BEN-25-048 Exhibit M COVRamp Security Questionnaire.xlsx
XLSX spreadsheet 31 KB Posted
- Attached to
- BEN-25-048 SNAP/50
- Solicitation number
- RFP-125291
- Issued by
- Virginia
About this file
This is a Cloud Service Vendor Intake Questionnaire (COV Ramp Security Questionnaire) for the Commonwealth of Virginia's technology procurement process, administered through VITA (Virginia Information Technologies Agency). The questionnaire is designed to assess cloud service procurements for state agency use and functions as a security and compliance intake form. The document does not specify particular product quantities, response dates, due dates, site visits, bidder meetings, award dates, or contract terms; instead, it serves as a standardized assessment tool to gather information about proposed cloud service procurements before they proceed through the security review and approval process.
The questionnaire requires vendors and procuring agencies to provide detailed information regarding service descriptions, total procurement value broken out by year, procurement methods, contract templates and compliance language, data sensitivity and security requirements, and staffing contacts across procurement, business, and end-user functions. Key evaluation areas include whether the cloud service processes sensitive data such as personally identifiable information (PII), protected health information (PHI), or financial records; requirements for Service Level Agreements, End User License Agreements, and content escrow provisions; and whether the procurement utilizes VITA statewide contracts, GSA agreements, or alternative cooperative contracts. The questionnaire emphasizes the necessity of contract provisions ensuring the Commonwealth can recover its data upon contract termination or service disruption, with VITA maintaining standardized escrow and limitation of liability language available for use in procurement agreements.
View the file
Other files
Show all 24
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Questionnaire Agency COV Ramp Intake Questionnaire
| 1 | Name of Cloud Service (i.e. SaaS/Application): |
| 2 | Name of Supplier: |
3 Please list the name and contact information for supplier POC:
| 4 | Have you submitted a COV Ramp Assessment in order to procure this product or are you trying to determine whether the product will pass/fail before deciding? |
| 5 | Is this Cloud Service already in use by your agency? |
| 6 | Provide a description of the application/service and the business process that it will support: |
| 7 | What is the total value of the procurement broken out by year (Base and Renewal years)? |
8 What is your timeline to complete this procurement?
9 What is your procurement method? (Sole source, RFP, joint cooperative, emergency, VITA statewide contract?)
10 Is this procurement related to an RFP previously issued by your agency? If so, what is the project name?
| 11 | If using a VITA Statewide contract, please include names of Reseller and Software Publisher: |
| 12 | If applicable, VITA Contract Number: |
| or | |
| 13 | If not using a VITA contract, provide the alternate source (i.e., joint/cooperative contract, agency contract, supplier contract) and Contract number: |
14 If using a GSA or other cooperative contract, provide link to contract:
15 If using a GSA or other cooperative contract, have you engaged your agency's OAG rep to review the selected joint/coop contract to ensure all terms within it are acceptable?
16 Are you utilizing a VITA IT Contract Template?
17 If you are not using a VITA IT Contract Template, does your Contract contain Acceptance and Cure language?
18 If you are not using a VITA IT Contract Template, does your Contract include an Indemnification clause?
19 If you are not using a VITA IT Contract Template, does your Contract include an OAG/VITA approved Limitation of Liability clause?
| 20 | Has supplier furnished a End User License Agreement (EULA)? |
| 21 | Will supplier be providing a general use or COTS Cloud Service? (i.e. no custom built source code is authorized |
under the Contract)
22 Has the Supplier introduced a set of Service Level Agreements for agency consideration?
23 Will you require a Cloud Exit/Transition Out Plan and Assistance for a duration of more than 6 months?
24 Will you require full content escrow language?
tc={646AF845-86B4-44CD-9C4F-CA8946033EED}: [Threaded comment]
Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924
Comment:
It is essential with cloud storage of Commonwealth data that there be a plan, and supporting contract provisions, to ensure that the Commonwealth can obtain its Content as needed should the contractual relationship end or run into significant difficulties. VITA has a full Content Escrow provision available for use, should it be determined that it’s needed. The full language requires that the supplier maintain a separate escrow account and an executed escrow agreement be provided to the agency.
| 25 | Is a License Agreement Addendum (LAA) being utilized? |
| 26 | Are there Clickwrap terms? |
tc={18F413E9-91CE-424F-9BE3-FE9E63CE17D3}: [Threaded comment]
Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924
Comment:
A clickwrap agreement is a digital contract where users consent to the terms and conditions by clicking a button or checking a box.
27 Will VITA be offering this through the Service Catalog:
28 How many users will be consuming this application/service:
| 29 | Please list the names and contact information for the following agency personnel: |
| a) | Procurement lead |
b) Business owner
c) End user (if different from business owner)
| d) | ISO |
| Cyber Liability Insurance Questions | |
| 30 | Will the application/service process and/or store sensitive data with relation to confidentiality, integrity, and/or availability: |
| 31 | If yes to the question above, please describe | |
| the sensitive data: | (i.e. confidentiality - PII, PHI; integrity - financial records; availability - public safety data) |
| 32 | Approximately how many records will the application/service process and store: |
| 33 | Approximately how many (max) unique individuals may be impacted in the event of a cyber security event: |
It is essential with cloud storage of Commonwealth data that there be a plan, and supporting contract provisions, to ensure that the Commonwealth can obtain its Content as needed should the contractual relationship end or run into significant difficulties. VITA has a full Content Escrow provision available for use, should it be determined that it’s needed. The full language requires that the supplier maintain a separate escrow account and an executed escrow agreement be provided to the agency.
A clickwrap agreement is a digital contract where users consent to the terms and conditions by clicking a button or checking a box.
Sheet1
File details come from the government source that posted it. Updated .