7360022802Cloud_RFQChecklist_PRB02.xlsx
XLSX spreadsheet 30 KB Posted
- Contract number
- 22802
- Issued by
- New York
About this file
This document is a Cloud Solution Request for Quotation (RFQ) Checklist developed by the New York State Office of General Services (OGS) Procurement Services for Group 73600, Award 22802 IT Umbrella Contracts - Manufacturer Based. The checklist is designed to guide authorized users through the process of procuring cloud solutions under a state contract, providing a comprehensive framework for evaluating and selecting cloud service providers.
The checklist covers multiple critical aspects of cloud solution procurement, including data classification, cloud service models, deployment models, statutory requirements, security considerations, and performance expectations. It addresses key elements such as data encryption, security incident response, data breach protocols, maintenance agreements, and contractor performance metrics. The document allows for flexibility in procurement by enabling authorized users to customize their requirements across various cloud service models (IaaS, PaaS, SaaS, XaaS) and deployment models (public, private, hybrid, community). The contract includes provisions for small business, minority-owned business, women-owned business, and service-disabled veteran-owned business participation, with a maximum contract duration of 60 months and options for fixed pricing, volume adjustments, and potential future enhancements.
View the file
Other files
Show all 30
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Check List
| APPENDIX G.5 - CLOUD - RFQ - CLOUD SOLUTION CHECK LIST |
| OGS highly recommends that all Authorized Users read and become familiar with the Contract, Appendices, Attachments & Appendix G, How to Use the Manufacturer Umbrella Contract before utilizing this checklist in conjunction with drafting an RFQ. Areas that Authorized Users may need to address when procuring their specific Cloud Solution may include but not be limited to what is listed below. |
| SCOPE | YES | NO | N/A |
| Does the Cloud Solution fit the Scope of the Contract? |
| ADDITIONAL LOTS | YES | NO | N/A | |
| Does the Cloud Solution require the utilization of an additional lot(s)? | ||||
| If yes, which additional lot(s) is needed: | ||||
| Lot 1 | ||||
| Lot 2 | ||||
| Lot 4 |
| DATA CLASSIFICATION / LEVEL OF RISK | YES | NO | N/A | |
| Has the Data been evaluated and classified into a risk level? (Mandatory) | ||||
| What is the Risk Level of the Data (Low, Medium or High): | ||||
| Low Risk Data | ||||
| Medium Risk Data | ||||
| High Risk Data | ||||
| Please note, if an Authorized User determines their Data to be High Risk, then it is Mandatory that the winning bidder have High Risk at the time of the RFQ response due date. Please refer to Section 2.1.2 Data Categorization in Appendix G.g – How to Use the Manufacturer Umbrella Contract – Cloud Solution Supplement. | ||||
| Does the Authorized User require additional insurance (that exceeds what is already required as per the Contract)? | ||||
| Will the Authorized User allow a Contractor who has insurance coverage for a lower risk level additional time to obtain enough insurance to respond to an RFQ that has a higher risk level requirement? If so, please provide adequate time for the Contractors to increase their risk levels and for OGS to approve these new levels in time for the RFQ Response due date. Please refer to a Contractor's Appendix D to see which risk level they hold. | ||||
| Has the Authorized User communicated the Data Classification and associated Level of Risk to the bidder pool? | ||||
| CLOUD SERVICE MODEL | YES | NO | N/A | |
| What Category is the desired Cloud Solution considered: | ||||
| (More information pertaining to the Cloud Service Models can be found via: http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf ) | ||||
| Infrastructure as a Service (IaaS) | ||||
| Platform as a Service (PaaS) | ||||
| Software as a Service (SaaS) | ||||
| Anything as a Service (XaaS) | ||||
| Other |
