Appendix F Vendor Checklist to RI GCOP Addendum B IT Policies - Revised.xlsx
XLSX spreadsheet 22 KB Posted
- Attached to
- DOIT - Managed Application Services
- Solicitation number
- RFP27006832
- Issued by
- Providence County, Rhode Island
About this file
This is a vendor compliance checklist for the Rhode Island General Conditions of Purchase (GCOP) Addendum B, issued by the Division of Enterprise Technology Strategy and Services (ETSS) within the Department of Administration. The checklist requires vendors responding to the Managed Application Services RFP (RFP27006832) to acknowledge compliance with 33 specified IT security and operational policies. Vendors must indicate agreement or rejection for applicable policies, which include Access Control, Audit and Accountability, Configuration Management, Contingency Planning, Federal Tax Information Access and Data Handling, Identification and Authentication, Media Protection, Personnel Security, Physical and Environmental Security, Security Planning, System and Communications Protection, System and Information Integrity, System and Services Acquisition, System Maintenance, and Technology Acceptable Use. Additionally, vendors must comply with Multi-Factor Authentication (MFA) requirements, Artificial Intelligence (AI) policies, Accessibility and Usability Standards, Cybersecurity Requirements for Vendors, and Data Breach Addendum provisions as defined in Addendum B. The checklist includes a requirement to complete and submit the ETSS Cybersecurity Questionnaire regarding the vendor's solution or product. Proposals are due August 11, 2026 at 10:00 a.m. EDT, with the vendor question and answer period running from July 14, 2026 through July 27, 2026.
The checklist serves as a compliance verification tool rather than a pricing or funding document. Many policies are marked as "NOT APPLICABLE" depending on the nature of the vendor's proposed solution. However, vendors providing solutions that include SOC2 reports, FedRamp authorization, StateRamp certification, ISO compliance, or PCI compliance documentation may be exempt from the Security Planning Policy requirement. The revised checklist was last updated July 30, 2026, and vendors must complete and return the checklist as part of their proposal submission. This compliance requirement applies to all vendors bidding on managed application services contracts with the State of Rhode Island and is mandatory for contract award consideration.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Addendum B RI General Conditions of Purchase - IT Policies - Revised.docx | DOCX document | |
| Exhibit 1 AMS Minimum Service Level Agreement.docx | DOCX document | |
| Appendix D Security Questionnaire.xlsm | XLSM spreadsheet | |
| RFP27006832_Jul_15_26_solicitation_doc.pdf | ||
| RFQ27006835 Generator SOW.pdf | ||
| RFP27006832_Aug_10_26_solicitation_doc.pdf | ||
| Appendix F Vendor Checklist to RI GCOP Addendum B IT Policies.xlsx | XLSX spreadsheet | |
| Appendix E RI ETSS Application Inventory.docx | DOCX document | |
| RFP27006832 Solicitation Specifications.pdf | ||
| RFP27006832 Questions and Answers.xlsx | XLSX spreadsheet | |
| ISBE Form - RFP Appendix B - 12.01.2025.pdf | ||
| Addendum E Business Associate Agreement.docx | DOCX document | |
| RFP27006832_Jul_20_26_solicitation_doc.pdf | ||
| Appendix C AMS RFP Cost Proposal.xlsx | XLSX spreadsheet | |
| Supplemental Bidder Attestation - 12-01-2025 (1).pdf | ||
| Addendum B RI General Conditions of Purchase - IT Policies.docx | DOCX document |
Show all 16
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Rhode Island General Conditions of Purchase - Addendum B Checklist July 30, 2026 | VENDOR NAME:_______________________________ SOLUTION/PRODUCT:__________________________ DATE: ______________________________________ | ||||||
| \ | File | Division | Last Revision Date | Summary | For the Rows which are applicable (in Yellow), Enter: ( A ) Agree or ( R ) Reject | Comments | |
| 1 | Access Control Policy | ETSS_Policy_300.1_Access_Control__AC_.pdf | ETSS | 6/22/26 | This policy ensures that only authorized users, devices, and processes gain access commensurate with business need; that privileged actions are tightly governed and auditable; and that accountability for user actions is maintained. | ||
| 2 | Annual Cybersecurity Awareness Training | CYBER_Awareness_Training_10-1-18.pdf | ETSS | 10/1/18 | State employees must complete annual cybersecurity awareness training. | NOT APPLICABLE | |
| 3 | Assessment, Authorization, and Continuous Monitoring Policy | ETSS_Policy_300.6_Assessment_Authorization_and_Continuous_Monitoring__CA_.pdf | ETSS | 7/29/26 | To establish policy for the effective implementation of security controls to safeguard State of Rhode Island IT system resources, infrastructure, and data. | NOT APPLICABLE | |
