Copy of Amm 2_.xlsx
XLSX spreadsheet 40 KB Posted
- Solicitation number
- RFP - 06A - 202603029
- Issued by
- Kennebec County, Maine
About this file
Summary
This is a compliance questionnaire and technical requirements document issued by the State of Maine for a commercial-off-the-shelf, web-based Software-as-a-Service solution to support the Maine Clean Water State Revolving Fund wastewater infrastructure program. The State of Maine Department of Environmental Protection, in partnership with the Maine Municipal Bond Bank, seeks to replace legacy Microsoft Access databases and manual processes with an integrated platform capable of managing the complete lifecycle of CWSRF projects, including loan management, financial administration, compliance monitoring, and EPA reporting. Qualified bidders must demonstrate at least ten continuous years of experience implementing and managing State Revolving Fund programs and must have successfully implemented and continue to support ten state SRF programs within the past ten years, with all implementations fully operational for a minimum of six months. The RFP requires comprehensive implementation services including system configuration, data migration from legacy systems, user training, system testing, and post-implementation support with defined service-level agreements. Proposals are due May 8, 2026, at 4:00 p.m. local time via the Vendor Self Service System, with questions due by April 24, 2026. The initial contract period runs from May 1, 2026, through April 30, 2028, with two optional renewal periods through April 30, 2031, subject to continued funding and satisfactory performance.
The compliance document requires bidders to address extensive technical and security requirements aligned with NIST standards, Maine data classification policies, and state information security policies. All proposed products must authenticate natively with Microsoft Active Directory and Okta Platform (OpenID 2.0, OAuth 2.0, SAML 2.0) and must comply with Moderate PII Impact Level controls, including NIST SP 800-53 Revision 5, State Breach Notification Law, Privacy Act of 1974, Driver Privacy Protection Act, and IRS Publication 1075. Bidders must provide detailed evidence for hosting requirements, application solution controls, backup and disaster recovery capabilities, security incident reporting within 24 hours, data ownership protections, and compliance with all applicable MaineIT policies. Proposals will be evaluated on a 100-point scale with Organization Qualifications and Experience weighted at 30 points, Proposed Services weighted at 40 points, and Cost Proposal weighted at 30 points; pricing must be presented as a fixed amount covering the initial contract period and all renewal periods, with the lowest cost proposal receiving full cost points. Bidders must not be suspended or debarred from doing business with the Federal Government, and the State anticipates making one award with all vendors expected to submit their best value pricing with their initial proposal.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| CWSRF Amm. 1 RFP Final.docx | DOCX document | |
| RFP 202603029 CWSRF_FINAL.docx | DOCX document | |
| CWSRF Amm. 2 RFP Final.docx | DOCX document | |
| CWSRF Amm. 1 RFP Final.docx | DOCX document | |
| RFP 202603029 CWSRF_FINAL.docx | DOCX document | |
| RFP 202603029 CWSRF_FINAL.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
The State of Maine requires Bidders to demonstrate that they (and the products proposed by them) have the appropriate Architecture & Security controls to protect the State’s information assets, and meet all appropriate compliance mandates.
| Bidders are urged to carefully read all the Header Instructions in the individual tabs before responding. Failure to comply with all the Header instructions will adversely affect the Technical Assessment of the Bid. |
| Bidders are instructed to submit (as a separate attachment) an Architecture Diagram of their proposed solution. This will provide additional context for the Technical Assessment. |
Data Compliance
| Data Compliance |
| The State data that is transacted by this RFP has been categorized according to the State’s Data Classification Policy, https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/DataClassificationPolicy.pdf |
The State data subject to this RFP has been classified as having a PII Impact Level of Moderate
| Bidders and their solutions must adhere to applicable State and Federal laws, policies, and standards that corresponds to the PII impact level of the State data that will be transacted by the proposed solution. For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. Either cite a publicly-accessible URL, or enclose a copy with the submission. | |||
| Type of Data | Control (State or Federal Compliance Standard) | Yes/No | Explanation |
| Publicly available information | § NIST 800-171 | ||
| § Maine Freedom of Access Act (Title 1 MRSA c. 13) | |||
| Confidential Personally Identifiable Information (PII) | § State of Maine Breach Notification Law | ||
| § National Institute of Standards & Technology: NIST SP 800-53 Revision 5 “Moderate” risk controls | |||
| § Privacy Act of 1974, 5 U.S.C. 552a. | |||
