ATTACHMENT F6 - Procurement_Pre-Assessment_Checklist~1.pdf

VENDOR PROCUREMENT

Pre-Assessment Checklist

VENDOR PROCUREMENT Pre-Assessment Checklist 2021.09.15 (FINAL) Page 1 of 2

COMPLETE AND EMAIL TO ASSIGEND PROCUREMENT ANANLYST:

Business Name:

Contact Name: Phone #:

Position / Title: Email:

Brief Goods/Products or Services Description: (continue on a separate sheet if space is insufficient)

OSL Department: RFX Ref #:

OSL Contact:

SECTION I - Select goods and/or services that best identifies your business – check all that apply:

Consultation Services Financial System / Services Game Development / Manufacturing Game Testing Non-Gaming Systems / Human Resources / Payroll

Marketing Online / Mobile Sports Book / Virtual Games Security – physical or logical security systems; IT systems, surveillance, escrow services Telecommunications

SECTION II - Indicate which category best defines your business’s goods and/or services – check all that apply:

CATEGORY A – Goods and/or Services that involve the manufacture or testing of games and/or direct access to gaming systems or gaming information. Complete all of Section III.

CATEGORY B – Goods and/or Services that do not have direct access to gaming systems or gaming information but requires safeguard of sensitive and secure information. Complete Section III A and B only.

CATEGORY C – Goods and/or Services that is non-web-based, non-gaming related or does not have any access to sensitive or gaming information. Complete Section III B only.

SECTION III - MINIMUM REQUIREMENTS – check all that apply:

A) Third Party Attestations / Certification for IT Security – check all that apply and include copies Not Applicable

COBIT ISO Applicable Standards SOC 2 Report Type II – Specific Controls

Fed Ramp NIST Applicable Standards STAR (Security Trust Assurance and Risk)

Other _________________________________________________________________________________________

Other _________________________________________________________________________________________ If you do not have any of the third-party attestations or certificates listed above, please complete the IT Security

Questionnaire (REQUIRED) - submit it together with this pre-assessment checklist.

B) Continuity Plans – check all that apply Not Applicable

Business Continuity Plans (BCP);

Not Applicable – if service is to test instant tickets or is a BCP provider

Disaster Recovery (DR) Plans C) Security – check all that apply Not Applicable

Preliminary Security Questionnaire (REQUIRED) – complete and submit with this pre-assessment checklist

Manufacturing Location Security Plans mailto:Security_Vendors@lottery.oregon.gov

VENDOR PROCUREMENT

Pre-Assessment Checklist

VENDOR PROCUREMENT Pre-Assessment Checklist 2021.09.15 (FINAL) Page 2 of 2

FOR OREGON LOTTERY INTERNAL USE ONLY (PROCUREMENT ANALYST)

Received by (sign and date): Forward to IT and Security (date):

To be completed by IT Department Only Reviewed by (sign and date): Yes No

• Attestation / Certification Questionnaire Required Yes No Compliance met

• Business Continuity Plans Required Yes No Compliance met

• Disaster Recovery Plans Required Yes No Compliance met

To be completed by Security Only Reviewed by (sign and date): Yes No

• Preliminary Security Questionnaire Completed Yes No Noted concerns

• Preliminary Vendor Review Completed Yes No Noted concerns

INSTRUCTIONS

Proposer/Vendor Please complete this form in its entirety. Complete all sections relating to the business, including the sections that relate the goods and services your business offers that pertain to this solicitation.

If there is insufficient space, please continue on a separate sheet and reference the question or section.

Lottery Procurement Analyst Please fill-in the email address of the assigned procurement analyst for submission related to this procurement solicitation.

Complete Oregon Lottery only section on Page 2. Same applies to the Security Preliminary Questionnaire.

Lottery IT Security Section Complete Green Section and forward to Procurement Analyst and Security (VIS) with comments in an email.

Lottery Security - Vendor Investigations Section (VIS) Complete Blue Section and forward to Procurement Analyst with comments on in an email.