Information_Technology_Security_Assessment.pdf
PDF 243 KB Posted
- Attached to
- Hypochlorous Acid Generator
- Solicitation number
- PD 25-26.083
- Issued by
- Escambia County, Florida
About this file
This is an Information Technology Security Assessment questionnaire for Escambia County Board of County Commissioners in Florida related to a hypochlorous acid generator procurement. The document does not specify a response date, due date, site visit, bidder's meeting, or award date. The selected contractor will be responsible for delivering and installing the generator equipment, conducting testing and personnel training, and providing ongoing hardware and software maintenance. The generator must be capable of producing sufficient disinfectant on demand for all county facilities while remaining safe for human and animal contact, including ingestion, inhalation, and skin exposure. The disinfectant must be non-corrosive, non-flammable, and incapable of being weaponized or misused to create intoxicants. Proposals were due August 11, 2026.
The assessment questionnaire addresses critical security and operational requirements across multiple domains, including support services, technology architecture and system requirements, artificial intelligence usage and safeguards, Americans with Disabilities Act compliance, hosting model and data center location, security architecture and incident notification procedures, data management and retention policies, and access controls. Vendors must demonstrate robust cybersecurity measures, describe their support model with remote access capabilities, confirm ADA compliance, specify hosting locations outside banned countries, detail encryption and data protection protocols, establish data ownership and retention procedures, and confirm integration with enterprise identity management solutions and multi-factor authentication. No contract value, contract term, incumbent, evaluation criteria, or funding information is specified in the available documentation.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Information Technology Security Assessment
Products name =
Support
1. Please describe your support model and include office location(s), hours of operation, how to submit, track, and escalate tickets, and average response time for tickets.
2. If your support team needs to remote into our systems, are they able to use approved methods: Microsoft Teams, Bomgar (BeyondTrust), or Zoom meeting?
3. Do you offer in-application online help? Please describe.
TECHNOLOGY
1. Please describe the basic system architecture of your application and how it will interact with our company’s IT resources. Provide a diagram if available.
2. What is the minimum system/network requirements to run your application? (Include security white sheet if available)
3. What documentation is provided with each new release of the application?
4. How many concurrent users can your application support? Please provide performance benchmarks if available.
5. Please describe how your application can interface with our existing third-party applications. (If Applicable)
AI USAGE
1. Q: Does this product utilize AI?
2. Q: What is the purpose of AI in the product and how does it operate?
3. Q: Is any data retained by the AI for any learning or replication purposes? (if yes, describe how and why)
4. Q: What processes does your organization take to ensure our data is not abused by AI?
5. Q: How much access is AI given to our systems or network?
6. Q: Does your company capture logging and monitor: prompts, outputs, user activity, AI agent activity and if so, are those logs available upon request?
7. Q: If audited can the decisions of the AI in your product be explained clearly?
8. Q: What controls do you have to ensure quality, fairness, accuracy and safety, while preventing hallucinations, biases, Prompt injection, data exfiltration?
9. Q: Please explain how you audit your AI for quality, fairness, biases, accuracy, hallucinations and safety?
10. Q: Can the AI agent be turned on or off for certain business workflows? Please describe as appropriate.
11. Q: Does the AI transmit data between our network and yours or is it completely cloud or on our network?
ADA COMPLIANCE
1. Q: Does your product support ADA compliance if needed by our employees?
2. Q: If your company has any public-facing web site, documents, and/or mobile applications on behalf of our organization, will it adhere to WCAG title II AA compliance?
3. Q: How do you verify your Web sites, documents, and/or mobile applications are ADA compliant to our standards?
HOSTING
1. Q: Please describe your hosting model (i.e. SaaS, on premise, vendor hosted).
2. Q: Where is your data center(s) located (countries, states, principalities, ETC)?
3. Q: Does any of your hosting sites reside in or belong to any countries that are part of the U.S.
banned countries list?
4. Q: Are any of your data centers located in or beholden to any countries(s) that are blacklisted by the United States Government or are countries of particular concern to the United States
Government?
5. Q: Do you provide clients with additional environments, in addition to the production environment (i.e. testing, training, configuration, etc.)? Is there an additional cost?
SECURITY
1. Please describe your security architecture. Include physical controls for data centers, any logical controls for data security, and the security framework your company uses. (List the use of Firewalls, web firewalls, intrusion detections/preventions systems/secure API endpoints)
2. What are your organization’s policies and procedures for notifying clients in the event of a security-related incident? What insurance does your organization have in the event of a data breach?
3. How and where does your organization encrypt data at rest and data in transit? (Include encryption methods and encryption key strength)
4. What safeguards do you have in place for personal identifiable information PII, financial data, Criminal Justice Information Data CJIS, Protected Health Information PHI, and other sensitive data?
5. Describe your products life cycle including frequency of releases, patches/hotfixes, and upgrade process. What are the client’s responsibilities with regards to upgrades?
DATA MANAGEMENT
1. How is data backed up and stored? Are backups ever moved offsite? How are backups encrypted and secured?
2. What happens to our data if your organization is purchased by another organization?
3. What is your data retention policy if the contract period ends? How do you securely delete/retrieve our data when it’s no longer needed or upon contract termination?
4. Who owns the data stored or processed by your systems? Will our data be used to train AI models or transferred for any reason to third parties?
5. Describe how our data (Sensitive or regular data) is anonymized or masked?
ACCESS CONTROLS
1. Does your application support integration with any Enterprise Identity Management solution and allow for Single Sign On (SSO)? If yes specify Protocols: [e.g. SAML, OAuth]
2. What criteria does your application enforce for secure user credential creation and does your application allow for multi-factor authentication?
3. Does your application support role-based security and limit access based on the principle of least privilege?
4. Describe your Password Policy Enforcement for your company and how our Users access the environment.
File details come from the government source that posted it. Updated .