Attachment_D_-_Vendor_Questionnaire_RFP_25_PR_8968.xlsx
XLSX spreadsheet 19 KB Posted
- Attached to
- Management Services for Temporary Staffing
- Solicitation number
- PR8968
- Issued by
- Florida
About this file
This is an IT Security Questionnaire Application associated with Request for Proposal 25-PR-8968 issued by the Orlando Utilities Commission (OUC) for management services for temporary staffing. The questionnaire is designed to assess the security posture of third-party application developers and resellers providing web-based portal solutions and supporting infrastructure for the staffing management services. The RFP solicits proposals for staff augmentation services including temporary administrative, professional, information technology, skilled trade, independent contractor, direct hire, and payrolling services, with a primary deliverable being a secure, user-friendly web-based portal available 24/7 for managing staffing requests, candidate submissions, assignments, time reporting, and reporting functions. The questions/comments deadline is March 11, 2026, with proposals due April 13, 2026 by 2:00 PM EST. The initial contract term is five years with one optional two-year renewal period. Vendors must have a minimum of ten years of business experience providing vendor management services with similar project scope and size and must provide at least three references.
The vendor must serve as the sole employer of record for temporary personnel, conducting all recruitment, screening, interviewing, testing, orientation, criminal background checks, motor vehicle screenings, employment and education verification, and drug and alcohol testing for safety-sensitive positions. The IT Security Questionnaire requires vendors to provide comprehensive responses addressing application security practices including secure software development lifecycle, vulnerability management, authentication and authorization; data security and privacy including encryption standards and data retention policies; application infrastructure and hosting security; incident management and monitoring; compliance with industry standards such as ISO 27001, SOC 2, NIST, PCI DSS, GDPR, CCPA, and HIPAA; risk assessment practices; and hardware security practices including supply chain integrity, hardware security features, manufacturing security, and maintenance protocols. For cloud-hosted solutions, data must be stored and transmitted exclusively within North America with encryption required for privileged or private data at rest, in transit, and in process. Pricing is structured according to two primary service models with mark-up rates specified by labor categories including Administrative/Clerical, Customer Service/Contact Center, Skilled Craft/Field Operation, Technical Support, Professionals, and IT/Digital/Systems Engineering, with separate disclosures for MSP program fees, conversion fees, tenure discounts, and independent contractor fees. No specific award values or budget ranges are disclosed in the RFP.
View the file
Other files
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
IT Security Questionnaire
| Application Name: |
| Application Developer / Reseller |
| Aplication version |
| Area | Response Yes/ No /Partial | Partial - Please Explain |
| 1. Application Security Practices |
| 1.1 Development Lifecycle |
| Does the third party follow a secure software development lifecycle (SDLC)? |
| Are security requirements incorporated during the design phase of the SDLC? |
| Are security reviews conducted at each phase of the development process? |
| Is static and dynamic application security testing (SAST/DAST) performed during development? |
| Does the application undergo regular security code reviews? |
| 1.2 Vulnerability Management |
| Does the third party have a vulnerability management program in place? |
| How frequently are security patches and updates applied to the application? |
| What is the process for addressing security vulnerabilities reported by third parties, users, or automated tools? |
| How are software vulnerabilities tracked and remediated (e.g., CVE reporting, timelines)? |
| Is your product penetration tested regularly by internal or third-party professionals? |
| Do you perform cybersecurity due diligence for third-party libraries, APIs, and cloud services used in your software? |
| Are third-party dependencies tracked, evaluated for security risk, and updated regularly? |
| 1.3 Authentication and Authorization |
| Does the application support multi-factor authentication (MFA)? |
| Does the application utilize role-based access control (RBAC) to ensure least-privilege access? |
| Are credentials stored using strong cryptographic algorithms (e.g., salted hashes)? |
| Does the application support Single Sign-On (SSO)? |
