ATTACHMENT D MANDATORY RESPONS

IT Security Services, SON # GTA 98000-5466 – Department of Juvenile Justice Security Assessment This document is protected from disclosure by OCGA § 50-18-72(a) (25) (A) (i) (2012)

ATTACHMENT D

MANDATORY RESPONSE WORKSHEET

Statement of Need 98000-00000-5619

Request for Qualified Contractor: 98000-00000-3088 Department of Community Supervision Security Assessment

Offeror Name: ___________________________________________________________

The Offeror will record all “Mandatory Requirements,” “Mandatory–Project Management,” and “Mandatory-Scored Requirements” responses as per instructions in the Statement of Need (SON).

Offeror is to base bid responses upon information within the SON and the environment information provide.

**No pricing is to be reported on this Attachment. **

I. Mandatory Requirements

Offeror MUST respond to each of the Mandatory Requirements with a “YES” response or the SOW will be disqualified from further review.

MANDATORY REQUIREMENTS

TASK #

OFFEROR

RESPONSE

(YES = COMPLY)

(NO = NOT

COMPLY)

REQUIREMENT

MAN-1

Yes No

Offeror must agree that if selected to perform the engagement, Offeror will accept, sign and return Attachment F: Non- Disclosure/Confidentiality of Sensitive Information Agreement, as is, prior to issuance of Purchase Order (PO).

MAN-2

Offeror must agree that if selected to perform the engagement and if Offeror resources are to be subjected to background checks, each of Offeror’s engagement assigned resources shall be required, at time of engagement, to complete the Georgia Bureau of Investigations (GBI) personnel screening requirements in Policy Area 12.5.1.2. of the latest version of the CJIS Security Policy at Offeror’s expense. These requirements are listed below:

1. Fingerprint-based background check at a Georgia Applicant Processing Service (GAPS) location or utilizing approved electronic fingerprint submission services for State of Georgia applicants

2. Successful completion of GBI’s online Security Awareness training (approximately 1 hour)

3. Signed Security Awareness Statement

4. Signed FBI Security Addendum

Said personnel screening checks shall be valid for 1 year. In addition to the basic Mandatory Background Check requirements listed here, Offeror must agree to comply with any further background check rules specified at the agency engagement level.

MAN-3

Offeror must agree that ALL data accessed and/or derived from any engagement activity shall have access restricted exclusively to either “U.S. Citizens” or “Lawful U.S. Permanent Residents.” (No access rights, no physical access, no viewing, no copying, no storage, or no manipulation, etc. by personnel not receiving prior approval from GTA and/or DJJ)

MAN-4

Offeror must agree that in the performance of the engagement, or at any time thereafter, Offeror will not store, transmit to or through, archive or maintain any ITSS engagement data, on any Offeror https://gbi.georgia.gov/personnel-security-requirements https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center

MANDATORY REQUIREMENTS

TASK #

OFFEROR

RESPONSE

(YES = COMPLY)

(NO = NOT

COMPLY)

REQUIREMENT

resources, to any location outside of the legal jurisdiction of the United States.

MAN-5

Offeror must agree that while in the performance of the engagement, or while under an active Purchase Order, or while any past or present ITSS engagement data is in Offeror possession, in the event of an Offeror data breach, ( as defined by NIST), involving any unauthorized disclosure of any ITSS engagement data Offeror holds, Offeror shall comply with reporting to GTA within the timeframe defined under OCGA 38-3-22 (2 hours).

MAN-6

Offeror must agree that in the performance of the engagement, or at any time thereafter, any data derived from the engagement shall have appropriate data security protection measures implemented for the protection of said data. For the engagement, data either stored, transmitted, archived, manipulated, or maintained, etc., by “Offeror” shall have at a minimum of “Moderate” (as defined by NIST) data protection controls and measures implemented for such protections. Offeror shall also agree to provide demonstration of said protections upon demand, in the form of system security plans or recent (within 1 year) system security assessments of said protection measures.

Offeror shall note that the response for the secure data storage/secure engagement file storage/document repository tool will additionally be scored in the “Mandatory - Scored Requirements” section.

MAN-7

Offeror must agree that if selected to perform the engagement of an agency with access to, use of, or have disclosure to any federal tax information (FTI), as defined by Internal Revenue Service code, Offeror will accept, sign and return the IRS Publication 1075 Acknowledgment (Attachment G).