| CLOUD DEPLOYMENT MODELS | YES | NO | N/A | |
| Which Cloud deployment model is requested: | ||||
| (More information pertaining to the Cloud Deployment Models can be found via: http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf ) | ||||
| Community Cloud | ||||
| Hybrid Cloud | ||||
| Private Cloud | ||||
| Public Cloud | ||||
| Other |
| STATUTORY / POLICY REQUIREMENTS | YES | NO | N/A | |
| Are their any laws, policies, regulations and/or rules that the Authorized User requires Contractor to be in compliance with? | ||||
| Does the Authorized User require Contractor compliance with an NYS ITS Policy(s)? | ||||
| Do any of the following NYS ITS Policies (or successor policies) apply: | ||||
| P03-002 - Information Security Policy | ||||
| P08-001 - Enterprise Plan to Procure |
Policy
| P08-005 - Accessibility of Web-Based Information and Application | ||||
| S13-002 - Information Classification Standard | ||||
| S13-003 - Sanitation/Secure Disposal | ||||
| S13-005 - Cyber Incident Response Standard | ||||
| S14-002 - Information Classification Standard | ||||
| S14-003 - Information Security Controls | ||||
| S14-006 - Authentication Tokens Standard | ||||
| S14-007 - NYS Encryption Standard | ||||
| S14-010 - Remote Access | ||||
| Other(s) | ||||
| STATUTORY / POLICY REQUIREMENTS (continued) | YES | NO | N/A | |
| Do any of the following National Institute of Standards and Technology (NIST) Policies (or successor policies) apply: | ||||
| NIST Federal Information Processing Standard (FIPS) Publication 140-2 | ||||
| NIST Federal Information Processing Standards (FIPS) Publication 199 – Standards for Security Categorization of Federal Information and Information Systems | ||||
| NIST Special Publication 800-53 - Security and Privacy Controls for Federal Information Systems and Organizations. | ||||
| NIST Special Publication 800-57, Part 1 - Recommendation for Key Management – Part 1: General | ||||
| NIST Special Publication 800-088r1 - Guidelines for Media Sanitization | ||||
| NIST Special Publication 800-111 - Guide To Storage Encryption Technologies For End User Devices | ||||
| NIST Special Publication 800-122 - Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) | ||||
| NIST Special Publication 800-131A - Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths | ||||
| Other(s) | ||||
| Do any of the following (or their successors) apply: | ||||
| New York State Information Security Controls Standard | ||||
| New York State Risk Management Standard | ||||
| Health Insurance Portability and Accountability Act of 1996 | ||||
| Other(s) | ||||
| Have the applicable laws, policies, rules and regulations that apply been communicated to the Contractor? | ||||
| CAIQ REQUIRMENT / CONTRACTOR SECURITY | YES | NO | N/A | |
| Is a Consensus Assessment Initiative Questionnaire (CAIQ) required to be submitted by the Contractor? | ||||
| Is the Authorized User retaining the right to request the CAIQ annually? | ||||
| Is a Written description of Contractor's physical/virtual security and/or internal control processes required? | ||||
| Has the Authorized User specified the required format that Security Logs and Reports need to be in when they are requested? | ||||
| MODIFICATION TO CLOUD SOLUTION | YES | NO | N/A | |
| Has the Authorized User set forth how/when they want to be notified if there are fundamental changes to the Cloud Solution? | ||||
| Has the Authorized User retained the right to review the changes and re-assess the risk mitigation methodologies and strategies and to revise the Authorized User Agreement as needed? |
| DATA ACCESS | YES | NO | N/A | |
| Has the required amount of uptime been addressed? | ||||
| Has the acceptable amount of downtime been addressed? | ||||
| Have the desired dates and times for acceptable downtime been set forth? | ||||
| Has the Authorized User dictated that the Data must remain in CONUS? | ||||
| Does the Authorized User want to allow for Application Programming Interfaces (API) (or similar feature) to access their Data? | ||||
| Does the Authorized User require their Data to be backed up? | ||||
