IT_Security_questionnaire.docx
DOCX document 16 KB Posted
- Solicitation number
- PR8409
- Issued by
- Florida
About this file
The document is an IT Security Questionnaire for Professional Services Vetting, associated with the Orlando Utilities Commission's (OUC) GIS Utility Network Migration Project. The project aims to transform OUC's legacy Esri Geographic Information System from a geometric network-based platform to Esri's modern ArcGIS Utility Network solution, addressing technology obsolescence and establishing standardized utility-focused data models. The procurement will cover migration services for water (starting in 2025), electric, and fiber networks, with an initial contract term of three years and a potential two-year renewal. The proposal is due on August 28, 2025, by 2:00 PM EST, with the project set to begin in October 2023.
The pricing structure includes flexible hourly rates for various professional roles, such as Senior Project Managers, Database Administrators, Developers, Consultants, GIS Analysts, and Technicians, with rates differentiated by job title and staffing type (on staff or subcontract). Bidder qualifications require being an Esri Gold Partner with at least ten years of GIS services experience, having completed at least two Utility Network implementations, and being licensed to do business in Florida. No specific set-aside designations or budget range are mentioned, but the project focuses on optimizing core GIS-based engineering, operations, inspections, maintenance, production, and construction processes while modernizing OUC's geospatial infrastructure.
View the file
Other files
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
IT Security Questionnaire for Professional Services Vetting
1. Governance & Risk Management
Do you have a formal information security policy? If yes, when was it last reviewed or updated? How is executive leadership involved in cybersecurity risk decisions?
Is there a documented process for identifying and managing cybersecurity risks associated with third-party services
2. Asset & Data Protection
Can you provide an inventory of critical assets relevant to the services provided? How is sensitive customer data classified and protected throughout its lifecycle? Are encryption methods used for data at rest and in transit?
3. Access Control
How do you manage identity and access for internal and external users?
Are multifactor authentication (MFA) and least-privilege principles enforced?
4. Detection & Monitoring
What tools or processes are used to detect cybersecurity events? How is anomaly detection incorporated into your operations?
5. Incident Response
Is there an incident response plan in place? Can it be shared upon request? Are tabletop exercises or simulations conducted regularly?
6. Recovery Planning
How do you ensure continuity of critical services during and after a cyber incident? Do you have documented disaster recovery and business continuity plans?
7. Third-Party & Supply Chain Security
Do you vet subcontractors or suppliers for cybersecurity risks?
Are SLAs or contracts in place with third parties that define cybersecurity responsibilities?
File details come from the government source that posted it. Updated .