Attachment B.xlsx

This document is a security requirements shortlist (Attachment B) for a Research Request for Proposal (RFP) issued by a South Carolina healthcare research department seeking core management software. The shortlist serves as an initial comparative screening tool to evaluate the security capabilities of proposed solutions and does not constitute a detailed risk assessment. The evaluation framework comprises 15 security domains organized into six categories: Data & Research Governance, Research Compliance, Architecture & Hosting, Identity & Access, Security Assurance, Technical Protection, Logging & Incident Response, Resilience, and Third Parties/Contracts/Exit. Each domain contains specific comparative requirements or questions that vendors must address regarding data collection, permitted uses, compliance support, system architecture, hosting locations, data separation, single sign-on capabilities, multi-factor authentication, role-based access controls, security certifications, encryption protocols, audit logging, availability commitments, and subprocessor management.

The shortlist functions as a standardized evaluation matrix designed to rapidly compare vendor responses across critical security capabilities relevant to healthcare research operations. Vendors are required to provide detailed explanations addressing data governance practices, compliance with research protocols and regulatory requirements, complete architecture and data-flow documentation, identity and access management capabilities, current independent security assurance evidence, encryption and key-management procedures, customer-accessible audit logging with incident notification timeframes, resilience commitments including recovery time and recovery point objectives, and disclosure of all subprocessors with associated contractual agreements and data exit procedures. This structured approach enables the healthcare research department to efficiently assess vendor security postures during the initial proposal evaluation phase before advancing finalists to more comprehensive risk assessment procedures.