identity Management (CI), General Security Program Governance (GSPG), Access Controls (AC), Awareness and Training (AT), Audit and Accountability (AU), Configuration Management (CM), Identification and Authentication (IA), Incident Response (IR), Maintenance (MA), Media Protection (MP), Physical and Environmental Protection (PE), Risk Assessment (RA), System and Services Acquisition (SA), System and Communications Protection (SC), System and Information Integrity (SI), Continuity of Operations (CL), Disaster Recovery (DR), Personnel Security (PNS), Security Control and Data Management (SCDM), and Data Protection Services (DPS). The questionnaire is due at proposal submission on December 2, 2026, with questions due by November 16, 2026 at 2:00 p.m.
Vendors completing the questionnaire must enable macros and provide responses in three columns: questions in Column A, answers in Column B, and formatting specifications in Column C. Responses utilize either Yes/No dropdown selections or free-text entries. Notably, if a vendor has an active FedRamp authorization or current-year ISO 27001/27002 or SOC 2 Type 2 attestation and answers "Yes" to Question 5, only the certification type need be specified in Question 6, which substantially shortens the completion requirement. Vendors without such certifications must complete all remaining questions covering written information security policies, security system plans, audit logging, incident response procedures, risk assessments, penetration testing, vendor management, network security, patch management, disaster recovery plans, data center security, and employee background checks. The questionnaire aligns with the IT Requirements Addendum (Appendix D) requirements for Rhode Island information security standards, encryption, access controls, and compliance documentation.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Engagement Risk Assessment Data
| Engagements | CI001 | CI002 | CI003 | GSPG001 | GSPG002 | GSPG003 | GSPG004 | GSPG005 | GSPG005A | GSPG006 | GSPG006A | GSPG006B | AC001 | AC002 | AC003 | AT001 | AT002 | AT003 | AU001 | AU002 | CM001 | CM002 | CM003 | CM004 | IA001 | IA002 | IR001 | IR002 | MA001 | MA002 | MP001 | PE001 | PE002 | RA001 | RA002-1 | RA002-2 | RA003 | RA003-2 | SA001 | SA002 | SA003 | SC001 | SC002 | SI001 | SI002 | CL001 | CL002-1 | CL002-2 | DR001 |
| No |
Instructions How to Complete the Security Questionnaire (last update date: 8/22/25)
As the Vendor completing this Questionnaire, the Security Questionnaire tab is where work will be completed. The file contains 3 columns, in column A you will see the question, Column B is where the answer will be provided, and in Column C is the answer format accepted in Column B.
The two types of formatting accepted for answers are Yes/No drop downs and free text values.
For the cases in which you need to select Yes or No, there's a dropdown. Click the arrow on the appropriate cell in Column B to display your drop down options.
1. Enable Macros when you first open the spreadsheet.
2. Per design when you complete question 5, if you select "Yes" to whether you have an active FedRamp authorization or current year ISO27001/27002 or SOC 2 Type 2 attestation, you only need to specify which type of certification you have (e.g. FedRamp, ISO27001/27002, SOC 2 Type 2) in question 6 which will complete the questionnaire for your organization. If you answer "No" to question 5, you must complete all the remaining questions in the questionnaire.
Security Questionnaire
| Question | Answer | Options/Type of response |
| Legal Name of the Company | Text | |
| Address and Location of Operations | Text | |
| Contact Information of the Security Team | Text | |
| Do you have an active FedRamp authorization or current year ISO27001/27002, or SOC 2 Type 2 attestation? | No | Values List (Yes, No) |
| Please select one from the list | Values List | |
| Do you have a written information security policy? | Values List (Yes, No) | |
| How often is your security policy reviewed and updated? | Text | |
| Describe the roles and responsibilities of your information security team | Text | |
| Do you have a Security System Plan (SSP)? | Values List (Yes, No) | |
| Do you have a current year SAS70, SSAE16 or PCI attestation? | Values List (Yes, No) | |
| If not within current year, do you have a bridge letter to accompany the reports for the current year? | Values List (Yes, No) | |
| Please Provide details if needed. | Text | |
| How do you manage access to systems and data, including remote access? | Text | |
| Describe your user authentication and authorization processes. Please note if you require use of multifactor authentication (MFA). | Text | |
| How do you ensure least privilege principles and separation of duties are followed in your organization? | Text | |
| What type of security awareness training do you provide to your employees? | Text | |
| How frequently is this training updated and provided? | Text | |
| Do you provide role-specific cyber security training? | Values List (Yes, No) | |
| Describe your audit logging processes. Include a high-level summary of what events are logged, and how long are logs retained? | Text | |
| How do you ensure the integrity of your logging and monitoring systems? | Text | |
| Describe your process for managing changes to system configurations. | Text | |
| Do changes require an approval by a change board or designee? | Values List (Yes, No) | |
| How do you ensure compliance with your configuration baselines? | Text | |
| Are changes tested and reviewed? | Values List (Yes, No) | |
| Do you provide unique identifiers for all users in your environment? | Values List (Yes, No) | |
| How do you manage cryptographic controls for securing authentication processes? | Text | |
| Describe your incident response plan. How are incidents identified, assessed, and remediated? | Text | |
| What is your process for reporting security incidents? How do your 3rd parties report to you? | Text | |
| What are your procedures for system maintenance? | Text | |
| How do you ensure that maintenance activities do not compromise security? | Text | |
| How do you manage and protect your digital and physical media containing sensitive information? Describe your data destruction and disposal processes. | Text | |
| What physical security measures are in place at your facilities? | Text | |
| How do you protect your systems from environmental risks? | Text | |
| Describe your risk assessment methodology and framework. How frequently are risk assessments conducted? | Text | |
| Do you maintain a risk register? | Values List (Yes, No) | |
| How do you incorporate findings from risk assessments into your security strategy? | Text | |
| Is penetration testing performed? | Values List (Yes, No) | |
| If yes (penetration testing is performed), how frequently and by whom? | Text | |
| How do you evaluate the security of software and services before an acquisition? | Text | |
| Describe the security requirements you impose on your vendors. | Text | |
| How do you enforce these requirements to the sub-processers or 3rd parties of these vendors? | Text | |
| What measures do you take to protect your network and data transmissions? | Text | |
| Describe your approach to network segregation, firewall management, and intrusion detection systems. | Text | |
| Describe your processes for patch management and vulnerability scanning. | Text | |
| Describe your virus prevention, detection, and update processes. | Text | |
| Which industry-specific security standards or regulations are you compliant with, if any? | Text | |
| Have you ever been subject to a data breach or security incident? | Values List (Yes, No) | |
| If so, provide details on how it was addressed. | Text | |
| Summarize your disaster recovery plan, including overview of backup procedures and scenarios for primary/secondary hosting facility disasters. | Text | |
| Does your data center have an HVAC system, fire extinguishing system, and a generator? | Text | |
| Describe the physical and electronic security measures for your data center and applications. | Text | |
| Are employees subject to thorough background checks? | Values List (Yes, No) | |
| Who configures and deploys servers? Are the procedures documented? | Text | |
| Describe the policies and procedures for hardening servers. | Text | |
| What are your customer confidentiality policies and how are they enforced? | Text | |
| What are your procedures for handling and destroying sensitive data? | Text | |
| What is your data governance policy? | Text | |
| Please provide any additional information or comments that you think are relevant to your information security posture. | Text |
Sheet2
| Yes | FedRamp authorization |
| No | current year ISO27001/27002 |
| SOC 2 Tye 2 attestation |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .