Appendix G - Vendor Checklist to RI GCOP Addendum B IT Policies.xlsx
XLSX spreadsheet 26 KB Posted
- Attached to
- DOH Prescription Drug Monitoring Program
- Solicitation number
- RFP27007077
- Issued by
- Providence County, Rhode Island
About this file
This is a Vendor Checklist document for Rhode Island's General Conditions of Purchase (GCOP) Addendum B IT Policies, applicable to the Department of Health's Prescription Drug Monitoring Program (PDMP) procurement. The checklist requires vendors to review and respond to 32 security and IT policy requirements, indicating agreement or rejection for applicable items. Key policy areas include access control, audit and accountability, incident handling and response, identification and authentication, IT systems and services acquisition, media protection, personnel security, physical and environmental security, configuration management, contingency planning, system maintenance, communications protection, and technology acceptable use. Additional requirements address multi-factor authentication (MFA), artificial intelligence (AI) governance, accessibility and usability standards, cybersecurity requirements for vendors, and data breach protocols. Vendors must complete and submit the ETSS CyberSecurity Questionnaire as part of their proposal response. Many policies are marked "Not Applicable" for certain vendor solutions, allowing flexibility based on the specific nature of the proposed system.
The checklist serves as a compliance verification tool ensuring that vendors understand and can meet Rhode Island's statewide information security standards before contract award. Vendors proposing solutions that handle state data, particularly sensitive information such as Protected Health Information (PHI) in the context of the PDMP, must demonstrate alignment with these policies or provide justification for non-applicability. The document references specific policy documents and direct URLs to Rhode Island's policy repository, facilitating vendor access to detailed requirements. Completion of this vendor checklist is a mandatory submission component for the PDMP RFP, with proposals due November 23, 2026, and contract performance anticipated to commence January 1, 2027, through April 30, 2028, with options for up to four additional 12-month renewal periods.
View the file
Other files
Show all 11
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Addendum B Checklist
| Rhode Island General Conditions of Purchase - Addendum B Checklist | VENDOR NAME:_______________________________ SOLUTION/PRODUCT:__________________________ DATE: ______________________________________ | ||||
| Policy / Item | Link | Description / Purpose | Enter: Agree ( A ) or Reject ( R ) (for rows which are applicable in YELLOW) | Comments | |
| 1 | Access Control Policy | ETSS_Policy_300.1_Access_Control__AC_.pdf | Employees and vendors accessing State or Rhode Island information resources who use password authentication shall use a password that complies with this policy. | ||
| 2 | Assessment, Authorization, and Monitoring Policy | ETSS_Policy_10-23_Assessment__Authorization__and_Monitoring__CA_.pdf | To establish policy for the effective implementation of security controls to safeguard State of Rhode Island IT system resources, infrastructure, and data. | Not Applicable | |
| 3 | Audit and Accountability Policy | ETSS_Policy_300.3_Audit_and_Accountability__AU_.pdf | To provide the Agency with policy, standards and guidelines for establishing and effectively managing an Information Systems Audit and Accountability program at the Agency. | ||
| 4 | Awareness and Training Policy | ETSS_Policy_10-26_Awareness_and_Training__AT_.pdf | To establish policy that ensures information system users are aware of current threats to information security and are adequately trained to perform their assigned roles and responsibilities in a manner that maintains system security. | Not Applicable | |
| 5 | Bring Your Own Device Security Policy | DOIT_Bring_Your_Own_Device_Security_Policy_4-1-16.pdf | To establish a Bring Your On Device Security Policy for the effective management of personally owned mobile devices used to access State networks, applications and/or data and to ensure the confidentiality, integrity, and availability of State networks, applications and data. | Not Applicable | |
| 6 | Configuration Management Policy | ETSS_Policy_10-14_Configuration_Management__CM_.pdf | To establish a Configuration Management Policy for effectively managing risk associated with changes to and tha have an impact on system configurations, baseline configuration settings and overall information system security, | ||
| 7 | Contingency Planning Policy | ETSS_Policy_100.6_Contingency_Planning__CP_.pdf | To establish policy for effective contingency planning that enables the restoration and continuity of operations of mission-critical assets and business functions. | ||
