Attachment_D_-_Vendor_Questionnaire_RFP_25_PR_8968_Rev._1.xlsx
XLSX spreadsheet 17 KB Posted
- Attached to
- Management Services for Temporary Staffing
- Solicitation number
- PR8968
- Issued by
- Florida
About this file
This is an IT Security Questionnaire attachment for Request for Proposal 25-PR-8968 issued by the Orlando Utilities Commission (OUC) in Florida for management services for temporary staffing. The questionnaire is designed to assess vendor security posture across multiple domains including application security practices, data security and privacy, application infrastructure and hosting security, incident management and monitoring, compliance and regulatory requirements, risk assessment and continuous improvement, and hardware security practices. The RFP solicits proposals for staff augmentation services encompassing temporary administrative, professional, information technology, skilled trade, independent contractor, direct hire, and payrolling services, with a primary deliverable being a secure, user-friendly web-based portal available 24/7 for managing staffing requests, candidate submissions, assignments, time reporting, and reporting functions. The questions/comments deadline is March 11, 2026, with proposals due April 13, 2026 by 2:00 PM EST. The initial contract term is five years with one optional two-year renewal period, and vendors must maintain firm pricing throughout the contract period.
Vendors are required to complete the comprehensive IT Security Questionnaire addressing critical security controls such as secure software development lifecycle practices, vulnerability management programs, multi-factor authentication and role-based access control implementation, data encryption standards (AES-256, TLS 1.2+), secure key management, incident response planning, security logging and monitoring with minimum 90-day retention, and compliance certifications including ISO 27001, SOC 2, NIST, PCI DSS, GDPR, CCPA, and HIPAA. For any cloud-hosted solutions or technology infrastructure, data must be stored and transmitted exclusively within North America, with encryption required for privileged or private data at rest, in transit, and in process. The questionnaire also addresses hardware security practices including bill of materials maintenance, supply chain security vetting, hardware security features such as TPM and Secure Boot support, secure manufacturing and physical security controls, firmware update mechanisms, and third-party security audits or assessments. No specific award values or budget ranges are disclosed; pricing is structured according to service models with mark-up rates specified by labor categories and separate disclosures for MSP program fees, conversion fees, tenure discounts, and independent contractor fees.
View the file
Other files
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
IT Security Questionnaire
| ATTACHMENT D - VENDOR IT SECURITY QUESTIONNAIRE |
| Application Name: |
| Application Developer / Reseller |
| Aplication version |
| Area | Response Yes/ No /Partial | Partial - Please Explain |
| 1. Application Security Practices |
| 1.1 Development Lifecycle |
| Does the third party follow a secure software development lifecycle (SDLC)? |
| Are security requirements incorporated during the design phase of the SDLC? |
| Are security reviews conducted at each phase of the development process? |
| Is static and dynamic application security testing (SAST/DAST) performed during development? |
| Does the application undergo regular security code reviews? |
| 1.2 Vulnerability Management |
| Does the third party have a vulnerability management program in place? |
| How frequently are security patches and updates applied to the application? |
| What is the process for addressing security vulnerabilities reported by third parties, users, or automated tools? |
| How are software vulnerabilities tracked and remediated (e.g., CVE reporting, timelines)? |
| Is your product penetration tested regularly by internal or third-party professionals? |
| Do you perform cybersecurity due diligence for third-party libraries, APIs, and cloud services used in your software? |
| Are third-party dependencies tracked, evaluated for security risk, and updated regularly? |
| 1.3 Authentication and Authorization |
| Does the application support multi-factor authentication (MFA)? |
| Does the application utilize role-based access control (RBAC) to ensure least-privilege access? |
| Are credentials stored using strong cryptographic algorithms (e.g., salted hashes)? |
| Does the application support Single Sign-On (SSO)? |
| Are password policies enforced (e.g., complexity, expiration)? |
| Is access to the software environment and data governed by role-based access controls and MFA? |
2. Data Security and Privacy
| 2.1 Data Encryption |
| Is sensitive data encrypted at rest and in transit? |
| What encryption standards are used (e.g., AES-256, TLS 1.2+)? |
| Is key management performed according to industry standards (e.g., hardware security modules)? |
| 2.2 Data Retention and Disposal |
| Does the third party have a data retention policy in place? |
| How is sensitive data securely disposed of when no longer required? |
| 2.3 Third-Party Data Sharing |
