Sheet1

Evidence to attach:

• Architecture diagram showing Azure/AWS services

• List of managed services used

• Customer infrastructure requirements (or note 'None' if SaaS)

1.2 Azure/AWS Native Services [List specific Azure or AWS managed services your solution uses]

Evidence:

• Service list with purpose (e.g., 'Azure SQL Managed Instance for primary database')

• Explain any IaaS components and why needed

1.3 Serverless/Microservices [Describe application architecture]

Evidence:

• Architecture diagram

• List of microservices or serverless functions

1.4 Multi-Region Capability [Describe multi-region deployment approach]

Evidence:

• Diagram showing primary and secondary regions

• Failover architecture

• Data replication approach

1.5 Infrastructure as Code [Describe IaC approach and automation]

Evidence:

• Sample IaC code (Terraform, ARM, CloudFormation)

• CI/CD pipeline description

1.6 Container Orchestration [If applicable, describe container strategy]

Evidence:

• Kubernetes/ECS configuration examples

• Container registry approach

REQUIRED Evidence:

• Copy of signed CJIS Information Agreement with state(s)

• List of states with active CJIS agreements

• Description of personnel background check process

• CJIS Security Awareness Training documentation

• If not CJIS compliant, explain path to compliance

2.2 NIST 800-53 / CSF Alignment [Describe NIST compliance]

Evidence:

• SOC 2 Type II report (recent, within 12 months)

• FedRAMP authorization (if applicable)

• 3PAO assessment letter

• Control matrix mapping to NIST 800-53 2.2a FedRAMP/GovRAMP (MANDATORY) [CRITICAL - REQUIRED BY APRIL 1, 2027]

Current Status:

□ GovRAMP Authorized at Moderate Level (attach GovRAMP Letter)

□ FedRAMP Authorized Rev 5 Moderate/High (attach ATO letter)

□ GovRAMP Snapshot enrolled (provide Snapshot Score: ____%)

□ Planning phase (provide detailed timeline below)

□ Not started

If not yet authorized, provide:

• Detailed timeline to achieve authorization by 4/1/2027

• 3PAO engagement letter or vendor selected

• Budget allocated for authorization

• NIST 800-53 Rev 5 gap analysis results

• Commitment letter from executive leadership

• Risk if authorization not achieved by deadline

REQUIRED Evidence:

• GovRAMP Authorization Letter OR Snapshot Score letter

• 3PAO assessment report (if authorized)

• Timeline to authorization with milestones

• State access authorization for GovRAMP portal

2.3 Data Encryption [Describe encryption architecture]

Evidence:

• Encryption architecture diagram

• Key management approach (customer vs. provider managed)

• Encryption algorithms and key lengths

• Key rotation frequency

2.4 Identity & Access Management [Describe IAM capabilities]

Evidence:

• Azure AD/Entra ID integration guide

• Sample SSO configuration

• RBAC role definitions

• MFA support documentation

2.5 Audit Logging & SIEM [Describe logging capabilities]

Evidence:

• List of logged events

• Log export formats (CEF, JSON, syslog)

• Sample log entries

• SIEM integration guide (if available)

2.6 Vulnerability Management [Describe vulnerability scanning and patching]

Evidence:

• Scanning frequency and tools used

• Sample vulnerability scan report (sanitized)

• Patching SLA

• Critical CVE response time

2.7 Penetration Testing [Describe pen testing program]

Evidence:

• Pen test frequency

• Testing firm (3rd party or internal)

• Sample pen test executive summary (sanitized)

• Remediation process and timeline

REQUIRED Evidence:

• VPAT 2.x (Voluntary Product Accessibility Template)

• WCAG 2.0 conformance level: □ Level AA □ Level A □ Not compliant

• Accessibility audit report (if conducted)

• Screen reader compatibility testing results

• Keyboard navigation verification

• Color contrast verification

• Remediation plan for any non-conformant items

Accessibility features provided:

□ Full keyboard navigation

□ Screen reader support (list tested: JAWS, NVDA, etc.)

□ Color contrast compliance (minimum 4.5:1)

□ Alternative text for images

□ Closed captions for video

□ Accessible forms

□ Skip navigation links

□ ARIA landmarks

REMINDER: WCAG 2.0 Level AA is Minnesota state standard per MN Statute. Non-compliance may result in disqualification.

Evidence:

• List of pre-built connectors

• Integration architecture diagram

• Customer references using integrations

• Implementation timeline for custom integrations

Evidence:

• Backup frequency and retention

• DR architecture diagram

• Sample DR drill report

• Automated vs. manual recovery process

Evidence:

• If SaaS: State 'Zero - all infrastructure included'

• If hybrid/IaaS: Provide detailed Azure/AWS cost estimate

• 3-year TCO comparison table

□ CJIS documentation (agreement, compliance summary)

□ SOC 2 Type II report (within 12 months)

□ VPAT 2.x (accessibility)

□ Customer reference list (3+ with contact info)

□ Pricing sheet / cost calculator

□ Sample contract or MSA

□ Security questionnaire (if provided separately)

□ Data Processing Agreement (DPA) / BAA if applicable