| Has the Authorized User described the process a Contractor (and/or an affiliate of the Contractor) needs to go through to gain access to the Authorized User's Data? | ||||
| Has the Authorized User set forth a process and/or Written agreement for the Contractor (or an affiliate of the Contractor) to access Authorized User's Data in any form? | ||||
| Does the Authorized User want to designate a point of contact to authorize access to the Authorized User's data? | ||||
| Has the Authorized User advised Contractor how to handle requests for Data by Third Parties? | ||||
| Are Authentication Tokens required? | ||||
| If yes, do Authentication Tokens need to be in compliance with NYS ITS Policy S14-006 (or successor policy)? | ||||
| Should the Contractor be able to copy or transfer Data? | ||||
| Has the Authorized User addressed whether or not the Contractor is allowed to conduct Data Mining, cross tabulate, monitor Authorized User’s Data usage and/or access, or perform any other Data Analytics? | ||||
| If yes, have the details been addressed? | ||||
| DATA ENCRYPTION | YES | NO | N/A | |
| Has Data Encryption been addressed? | ||||
| If yes, does the proposed method of Encryption meet or exceed NYS-S14-007 (or successor policy)? | ||||
| When does the Data need to be Encrypted: | ||||
| At All Times | ||||
| DATA ENCRYPTION (continued) | YES | NO | N/A | |
| In Use | ||||
| In Transit | ||||
| At Rest | ||||
| Has the Authorized User addressed what they are responsible for regarding Encryption? | ||||
| Has the Authorized User determined who will have access to the encryption key? | ||||
| Has the Authorized User addressed what the Contractor is responsible for regarding Encryption? | ||||
| SECURITY INCIDENT | YES | NO | N/A | |
| Have Data Security Provisions been set forth? | ||||
| Does the Authorized User have or did they create a Security Incident Response Plan? | ||||
| Is the Security Incident Response Plan in compliance with ITS Policy NYS-P03-002 (or successor policy)? | ||||
| Has the Authorized User addressed what they are responsible for if there is a Security Incident? | ||||
| Has the Authorized User addressed what the Contractor is responsible for if there is a Security Incident? | ||||
| DATA BREACH | YES | NO | N/A | |
| Has the Authorized User set forth a Designated Contact and at least one telephone # to be notified if there is a Data Breach? | ||||
| Is being notified within 24 hours of a confirmed Data Breach acceptable to the Authorized User? | ||||
| If no, has the Authorized User set forth a timeframe less than 24 hours for notification of a data breach in the RFQ? | ||||
| Has the Authorized User set forth the same timeframe as set forth in the RFQ for notification of a data breach in the Authorized User Agreement? | ||||
| Does the Authorized User have coordinated incident response plan? (Mandatory) | ||||
| If no, has the Authorized User created a coordinated incident response plan? (Mandatory) | ||||
| Has the Authorized User addressed what they are responsible for if there is a Data Breach? | ||||
| Has the Authorized User addressed what the Contractor is responsible for if there is a Data Breach? | ||||
| Is there a set timeframe for corrective action to be taken if there is a Data Breach? |
| DATA TRANSFER / RETURN | YES | NO | N/A | |
| Have provisions been set forth for the Data Transfer Plan? | ||||
| Has the Authorized User set forth the specific format that their Data needs to be returned to in (i.e. - Microsoft Excel, Microsoft Word…) | ||||
| Does the Authorized User want to allow for an Application Program Interface (API) (or similar feature) for the return or transfer of their Data? | ||||
| Does the Authorized User currently need services to transfer Data from existing Databases to physical storage devices or to facilitate movement of large volumes of Data? | ||||
| Has the Authorized User addressed a possible future need for services to transfer Data from existing Databases to physical storage devices or to otherwise facilitate movement of large volumes of Data? | ||||