| Does the application share data with any external third parties? |
| If yes, is data sharing governed by contracts or data protection agreements (e.g., GDPR, CCPA)? |
| Are sensitive data exchanges encrypted? |
3. Application Infrastructure and Hosting Security
| 3.1 Environment Security |
| Where is the application development hosted (e.g., cloud, on-premise, hybrid)? |
| Is the hosting environment hardened according to industry best practices? |
| Are servers regularly patched and updated? |
| Is the application development hosted in a segregated network or isolated from other systems? |
| 3.2 Backup and Recovery |
| Are regular backups taken of critical application data and configurations? |
| Are backups encrypted and stored in a secure location? |
| Does the application have a documented disaster recovery plan (DRP)? |
| Has the application undergone disaster recovery testing in the last 12 months? |
4. Incident Management and Monitoring
| 4.1 Security Incident Management |
| Does the third party have a formal incident response plan (IRP) in place? |
| Are security incidents regularly reported and tracked? |
| In the event of a security breach, how quickly will the third party notify affected customers? |
| Is there a documented, tested incident response plan specific to the software you deliver? |
| 4.2 Logging and Monitoring |
| Are security logs generated for critical application events (e.g., login attempts, data access)? |
| Are logs monitored and reviewed regularly for suspicious activities? |
| Are logs retained for a minimum of 90 days? |
| Are security logs protected from unauthorized access or modification? |
| Do you monitor your product and infrastructure for anomalous or unauthorized behavior? |
5. Compliance and Regulatory Requirements
| 5.1 Compliance Standards |
| Does the application meet any industry security standards or frameworks? (e.g., ISO 27001, SOC 2, NIST, PCI DSS) |
| Please list the relevant compliance certifications the application holds: |
| 5.2 Data Protection Laws |
| Is the application compliant with data protection regulations such as GDPR, CCPA, HIPAA, etc.? |
| Does the third party provide a data processing agreement (DPA) or similar legal document? |
6. Risk Assessment and Continuous Improvement
| 6.1 Risk Assessment |
| Does the third party conduct regular security risk assessments of the application? |
| Are third-party security assessments, such as penetration testing or external audits, conducted periodically? |
| When were the last third-party security assessments performed? |
| 6.2 Security Training and Awareness |
| Do employees involved in the development and operation of the application receive regular security training? |
| Are third-party developers and contractors required to undergo security awareness training? |
7. Additional Information
| Are there any known security issues, vulnerabilities, or challenges with the application? |
| Are there any additional security measures or protocols that the third party employs? |
| Do you maintain a documented information security program endorsed by executive leadership? |
| How often do you perform formal risk assessments related to your software product and delivery? |
| How often do you perform formal penetration testing to your software product? |
8. Hardware Security Practices
| 8.1 Asset Integrity & Supply Chain |
| Do you maintain a bill of materials (BOM) for all hardware components, including sub-tier suppliers? |
| Do you perform security vetting of your suppliers and subcontractors? |
| Are hardware components inspected for tampering or unauthorized modifications before shipment? |
| Do you provide a chain-of-custody record for critical hardware components? |
| 8.2 Hardware Security Features |
| Do your products support hardware-based security features (e.g., TPM, Secure Boot, UEFI protections)? |
| Are firmware and BIOS updates cryptographically signed and verified before installation? |
| Do your devices support hardware-based encryption (e.g., self-encrypting drives)? |
| 8.3 Secure Manufacturing & Physical Security |
| Are your manufacturing facilities protected by physical access controls and surveillance? |
| Do you conduct background checks on personnel with access to sensitive hardware or manufacturing processes? |
| Is tamper-evident packaging used for shipping hardware? |
| 8.4 Maintenance, Updates & End-of-Life |
| Do you provide secure firmware and hardware update mechanisms post-deployment? |
| Do you have a documented process for secure decommissioning and disposal of hardware? |
| Do you notify customers of known hardware vulnerabilities and provide mitigation guidance? |
| 8.5 Compliance & Certifications |
| Are your hardware products certified under any security standards (e.g., FIPS 140-3, Common Criteria, TAA compliance)? |
| Do you conduct third-party security audits or assessments of your hardware security practices? |
| Signature: |
| By completing this questionnaire, you acknowledge that the information provided is accurate to the best of your knowledge and will be used to assess the security posture of the third-party application. |
| Name: |
| Position: |
| Date: |
File details come from the government source that posted it. Updated .