Appendix F Vendor Checklist to RI GCOP Addendum B IT Policies.xlsx
XLSX spreadsheet 25 KB Posted
- Attached to
- DOIT - Managed Application Services
- Solicitation number
- RFP27006832
- Issued by
- Providence County, Rhode Island
About this file
This is an Appendix F Vendor Checklist for Rhode Island's GCOP Addendum B IT Policies, prepared by the Division of Enterprise Technology Strategy and Services (ETSS) within the Department of Administration for use in evaluating vendor solutions and products in connection with the Managed Application Services RFP27006832. The checklist requires vendors to review and respond to 31 distinct policy and security requirement items, including access control, audit and accountability, configuration management, contingency planning, identification and authentication, incident handling and response, IT systems acquisition, media handling, personnel security, physical and environmental security, system maintenance, communications protection, technology acceptable use, and cyber security questionnaire completion. Vendors must indicate agreement (A) or rejection (R) for each applicable policy requirement and provide comments explaining their position. The checklist serves as a mandatory compliance assessment tool for vendors whose solutions will interface with State of Rhode Island information resources, with multiple policies marked as not applicable depending on the nature of the proposed service delivery model.
The vendor checklist encompasses comprehensive information security and risk management standards established by Rhode Island's Enterprise Technical Security Standards (ETSS) program, designed to ensure confidentiality, integrity, and availability of state IT resources and data. Vendors must demonstrate compliance with policies addressing federal tax information protection, bring-your-own-device security, supply chain risk management, system and information integrity, multi-factor authentication (MFA), artificial intelligence (AI) governance, accessibility and usability standards, and data breach protocols. Completion and submission of the ETSS CyberSecurity Questionnaire is mandatory, with vendors required to review detailed policy documentation available through provided links to rigov-policies.s3.amazonaws.com. This checklist functions as a prerequisite compliance document for the January 1, 2027 contract start date under the three-year initial term with two optional 24-month renewal periods, establishing baseline security and operational requirements that vendors must satisfy prior to contract award.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Addendum B RI General Conditions of Purchase - IT Policies - Revised.docx | DOCX document | |
| Exhibit 1 AMS Minimum Service Level Agreement.docx | DOCX document | |
| Appendix D Security Questionnaire.xlsm | XLSM spreadsheet | |
| RFP27006832_Jul_15_26_solicitation_doc.pdf | ||
| RFQ27006835 Generator SOW.pdf | ||
| Appendix F Vendor Checklist to RI GCOP Addendum B IT Policies - Revised.xlsx | XLSX spreadsheet | |
| RFP27006832_Aug_10_26_solicitation_doc.pdf | ||
| Appendix E RI ETSS Application Inventory.docx | DOCX document | |
| RFP27006832 Solicitation Specifications.pdf | ||
| RFP27006832 Questions and Answers.xlsx | XLSX spreadsheet | |
| ISBE Form - RFP Appendix B - 12.01.2025.pdf | ||
| Addendum E Business Associate Agreement.docx | DOCX document | |
| RFP27006832_Jul_20_26_solicitation_doc.pdf | ||
| Appendix C AMS RFP Cost Proposal.xlsx | XLSX spreadsheet | |
| Supplemental Bidder Attestation - 12-01-2025 (1).pdf | ||
| Addendum B RI General Conditions of Purchase - IT Policies.docx | DOCX document |
Show all 16
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Addendum B Checklist
| Addendum B Checklist | VENDOR NAME:_______________________________ SOLUTION/PRODUCT:__________________________ DATE: ______________________________________ | ||||
| Policy / Item | Link | Description / Purpose | Enter: Agree ( A ) or Reject ( R ) (for rows which are applicable) | Comments | |
| 1 | Access Control Policy | ETSS_Policy_10-10_Access_Control__AC_.pdf | Employees and vendors accessing State or Rhode Island information resources who use password authentication shall use a password that complies with this policy. | ||
| 2 | Assessment, Authorization, and Monitoring Policy | ETSS_Policy_10-23_Assessment__Authorization__and_Monitoring__CA_.pdf | To establish policy for the effective implementation of security controls to safeguard State of Rhode Island IT system resources, infrastructure, and data. | Not Applicable | |
| 3 | Audit and Accountability Policy | ETSS_Policy_10-13_Audit_and_Accountability__AU_.pdf | To provide the Agency with policy, standards and guidelines for establishing and effectively managing an Information Systems Audit and Accountability program at the Agency. | ||
| 4 | Awareness and Training Policy | ETSS_Policy_10-26_Awareness_and_Training__AT_.pdf | To establish policy that ensures information system users are aware of current threats to information security and are adequately trained to perform their assigned roles and responsibilities in a manner that maintains system security. | Not Applicable | |