| 4 | Audit and Accountability Policy | ETSS_Policy_300.3_Audit_and_Accountability__AU_.pdf | ETSS | 6/22/26 | Establish policy for effectively managing and monitoring audit and accountability controls to ensure there are sufficient information system logs of actions performed to determine accountability. | ||
| 5 | Awareness and Training Policy | ETSS_Policy_950.2_Awareness_and_Training__AT_.pdf | ETSS | 7/21/26 | Establish policy for implementing a comprehensive security awareness and training program that ensures all Network Resource privileged users, administrators, or users with access to Non-Public Classified Data systems understand their security responsibilities, recognize current threats, and are adequately trained to perform their assigned roles in a secure manner. | NOT APPLICABLE | |
| 6 | Bring Your Own Device Security Policy | DOIT_Bring_Your_Own_Device_Security_Policy_4-1-16.pdf | ETSS | 4/1/16 | To establish a Bring Your On Device Security Policy for the effective management of personally owned mobile devices used to access State networks, applications and/or data and to ensure the confidentiality, integrity, and availability of State networks, applications and data. | NOT APPLICABLE | |
| 7 | Configuration Management Policy | ETSS_Policy_500.1_Configuration_Management.pdf | ETSS | 7/14/26 | This policy establishes the requirements for managing the configuration of State of Rhode Island information systems and their components throughout the system development lifecycle. | ||
| 8 | Contingency Planning Policy | ETSS_Policy_100.6_Contingency_Planning__CP_.pdf | ETSS | 6/22/26 | This policy establishes the requirements for contingency planning across State of Rhode Island information systems. Contingency planning enables the restoration and continuity of operations of mission-critical assets and business functions following a disruption, compromise, or failure. This policy defines requirements for contingency plan development, testing, and training, system backup and recovery, and the establishment of alternate storage, processing, and telecommunications capabilities. | ||
| 9 | Cybersecurity and Risk Program Management | ETSS_Policy_300.13_Cybersecurity_and_Risk_Program_Management__PM_.pdf | ETSS | 7/29/26 | The Security and Risk Management Program defines the foundation for information technology security in Rhode Island. It establishes the Statewide information security standards, providing direction for the Chief Information Security Officer (CISO) to establish a set of standards for information technology security to maximize the functionality, security, and interoperability of the State’s distributed information technology assets, including, but not limited to, data classification and management, communications, and encryption technologies. These standards apply to all executive branch agencies. | NOT APPLICABLE | |
| 10 | Cybersecurity Incident Handling and Response Policy | ETSS_Policy_300.8_Cybersecurity_Incident_Handling_and_Response.pdf | ETSS | 7/29/26 | To establish policy for the effective and timely management of IT security related incidents to safeguard State of Rhode Island IT resources, infrastructure, and data. | NOT APPLICABLE | |
| 11 | Federal Tax Information Access and Data Handling Policy | ETSS_Policy_400.2_FTI_Access_and_Data_Handling.pdf | ETSS | 7/14/26 | This policy establishes the requirements for the access, handling, processing, storage, retention, and disposal of Federal Tax Information (FTI), Personally Identifiable Information (PII), and other classified data throughout its lifecycle. | ||
| 12 | Identification and Authentication Policy | ETSS_Policy_300.7_Identification_and_Authentication__IA_.pdf | ETSS | 6/22/26 | This policy ensures that user access is authorized prior to system access, classified data is protected through strong authentication mechanisms, and accountability is maintained through unique identification and centralized identity services. | ||
| 13 | Information Technology Project Approval Policy | IT-07-02_Information_Technology_Project_Approval_Policy_2022.pdf | ETSS | 3/22/22 | Prior to the expenditure of State resources, the State CDO/CIO will ensure that all major information technology (IT) efforts are consistent with the State of Rhode Island's strategic direction and will be delivered within the DoIT Project Management Framework. | NOT APPLICABLE | |
| 14 | Media Protection Policy | ETSS_Policy_300.10_Media_Protection__MP__2026.pdf | ETSS | 6/22/26 | This policy establishes enterprise requirements for the protection of information stored on digital and non-digital media throughout its lifecycle. It defines controls for media access, marking, storage, transport, sanitization, and use to protect the confidentiality, integrity, and availability of State information. | ||
