BEN-25-048 Appendix D-1 COV Ramp Guidance and Requirements.docx

Appendix D-1 COV Ramp Guidance and Requirements

COV Ramp Instructional Guidance for RFP:

COV Grade indicates the highest level of modernization, security, and environmental readiness available for Virginia customers. COV Grade will simplify the process for state agencies to make IT decisions and purchases, and enable IT customers to utilize safe, compliant, and consistent resources. COV Ramp, formally Enterprise Cloud Oversight Service (ECOS), is part of COV Grade and provides oversight and support services for agencies undertaking the decision to move to cloud-based services. Numerous solutions are offered as cloud platforms/services or have cloud options. Executive branch agency procurement of cloud requires that the agency seek VITA cloud approval before procurement, including potential COV Ramp assessment, agreement on Cloud Terms and ongoing security oversight.

If this is a cloud-based procurement (i.e., off-premises hosting), following Agency’s selection of the proposal(s) representing best value to the Commonwealth, Supplier’s failure to successfully answer, negotiate, and/or comply with any resulting security exceptions that may arise in order to approve Supplier’s cloud application, may result in removal from further consideration.

The attached Assessment Form titled “Attachment A to Standard Form 1-003 for COV Ramp Assessment V14” is used by VDSS Security to conduct the COVRamp assessment of proposed cloud solutions. The Assessment Form is being provided as part of the RFP so that Supplier can be prepared to submit, if so requested.

Supplier should not submit the completed Assessment Form with its proposal response. If required during the evaluation process, the Procurement Officer will request that Supplier submit the completed Assessment Form which will be due immediately upon request.

COV Ramp Requirements for RFP:

1. Proposed solution shall comply with all current COV ITRM Policies and Standards, including those pertaining to:

A. Information Security B. Data Standards C. Enterprise Architecture D. Prohibited Hardware and Software Services E. Artificial Intelligence Policies are located at: https://www.vita.virginia.gov/policy--governance/policies-standards--guidelines/ If proposed solution does not, please provide details that specify the Standard/Policy and how Supplier's solution does not comply.

2. Supplier's solution, training material and communications plans shall provide effective, interactive control and use with nonvisual means and provide 508 Compliance in accordance with the following standard regarding IT Accessibility and 508 Compliance:

https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/psgs/domain-amp-topic-reports/pdf/ETAITAccessibilityTopicReportGOV103.pdf (Refer to https://www.section508.gov/ and www.access-board.gov for further information) Describe how this functionality is achieved and include a completed Voluntary Product Accessibility Template (VPAT) with the proposal. The VPAT template can be accessed at the following URL: https://www.section508.gov/sell/vpat If the solution provides alternate accessibility functionality, please describe.

3. Numerous solutions are offered as cloud platforms/services or have cloud options. Executive branch agency procurement of solutions with cloud elements require that the agency seek VITA cloud approval before procurement, including potential COVRamp assessment, agreed Cloud Terms and ongoing oversight. Describe the process for ensuring that VITA cloud approval has been obtained before a purchase order has been placed.

4. Describe whether the proposed cloud solution is a Software as a Service (SaaS) delivery model or a Platform as a Service (PaaS) delivery model.

5. Describe whether the proposed solution is a public, private, government, or hybrid cloud model.

6. Describe all available models and ensure pricing response includes offered options.

7. Describe whether the proposed solution allows for agency hosting. Elaborate on the advantages and disadvantages of offsite and onsite hosting that the solution offers.

8. Describe whether the proposed cloud solution is FedRamp authorized. If so, describe the FedRamp level of certification (low, moderate, or high).

9. "The proposed Solution shall comply with all Customers’ individual Information Security Policies and applicable Federal standards (e.g., FedRAMP, CJIS, FISMA,PCI, ISO27001, FERPA, FTI (IRS PUB-1075), SSA, HIPAA-HITECH). If proposed solution does not comply, please provide details that specify the Standard/Policy and how Supplier's solution does not comply.”

10. Describe whether the proposed cloud solution relies on third-party partners or subcontractors and elaborate on the third-party partners/subcontractors required as applicable.

11. Describe whether the proposed cloud solution allows a customer to solely manage its own encryption keys or if the function must remain with the solution provider.

12. Describe whether the proposed solution has a documented encryption key management process.

13. Describe whether the proposed solution uses standard data encryption techniques. If so, define in detail at all levels. Include, if applicable, what additional options may be added.

14. Describe how the proposed solution addresses security. Provide an attachment to detail the levels of security inherent in your application and what options can be added to support unique customer requirements to ensure confidentiality.

15. Given the desire for electronic payment, with approval from DOA, please describe in detail how this process will work and what safeguards and security measures will be employed to ensure audit compliance.

16. Describe whether the solution incorporates security and privacy recommendations and best practices from the National Institute Standards and Technology (“NIST”).

17. Supplier's solution shall have the ability to produce custom financial information and reporting as required to ensure proper accounting and financial management by VITA and Authorized Users, in compliance with the pronouncements of the Governmental Accounting Standards Board (GASB), with particular emphasis on Statements No. 87 ""Leases"" and No. 96 ""Subscription-Based Information Technology Arrangements. Examples may include but are not limited to: asset/inventory management for leased equipment, discount/interest rates for leases, inventory management for software licenses including coverage terms, etc. For more information see: https://www.gasb.org/standards-and-guidance/pronouncements of

RFP# BEN-25-048

Attachment D-1 COV Ramp Guidance and Requirements