Exhibit B- Security Technical and Functional Requirements.pdf
PDF 152 KB Posted
- Solicitation number
- DOJ 2018-02
- Issued by
- Wisconsin
About this file
Exhibit B is a security, technical, and functional requirements document prepared by the Wisconsin Department of Justice for Request for Bids (RFB) DOJ 2018-02 regarding the printing and delivery of U.S. Supreme Court briefs and appendices. The document establishes mandatory and non-mandatory requirements that bidders must address in their proposals, with bidders required to indicate whether they can fully meet each requirement (YES), cannot comply as stated (NO), or provide explanatory descriptions of their capabilities and proposed solutions. Key mandatory requirements include hosting all data and backups within Continental United States datacenters, implementing FIPS-140 compliant encryption for data in motion, maintaining U.S.-based support services, ensuring data separation from other customers' databases, and providing data return capabilities in portable standard formats upon request. Additional mandatory requirements address password encryption and hashing procedures.
The document specifies that bidders must provide detailed responses addressing operating system and web server hardening procedures, vulnerability management programs, incident handling processes with 24-hour notification and seven-business-day resolution timelines for Wisconsin DOJ security incidents, security standards compliance with documentation of third-party audit frequency and reports, security event log auditing processes, privileged account management procedures, and data segregation methods. Response codes require bidders to explain their system capabilities, highlight any superior features, or propose alternate solutions where full compliance cannot be achieved. Failure to meet mandatory requirements may result in bid disqualification, though the Department of Justice reserves the right to modify specifications if no bidders can comply with stated requirements.
View the file
Other files
Show all 15
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
RFB DOJ 2018-02
Printing and Delivery of U.S. Supreme Court Briefs
Bidder: _____________________________________________________________________
EXHIBIT B
SECURITY, TECHNICAL AND FUNCTIONAL REQUIREMENTS
BIDDER RESPONSE:
This section specifies SYSTEM SECURITY, TECHNICAL AND FUNCTIONAL REQUIREMENTS which the DOJ requires for a desired procurement. Bidders must indicate one and/or any applicable response code for each requirement: Conditions of the RFQ that include the word
“must” or “shall” describe a mandatory requirement. Failure to meet a mandatory requirement may disqualify your bid, unless determined by DOJ that no bidders are able to meet such requirement, in which case, the DOJ reserves the right to delete or modify said mandatory specification or condition.
This RFQ document, any amendments, addenda and the awarded proposer’s response as accepted by the DOJ, shall constitute part or the entire resulting contract.
Bidders must confirm their ability to satisfy each Mandatory Requirement by completing and returning this EXHIBIT B with your bid.
Response Code Code Explanation
YES
Fully meets the requirement.
Describe/explain how your system meets the stated requirement and/or highlight additional or superior capabilities.
NO
Cannot comply with requirement as stated.
Describe/explain how your system is qualified to meet the stated requirement and/or your proposed alternate solution.
REQUIREMENTS
Response
Code
1. Hosting - Data and backups MUST be hosted within datacenters in the Continental United States
(CONUS).
Describe/Explain:
2. Security - The system must encrypt DOJ data with FIPS-140 compliant encryption when in motion.
2.1 Describe the procedures for operating system and web server hardening. The organization should have procedures for operating system and web server hardening.
Code
2.2 Describe your vulnerability management program. The organization should have a vulnerability management program.
2.3 The organization should have an incident handling process and procedures. WI DOJ should be informed within 24 hours of a security incident and provide resolution within 7 business days. Describe the organization’s security incident handling process and procedures, and the support response times for Critical, Urgent, High & Low issues/requests.
2.4 Describe what security standards are followed and how often are third party audits conducted. Security standards and audits should be in place. Provide the latest audit report.
2.5 The logs of security events should be audited. Describe the process of how you audit logs of security events such are firewall logs and authentication logs.
3.
Identity Management - Passwords must be encrypted. Explain how passwords are hashed and stored.
Code
3.1 The organization should have a process to manage privileged accounts and secure remote privileged access.
4.
Support and Maintenance- Support must be located in the United States. Explain who provides the support desk and where they are located.
Explain:
4.1 Data and Database
4.1.1 WI DOJ data should be separated from other customer's data. Explain the degree of separation there is for other customer's data and whether each customer has a separate schema or database.
4.1.2 Data shall be returned to the State when requested by the WI DOJ. The data should be provided in a portable standard data format and proof that DOJ data is removed from the vendor's environment including from backups.
File details come from the government source that posted it. Updated .