| Federal Tax Information | § Internal Revenue Service Tax Information Security Guidelines for Federal, State and Local Agencies: IRS Pub 1075 | ||
| § IRS Pub 1075 Contractor Language Addendum required | |||
| Personal Information from | § Driver’s Privacy Protection Act (Title XXX) (“DPPA”) 18 U.S.C. Chapter 123, §§ 2721 – 2725 |
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdfhttp://legislature.maine.gov/legis/statutes/10/title10ch210-Bsec0.htmlhttps://nvd.nist.gov/800-53https://www.justice.gov/opcl/privacy-act-1974https://www.irs.gov/privacy-disclosure/safeguards-programhttps://www.congress.gov/bill/103rd-congress/house-bill/3355/text BoM
| Bill of Materials (BoM) | |
| Bidders must exhaustively list ALL the products that are being proposed as part of this bid. If a product is sold as a single SKU, even if it includes components, list it only once. Example: Salesforce Service Cloud must be listed only once because it is sold as a single SKU. Even though several components makes up the Salesforce Service Cloud, such as, Console, Case Management, Workflow automation, etc. However, Salesforce Maps must be listed independently because it is sold as a distinct SKU. Products must be listed even if they are free downloads. All responses in ALL other tabs must cover ALL the products listed in the BoM here. | |
| Product Name | Product URL |
| Example: Salesforce Cloud | Example URL: https://www.salesforce.com/sales/ |
MaineIT
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. Either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID # | Control | Yes/No | Explanation |
| Hosting | |||
| H1 | Any technical solution must be hosted in a data center. | ||
| H2 | Any hosting provider must provide for back-up and disaster recovery models and plans as needed for the solution. | ||
| H3 | Any hosting provider will abide by NIST best practices for change requests, incident management, problem management, and service desk. | ||
| Application Solution | |||
| A1 | Any solutions Bidder must provide for the backup/recover, data retention, and disaster recovery of a contracted/hosted application solution. | ||
| A2 | Any solutions Bidder must provide for application management and design standard of all technology platforms and environments for the application solution (Development, Staging, Productions, DR, etc.) | ||
| A3 | Any solutions Bidder must engage the State of Maine using Service Level Agreements for system and application performance, incident reporting, and maintenance. See the defaults in the Remote Hosting Policy. | ||
| A4 | The State owns any data they enter, migrate, or transmit into the solution and the Bidder shall allow the State to pull or copy this data at any time free of charge in a format defined by the State. |
https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/RemoteHostingPolicy.pdf Information Security Standards
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. For any evidentiary material, either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID# | Control | Yes/No | Explanation |
| S1 | Bidder provides and maintains a security plan that: |
1. Complies with NIST security requirements;
2. Protects the confidentiality, integrity, and availability of the State’s information systems; and
3. Comply with all applicable federal and state laws and regulations, as well as compliance with all MaineIT contractual requirements and information security policies.
| S2 | Bidder ensures that any agent or subcontractor of the bidder to whom the State provides access agrees to the same restrictions and conditions that apply through this Agreement and agrees to implement reasonable and appropriate safeguards to ensure the confidentiality, integrity, and availability of the State’s information systems. |
| S3 | Bidder will report a security incident that occurs on the Agency’s information systems that may affect the Agency or State of Maine systems to the CISO within 24 hours of discovery in accordance with the terms of the MaineIT Non-Disclosure Agreement (Attachment D). |
| S4 | Provide the stated cyber risk appetite statement that has been approved by the board/leadership of your company. |
Cloud Service Provider Reqs
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. For any evidentiary material, either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID # | Control | Yes/No | Explanation |
| CSP1 | General Architecture Principles | ||
| CSP2 | All products proposed must be able to authenticate natively with both Microsoft Active Directory, and the Okta Platform (OpenID 2.0, Oauth 2.0, SAML 2.0) | ||
| CSP3 | System and Services Acquisition Policy and Procedures (SA-1) | ||
| CSP4 | Application Deployment Certification Policy | ||
| CSP5 | Digital Accessibility and Usability Policy | ||
| CSP6 | Remote Hosting Policy | ||
| CSP7 | Data Exchange policy | ||
| CSP8 | Information Security Policy | ||
| CSP9 | Access Control Policy | ||
| CSP10 | Access Control Procedures for Users | ||
| CSP11 | Risk Assessment policy | ||
| CSP12 | Vulnerability Scanning Procedure | ||
| CSP13 | Security Assessment and Authorization Policy | ||
| CSP14 | System and Information Integrity Policy | ||