| Are password policies enforced (e.g., complexity, expiration)? |
| Is access to the software environment and data governed by role-based access controls and MFA? |
2. Data Security and Privacy
| 2.1 Data Encryption |
| Is sensitive data encrypted at rest and in transit? |
| What encryption standards are used (e.g., AES-256, TLS 1.2+)? |
| Is key management performed according to industry standards (e.g., hardware security modules)? |
| 2.2 Data Retention and Disposal |
| Does the third party have a data retention policy in place? |
| How is sensitive data securely disposed of when no longer required? |
| 2.3 Third-Party Data Sharing |
| Does the application share data with any external third parties? |
| If yes, is data sharing governed by contracts or data protection agreements (e.g., GDPR, CCPA)? |
| Are sensitive data exchanges encrypted? |
3. Application Infrastructure and Hosting Security
| 3.1 Environment Security |
| Where is the application development hosted (e.g., cloud, on-premise, hybrid)? |
| Is the hosting environment hardened according to industry best practices? |
| Are servers regularly patched and updated? |
| Is the application development hosted in a segregated network or isolated from other systems? |
| 3.2 Backup and Recovery |
| Are regular backups taken of critical application data and configurations? |
| Are backups encrypted and stored in a secure location? |
| Does the application have a documented disaster recovery plan (DRP)? |
| Has the application undergone disaster recovery testing in the last 12 months? |
4. Incident Management and Monitoring
| 4.1 Security Incident Management |
| Does the third party have a formal incident response plan (IRP) in place? |
| Are security incidents regularly reported and tracked? |
| In the event of a security breach, how quickly will the third party notify affected customers? |
| Is there a documented, tested incident response plan specific to the software you deliver? |
| 4.2 Logging and Monitoring |
| Are security logs generated for critical application events (e.g., login attempts, data access)? |
| Are logs monitored and reviewed regularly for suspicious activities? |
| Are logs retained for a minimum of 90 days? |
| Are security logs protected from unauthorized access or modification? |
| Do you monitor your product and infrastructure for anomalous or unauthorized behavior? |
5. Compliance and Regulatory Requirements
| 5.1 Compliance Standards |
| Does the application meet any industry security standards or frameworks? (e.g., ISO 27001, SOC 2, NIST, PCI DSS) |
| Please list the relevant compliance certifications the application holds: |
| 5.2 Data Protection Laws |
| Is the application compliant with data protection regulations such as GDPR, CCPA, HIPAA, etc.? |
| Does the third party provide a data processing agreement (DPA) or similar legal document? |
6. Risk Assessment and Continuous Improvement
| 6.1 Risk Assessment |
| Does the third party conduct regular security risk assessments of the application? |
| Are third-party security assessments, such as penetration testing or external audits, conducted periodically? |
| When were the last third-party security assessments performed? |
| 6.2 Security Training and Awareness |
| Do employees involved in the development and operation of the application receive regular security training? |
| Are third-party developers and contractors required to undergo security awareness training? |
7. Additional Information
| Are there any known security issues, vulnerabilities, or challenges with the application? |
| Are there any additional security measures or protocols that the third party employs? |
| Do you maintain a documented information security program endorsed by executive leadership? |
| How often do you perform formal risk assessments related to your software product and delivery? |
| How often do you perform formal penetration testing to your software product? |
8. Hardware Security Practices
| 8.1 Asset Integrity & Supply Chain |
| Do you maintain a bill of materials (BOM) for all hardware components, including sub-tier suppliers? |
| Do you perform security vetting of your suppliers and subcontractors? |
| Are hardware components inspected for tampering or unauthorized modifications before shipment? |
| Do you provide a chain-of-custody record for critical hardware components? |
| 8.2 Hardware Security Features |
| Do your products support hardware-based security features (e.g., TPM, Secure Boot, UEFI protections)? |
| Are firmware and BIOS updates cryptographically signed and verified before installation? |
| Do your devices support hardware-based encryption (e.g., self-encrypting drives)? |
| 8.3 Secure Manufacturing & Physical Security |
| Are your manufacturing facilities protected by physical access controls and surveillance? |