| 15 | Mobile Devices Service and Support Policy 09-01 | ETSS_Policy_09-01_Mobile_Devices_Service_and_Support_Policy.pdf | ETSS | 4/21/25 | Identify the process and procedures for the procurement and support of cellular telephones and mobile broadband devices (commonly referred to as air cards or hotspots). | NOT APPLICABLE | |
| 16 | Personnel Security Policy | ETSS_Policy_300.14_Personnel_Security__PS_.pdf | ETSS | 6/22/26 | To establish a personnel security policy that provides effective governance of personnel to ensure the security of sensitive information systems and data. | ||
| 17 | Physical and Environmental Security Policy | ETSS_Policy_100.11_Physical_and_Environmental_Security.pdf | ETSS | 6/22/26 | This policy establishes the requirements for physical and environmental security controls at facilities that house State of Rhode Island information systems and support infrastructure. It provides a framework for protecting information systems and their components from physical threats, environmental hazards, and unauthorized physical access. | ||
| 18 | Risk Assessment Policy | ETSS_Policy_300.2_Risk_Assessment__RA_.pdf | ETSS | 11/8/22 | This policy establishes the requirements for effectively managing risk to State of Rhode Island information systems and data through security categorization, risk assessment, vulnerability monitoring and scanning, risk response, and criticality analysis. | NOT APPLICABLE | |
| 19 | Security Planning Policy | ETSS_Policy_300.12_Security_Planning.pdf | ETSS | 6/22/26 | This policy establishes the requirements for security planning across State of Rhode Island information systems. Security planning ensures that information systems are designed, implemented, operated, and maintained with appropriate security and privacy controls, and that the security posture of each system is documented, reviewed, and authorized. This policy defines the requirements for developing and maintaining System Security Plans (SSPs), establishing rules of behavior, managing security and privacy architectures, and selecting and tailoring control baselines. | If a current year SOC2 report, FedRamp, Stateramp, ISO or PCI compliance document is provided, this Policy is not applicable. | |
| 20 | Social Networking Policy | IT-10-09_Policy_on_Social_Networking.pdf | ETSS | 2/28/18 | This policy is aimed at allowing state agencies and departments the benefit of using social networking for the performance of state business, to communicate with the public, protect the infrastructure and legal interests of the State of Rhode Island and assure that adequate bandwidth is available to conduct State business without interruption | NOT APPLICABLE | |
| 21 | State Network Device Security Policy 10-04 | ETSS_Policy_10-04_State_Network_Device_Security.pdf | ETSS | 4/20/25 | Establish policy and guidance for appropriately managing and securing State Network Devices. Protect employees and the workplace environment through reducing the risk of compromising state data, disruption of network resources, and legal-related issues. The intent of this policy is to maintain the confidentiality and integrity of state data, ensure the availability of network resources, and assist in the reduction of financial and legal penalties associated with non-compliance of federal and state programs. | NOT APPLICABLE | |
| 22 | Supply Chain Risk Management Policy | ETSS_Policy_800.2_Supply_Chain_Risk_Management__SR_.pdf | ETSS | 7/14/26 | This policy establishes the requirements for identifying, assessing, and mitigating risks associated with the information and communications technology (ICT) supply chain. | NOT APPLICABLE | |
| 23 | System and Communications Protection Policy | ETSS_Policy_300.4_System_and_Communications_Protection_.pdf | ETSS | 7/14/26 | This policy establishes the requirements for protecting State of Rhode Island information systems, networks, and communications to ensure the confidentiality, integrity, and availability of information resources. It defines controls for system segmentation, boundary protection, transmission and data-at-rest encryption, cryptographic key management, network session management, DNS security, and other communications protection mechanisms. | ||
| 24 | System and Information Integrity Policy | ETSS_Policy_300.5_System_and_Information_Integrity__SI_.pdf | ETSS | 7/14/26 | This policy establishes the requirements for maintaining the integrity of State of Rhode Island information systems and data. It defines controls for flaw remediation, malicious code protection, system monitoring, security alerts, software and firmware integrity verification, spam protection, information input validation, error handling, information retention, and memory protection. | ||