| Has the Authorized User addressed a possible future need for services to transfer Data from existing Databases to physical storage devices or to otherwise facilitate movement of Data at the end of the Authorized User Agreement? | ||||
| Will the Authorized User require the Contractor to transfer Data to a new Contractor? | ||||
| Has the Authorized User advised the Contractor that there may by a need for cloud services to overlap when the Authorized User is transitioning between providers? | ||||
| Is the Authorized User willing to pay for the transfer of Data? | ||||
| Is there a payment provision for the last 6 months of services that may be needed in order to transition the Data? | ||||
| DATA DESTRUCTION | YES | NO | N/A | |
| Have provisions been set forth for Data Destruction? | ||||
| Does the storage medium holding the Data need to be destroyed (if applicable)? | ||||
| If yes, are there instructions pertaining to how the storage medium holding the Data needs to be destroyed? | ||||
| If yes, is the method of destruction in compliance with ITS S13-003 and S14-003 (or successor policies)? | ||||
| Does the Data require Cryptographic Erase/Cryptographic Key Destruction? | ||||
| If yes, do the Cryptographic Erase procedures need to meet or exceed NIST 800-088r1 or NIST 800-57, Part 1? | ||||
| Has the Authorized User set forth their responsibilities for Cryptographic Key Destruction? | ||||
| Has the Authorized User set forth the Contractor's responsibilities for Cryptographic Key Destruction? | ||||
| Is a Certificate of Destruction required for the Data? | ||||
| If yes, does the Certificate of Destruction need to meet a particular standard? | ||||
| THINGS TO CONSIDER | YES | NO | N/A | |
| Has the Authorized User advised of their contact information? | ||||
| Does the desired Cloud Solution require a Pre-Installation Site Visit? | ||||
| If yes, have the details of a Pre-Installation Site Visit been set forth? | ||||
| THINGS TO CONSIDER (continued) | YES | NO | N/A | |
| Does the Authorized User want to have a kick off meeting with the Contractor? | ||||
| Does the Authorized User want to utilize the polling document? | ||||
| Is the Authorized User willing to utilize an Application Program Interface (API) or other electronic portal for various purposes? | ||||
| Does the Authorized User want to negotiate more advantageous terms and conditions than those originally established with the Manufacturer Umbrella Contract and Attachments (Specifically Appendix B) be included to allow for lower prices or other Cloud Solution specific advantages? | ||||
| If yes, do any of the more advantageous terms and conditions conflict with the carved out sections as listed in Appendix B, Section 28 (C)? (Mandatory) | ||||
| Has it been made clear that the Cloud Solution can not exceed 60 months? | ||||
| Have the goals for SBs, MBEs, WBEs and/or SDVOBs been considered? | ||||
| Do Prevailing Wage Rates need to be addressed? | ||||
| Does Living Wage need to be addressed? | ||||
| Has the Authorized User set forth their particular security procedures? | ||||
| Has the Authorized User drafted a Statement of Work that will need to be negotiated with a Contractor to formalize all functional requirements and then be incorporated into the Authorized User Agreement? (Highly Recommended - See below for additional details) | ||||
| Has the Authorized User stated that the Contractor is required to identify all Warranties, Guaranties, Service Level Agreements, Performance Standards, Service Commitments, Credits, etc… that relate to the Cloud Solution offering? (Highly Recommended) | ||||
| Is the Authorized User prepared to negotiate a Service Level Agreement (SLA) and incorporate the same into the Authorized User Agreement? | ||||
| Has the Authorized User set forth that they will not accept Service Level Objectives/Goals (SLOs)? (Highly Recommended) | ||||
| Has a date been set to start planning for a replacement Cloud Solution (at least 1 year prior to the expiration of the Cloud Solution that this RFQ pertains to)? | ||||