| 8 | Federal Tax Information Access Policy | ETSS_Policy_10-11_Federal_Tax_Information_Access__FTI_.pdf | To establish policy that adequately protects and ensures the confidentiality of federal tax information (FTI) in accordance with Internal Revenue Service (IRS) has issued Publication 1075 entitled “Tax Information Security Guidelines for Federal, State, and Local Agencies” (IRS Publication 1075). | ||
| 9 | Identification and Authorization Policy | ETSS_Policy_300.7_Identification_and_Authentication__IA_.pdf | To establish policy for identifying and authenticating user access to information systems and network resources that ensures user access is authorized, confidential and sensitive data is protected, and accountability is maintained. | ||
| 10 | Incident Handling and Response Policy | ETSS_Policy_10-12_Incident_Handling_and_Response__IR_.pdf | To establish policy for the effective and timely management of IT security related incidents to safeguard State of Rhode Island IT resources, infrastructure, and data. | Not Applicable | |
| 11 | Information Technology Project Approval Policy | IT-07-02_Information_Technology_Project_Approval_Policy_2022.pdf | Prior to the expenditure of State resources, the State CDO/CIO will ensure that all major information technology (IT) efforts are consistent with the State of Rhode Island's strategic direction and will be delivered within the DoIT Project Management Framework. | Not Applicable | |
| 12 | IT Systems and Services Acquisition Policy | ETSS_Policy_10-17_System_and_Services_Acquisition__SA_.pdf | This policy provides requirements for the IT system and service acquisition process required to assure that information systems are acquired using controls sufficient to safeguard the State’s information systems. | ||
| 13 | Media Protection Policy | ETSS_Policy_300.10_Media_Protection__MP__2026.pdf | To establish policy for effectively handling and securing media in a manner that protects the confidentiality and integrity of data maintained on digital and non-digital media. | ||
| 14 | Mobile Devices Service and Support Policy 09-01 | ETSS_Policy_09-01_Mobile_Devices_Service_and_Support_Policy.pdf | Identify the process and procedures for the procurement and support of cellular telephones and mobile broadband devices (commonly referred to as air cards or hotspots). | Not Applicable | |
| 15 | Personnel Security Policy | ETSS_Policy_300.14_Personnel_Security__PS_.pdf | To establish a personnel security policy that provides effective governance of personnel to ensure the security of sensitive information systems and data. | ||
| 16 | Physical and Environmental Security Policy | ETSS_Policy_100.11_Physical_and_Environmental_Security.pdf | To establish policy for the implementation of adequate physical and environmental security controls at data centers and facilities where data centers reside to ensure the protection of information systems and supporting components and infrastructure from physical and environmental hazards. | ||
| 17 | Risk Assessment Policy | ETSS_Policy_10-25_Risk_Assessment__RA__.pdf | To establish policy that effectively manages inherent risk, vulnerabilities, threats, and countermeasures based on the criticality of the information system and data to ensure its confidentiality, integrity, and availability, and achieve an acceptable level of enterprise risk. | Not Applicable | |
| 18 | Security and Risk Program Management | ETSS_PM-1_Security_and_Risk_Program_Management_Rev1.2.pdf | The Security and Risk Management Program defines the foundation for information technology security in Rhode Island. It establishes the Statewide information security standards, providing direction for the Chief Information Security Officer (CISO) to establish a set of standards for information technology security to maximize the functionality, security, and interoperability of the State’s distributed information technology assets, including, but not limited to, data classification and management, communications, and encryption technologies. These standards apply to all executive branch agencies. | Not Applicable | |
| 19 | Security Planning Policy | ETSS_Policy_300.12_Security_Planning.pdf | To establish policy for the effective management of Enterprise risk via a security planning program to ensure the confidentiality, integrity, and availability of information systems and data. | Not Applicable, if a current year SOC2 report, FedRamp, Stateramp, ISO or PCI compliance document is provided | |
| 20 | Social Networking Policy | IT-10-09_Policy_on_Social_Networking.pdf | This policy is aimed at allowing state agencies and departments the benefit of using social networking for the performance of state business, to communicate with the public, protect the infrastructure and legal interests of the State of Rhode Island and assure that adequate bandwidth is available to conduct State business without interruption | Not Applicable | |
