ESBD_438972_1753311419609_Attachment A - Technical Review Questionnaire.xlsx
XLSX spreadsheet 89 KB Posted
- Attached to
- Media Monitoring Platform and Services
- Solicitation number
- 2507-002
- Issued by
- Texas
About this file
The file is a Technical Review Questionnaire for a state and local contract opportunity, specifically designed to comprehensively evaluate a vendor's technical capabilities, security protocols, and operational standards. The document is a detailed, 47-question assessment covering critical areas such as data center security, redundancy, disaster recovery, security operations, authentication, backup processes, availability, data protection, HIPAA compliance, and technical compatibility. The questionnaire appears to be structured for a potential technology service or cloud computing contract, requiring vendors to provide in-depth responses about their infrastructure, security measures, compliance certifications, and operational capabilities.
The technical review questionnaire seeks extensive documentation and explanations across multiple domains, including physical and virtual security architecture, incident response protocols, risk management procedures, authentication mechanisms, backup strategies, service level agreements, and data ownership rights. Key areas of focus include encryption standards, data center tier ratings, failover designs, penetration testing protocols, HIPAA compliance strategies, web and mobile compatibility, support resources, and various agreements such as Business Associate Agreements, End User License Agreements, and Service Level Agreements. The document suggests a rigorous evaluation process aimed at selecting a vendor with robust technical infrastructure, comprehensive security measures, and demonstrated compliance with state and federal standards.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Tech Review
| Version | 1/5/24 | ||
| CATEGORY | QUESTION NO. | QUESTION | VENDOR/OFFEROR'S COMMENTS |
| DATA CENTER SECURITY & COMPLIANCE | 1 | Describe data center security standards for the hosted solution (i.e. Advanced Encryption Standard 256 and State of Texas Cybersecurity Standard). | |
| 2 | Describe data center compliance with those standards, including independent audit results or certifications. | ||
| 3 | Attach a security architecture diagram. | ||
| 4 | Attach a copy of the most recent data center SOC audit or other self-attestation regarding security and compliance. | ||
| REDUNDANCY & DISASTER RECOVERY | 5 | Describe data center tier rating(s) and resiliency for redundancy and failover. | |
| 6 | Describe the physical locations of data centers that will host our data, including those for redundancy. If the actual locations cannot be revealed, describe them geographically in terms of distance. | ||
| 7 | Describe any locations that are off-shore from the Continental United States. | ||
| 8 | Describe failover design. | ||
| 9 | Describe disaster recovery protocols and how data is restored. | ||
| 10 | Describe the thresholds and protocols to notify the customer when disaster recovery protocols are triggered. | ||
| SECURITY OPERATIONS | 11 | Is there a dedicated Information Security Officer or CISO responsible for security architecture and operations? | |
| 12 | Describe incident response protocols and how security events are investigated and remediated. | ||
| 13 | Describe Risk Management and Risk Assessment protocols, including any 3rd party Risk Assessments. | ||
| 14 | Describe Penetration Testing protocols including frequency. | ||
| 15 | Describe physical security controls for any facilities in which our data may be processed. | ||
| 16 | Are internal systems protected with dedicated firewalls and anti-virus software? | ||
| 17 | Describe security within your development lifecycle - are DAST or SAST tools implemented? | ||
| 18 | Describe State and Federal Security Audit Certifications obtained such as TX-RAMP, FedRAMP, StateRAMP, FISMA, etc. | ||
| AUTHENTICATION | 19 | Describe any SSO or Federation capabilities. | |
| 20 | Describe any MFA or 2FA capabilities. | ||
| 21 | Describe any other integration capabilities. | ||
| BACK-UP, MAINTENANCE | 22 | Describe the backup process, including but not limited to, frequency and method (e.g., incremental/full, onsite/offsite). | |
| 23 | If the backup process involves a third party network/server/vendor, please identify the third party(ies). | ||
| 24 | Describe routine and emergency maintenance protocols. | ||
| AVAILABILITY, MONITORING & ALERTS | 25 | Describe up-time. | |
| 26 | Describe the protocol for monitoring services. | ||
| 27 | Describe Service Level Agreement. | ||
| DATA PROTECTION, RETENTION & USE | 28 | Describe data retention protocols. | |
| 29 | If data is not retained indefinitely, describe the alternatives for storage and destruction. | ||
| 30 | Describe scalability for growth of data. | ||
| 31 | Describe our ownership rights to the data while under contract and in the event the contractual relationship is terminated. | ||
| 32 | Is data used for any other purpose other than our stated purpose? | ||
| 33 | Is data encrypted during transit? | ||
| 34 | Is data encrypted at rest? | ||
| PROTECTED HEALTH INFORMATION / HIPAA | 35 | Describe measures or architecting strategies to protect health-related data for HIPAA compliance. | |
| 36 | Describe data separation environment and/or shared computing resources so that we fully understand the physical or virtual machine environment that supports its data. | ||
| 37 | Describe the protocol to notify customers of security breaches. | ||
| WEB-BASED, OS & BROWSER COMPATABILITY | 38 | Is this a web-based application? If not, describe the application such as locally installed on computers or on-premise environment. | |
| 39 | Identify all compatible operating systems. | ||
| 40 | Identify all compatible browsers. | ||
| 41 | Identify all compatible devices, such as PC, laptops, tablets, etc. | ||
| 42 | Is there a mobile app? If yes, describe whether it is available for iPhones, Windows, Android. | ||
| SUPPORT, ON-GOING ADMINISTRATION & TALENT | 43 | Describe the service desk support process and resources, including but not limited to customer portal, hours of operation, escalation paths. | |
| 44 | If available, describe the various levels of support plans and their cost. | ||
| 45 | Describe recommended certifications to properly administer the services from the customer side. | ||
| 46 | Describe training and continuous learning resources to properly administer the services from the customer side. | ||
| AGREEMENTS | 47 | Attach a copy of, or provide an online link, to the following documents: |
a. All Terms and Conditions which may include, but not be limited to,
i. Business Associate Agreement
ii. End User License Agreement and/or all other licensing agreements
iii. Service Level Agreement
iv. Support and Warranty Agreements
b. All other documents and/or agreements not listed above that will require signature or attestation by Central Health in order to secure a contract.
image1.png
File details come from the government source that posted it. Updated .