MAN-8

Offeror must agree, upon completion of the engagement, or upon GTA’s or DJJ’s request, and within the time period specified by GTA, any data identified by GTA (whether GTA-owned or agency-owned) must be either transferred to GTA or destroyed . Further, Offeror must agree to complete a data destruction or transfer certificate affirming Offeror’s transfer or destruction of data (Attachment H).

MAN-9

Yes No

Offeror must agree that if selected to perform engagement of an agency with HIPAA data requirements, Offeror will accept, sign, and return Attachment I - HIPAA BAA (Business Associate Agreement) as-is, prior to issuance of PO.

https://ia800704.us.archive.org/22/items/gov.ga.ocga.2018/release77.2020.08.10/gov.ga.ocga.title.38.html

MANDATORY REQUIREMENTS

TASK #

OFFEROR

RESPONSE

(YES = COMPLY)

(NO = NOT

COMPLY)

REQUIREMENT

MAN-10

Offeror must affirm they have successfully completed at least one (1) engagement of a CIS 20 Critical Controls assessment, within the past 48 months. Offeror will provide verifiable Name and contact phone number of contacts at each entity cited as references to this requirement. A Maximum of 5 engagements will be accepted. GTA reserves the right to verify at GTA discretion.

Entity 1:

Contact Name:

Contact Number:

MAN-11

Offeror must agree that if selected to perform the engagement, offeror will begin on-site engagement activities within a week of receiving a purchase order.

II. Mandatory - Project Management

Offeror MUST respond to each of the Mandatory – Project Management requirements with a “YES” response or the SOW response will be disqualified from further review.

MANDATORY PROJECT MANAGEMENT

TASK ITEM TASK # TASK DESCRIPTION

OFFEROR

RESPONSE

(YES = COMPLY)

(NO = NOT

COMPLY)

Timely conduct Requirements Definition Interviews

PM-1

If selected for engagement award, Offeror agrees to perform initial consultations with appropriate stakeholders to assess engagement needs and ensure that all requirements are defined and documented.

Initial Consultations are to commence within 10 working days from the date the awarded Offeror receives a completed Purchase Order.

MANDATORY PROJECT MANAGEMENT

TASK ITEM TASK # TASK DESCRIPTION

OFFEROR

RESPONSE

(YES = COMPLY)

(NO = NOT

COMPLY)

Update Bid Solicitation Security Assessment Plan (SAP) throughout Engagement

PM-2

If selected for engagement award, Offeror agrees to amend/revise the bid solicitation SAP plan to represent revised job details based upon information discovered within the engagement. Said plan shall be utilized for engagement execution, monitoring and reporting. Said plan is not to be an increase in project scope, but a more detailed work activity breakout.

Required additional information to be detailed in SAP plan shall include proposed dates of application technical scanning, for those applications/systems specified as in scope. This information is required for scheduling, authorization clearance and coordination purposes for the technical scanning.

The amended SAP plan shall be made available no later than 10 working days after engagement activities have begun.

Said plan shall include, but not be limited to: list of milestones, WBS items, associated sub-task items, expected task duration, task start date, task completion status, overall project completion status and resource assignments to tasks.

Provide Ongoing Project Status Reporting

PM-3

The Offeror shall continually evaluate and communicate the project’s progress, make recommendations to management, update the SAP and provide status reporting to each in scope agencies and GTA.

Yes No Project status reporting reviews shall commence no later than 10 working days from the date the Offeror begins engagement activities.

MANDATORY PROJECT MANAGEMENT

TASK ITEM TASK # TASK DESCRIPTION

OFFEROR

RESPONSE

(YES = COMPLY)

(NO = NOT

COMPLY)

Thereafter, periodic project reviews and reporting shall occur every 1 week, until project completion.

The amended SAP plan, as noted in MANDATORY – Project Management (PM-2), shall be used for reporting of engagement status.

Provide Project Summary Reporting

PM-4

The Offeror shall produce final summary reporting for each in-scope agency. Said reporting shall include identification/discussion of all project deliverables regarding their accuracy and completeness.

Reporting will also contain all findings of deficiencies or gaps and their potential impacts along with mitigation/remediation recommendations.

The Offeror shall hold project final exit presentation for each in-scope agency.

Reporting and presentation shall be completed no later than 15 working days from the date the Offeror completes engagement activities.

