Attachment L11 - Revised Service Category 11 Response.docx

Digital Security Solutions RFP No. 24-43230000-RFP Revised Attachment L11 – Service Category 11: Governance, Risk, and Compliance (GRC)

Respondent Name: Respondent Name Goes Here Solution Name: Solution Name Goes Here

Respondent Instructions:

· Respondents shall use this Attachment as provided to respond. Altering character count limits or any other restriction or control may result in a Respondent being found non-responsive.

· Names. Respondents must provide their name and the proposed Solution name in the spaces above.

· Section 1 Prompts. Section 1 of this attachment provides prompts. The Respondent shall provide a response to prompt 1 and should provide responses to prompts 2 through 8. Prompts are indicated by red text followed by a response block.

Prompt 1 has a maximum of 3000 characters. Prompts 2 through 8 have a maximum character limit of 500. Respondents who submit responses outside of the maximum character limit may be deemed non-responsive. Any additional files, links, or other information provided outside the response block will not be considered for evaluation.

Scores will be assigned by each individual evaluator in accordance with Attachment C, Evaluation Criteria. Prompt 1 is worth a total of 5 points. Prompts 2 through 8 are worth a maximum of 4 points total. An individual Evaluator’s score of the technical response for a proposed Solution will be calculated by the following:

Evaluator’s Prompt 1 score + (Sum of Evaluator’s Score for Prompts 2-8 / 7) = Evaluator’s Technical Response Score

· Section 2 Terms and Conditions. Section 2 of this attachment provides a space for the Respondent to include any Service Level Agreements (SLA) or additional terms and conditions that apply to the proposed Solution. Neither the SLAs nor the additional terms and conditions will be considered for evaluation.

· Definitions. Definitions contained in Attachment A, Statement of Work, are incorporated by reference.

Section 1. Prompts.

Prompt 1: GRC Solutions should provide a structured approach to managing governance frameworks, assessing enterprise risks, and ensuring compliance with industry regulations. The Solution must facilitate the development of policies, automate compliance checks, and enable risk management and assessment workflows that align with business objectives.

Please describe how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 1 Response Goes Here

For the prompts below (indicated by red text followed by a response block), the Respondent should provide details on if and how the Solution meets the identified technical capabilities and features.

Prompt 2: Centralized Policy Management – Solution should allow the creation, distribution, and tracking of governance frameworks, compliance guidelines, and operational policies. The Solution should support version control and electronic signatures for policy acceptance.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 2 Response Goes Here

Prompt 3: Risk Assessment Tools – Solution should enable organizations to identify, assess, and prioritize risks across departments or business units based on likelihood and impact.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 3 Response Goes Here

Prompt 4: Risk Mitigation and Treatment Workflows – Solution should allow teams to define and track risk response plans, assign responsibilities, and monitor progress toward mitigation goals.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 4 Response Goes Here

Prompt 5: Audit Management Capabilities – Solution should support the planning, scheduling, and execution of internal and external audits. The platform should automatically generate audit reports, track findings, and ensure follow-up actions are completed.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 5 Response Goes Here

Prompt 6: Compliance Tracking – Solution should include industry-specific regulations (e.g., NIST CSF, GDPR, HIPAA, PCI-DSS), with automated controls and real-time monitoring to detect non-compliance or control failures.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 6 Response Goes Here

Prompt 7: Customizable Risk Dashboards – Solution should provide executives with an overview of key risks, compliance metrics, and the overall health of the governance program. Dashboards should display real-time data and support drill-down views for detailed analysis.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 7 Response Goes Here

Prompt 8: Third-Party Risk Management – Solution should facilitate the assessment of third-party vendor risks and perform due diligence on vendors' compliance and risk management practices.

Please describe if and how Respondent’s proposed Solution meets the above prompt in the field below.

Prompt 8 Response Goes Here

Section 2. Service Level Agreement or Additional Terms and Conditions.

Respondent shall include any Service Level Agreements (SLAs) or additional terms and conditions that apply to the proposed Solution in the following text boxes. The text boxes below have a maximum character limit of 32,672 characters each. The information provided in the text boxes below will not be scored but will be incorporated into the final Term Contract documents as an exhibit.

Any Applicable SLA Goes Here Any applicable Addtional Terms and Conditons Goes Here