Enclosure No. 7 - SaaS Questionnaire.xlsx
XLSX spreadsheet 21 KB Posted
- Attached to
- Request for Proposal: ALCF Equinox AI System Federal contract opportunity
- Solicitation number
- 6-B143-P-00251-00
- Issued by
- Department of Energy Office of Science
About this file
This is a Software-as-a-Service (SaaS) questionnaire used by Argonne National Laboratory to evaluate vendor proposals for a cloud-based software solution. The questionnaire establishes detailed technical and operational requirements that prospective vendors must address, including system architecture, hosting operations, security, backup and recovery, authentication, data protection, and support capabilities.
Argonne seeks a SaaS solution emphasizing product innovation, rapid implementation, predictable operating costs, minimal IT overhead, and enhanced vendor support. Required technical specifications include three-tier separated-network architecture with perimeter security protections (firewalls, IPS/IDS, DLP, anti-malware), encrypted access via TLS 1.2+ (minimum 128-bit cipher strength) through web browsers without client-side downloads, support for major browsers (Firefox, Chrome, Internet Explorer, Opera, Safari), comprehensive data encryption and key management, backup and recovery capabilities, and subscription-based access to a single codebase deployed across all customers. All hosted hardware and data backups must reside within the continental United States. The questionnaire requires vendors to provide detailed responses across nine major categories: system architecture and integration capabilities (A1-A24), hosting operations with Authority to Operate documentation based on NIST SP 800-53 compliance at Moderate FIPS-199 level or higher (B1-B15), security event logging and monitoring procedures (C1-C16), backup and disaster recovery protocols with defined recovery objectives (D1-D7), authentication and password management standards aligned with NIST recommendations (E1-E5), data protection and encryption methods (F1-F5), security breach notification procedures (G1-G3), Service Level Agreements and uptime metrics (H1-H4), product release and maintenance processes (I1-I3), and artificial intelligence component disclosure and customer control capabilities (J1-J3).
View the file
Other files for this federal contract opportunity
Show all 18
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| ARGONNE NATIONAL LABORATORY |
| Software as a Service (SaaS) Requirements |
| Technology Requirements |
| Argonne National Laboratory seeks a Software-as-a-Service (SaaS) solution due to the desire for product innovation, expedient implementation, predictable operating costs, low administrative and internal IT overhead, and enhanced customer support. Ideally, the vendor-delivered model should include the following: |
| · Software is securely hosted on servers, in a three-tier separated-network architecture that the vendor provides and maintains. |
| · Software and network infrastructure must have perimeter security protection such as Firewalls, IPS/IDS, DLP, and Anti-malware/virus with proper security incident/intrusion detection and escalation process in place. |
| · Software is securely accessible via encrypted sessions (TLS/HTTPS with +128-bit cipher strength, TLS >=1.2) using a web browser with no client-side downloads required. |
| · Software supports the major web browsers: Firefox, Google Chrome, Internet Explorer, Opera and Safari with equal functionality. |
| · Data encryption, key management, backup and recovery are in place to provide protection to sensitive and confidential data. |
| · Access to the software is subscription-based rather than licensed. |
| · A single codebase is deployed across all customers. |
| · The location of the hosted hardware and data, including all back-ups, must be within the continental United States. |
| Product Name: | ||
| Date Completed: | Application URL: | |
| TECHNOLOGY | ||
| A. | SYSTEM ARCHITECTURE | Response: |
| A1. | Provide an overview of your product and system architecture. Attach any documentation or diagrams that support your overview. | |
| A2. | Base software technologies | |
| A3. | Databases used/supported | |
| A4. | Operating systems supported | |
| A5. | Web browsers supported | |
| A6. | Reliance on proprietary technologies | |
| A7. | Third party software products and versions required | |
| A8. | Open-source integrated products | |
| A9. | Configuration architecture | |
| A10. | Extensibility architecture | |
| A11. | Customization architecture | |
| A12. | Workflow and routing architecture | |
| A13. | Integration and e-mail calendaring systems (Exchange) | |
| A14. | UI architecture | |
| A15. | Application user interfaces (APIs) | |
| A16. | Self-diagnosis and healing | |
| A17. | Could the system be configured to send email from the cloud using a “From:” address with an anl.gov domain? | |
| A18. | If the answer to A1.s is yes, does the system support modern e-mail security capabilities including DKIM (Domain Keys Identified Mail), DMARC (Domain Message Authentication Reporting and Conformance), and SPF (Sender Policy Framework)? If the answer to A1.r is yes, does the system support DKIM (Domain Keys Identified Mail)? | |
| A19. | Describe the skill requirements for an in-house system integrator or other technical expertise required and the amount of IT support required. | |
| A20. | Does vendor provide Software Development Kits (SDK) or Libraries for developing integrations with product? | |
| A21. | Describe how data is imported/exported between systems. | |
| A22. | Describe how data in the system can be mass updated. | |
| A23. | Describe the reporting engine(s), capabilities and features supported by your system. | |
| A24. | What flexibility is supported related to security within the product: field level, record level, table-level security definition, roles definition, reporting security? | |
| B. | HOSTING OPERATIONS | Response: |
| B1. | If applicable, provide a copy of your Authority to Operate (ATO) letter. The ATO must be based on compliance with the applicable NIST SP 800-53. The letter or its attachments must indicate: | |
| 1. A FIPS-199 level of at least Moderate, | ||
| 2. A signatory that is an authorized official of an agency of the U.S. federal government, | ||
| 3. The validity dates of the ATO, and | ||
| 4. The organization or individual that performed the certification. | ||
| B2. | Does your organization hold a FedRAMP certification? If so, at what level? | |