| 21 | State Network Device Security Policy 10-04 | IT-10-09_Policy_on_Social_Networking.pdf | Establish policy and guidance for appropriately managing and securing State Network Devices. Protect employees and the workplace environment through reducing the risk of compromising state data, disruption of network resources, and legal-related issues. The intent of this policy is to maintain the confidentiality and integrity of state data, ensure the availability of network resources, and assist in the reduction of financial and legal penalties associated with non-compliance of federal and state programs. | Not Applicable | |
| 22 | Supply Chain Risk Management Policy | ETSS_Policy_10-30_Supply_Chain_Risk_Management__SR_.pdf | Establish policy for the identification, assessment, selection, and implementation of risk management processes and mitigating controls to help manage commercially available information and communications technology supply chain risks. | Not Applicable | |
| 23 | System and Information Integrity Policy | ETSS_Policy_10-29_System_and_Information_Integrity__SI_.pdf | To establish policy for effective system and information integrity security controls to safeguard State of Rhode Island information system resources, infrastructure, and data. | ||
| 24 | System Maintenance Policy | ETSS_Policy_10-24_System_Maintenance__MA_.pdf | To establish policy for effective and secure maintenance, repair, and diagnostic requirements of information systems and system components, both on-site or off-site, to ensure the confidentiality, integrity, and availability of data. | ||
| 25 | Systems and Communications Protection Policy | ETSS_Policy_10-15_System_and_Communications_Protection_Policy__SC_.pdf | To establish policy for effective information system, network, and communications security and ensure the confidentiality, integrity, and availability of information resources. | ||
| 26 | Technology Acceptable Use Policy | Policy_00-02_Technology_Acceptable_Use_Policy_2022.pdf | To establish policy for the acceptable use of State network resources. Protect employees and the workplace environment through reducing the risk of compromising State data, disruption of network resources, and legal related issues. | ||
| 27 | MFA | As defined in Addendum B | |||
| 28 | AI | As defined in Addendum B | |||
| 29 | Accessibility and Usability Standard | As defined in Addendum B | |||
| 30 | Cybersecurity Requirements for Vendors | As defined in Addendum B | |||
| 31 | Data Breach Addendum | As defined in Addendum B | |||
| 32 | ETSS CyberSecurity Questionnaire | ETSS CyberSecurity Questions regarding the vendor solution/product being utilized for the State of Rhode Island. | See the ETSS CyberSecurity Questionnaire | COMPLETE AND SUBMIT QUESTIONNAIRE |
https://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.1_Access_Control__AC_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-12_Incident_Handling_and_Response__IR_.pdfhttps://rigov-policies.s3.amazonaws.com/IT-07-02_Information_Technology_Project_Approval_Policy_2022.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-17_System_and_Services_Acquisition__SA_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.10_Media_Protection__MP__2026.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_09-01_Mobile_Devices_Service_and_Support_Policy.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.14_Personnel_Security__PS_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_100.11_Physical_and_Environmental_Security.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-25_Risk_Assessment__RA__.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_PM-1_Security_and_Risk_Program_Management_Rev1.2.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.12_Security_Planning.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-23_Assessment__Authorization__and_Monitoring__CA_.pdfhttps://rigov-policies.s3.amazonaws.com/IT-10-09_Policy_on_Social_Networking.pdfhttps://rigov-policies.s3.amazonaws.com/IT-10-09_Policy_on_Social_Networking.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-30_Supply_Chain_Risk_Management__SR_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-29_System_and_Information_Integrity__SI_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-24_System_Maintenance__MA_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-15_System_and_Communications_Protection_Policy__SC_.pdfhttps://rigov-policies.s3.amazonaws.com/Policy_00-02_Technology_Acceptable_Use_Policy_2022.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.3_Audit_and_Accountability__AU_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-26_Awareness_and_Training__AT_.pdfhttps://rigov-policies.s3.amazonaws.com/DOIT_Bring_Your_Own_Device_Security_Policy_4-1-16.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-14_Configuration_Management__CM_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_100.6_Contingency_Planning__CP_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-11_Federal_Tax_Information_Access__FTI_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_300.7_Identification_and_Authentication__IA_.pdf
File details come from the government source that posted it. Updated .