ATTACHMENT I - Security Questions from OIT Contracts (Noah Kaplan).pdf
PDF 261 KB Posted
- Attached to
- In-Car Digital Evidence Recording System
- Solicitation number
- RFP RBAA 2019000099 4
- Issued by
- Broomfield County, Denver City, Colorado
About this file
This attachment to Request for Proposal RBAA 2019-0099 outlines security requirements and compliance obligations established by the State of Colorado Information Security Office for vendors responding to the solicitation. The document requires all offerors to demonstrate compliance with the State of Colorado Information Security Policies (CISP) promulgated by the Colorado Chief Information Security Officer and the OIT Technology Standards established by the OIT Chief Technology Officer. Vendors must agree that all personnel performing work under any resulting contract will comply with these policies and standards, and must complete assigned vendor portions of the System Security Plan as directed by the Office of Information Security.
The attachment specifies seven categories of security controls that offerors must address in their proposals: role-based access control for logical interactive access, auditable logs and trails for access and administrative actions, business continuity and disaster recovery planning with defined recovery objectives, third-party certifications or audit results such as SOC 2 Type II or FISMA compliance, documentation of secure system development lifecycle practices, infrastructure hardening consistent with CISecurity.org standards, and any additional policies or procedures related to Colorado Information Security Policies or the NIST Cybersecurity Framework. For each category, offerors must describe how their proposal achieves compliance or explain why a control is inapplicable. Offerors must also disclose any required exceptions from CISP compliance and be prepared to provide evidence supporting their security control responses upon request. All costs associated with implementing the stated security requirements are included in the price proposal, with the awarded offeror responsible for any additional costs to implement or verify security controls.
View the file
Other files
Show all 18
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ATTACHMENT I
State of Colorado Information Security Office
The Proposal shall clearly state, with no exception, agreement to comply with, and to ensure personnel doing work for the State under any contract resulting from this RFP will comply with, the State of Colorado Information Security Policies (CISP) promulgated by the Colorado Chief Information Security Officer and available at http://oit.state.co.us/ois/policies. The Proposal shall clearly state that the Proposal shall be in compliance with the current OIT Technology Standards promulgated by the OIT Chief Technology Officer and available at http://www.oit.state.co.us/cto/ea/standards. The Proposal shall clearly state agreement to complete the assigned vendor portions of the System Security Plan as directed by the Office of Information Security and as reflected in Attachment II - System Security Plan Template.
a. To the extent applicable to the Proposal, Offeror agrees that the Price Proposal includes all costs and expenses for the security requirements stated below. Any additional costs to add security controls or to verify the security controls described below will be the obligation of the Awarded Offeror, and any addition or change to the Price Proposal will be disallowed.
b. For each category of security control listed below, describe how the Proposal will comply, or briefly explain why the control would be inapplicable.
i. Role-based access control (RBAC) for any logical interactive access to applications and/or supporting systems (e.g., user-interface, maintenance);
ii. Auditable logs/trails for successful and attempted access to the application/system, administrative actions such as add/delete/modify user permissions, and/or other auditable events;
iii. Business continuity and disaster recovery planning, including defined recovery time and recovery point objectives;
iv. Third-party certification or audit results that fully covers the scope of the work included in the Proposal, such as a SOC 2 Type II report, FISMA compliance certification, or similar information security assurance certification, or agreement to allow the performance of security audit and penetration tests as requested by OIS or its designee;
v. Documentation of an industry-standard secure system development lifecycle (S- SDLC), including written policies and procedures, documented results of vulnerability scans and/or penetration testing, evidence of and/or plans for remediation of known vulnerabilities, etc.;
vi. Infrastructure hardening consistent with all standards published on CISecurity.org, or similar;
vii. Any additional policy, procedure, practice, or evidence not described above related to compliance with the Colorado Information Security Policies or the NIST Cybersecurity Framework on which the CISPs are based?
page 1 of 2RFP RBAA 2019-0099 http://oit.state.co.us/ois/policies http://oit.state.co.us/ois/policies http://www.oit.state.co.us/cto/ea/standards http://www.oit.state.co.us/cto/ea/standards
c. Will the solution(s) described in the Proposal require any exceptions from compliance with the CISPs or other information security controls described above?
Offeror must detail how the Proposal complies with the requirements above. Offeror must be prepared to provide evidence in connection with any aspect of this answer upon request by the State.
Offeror’s Response:
b.i b.ii b.iii b.iv b.v b.vi b.vii page 2 or 2RFP RBAA 2019-0099
File details come from the government source that posted it. Updated .