III. Mandatory - Scored Requirements

If Offeror bid response for any “Mandatory-Scored Requirement” Task Item is to include/constitute a document attachment(s), Offeror is to clearly indicate a document attachment(s) in the respective Mandatory Scored Task Item response section and state the “Task Item” name on each separate document the attachment applies to or the document(s) will be disregarded from evaluation.

(Example: Attachment Security Assessment Plan, applies to: “Statement of Work (SOW) Security Assessment Plan Components” task item).

Note: Mandatory - Scored Requirements worksheet table follows on the next page.

MANDATORY-SCORED REQUIREMENTS

*MS-1 – SOW Narrative with Security Assessment Plan.

A Statement of Work (SOW) Narrative, containing a high-level engagement Security Assessment Plan (SAP), must be provided as part of the bid response.

Offeror will provide a SOW Narrative, in the Offeror’s own words, detailing the Offeror’s understanding of the project objectives, of GTA’s project expectations, deliverables to be provided, and the approach and methodologies that the Offeror will implement to address the required work activities.

The SOW Narrative shall include, preferably at the end, a high-level Security Assessment Plan (SAP)s, for each agency assessment.

Task Description:

It is GTA’s intent to receive the SAP plan(s) which contain tasking alignment with the submitted Resumes/Titles/staff description thus presenting a cohesive road map/picture. GTA will evaluate said plans on their clarity of demonstrating how the WBS tasks will be performed, and by employing whom/resource types to do so, utilization of tools to be employed if so appropriate and the expected scheduling/timeline to complete each necessary activity.

The SOW Narrative and each SAP will be evaluated upon how they identify and document:

1) The detailed listing of work activities, scheduling details, staffing assignments, milestones, deliverables and artifacts necessary for a comprehensive and successful evaluation engagement execution.

2) The anticipated timelines to complete each work activity item and each agency engagement.

3) That appropriate staffing resources are to be assigned to complete individual work activity items and the overall engagement. Staffing assignments in each SAP are to match the staff resource resumes or skill set types that are identified within the Resumes for Planned Engagement Staffing Resources response (*MS-2).

4) In each SAP, clearly identify any software tool(s) that will be used to complete any work activity item that will require performing analysis, technical testing, data capture or any technical assessment functionalities within the engagement.

(Staffing resources resumes can be notated by a generic skill set type: ex: Project Manager, Manager, Administrative, Security Analyst, technical type, etc. The SAP may use the generic skill set type for identifying the resource assignments to specific work activities if the staffing resource resumes listed in *MS-2 clearly identify the skill set type on each resume).

MS-1 Task Item Response Instructions

• Offeror is to provide their *MS-1 responses (the SOW Narrative and the Security Assessment

Plan) as separate attachment(s).

• For SAPs, GTA expects plans to be in Microsoft Project format.

• GTA shall use for scoring, the resource assignments and listing of tools, as applied to tasks, within the SAP.

• Limit response to this identified task item to 10 pages.

MS-1: Offeror to List Names of Attachments in this Section.

MS-2: Resumes for the Planned Engagement Staffing Resources.

The Offeror is to produce in their bid proposal the resumes for the planned engagement staffing resources.

The Engagement Staffing Resources Resumes will be evaluated upon:

1) How resumes demonstrate that the proposed staff has sufficient experience and appropriate skill sets to successfully complete engagement activities, per the SON conditions.

(Staffing assignments are to also be documented, for evaluation, in the SAP (as stated in *MS-1.3).

Each staff resume listed will show their proposed activity assignments, on each SAP. If a staff resource proposed in the Offeror bid response, is not available for engagement assignment, GTA reserves the right to have Offeror provide an equivalent or higher qualified staff resource replacement for the engagement.)

MS-2 Task Item Response Instructions

• Offeror is to provide *MS-2 response(s) as separate resume attachment(s).

• Limit response for this task item to 2 pages per staff resume.

• If resumes are to be identified with a “skill set type,” Offeror must clearly indicate this.

• Resume response may be consolidated into one large file attachment if each resume included is clearly separated/identified from others

MS-2: Offeror to List Names of Attachments in this Section.

MS-3: Samples of Reporting Deliverables.

The Offeror is to produce in their bid proposal, samples of one each of the following:

• Risk Assessment Report (RAR)

• Security Assessment Report with embedded Gap Analysis (SAR & GAP) that shall include, but not be limited to, control findings for all “in-compliance” and “gap results.”

• Remediation Plan of Action with Milestones (POA&M) cross-referenced to the SAR.

