ATTM 022(a).pdf
PDF 121 KB Posted
- Attached to
- MEDICAID CLINICAL DATA EXCHANGE
- Solicitation number
- 5400030026
- Issued by
- Richland County, South Carolina
About this file
This is a Service Provider Security Assessment Questionnaire (SPSAQ) attachment used by state and local government entities to evaluate contractor security capabilities and compliance. The document serves as a standardized assessment tool that prospective service providers must complete as part of the contract bidding process. The questionnaire does not specify particular products or services, response dates, due dates, site visits, or award information, as it functions as a generic security evaluation instrument applicable to various contract opportunities requiring government information access.
The SPSAQ requires contractor responses addressing twelve critical security dimensions, including access control policies, disaster recovery and business continuity planning, employee and subcontractor vetting procedures, third-party security policies, and relevant compliance certifications such as ISO/IEC 27001 or AICPA SOC 2 reports. Contractors must detail data encryption practices for information at rest, in transit, and during backup; physical security measures for data centers; breach detection controls and audit logging procedures; incident response protocols; and post-contract data deletion procedures. The questionnaire mandates identification of any third parties with access to government information and requires an authorized contractor representative to sign and certify the accuracy of all responses. Pricing terms, set-asides, incumbents, and funding sources are not addressed in this assessment document.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Amendment 1.pdf | ||
| Amendment 2.pdf | ||
| PL 001.pdf | ||
| ATTM 003.pdf | ||
| ATTM 005.pdf | ||
| PL 005.pdf | ||
| ATTM 025.pdf | ||
| ATTM 019.pdf | ||
| ATTM 013.xlsx | XLSX spreadsheet | |
| ATTM 004.pdf | ||
| ATTM 018.pdf | ||
| ATTM 023.pdf | ||
| PL 004.pdf | ||
| ATTM 017.pdf | ||
| ATTM 010.pdf | ||
| PL 002.pdf | ||
| ATTM 002.pdf | ||
| ATTM 007.pdf | ||
| ATTM 022(b).xlsx | XLSX spreadsheet | |
| ATTM 020.pdf | ||
| ATTM 009.xlsx | XLSX spreadsheet | |
| _MCDE RFP.pdf | ||
| ATTM 015.pdf | ||
| ATTM 006.pdf | ||
| ATTM 024.pdf | ||
| PL 003.pdf | ||
| ATTM 001.pdf | ||
| ATTM 008.xlsx | XLSX spreadsheet | |
| ATTM 014.pdf | ||
| ATTM 012.xlsx | XLSX spreadsheet | |
| ATTM 011.pdf | ||
| ATTM 021.pdf | ||
| ATTM 016.pdf |
Show all 33
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
ATTACHMENT 022(a)
SERVICE PROVIDER SECURITY ASSESSMENT QUESTIONNAIRE (SPSAQ)
Instructions: (1) Attach additional pages or documents as appropriate and make sure answers cross reference to the questions below. (2) As used in this Questionnaire, the phrase "government information" shall have the meaning defined in the clause titled "Information Security." (3) This Questionnaire must be read in conjunction with both of the following two clauses (a) Service Provider Security Assessment Questionnaire - Required, and (b) Service Provider Security Representation.
1. Describe your policies and procedures that ensure access to government information is limited to only those of your employees and Contractors who require access to perform your proposed services.
2. Describe your disaster recovery and business continuity plans.
3. What safeguards and practices do you have in place to vet your employees and Contractors who will have access to government information?
4. Describe and explain your security policies and procedures as they relate to your use of your Contractors and next-tier Subcontractors.
5. List any reports or certifications that you have from properly accredited third-parties that demonstrate that adequate security controls and assurance requirements are in place to adequately provide for the confidentiality, integrity, and availability of the information systems used to process, store, transmit, and access all government information. (For example, an ISO/IEC 27001 compliance certificate, an AICPA SOC 2 (Type 2) report, or perhaps an AICPA SOC 3 report (i.e., a SysTrust or WebTrust seal)). For each certification, describe the scope of the assessment performed. Will these reports / certifications remain in place for the duration of the Contract? Will you provide the state with most recent and future versions of the applicable compliance certificate / audit report?
6. Describe the policies, procedures and practices you have in place to provide for the physical security of your data centers and other sites where government information will be hosted, accessed or maintained.
7. Will government information be encrypted at rest? Will government information be encrypted when transmitted?
Will government information be encrypted during data backups, and on backup media? Please elaborate.
8. Describe safeguards that are in place to prevent unauthorized use, reuse, distribution, transmission, manipulation, copying, modification, access or disclosure of government information.
9. What controls are in place to detect security breaches? What system and network activity do you log? How long do you maintain these audit logs?
10. How will government information be managed after Contract termination? Will government information provided to the Contractor be deleted or destroyed? When will this occur?
11. Describe your incident response policies and practices.
12. Identify any third party which will host or have access to government information.
Offeror’s response to this questionnaire includes any other information submitted with its offer regarding information or data security.
SIGNATURE OF PERSON AUTHORIZED TO REPRESENT THE ACCURACY OF THIS INFORMATION ON
BEHALF OF CONTRACTOR:
By: ____________________________________ (Authorized signature)
Its: ____________________________________ (Printed name of person signing above)
(Title of person signing above)
Date: ____________________________________
SPSAQ (FEB 2015) [09-9025-1]
File details come from the government source that posted it. Updated .