| CSP15 | Configuration Management Policy | ||
| CSP16 | GenAI Policy (if applicable to this bid) | ||
| CSP17 | Site-to-site VPN | ||
| CSP18 | Vendor Identity System Integration Policy | ||
| CSP19 | Prohibited Technologies Policy |
https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Farchitecture%2Fdocuments%2FGeneralArchitecturePrinciples.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283462187%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=hPw50eOA1Pw%2FS7R%2FsUilpZ4BKgn7UYAxzEcMekJd1Hw%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FRiskAssessmentPolicy%26Procedure.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283506985%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=DX8YitoGyojwrLOCZ%2BhltBROyt1iHfTszY6y8smDuQ0%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FVulnerablityScanningProcedure.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283511966%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Upbkei0Hmg5zbmM%2F4ADQiV8j4DcYlZfyJjqxWD8n%2FyE%3D&reserved=0https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/SecurityAssessmentAuthorizationPolicy.pdfhttps://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FSystemInformationIntegrityPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283521918%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=DhV6plvPwGgyPGWwZxIMl8vB%2FBUwhqWZjudSIJoS2Z8%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FConfigurationManagementPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283526900%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=2%2BbyzrG%2BhVzJEKIyrEZ3Zv5DXOy%2BwiqEpAWjk9a4g%2FE%3D&reserved=0https://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/GenAIPolicy.pdfhttps://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/SiteToSiteVPNPolicy.pdfhttps://www.maine.gov/oit/sites/maine.gov.oit/files/inline-files/VendorIdentitySystemIntegrationPolicy.pdfhttps://www.maine.gov/oit/prohibited-technologieshttps://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fsites%2Fmaine.gov.oit%2Ffiles%2Finline-files%2Fsystem-services-acquisition-policy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283467162%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=S7J%2FjMIY1e6DijINzpo1K5R4fY3roSfTuNwDwpO1%2FNA%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FApplication-Deployment-Certification.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283472139%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=yBtVAz176L3Cag78nRWojRHWkHQ5Gba07JE%2FMQkxSsI%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FDigitalAccessibilityPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283477122%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=ub%2B%2F1cpCnNM4PoKAbhPUZ%2FluONQHbeK6j1rVOKXnaxk%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FRemoteHostingPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283482097%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=MR40mMW77Gu8X2QN8pjKM5bjP7DoRO%2BhfOhk0p1phTg%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FDataExchangePolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283487078%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=XTBYIGil6RMH8SmClnRcxTO7y9cEatf1EofD0QHPqMc%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FSecurityPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283492057%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=b%2FXvhpG1sp2fZIgpQx%2BwB7ZGRubGu7dN9sYBjFVRs%2BU%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FAccessControlPolicy.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283497031%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=foTOPC7xuTna00%2FTXggz7Rahs9XTpw5BSrCgrBmNZ9Y%3D&reserved=0https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.maine.gov%2Foit%2Fpolicies%2FAccessControlProceduresForUsers.pdf&data=04%7C01%7CPatrick.J.Williams%40maine.gov%7C07514feba418425f72c108d905c81c29%7C413fa8ab207d4b629bcdea1a8f2f864e%7C0%7C0%7C637547179283502010%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=lO0DXc6NgpCav9iZYOLgMBuFsfmIFC8OiDtOvv%2BgOX8%3D&reserved=0 NIST Requirements
| For each Control, respond with a Yes/No, and the appropriate Explanation (Evidence) behind the Yes/No. Any Yes/No response would be deemed Incomplete in the absence of supporting Evidence in the Explanation column. Evidence may include published policies, regulatory compliance audit reports, etc. For any evidentiary material, either cite a publicly-accessible URL, or enclose a copy with the submission. Also, all responses must cover ALL the products listed in the BoM. | |||
| ID # | Control | Yes/No | Explanation |
| N1 | Physical and Environmental Protection | ||
| N2 | Awareness and Training | ||
| N3 | Planning | ||
| N4 | Audit and Accountability | ||
| N5 | Personnel Security | ||
| N6 | Contingency Planning | ||
| N7 | PII Processing and Transparency | ||
| N8 | Identification and Authentication | ||
| N9 | Incident Response | ||
| N10 | System and Communications Protection | ||
| N11 | Maintenance | ||
| N12 | Media Protection | ||
| N13 | Supply Chain Risk Management | ||
| N14 | Any Other Relevant Comment |
File details come from the government source that posted it. Updated .