| 5 | Bring Your Own Device Security Policy | DOIT_Bring_Your_Own_Device_Security_Policy_4-1-16.pdf | To establish a Bring Your On Device Security Policy for the effective management of personally owned mobile devices used to access State networks, applications and/or data and to ensure the confidentiality, integrity, and availability of State networks, applications and data. | Not Applicable | |
| 6 | Configuration Management Policy | ETSS_Policy_10-14_Configuration_Management__CM_.pdf | To establish a Configuration Management Policy for effectively managing risk associated with changes to and tha have an impact on system configurations, baseline configuration settings and overall information system security, | ||
| 7 | Contingency Planning Policy | ETSS_Policy_10-28_Contingency_Planning__CP_.pdf | To establish policy for effective contingency planning that enables the restoration and continuity of operations of mission-critical assets and business functions. | ||
| 8 | Federal Tax Information Access Policy | ETSS_Policy_10-11_Federal_Tax_Information_Access__FTI_.pdf | To establish policy that adequately protects and ensures the confidentiality of federal tax information (FTI) in accordance with Internal Revenue Service (IRS) has issued Publication 1075 entitled “Tax Information Security Guidelines for Federal, State, and Local Agencies” (IRS Publication 1075). | ||
| 9 | Identification and Authorization Policy | ETSS_Policy_10-20_Identification_and_Authentication__IA_.pdf | To establish policy for identifying and authenticating user access to information systems and network resources that ensures user access is authorized, confidential and sensitive data is protected, and accountability is maintained. | ||
| 10 | Incident Handling and Response Policy | ETSS_Policy_10-12_Incident_Handling_and_Response__IR_.pdf | To establish policy for the effective and timely management of IT security related incidents to safeguard State of Rhode Island IT resources, infrastructure, and data. | Not Applicable | |
| 11 | Information Technology Project Approval Policy | IT-07-02_Information_Technology_Project_Approval_Policy_2022.pdf | Prior to the expenditure of State resources, the State CDO/CIO will ensure that all major information technology (IT) efforts are consistent with the State of Rhode Island's strategic direction and will be delivered within the DoIT Project Management Framework. | Not Applicable | |
| 12 | IT Systems and Services Acquisition Policy | ETSS_Policy_10-17_System_and_Services_Acquisition__SA_.pdf | This policy provides requirements for the IT system and service acquisition process required to assure that information systems are acquired using controls sufficient to safeguard the State’s information systems. | ||
| 13 | Media Handling and Security Policy | ETSS_Policy_05-01_Media_Protection__MP_.pdf | To establish policy for effectively handling and securing media in a manner that protects the confidentiality and integrity of data maintained on digital and non-digital media. | ||
| 14 | Mobile Devices Service and Support Policy 09-01 | ETSS_Policy_09-01_Mobile_Devices_Service_and_Support_Policy.pdf | Identify the process and procedures for the procurement and support of cellular telephones and mobile broadband devices (commonly referred to as air cards or hotspots). | Not Applicable | |
| 15 | Personnel Security Policy | ETSS_Policy_10-21_Personnel_Security__PS_.pdf | To establish a personnel security policy that provides effective governance of personnel to ensure the security of sensitive information systems and data. | ||
| 16 | Physical and Environmental Security Policy | ETSS_Policy_10-16_Physical_and_Environmental_Security__PE_.pdf | To establish policy for the implementation of adequate physical and environmental security controls at data centers and facilities where data centers reside to ensure the protection of information systems and supporting components and infrastructure from physical and environmental hazards. | ||
| 17 | Risk Assessment Policy | ETSS_Policy_10-25_Risk_Assessment__RA__.pdf | To establish policy that effectively manages inherent risk, vulnerabilities, threats, and countermeasures based on the criticality of the information system and data to ensure its confidentiality, integrity, and availability, and achieve an acceptable level of enterprise risk. | Not Applicable | |
| 18 | Security and Risk Program Management | ETSS_PM-1_Security_and_Risk_Program_Management_Rev1.2.pdf | The Security and Risk Management Program defines the foundation for information technology security in Rhode Island. It establishes the Statewide information security standards, providing direction for the Chief Information Security Officer (CISO) to establish a set of standards for information technology security to maximize the functionality, security, and interoperability of the State’s distributed information technology assets, including, but not limited to, data classification and management, communications, and encryption technologies. These standards apply to all executive branch agencies. | Not Applicable | |
| 19 | Security Planning Policy | ETSS_Policy_10-18_Security_Planning__PL_.pdf | To establish policy for the effective management of Enterprise risk via a security planning program to ensure the confidentiality, integrity, and availability of information systems and data. | Not Applicable | |
