Exhibit C 8.0 Scanning Form Fill.pdf
PDF 103 KB Posted
- Attached to
- Medicaid Dental Adjudication and Admin Services
- Solicitation number
- 25RFP12174
- Issued by
- Harding County, South Dakota
About this file
This is a security scanning authorization form (Exhibit C) that outlines the State's requirements for conducting security and vulnerability scans of offerors' systems as part of the RFP review process. The State will use commercially available industry standard tools to scan a non-production environment with non-production data at mutually agreed upon times, explicitly excluding penetration testing. The form requires offerors to provide contact information for their security representative and authorization for the State to conduct the scanning.
The document specifies that RFP responses without a completed and signed form may be disqualified, particularly when State data protected by federal/state law, regulation, or industry standards is involved. The State will accept full scan reports from industry standard tools like Invicti, Burp Suite, Nmap, Qualys, or Nessus as alternatives to their own scanning. Executive Summaries, penetration test reports, and SOC I/SOC II reports are not accepted as substitutes. The State will sign an NDA if required before conducting scans or receiving security assessments.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Exhibit B Security and Vendor Questionnaire.docx | DOCX document | |
| RFP Document.pdf | ||
| Exhibit C 8.0 Scanning Form Fill.pdf | ||
| Response to Offeror Questions document.pdf | ||
| Exhibit A ITSP.pdf | ||
| Exhibit A.1 ITSP Agreement.pdf | ||
| Exhibit A ITSP.pdf | ||
| RFP Document.pdf | ||
| Exhibit B Security and Vendor Questionnaire.docx | DOCX document | |
| Exhibit A.1 ITSP Agreement.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
8.0 SCANNING
The offeror acknowledges that the State will conduct a security and vulnerability scan as part of the review of the offeror’s RFP. This scan will not include a penetration test. The State will use commercially available, industry standard tools to scan a non-production environment with non-production data at mutually agreeable times.
The offeror should fill in the information below and sign the form. The offeror’s employee signing this form must have the authority to allow the State to do a security scan. If no security contact is given the State will assume that the State can scan at any time. At the state’s option, any RFP response that does not include a completed and signed form may be dropped from consideration. If there is State data protected by federal or state law or regulation or industry standard involved, the State is more likely to consider a security scan necessary for an RFP to be considered. Except for State staff, the State will only provide scan information to the offeror’s security contact. At the State’s option, the State will conduct the scan at a location named by the offeror. The offeror can only request, not require, naming the scanning location. The State may consider a full scan report from industry standard Web Application Vulnerability scanning tools (ex. Invicti, Burp Suite, Nmap, Qualys, Nessus, etc...) as satisfying the scanning requirement.
Executive Summaries, penetration test methodology/vulnerability summary reports, and SOC I/SOC II are not considered as sufficient replacements for a vulnerability scan. If required, the State will sign a non-disclosure agreement before scanning or receiving the full security assessment.
Offeror’s name: _______________________
Offeror’s security contact’s name: _______________________
Security contact’s phone number: _______________________
Security contact’s email address: _______________________
Web address URL or Product Name _____________________ (The State will contact the security contact to arrange for a test log for scanning)
Offeror’s employee acknowledging the right to scan:
Name (Print): ___________________________
Title:
Date:
Signature:
EXHIBIT C
| Offerors name: |
| Offerors security contacts name: |
| Security contacts phone number: |
| Security contacts email address: |
| Web address URL or Product Name: |
| Name Print: |
| Title: |
| Date: |
File details come from the government source that posted it. Updated .