ATTACHMENT B - VSIQ.pdf
PDF 181 KB Posted
- Attached to
- Current Year Model Recording System
- Solicitation number
- 5400030288
- Issued by
- Richland County, South Carolina
About this file
Summary
This document is a Vendor Software Intake Questionnaire (VSIQ) used to evaluate software vendors and service providers for state and local contract opportunities. The questionnaire comprehensively assesses vendor security and compliance capabilities across multiple dimensions, including security frameworks, physical and environmental security measures for data-hosting servers, access control policies, encryption standards for data in transit and at rest, employee vetting procedures, virus scanning frequency, network monitoring and logging practices, and data breach response protocols. Additionally, the questionnaire addresses data retention schedules, information disposal procedures, and supplementary physical, administrative, and technical controls designed to prevent unauthorized access and data misuse.
The questionnaire further evaluates vendor implementation of Artificial Intelligence (AI) in business processes, including whether AI is integrated into offered products or services, how AI functionality is utilized, and whether AI features can be disabled. For vendors whose products or services access Personally Identifiable Information (PII), the questionnaire requires detailed documentation of what PII is collected, the business purposes for collection and use, collection methods, storage locations and retention periods, and any separate PII-specific retention schedules. This intake questionnaire serves as a comprehensive due diligence tool to ensure vendor compliance with data security, privacy, and operational standards prior to contract award.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Attachment C Sub Cont.docx | DOCX document | |
| Solicitation.docx | DOCX document | |
| ATTACHMENT A - SPSAQ.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Vendor Software Intake Questionnaire What security compliance/frameworks does your company hold?
What physical and environmental security practices are put in place for servers that host/store customer data?
Where are these servers housed? (e.g., On-site, cloud, hybrid, etc.)
Who is allowed access to servers and endpoints with access to confidential/sensitive information?
What criteria are in place to determine which users or roles may access the information?
Is data encrypted in travel and at rest? ☐ Yes ☐ No If yes, what encryption standards are used?
What kind of vetting process/background checks do your employees go through before they’re given access to IT hardware at your company?
How often are virus scans run on your network and endpoints?
Is network traffic monitored and logged? ☐ Yes ☐ No If yes, how often are these logs reviewed and who are they reviewed by?
What is the response plan should there be a data breach containing customer data?
How long is information retained and under what retention schedule?
What is the procedure for the disposal of information at the end of the retention period?
What additional physical, administrative, and technical controls are in place to protect the data from unauthorized access and misuse?
Does your company implement Artificial Intelligence (AI) in work processes? ☐ Yes ☐ No If yes, continue with questions – If not, can move on to next section
Is AI an integrated part of your offered products/services?
Please include summary of how AI is utilized
Are the AI features/functionality/processes able to be turned off?
Does the product/service access any Personally Identifiable Information (PII) ☐ Yes ☐ No If yes, continue with questions – If not, no need to continue
What PII is collected, used, retained, or shared?
-end-
What is the purpose for which PII is collected, used, retained, or shared?
How is the PII collected for this business purpose?
Where is the PII maintained or stored and for how long?
Please include any separate retention schedule for PII as applicable
File details come from the government source that posted it. Updated .