| 25 | System and Services Acquisition Policy | ETSS_Policy__800.1_System_and_Services_Acquisition.pdf | ETSS | 7/14/26 | This policy establishes the requirements for acquiring, developing, and managing information systems and services with adequate security controls to safeguard the State’s information, infrastructure, and data. It defines requirements for resource allocation, system development lifecycle integration, acquisition processes, system documentation, security engineering principles, external system services, developer configuration management and testing, and the management of unsupported system components. | ||
| 26 | System Maintenance Policy | ETSS_Policy_100.2_System_Maintenance__MA_.pdf | ETSS | 7/14/26 | This policy establishes the requirements for the effective and secure maintenance, repair, and diagnostic servicing of State of Rhode Island information systems and system components. It defines requirements for controlled maintenance activities performed on-site or off-site, the management and inspection of maintenance tools, non-local (remote) maintenance, the authorization of maintenance personnel, and timely maintenance support. | ||
| 27 | Technology Acceptable Use Policy | Policy_00-02_Technology_Acceptable_Use_Policy_2022.pdf | ETSS | 7/13/22 | To establish policy for the acceptable use of State network resources. Protect employees and the workplace environment through reducing the risk of compromising State data, disruption of network resources, and legal related issues. | ||
| 28 | MFA | As defined in Addendum B | ETSS | ||||
| 29 | AI | As defined in Addendum B | ETSS | ||||
| 30 | Accessibility and Usability Standard | As defined in Addendum B | ETSS | ||||
| 31 | Cybersecurity Requirements for Vendors | As defined in Addendum B | ETSS | ||||
| 32 | Data Breach Addendum | As defined in Addendum B | ETSS | ||||
| 33 | ETSS CyberSecurity Questionnaire | ETSS CyberSecurity Questions regarding the vendor solution/product being utilized for the State of Rhode Island. | ETSS | Complete and Submit the ETSS CyberSecurity Questionnaire |
https://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.1_Access_Control__AC_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.8_Cybersecurity_Incident_Handling_and_Response.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_400.2_FTI_Access_and_Data_Handling.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.7_Identification_and_Authentication__IA_.pdfhttps://rigov-policies.s3.amazonaws.com/IT-07-02_Information_Technology_Project_Approval_Policy_2022.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.10_Media_Protection__MP__2026.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_09-01_Mobile_Devices_Service_and_Support_Policy.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.14_Personnel_Security__PS_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_100.11_Physical_and_Environmental_Security.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.2_Risk_Assessment__RA_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.12_Security_Planning.pdfhttps://rigov-policies.s3.amazonaws.com/CYBER_Awareness_Training_10-1-18.pdfhttps://rigov-policies.s3.amazonaws.com/IT-10-09_Policy_on_Social_Networking.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-04_State_Network_Device_Security.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_800.2_Supply_Chain_Risk_Management__SR_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.4_System_and_Communications_Protection_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.5_System_and_Information_Integrity__SI_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy__800.1_System_and_Services_Acquisition.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_100.2_System_Maintenance__MA_.pdfhttps://rigov-policies.s3.amazonaws.com/Policy_00-02_Technology_Acceptable_Use_Policy_2022.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.6_Assessment_Authorization_and_Continuous_Monitoring__CA_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.3_Audit_and_Accountability__AU_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_950.2_Awareness_and_Training__AT_.pdfhttps://rigov-policies.s3.amazonaws.com/DOIT_Bring_Your_Own_Device_Security_Policy_4-1-16.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_500.1_Configuration_Management.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_100.6_Contingency_Planning__CP_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.13_Cybersecurity_and_Risk_Program_Management__PM_.pdf
File details come from the government source that posted it. Updated .