Exhibit I.docx
DOCX document 21 KB Posted
- Attached to
- Perkins Data and Application System
- Solicitation number
- 24RFP10864
- Issued by
- Harding County, South Dakota
About this file
Exhibit I is a document that outlines the security and vulnerability scanning requirements for offerors responding to a Request for Proposal (RFP) issued by the State of South Dakota Department of Education's Division of. The State will conduct a security and vulnerability scan of the offeror's non-production environment as part of the RFP review process. The offeror must provide the State with contact information for their security representative and grant the State permission to conduct the scan at mutually agreeable times. The State may consider a full security assessment report from industry-standard vulnerability scanning tools as satisfying the scanning requirement.
The related state and local contract opportunity is for the Perkins Data and Application System project. The State seeks a qualified vendor to provide professional services to review the requirements of the RFP and submit a proposal by the deadline. Consultants may make email inquiries to obtain clarification of the RFP requirements, but no inquiries will be accepted after the indicated date. The State will respond to consultant inquiries and inform all consultants of any modifications to the RFP.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Exhibit C.docx | DOCX document | |
| Exhibit B.pdf | ||
| Exhibit E.docx | DOCX document | |
| Exhibit F.pdf | ||
| Exhibit H.docx | DOCX document | |
| Exhibit G.docx | DOCX document | |
| RFP Document.pdf | ||
| Exhibit D.docx | DOCX document | |
| Response to Offeror Questions document.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Exhibit I
SCANNING
The offeror acknowledges that the State will conduct a security and vulnerability scan as part of the review of the offeror’s RFP. This scan will not include a penetration test. The State will use commercially available, industry standard tools to scan a non-production environment with non-production data at mutually agreeable times.
The offeror should fill in the information below and sign the form. The offeror’s employee signing this form must have the authority to allow the State to do a security scan. If no security contact is given the State will assume that the State can scan at any time. At the state’s option, any RFP response that does not include a completed and signed form may be dropped from consideration. If there is State data protected by federal or state law or regulation or industry standard involved, the State is more likely to consider a security scan necessary for an RFP to be considered. Except for State staff, the State will only provide scan information to the offeror’s security contact. At the State’s option, the State will conduct the scan at a location named by the offeror. The offeror can only request, not require, naming the scanning location. The State may consider a full scan report from industry standard Web Application Vulnerability scanning tools (ex. Invicti, Burp Suite, Nmap, Qualys, Nessus, etc...) as satisfying the scanning requirement. Executive Summaries, penetration test methodology/vulnerability summary reports, and SOC I/SOC II are not considered as sufficient replacements for a vulnerability scan. If required, the State will sign a non-disclosure agreement before scanning or receiving the full security assessment.
Offeror’s name:
Offeror’s security contact’s name:
Security contact’s phone number: _______________________
Security contact’s email address: _______________________
Web address URL or Product Name ____________________. The State will contact the security contact to arrange for a test log for scanning.
Offeror’s employee acknowledging the right to scan:
Name (Print):
Title:
Date:
Signature:
File details come from the government source that posted it. Updated .