| Has the Authorized User's Legal Department reviewed the request to procure the Cloud Solution? | ||||
| PRICING | YES | NO | N/A | |
| Does the Authorized User require fixed pricing over the life of the Authorized User Agreement based upon the Umbrella Contract - Manufacturer Based Price List? | ||||
| Does the Authorized User want to entertain Cloud Solutions that have SKUs on the Umbrella Contract- Manufacturer Based Price List for pre-set price increases over the life of the Authorized User Agreement? | ||||
| Does the Authorized User want to utilize Retainage? | ||||
| Does the Authorized User want to reserve the right for unanticipated Enhancements? | ||||
| Does the Authorized User desire to include language that allows pricing to be held for Products that may be re-purchased within the next 6 to 12 months? (Recommended) | ||||
| Does the Authorized User want to include language that allows for a fixed price discount to meet future needs? (Recommended) | ||||
| Does the Authorized User want to include language that allows them to apply the discount from the list price for all other Products or services that may fit within the original RFQ Scope for unforeseen future needs or technological developments? (Recommended) | ||||
| INCREASE / DECREASE OF USAGE | YES | NO | N/A | |
| Have costs related to the use of the Cloud Solution at current levels as well as changes in Volume been considered? | ||||
| If yes, have costs pertaining to changes in volume been incorporated into the evaluation/method of award? | ||||
| Has the Cost per unit to expand current usage volume, including additional volume discount tiers, been considered? | ||||
| Has the Cost per unit resulting of a decrease in Authorized User's volume been considered? | ||||
| Are notification timeframes for increases and/or decreases in commitments required? | ||||
| Have emergency increases in usage that may temporarily increase costs been considered? | ||||
| Has the Authorized User considered saving money by purchasing a preconfigured Cloud Solution instead of a Custom Cloud Solution? | ||||
| Has the Total Cost of Ownership been considered? | ||||
| Should the cost of stored Data be based upon availability? | ||||
| MAINTENANCE / SUPPORT AGREEMENT | YES | NO | N/A | |
| Are Maintenance/Support Services required? | ||||
| If yes, does the Maintenance/Support Agreement identify the following: | ||||
| Scope of Services | ||||
| Service Level Agreements | ||||
| Service Level Agreement Penalties/Rewards | ||||
| Guarantee for Support Availability | ||||
| Guarantee for Response Time | ||||
| MAINTENANCE / SUPPORT AGREEMENT (continued) | YES | NO | N/A | |
| Delivery and Acceptance Timeframes and Procedures | ||||
| Time Commitments & Prioritization of Services | ||||
| Preventive and Corrective Maintenance/Support Activities | ||||
| Reporting Requirements/Problem Escalation and Follow-Up Procedures | ||||
| Who Can Request Support on the Behalf of the Authorized User | ||||
| How Support Can be Accessed | ||||
| Error Notification and Correction Process | ||||
| Minimum Timeframe within the Contractor Must Notify the State Prior to Making Changes to Existing Technical Access Requirements | ||||
| Other(s) | ||||
| Does the Authorized User want to allow Maintenance/Support Agreement to automatically renew? | ||||
| If yes, has the Authorized User set up a mechanism to remind them that they can cancel the automatic renewal provision via Written notice no later than 30 calendar days prior to the anniversary date of the Authorized User Agreement? | ||||
| Has the Authorized User set up a mechanism to force them to cancel the automatic renewal provision via Written notice no later than 30 calendar days prior to the end date of the Authorized User Agreement? | ||||
| Are Service Sheets for all Maintenance/Support requests required? | ||||
| If yes, has the Authorized User specified that the Service Sheets must include the following: | ||||
| Date and Time Notified by Authorized User | ||||
| Date and Time of Arrival of Contractor | ||||