| 20 | Social Networking Policy | IT-10-09_Policy_on_Social_Networking.pdf | This policy is aimed at allowing state agencies and departments the benefit of using social networking for the performance of state business, to communicate with the public, protect the infrastructure and legal interests of the State of Rhode Island and assure that adequate bandwidth is available to conduct State business without interruption | Not Applicable | |
| 21 | State Network Device Security Policy 10-04 | ETSS_Policy_10-04_State_Network_Device_Security.pdf | Establish policy and guidance for appropriately managing and securing State Network Devices. Protect employees and the workplace environment through reducing the risk of compromising state data, disruption of network resources, and legal-related issues. The intent of this policy is to maintain the confidentiality and integrity of state data, ensure the availability of network resources, and assist in the reduction of financial and legal penalties associated with non-compliance of federal and state programs. | Not Applicable | |
| 22 | Supply Chain Risk Management Policy | ETSS_Policy_10-30_Supply_Chain_Risk_Management__SR_.pdf | Establish policy for the identification, assessment, selection, and implementation of risk management processes and mitigating controls to help manage commercially available information and communications technology supply chain risks. | Not Applicable | |
| 23 | System and Information Integrity Policy | ETSS_Policy_10-29_System_and_Information_Integrity__SI_.pdf | To establish policy for effective system and information integrity security controls to safeguard State of Rhode Island information system resources, infrastructure, and data. | ||
| 24 | System Maintenance Policy | ETSS_Policy_10-24_System_Maintenance__MA_.pdf | To establish policy for effective and secure maintenance, repair, and diagnostic requirements of information systems and system components, both on-site or off-site, to ensure the confidentiality, integrity, and availability of data. | ||
| 25 | Systems and Communications Protection Policy | ETSS_Policy_10-15_System_and_Communications_Protection_Policy__SC_.pdf | To establish policy for effective information system, network, and communications security and ensure the confidentiality, integrity, and availability of information resources. | ||
| 26 | Technology Acceptable Use Policy | Policy_00-02_Technology_Acceptable_Use_Policy_2022.pdf | To establish policy for the acceptable use of State network resources. Protect employees and the workplace environment through reducing the risk of compromising State data, disruption of network resources, and legal related issues. | ||
| 27 | MFA | As defined in Addendum B | |||
| 28 | AI | As defined in Addendum B | |||
| 29 | Accessibility and Usability | As defined in Addendum B | |||
| 30 | Data Breach | As defined in Addendum B | |||
| 31 | ETSS CyberSecurity Questionnaire | ETSS CyberSecurity Questions regarding the vendor solution/product being utilized for the State of Rhode Island. | See the ETSS CyberSecurity Questionnaire | COMPLETE AND SUBMIT QUESTIONNAIRE |
https://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-10_Access_Control__AC_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-12_Incident_Handling_and_Response__IR_.pdfhttps://rigov-policies.s3.amazonaws.com/IT-07-02_Information_Technology_Project_Approval_Policy_2022.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-17_System_and_Services_Acquisition__SA_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_05-01_Media_Protection__MP_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_09-01_Mobile_Devices_Service_and_Support_Policy.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-21_Personnel_Security__PS_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-16_Physical_and_Environmental_Security__PE_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-25_Risk_Assessment__RA__.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_PM-1_Security_and_Risk_Program_Management_Rev1.2.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-18_Security_Planning__PL_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-23_Assessment__Authorization__and_Monitoring__CA_.pdfhttps://rigov-policies.s3.amazonaws.com/IT-10-09_Policy_on_Social_Networking.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-04_State_Network_Device_Security.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-30_Supply_Chain_Risk_Management__SR_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-29_System_and_Information_Integrity__SI_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-24_System_Maintenance__MA_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-15_System_and_Communications_Protection_Policy__SC_.pdfhttps://rigov-policies.s3.amazonaws.com/Policy_00-02_Technology_Acceptable_Use_Policy_2022.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-13_Audit_and_Accountability__AU_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-26_Awareness_and_Training__AT_.pdfhttps://rigov-policies.s3.amazonaws.com/DOIT_Bring_Your_Own_Device_Security_Policy_4-1-16.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-14_Configuration_Management__CM_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-28_Contingency_Planning__CP_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-11_Federal_Tax_Information_Access__FTI_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-20_Identification_and_Authentication__IA_.pdf
File details come from the government source that posted it. Updated .