Appendix_J_Security_Questionnaire.docx

This is a Security Questionnaire template from the Minnesota Department of Information Technology Services (MNIT) in partnership with the Minnesota Department of Corrections (DOC) for the Incarcerated Person Communication Services (IPCS) contract opportunity. The questionnaire requires vendors to certify compliance with baseline and enhanced security requirements based on the nature of their proposed solutions. Vendors must confirm implementation of information security policies aligned with industry standards and frameworks, with responses structured to address whether proposals include Software-as-a-Service (SaaS) or cloud-hosted solutions, as well as applications or software components. For cloud-based solutions, vendors must verify encryption of state data in transit, secure software development practices, automated and manual security testing, access controls, industry-standard system configuration, firewall implementation, timely patch management, and secure data destruction compliant with NIST Special Publication 800-88 standards.

For high-data categorization requirements, vendors must certify compliance with applicable federal regulations including HIPAA, HITECH, FERPA, IRS Publication 1075, FBI/CJIS Security Policy, and PCI DSS standards where applicable. Additionally, vendors proposing cloud services must obtain or commit to obtaining GovRAMP authorization at the Moderate Impact Level by April 1, 2027, to meet state requirements. The questionnaire uses a yes or no response format to systematically evaluate vendor security postures and regulatory compliance capabilities, with conditional branching to ensure only relevant security questions are answered based on the specific technical architecture of each proposal.