| Description of Malfunction Reported by Authorized User | ||||
| Diagnosis of Failure and Work Performed by Contractor | ||||
| Date and Time Failure was Corrected | ||||
| Charges for the Service | ||||
| Name of Person Performing the Service | ||||
| Other(s) | ||||
| Is Remote Administration, Maintenance and Support required? | ||||
| Has the Authorized User addressed that Support services that do not directly or indirectly access Data may be provided in a Follow the Sun format? | ||||
| Has the Authorized User stated the days and hours when the system may be unavailable for maintenance? | ||||
| If yes, is it ensured that maintenance occurs during periods of little or no demand? | ||||
| SERVICE REPORTS | YES | NO | N/A | |
| Are Service Reports desired by the Authorized User? | ||||
| If yes, did the Authorized User advise how they want to receive the Service Reports? | ||||
| If yes, has the Authorized User set forth the information they want in the Service Reports such as the following: | ||||
| Date and Time Contractor was Notified | ||||
| Date and Time of Contractor's Arrival | ||||
| Make and Model of the Product | ||||
| Description of Malfunction Reported by the Authorized User | ||||
| Diagnosis of Failure and/or Work Performed by Contractor | ||||
| Date and Time Failure was Corrected by Contractor | ||||
| Type of Service - Maintenance/Support or Warranty | ||||
| Charges, if any, for the Service | ||||
| Other(s) | ||||
| Would the Authorized User accept a duplication of Appendix H, Maintenance and Warranty Service Report (which may be requested by OGS)? | ||||
| CONTRACTOR'S ASSOCIATES | YES | NO | N/A | |
| Are background checks required for certain Contractor Staff? | ||||
| Does the Authorized User require the separation of job duties? | ||||
| Is it a requirement that Contractor staff knowledge of Data be limited to that which is absolutely needed to perform job duties? | ||||
| Is it stated that Contractors must identify and detail all Reseller/Subcontractor relationships in regards to the Cloud Solution and implementation thereof? | ||||
| Has the Authorized User addressed how they intend to handle staffing changes of the Contractor or its Subcontractor? | ||||
| CONTRACTOR PERFORMANCE | YES | NO | N/A | |
| Does the Authorized User want to assess the Contractor's performance either independently or via a third party at the Authorized User's expense? | ||||
| Has the Authorized User set forth the materials that they may request the Contractor to produce? | ||||
| Has the Authorized User set forth the parameters that may be used to monitor performance such as the following: | ||||
| Uptime | ||||
| Downtime | ||||
| CONTRACTOR PERFORMANCE (continued) | YES | NO | N/A | |
| Amount of Time that is Acceptable for an Error Correction | ||||
| Acceptable Level of Latency | ||||
| Recovery Time Objective | ||||
| Recovery Point Objective | ||||
| Timeliness of Incident Reporting | ||||
| Incident Resolution Times | ||||
| Subcontractor Performance | ||||
| Page Load Times | ||||
| Other(s) | ||||
| Does the Authorized User require performance, payment or Bid Bond, or negotiable irrevocable letter of credit or other form of security for faithful performance of the Authorized User Agreement? | ||||
| Does the Authorized User want to list the consequences for failure to perform? | ||||
| If yes, are the consequences in compliance with the Contract and Appendix B? | ||||
| Are there remedies for failure to perform? | ||||
| If yes, are the remedies in compliance with the Contract and Appendix B? |
| DISPUTE RESOLUTION | YES | NO | N/A |
| Has the Authorized User set forth a bid dispute resolution process? | |||
| Has the Authorized User developed and communicated an Authorized User Agreement dispute resolution process? | |||
| Has the Authorized User set forth how they need their Data returned to them in the event there is a dispute during the Authorized User Agreement? |
| MANAGED SERVICES, ETC… | YES | NO | N/A | |
| Are Managed Services required? | ||||
| If yes, have the minimum requirements for Managed Services been set forth? | ||||