| B3. | Does your organization currently have any commercial security certifications such as an ISO-27001 or participate in a 3rd Party Security Assessment such as a SOC2 Type 2? If so, please include any certificate letters and reports from these certifications in the response. | |
| B4. | Provide an overview of your hosting facilities, including backup and disaster recovery, and your recovery point objective (RPO)/recovery time objective (RTO). | |
| B5. | Describe where the servers, network hubs, etc. are physically located, including primary and backup facilities. If cloud-based, please identify the vendor(s) and region(s). | |
| B6. | Describe how you protect against power outages/surges, single points of failure (hardware and network), and water damage. | |
| B7. | Describe the access controls including access to server rooms, paper records, back-up facilities, and tape/disk storage. | |
| B8. | Describe any video surveillance (outside building/ inside building /inside server room) at the facility. | |
| B9. | Describe whether responsibility for physical security has been formally assigned and to whom. | |
| B10. | Are background checks performed before physical and logical access is granted to employees? | |
| B11. | Are employees with access to a client’s data required to sign a confidentiality agreement before being granted access? | |
| B12. | Will any of the services or operational functions be outsourced to another organization? If so, what services and to whom? | |
| B13. | What is your protocol for ensuring the security of a client’s data when using third parties? | |
| B14. | Can Argonne restrict the access by your employees to Argonne’s information (e.g. restrict access to only U.S. citizens)? | |
| B15. | Can Argonne’s data be restricted to only U.S. datacenters? | |
| C. | SECURITY EVENTS | Response: |
| C1. | Are the following host-based security activity events being logged and reviewed? Who performs these reviews and how often are they performed? | |
| C2. | Invalid login attempts | |
| C3. | Brute force login attempts | |
| C4. | Unauthorized attempts to access system resources | |
| C5. | Unauthorized attempts to view or change security definitions and rules | |
| C6. | Authorized security rule changes | |
| C7. | Authorized access to resources | |
| C8. | Change of system security settings | |
| C9. | Host OS and application software security patching cycle | |
| C10. | Are the following network security activity events being monitored? Who performs these reviews and how often are they performed? | |
| C11. | Security incident/intrusion monitoring, detection, validation, and escalation process and procedure | |
| C12. | Unusual traffic or known penetration attempts | |
| C13. | Denied access attempts at the firewall | |
| C14. | Malicious software prevention, detection, correction | |
| C15. | Are security event logs/audit logs made available and visible to the customer? | |
| C16. | Can data activity logs be forwarded to external services? (e.g. customer’s SIEM?) | |
| D. | BACK-UP AND RECOVERY | Response: |
| D1. | Describe the back-up process for the data, applications, and operating system including the tape rotation and retention policy, the recovery procedures, and where the tapes are stored. | |
| D2. | Describe the fail-over or high availability system and the location. | |
| D3. | Describe the disaster recovery plan and how often it is tested. | |
| D4. | Describe your Business Continuity Plan. | |
| D5. | Describe the policies/procedures in place for clients to “recover” their data, should the contract terminate, or the vendor cease operations and what formats are available. | |
| D6. | Describe the policies/procedures in place for clients to “recover” their data in the event of a disaster affecting the operation of the vendor’s data center inhibiting the availability of the client to access its information. | |
| D7. | Describe your retention policy and to what extent you offer flexibility for clients to define their own retention policies within your system. | |
| E. | AUTHENTICATION / PASSWORDS | Response: |
| E1. | What types of Multi-Factor Authentication (MFA) methods are supported? | |
| E2. | Can the product integrate with existing Identity Providers (IdPs) using Single Sign On (SSO) protocols? (e.g., SAML, OAuth2, OIDC, Azure AD) | |
| E3. | Does vendor conform to NIST recommendations for password length and complexity? Describe password requirements. | |
| E4. | Do the users’ IDs get locked out after a certain threshold for denied access attempt and, if yes, what is that threshold? | |
| E5. | Is there a restriction around the reuse of passwords and, if passwords may be reused, after how many intervals may it be reused? | |
| F | DATA PROTECTION | Response: |
| F1. | Describe the process to ensure data protection and security. | |
| F2. | Describe how one customer’s information is separated from other customers. | |
| F3. | Describe how transmitted data is encrypted. | |
| F4 | Describe how at-rest data is encrypted. | |
| F5. | Describe how the system protects against inadvertent deletion of data by users, and allows restoring requested schemas, tables, or the entire database from a backup source. | |
| G. | BREACHES OF SECURITY | Response: |
| G1. | Describe how and how quickly clients are notified when security mechanisms have been breached. | |
| G2. | Describe your incident response procedure. | |
| G3. | Are security event logs/audit logs made available and visible to the customer? (See H4) | |
| H. | SUPPORT AND SERVICE LEVEL INFORMATION | Response: |
| H1. | Describe your approach to Service Level Agreements. | |
| H2. | Describe your system uptime for the last twelve months. | |
| H3. | Describe any scheduled outages for maintenance or upgrades. | |
| H4. | What steps are taken during customer onboarding to ensure application performance and positive user experience? | |
| I. | PRODUCT RELEASE AND MAINTENANCE | Response: |
| I1. | Describe how new releases are developed and deployed. | |
| I2. | Describe how often new releases are deployed and the expectations of the customer during and after release (e.g. user acceptance testing, timeline expectations for upgrades, etc) | |
| I3. | Describe how requests for enhancements and changes are handled. | |
| J. | ARTIFICIAL INTELLIGENCE (AI) | Response: |
| J1. | Are (AI) components included and active within this product? | |
| J2. | Can the customer disable AI functionality? | |
| J3. | Is customer data used to train the public model? |
&"-,Italic"&9Cyber Security Program Office &9Version 2 2026-06-09
&F Page &P of &N
File details come from the government source that posted it. Updated .