• Agency Exit Reporting - Executive Summary Report containing, but not limited to, summary data of engagement, graphical representations of findings, heat map summarization of findings, discussions of critical risk(s), and overview of critical control findings.

The sample reports will be evaluated upon:

1) Comprehensiveness and clarity.

2) Demonstration that artifacts are aligned with NIST for reporting content and detail.

3) Demonstration that technical testing and analysis was performed against applicable technical controls.

4) Ability to be easily leverage report artifacts into working documents.

GTA requires that report samples provided for evaluation be actual artifacts (redacted) submitted by Offeror from a previous engagement that was performed within the last 48 months. These samples are to correspond to the jobs referenced and cited in “MAN-4”. Samples of example templates found on internet sites are not considered acceptable.

GTA requires that the Security Assessment Report (SAR) and Gap Analysis (GAP) is to be a combined single report containing all appropriate data elements from each discipline.

GTA understands and respects the confidentiality rights of others. Offeror shall redact company specific information, for any of the sample reports identified within this requirement.

GTA expects that the sample reports will contain sufficient detail to demonstrate comprehensive reporting. A simple “Table of Contents” type format will not be viewed as satisfactory.

MS-3 Task Item Response Instructions

• Offeror is to provide each of their MS-3 response items as separate document attachments.

• Limit response for this task item to 10 pages per each report sample.

MS-3: Offeror to List Names of Attachments in this Section.

MS-4: Listing of Engagement Tool(s) with a Service and Utilization Description for Each Tool and the File Management, Storage, Transfer Tool/Platform.

Task Description:

The Offeror is to produce in their bid proposal: A listing of ALL the software tools planned to be used to perform the engagement.

A service and utilization description for each tool must identify what the tool does and where that tool will be utilized to perform the assessment. Standard office and document preparation productivity tools (ex: MS Office, Adobe PDF Reader, etc.) only require a short (single sentence) description stating their use for “document or artifact” preparation but must also be listed. The service and utilization description for other tool(s) should only be large enough to clearly describe planned use within the engagement.

A descriptive information response of the workflow messaging, file management, file storage, file transfer tool/platform to be utilized for the engagement. The response will describe capabilities of workflow messaging, where data is stored, how it’s securely accessed, how it’s secured in-transit and at rest and the data classification capability of tool/platform (as described within FIPS 199). This description response will be considered part of the “Engagement Tool” scoring.

GTA has the minimum expectation that this item bid response will contain the following items:

1. A listing of all engagement tool(s) that will be applied to work activities, so to demonstrate the capability to comprehensively and successfully complete the assessment.

2. A service and utilization description for each tool(s) listed. Service and utilization description is to include:

• a general service description of the tool describing the tool capabilities and use.

• A utilization description that identifies what engagement work area or areas (technical assessment, compliance assessment, port scanning, code testing, data capture, compliance analysis and review, project management, document storage, etc.) where the tool is to be applied. (Example: Tool - Nessus: is a remote security scanning tool which scans a computer to discover any vulnerability. Nessus will be used for testing of technical controls to identify items such as server configuration errors, patch level inconsistencies, general vulnerabilities and open ports, etc.)

3. A descriptive information response of the workflow messaging, file management, storage, transfer tool/platform to be utilized for the engagement. The response will describe where data is stored, how it’s securely accessed, how it’s secured in-transit and at rest and the data classification capability level of the tool/platform (as described within FIPS 199). This description response will be considered part of the “Engagement Tool” scoring.

For GTA to appropriately evaluate the *MS-4 bid response, the Contractor needs to address ALL the stated response areas. Failure to provide a full listing of ALL proposed engagement tools, a clear general service description for EACH TOOL and a clear identification of the work area(s) where EACH TOOL will be used will negatively impact the scoring for the “MS-4” requirement.

GTA understands and respects the privacy rights of others. Should Contractor deem it appropriate to utilize a proprietary tool or tool sets, it is permissible to do so, but the service and utilization description for said tool or tool sets must be provided so to evaluate the capabilities and applicability of said tool(s) per the engagement needs. Failure to provide said descriptions, will negatively impact the scoring for the “MS-4” requirement)

MS-4 Task Item Response Instructions

• Offeror is to provide each of their MS-4 response items as separate document attachments.

• Limit response for this task item to 10 pages.

MS-4: Offeror to List Names of Attachments in this Section.

*”MS” means Mandatory Scored