| Is Remote Administration required? | ||||
| If yes, have the minimum requirements for Remote Administration been set forth? | ||||
| BUSINESS CONTINUITY / DISASTER RECOVERY | YES | NO | N/A | |
| Does the Authorized User wish to have a Business Continuity / Disaster Recover (BC/DR) plan in place? | ||||
| Has a BC/DR plan been drafted by the Authorized User? | ||||
| Will the Authorized User accept and/or negotiate a BC/DR plan as drafted by the Contractor? | ||||
| Has the Authorized User addressed what they are responsible for in the BC/DR plan? | ||||
| Has the Authorized User addressed what the Contractor is responsible for in the BC/DR plan? | ||||
| Does the Contractor need to specify how the BC/DR plan will impact the uptime? | ||||
| ENVIRONMENTAL / RECYCLING | YES | NO | N/A | |
| Does the Cloud Solution include a Product that will require physical disposal? | ||||
| If yes, is there a policy(s) that will need to be complied with? | ||||
| Is a Record of Disposition required? | ||||
| If yes, has the preferred or required documentation of the disposition been specified? | ||||
| EXPIRATION, TERMINATION OR SUSPENSION OF SERVICES | YES | NO | N/A | |
| Does the Authorized User have an exit strategy in place? | ||||
| Have additional specifics about Suspension of Services been addressed? | ||||
| Does the Authorized User want to address any specifics pertaining to Remedies for Breach of contract? | ||||
| Has the Authorized User set forth expectations for Expiration or Termination of Services? | ||||
| Has a timeframe been set for the return of Data? | ||||
| Does the Authorized User envision needing full access to their Data for more than 60 calendar days after an expiration or termination of an Authorized User Agreement? | ||||
| STATEMENT OF WORK (HIGHLY RECOMMENDED) | YES | NO | N/A | |
| Has the Authorized User drafted a Statement of Work that will need to be negotiated with a Contractor to formalize all functional requirements for the Authorized User Agreement? | ||||
| If yes, has the Authorized User addressed all desired concepts which can include but not be limited to: | ||||
| Project Plan - Milestones / Timeframes | ||||
| Project Plan - Dependencies | ||||
| Project Plan - Roles & Responsibilities | ||||
| Project Plan - Knowledge Transfer | ||||
| Project Plan - Other Decision Points | ||||
| Project Timeline (i.e. Site Visits, Question & Answer Period, etc…) | ||||
| Language to Retain Discounts for Product/Service Purchases | ||||
| Background Checks | ||||
| Deliverables/Payment Points and Retainage | ||||
| Key Personnel Interviews | ||||
| STATEMENT OF WORK (HIGHLY RECOMMENDED) (continued) | YES | NO | N/A | |
| Location Where Work Will Be Performed | ||||
| Risk Projections and Mitigation Strategies Based on the Presented RFQ | ||||
| Uptime | ||||
| Downtime | ||||
| Response Time | ||||
| Security Conditions | ||||
| Disaster Recovery/Business Continuity | ||||
| Data Transfer Services | ||||
| Chargebacks for Not Meeting Service Levels | ||||
| Liquidated Damages for Not Meeting Service Levels | ||||
| Penalties for Not Meeting Service Levels | ||||
| Technical Requirements | ||||
| Required Services | ||||
| Required Reports | ||||
| Deliverables | ||||
| Other(s) |
&"Arial,Regular"&8NYS Office of General Services Procurement Services &"Arial,Regular"&8Group 73600 - Award 22802 IT Umbrella Contracts - Manufacturer Based First Periodic Recruitment RFQ - Cloud Solution Checklist &"Arial,Regular"&8Page &P of &N
&"Arial,Regular"&8NYS Office of General Services Procurement Services &"Arial,Regular"&8Group 73600 - Award 22802 IT Umbrella Contracts - Manufacturer Based Appendix G.5 - RFQ - Cloud Solution Checklist &"Arial,Regular"&8Page &P of &N
&"Arial,Regular"&8July 2017 &"Arial,Regular"&8Attachment 12C, Part 1 - RFQ Cloud Solution Checklist
&"Arial,Regular"&8September 2022 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdfhttp://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf
File details come from the government source that posted it. Updated .