Exhibit 2 - High-Level Cybersecurity and Data Protection Information Requested .pdf
PDF 130 KB Posted
- Attached to
- Request for Information - Travel System
- Solicitation number
- ORNLTravelRFI2026
- Issued by
-
Department of Energy
About this file
This document is Exhibit 2 of a Travel System Request for Information (RFI) outlining high-level cybersecurity and data protection information requested from potential suppliers. As this is an RFI rather than an RFP, suppliers are instructed to provide concise descriptions of capabilities, architecture, and security practices without detailed evidence, certifications, or formal documentation at this stage.
The RFI requests information across ten primary areas: (1) System Hosting & Data Location, including whether systems are cloud or on-premise, U.S.-based or international, and whether any data is processed outside the United States; (2) Access Control & Authentication methods such as SSO, MFA, and identity provider compatibility, plus disclosure of foreign national access; (3) Data Protection Practices describing encryption, anonymization, and data minimization approaches; (4) Incident Response & Monitoring capabilities for detecting and responding to security events; (5) Business Continuity & Disaster Recovery with RTO/RPO targets and equivalent security controls; (6) Data Retention & Post-Contract Handling including policies for returning or deleting data after contract termination; (7) Third-Party Integrations & Supply Chain risk management; (8) Compliance & Security Standards such as SOC 2, ISO 27001, or FedRAMP certifications; (9) Foreign National Access Considerations disclosing vendor staff locations and controls preventing access from restricted countries; and (10) Optional Additional Security Features such as zero-trust architecture or advanced threat detection. Suppliers are advised that detailed technical documentation, certifications, and penetration test reports will be requested during a subsequent RFP phase if applicable.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Exhibit 2: High-Level Cybersecurity & Data Protection Information Requested
This section outlines the high-level cybersecurity information requested from Suppliers as part of the Travel System Request for Information (RFI). Since this is not an RFP, detailed evidence, certifications, or documentation are not required at this stage. Potential Suppliers should provide concise descriptions of capabilities, architecture, and security practices.
1. System Hosting & Data Location
• High-level description of where the system is hosted (cloud/on-prem, U.S.-based or international).
• General location of production and disaster recovery environments.
• Whether any data is stored, accessed, or processed outside the United States.
2. Access Control & Authentication
• Overview of authentication methods supported (SSO, MFA, identity provider compatibility).
• Summary of access control approach (role-based access, admin access structure).
• Whether any foreign nationals may have access to the system or its data.
3. Data Protection Practices
• High-level description of data protection methods (encryption in transit/at rest, anonymization, or data minimization practices).
• General approach to securing sensitive travel information.
4. Incident Response & Monitoring
• Overview of how the vendor detects and responds to security incidents.
• Description of available system logging and monitoring capabilities.
5. Business Continuity & Disaster Recovery
• Summary of DR/COOP approach.
• High-level RTO/RPO targets.
• Confirmation that DR environments apply equivalent security controls.
6. Data Retention & Post-Contract Handling
• General data retention policies for customer data.
• High-level process for returning or deleting data after contract termination.
• Whether system logs or backups persist after customer offboarding.
7. Third-Party Integrations & Supply Chain
• High-level list of major third-party services integrated into the system.
• General approach to vendor’s supply-chain risk management.
8. Compliance & Security Standards
• Summary of relevant security certifications or frameworks followed (e.g., SOC 2, ISO 27001, FedRAMP).
• High-level overview only; no documentation required at this time.
9. Foreign National Access Considerations
• High-level disclosure of countries where vendor staff or support may be located.
• Whether any support, development, or operations functions are performed outside the U.S.
• Summary of controls to prevent access from restricted/sensitive countries.
10. Optional: Additional Security Features
Vendors may provide high-level descriptions of any other security capabilities that differentiate their system (e.g., zero-trust architecture, advanced threat detection, privacy-by-design features).
Note to Suppliers
At this RFI stage, broad descriptions are sufficient. Detailed technical documentation, certifications, penetration test reports, or policy documents will be requested during a later RFP phase if applicable.
| Exhibit 2: High-Level Cybersecurity & Data Protection Information Requested |
| 1. System Hosting & Data Location |
| 2. Access Control & Authentication |
| 3. Data Protection Practices |
| 4. Incident Response & Monitoring |
| 5. Business Continuity & Disaster Recovery |
| 6. Data Retention & Post-Contract Handling |
| 7. Third-Party Integrations & Supply Chain |
| 8. Compliance & Security Standards |
| 9. Foreign National Access Considerations |
| 10. Optional: Additional Security Features |
| Note to Suppliers |
File details come from the government source that posted it. Updated .