| Do you conduct background checks on personnel with access to sensitive hardware or manufacturing processes? |
| Is tamper-evident packaging used for shipping hardware? |
| 8.4 Maintenance, Updates & End-of-Life |
| Do you provide secure firmware and hardware update mechanisms post-deployment? |
| Do you have a documented process for secure decommissioning and disposal of hardware? |
| Do you notify customers of known hardware vulnerabilities and provide mitigation guidance? |
| 8.5 Compliance & Certifications |
| Are your hardware products certified under any security standards (e.g., FIPS 140-3, Common Criteria, TAA compliance)? |
| Do you conduct third-party security audits or assessments of your hardware security practices? |
| Signature: |
| By completing this questionnaire, you acknowledge that the information provided is accurate to the best of your knowledge and will be used to assess the security posture of the third-party application. |
| Name: |
| Position: |
| Date: |
Sheet2
| Section | Question | Response Options | NIST CSF 2.0 Mapping | C2M2 Mapping | Associated Risk if Not Met |
| Asset Integrity & Supply Chain | Do you maintain a bill of materials (BOM) for all hardware components, including sub-tier suppliers? | Yes / No / Partial | ID.SC-01, ID.SC-04 | RM MIL2+ | Lack of BOM increases risk of counterfeit or malicious components entering the supply chain. |
| Asset Integrity & Supply Chain | Do you perform security vetting of your suppliers and subcontractors? | Yes / No / Partial | ID.SC-02 | RM-2a, RM-2b | Unvetted suppliers may introduce vulnerabilities or compromise product integrity. |
| Asset Integrity & Supply Chain | Are hardware components inspected for tampering or unauthorized modifications before shipment? | Yes / No / Partial | ID.SC-04 | TVM | Tampered hardware can lead to embedded malware or backdoors. |
| Asset Integrity & Supply Chain | Do you provide a chain-of-custody record for critical hardware components? | Yes / No / Partial | ID.SC-05 | RM-3a | Lack of traceability increases risk of undetected tampering during transit. |
| Hardware Security Features | Do your products support hardware-based security features (e.g., TPM, Secure Boot, UEFI protections)? | Yes / No / Partial | PR.PT-01, PR.PT-03 | CM | Absence of hardware protections weakens device integrity and trust. |
| Hardware Security Features | Are firmware and BIOS updates cryptographically signed and verified before installation? | Yes / No / Partial | PR.IP-12 | CM-2b | Unsigned updates can be exploited to install malicious firmware. |
| Hardware Security Features | Do your devices support hardware-based encryption (e.g., self-encrypting drives)? | Yes / No / Partial | PR.DS-01 | DP | Data at rest may be exposed if devices are lost or stolen. |
| Secure Manufacturing & Physical Security | Are your manufacturing facilities protected by physical access controls and surveillance? | Yes / No / Partial | PR.PH-01 to PR.PH-05 | SA | Unauthorized access to manufacturing can lead to hardware tampering. |
| Secure Manufacturing & Physical Security | Do you conduct background checks on personnel with access to sensitive hardware or manufacturing processes? | Yes / No / Partial | PR.AT-01 | WM | Insider threats may go undetected, increasing risk of sabotage. |
| Secure Manufacturing & Physical Security | Is tamper-evident packaging used for shipping hardware? | Yes / No / Partial | PR.PH-03 | RM-2a | Tampering during transit may go unnoticed, compromising device integrity. |
| Maintenance, Updates & End-of-Life | Do you provide secure firmware and hardware update mechanisms post-deployment? | Yes / No / Partial | PR.IP-12 | CM-2a | Insecure update channels can be hijacked to deliver malicious code. |
| Maintenance, Updates & End-of-Life | Do you have a documented process for secure decommissioning and disposal of hardware? | Yes / No / Partial | PR.IP-06 | DP-3a | Improper disposal may lead to data leakage or hardware reuse by adversaries. |
| Maintenance, Updates & End-of-Life | Do you notify customers of known hardware vulnerabilities and provide mitigation guidance? | Yes / No / Partial | DE.CM-08, RS.AN-01 | IR-2a | Delayed disclosure can leave customers exposed to known threats. |
| Compliance & Certifications | Are your hardware products certified under any security standards (e.g., FIPS 140-3, Common Criteria, TAA compliance)? | Yes / No / Partial | ID.GV-03 | RM | Lack of certification may indicate non-compliance with industry best practices. |
| Compliance & Certifications | Do you conduct third-party security audits or assessments of your hardware security practices? | Yes / No / Partial | ID.RA-03 | RM-3b | Absence of independent validation reduces confidence in vendor security claims. |
File details come from the government source that posted it. Updated .