IT_Security_questionnaire.docx
DOCX document 16 KB Posted
- Solicitation number
- PR8409
- Issued by
- Florida
About this file
This IT Security Questionnaire is a vetting document for the Orlando Utilities Commission's GIS Utility Network Migration Project and Support Services procurement (RFP PR8409). The project seeks a System Integrator to migrate OUC's legacy Esri Geographic Information System from a geometric network-based platform to Esri's modern ArcGIS Utility Network solution. The migration will encompass water, electric, and fiber networks, with water migration beginning in 2025. The contract term is set for three years with a potential two-year renewal option. The proposal is due August 28, 2025, by 2:00 PM EST, with project commencement scheduled for October 2023. Bidder qualifications require Esri Gold Partner status, a minimum of ten years of GIS services experience, successful completion of at least two Utility Network implementations (preferably including electric and water experience), and Florida business licensure. Key deliverables include a first draft Scope of Work, project implementation plan, milestones, and comprehensive project schedule.
The IT Security Questionnaire comprehensively assesses potential service providers across seven cybersecurity domains: governance and risk management, asset and data protection, access control, detection and monitoring, incident response, recovery planning, and third-party supply chain security. The questionnaire evaluates formal information security policies, executive leadership involvement in cybersecurity decisions, data classification and encryption protocols, identity and access management systems, multifactor authentication implementation, incident detection and response capabilities, business continuity planning, and third-party vetting procedures. No specific budget range or total contract value is stated in the documentation. The pricing structure utilizes hourly rates differentiated by professional role (Senior Project Managers, Database Administrators, Developers, Consultants, GIS Analysts, and Technicians) and staffing type (on staff or subcontract), with separate rates for normal and after-hours/overtime work. No incumbent vendors, bid bonds, or payment and performance bonds are identified in the provided documentation.
View the file
Other files
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
IT Security Questionnaire for Professional Services Vetting
1. Governance & Risk Management
Do you have a formal information security policy? If yes, when was it last reviewed or updated? How is executive leadership involved in cybersecurity risk decisions?
Is there a documented process for identifying and managing cybersecurity risks associated with third-party services
2. Asset & Data Protection
Can you provide an inventory of critical assets relevant to the services provided? How is sensitive customer data classified and protected throughout its lifecycle? Are encryption methods used for data at rest and in transit?
3. Access Control
How do you manage identity and access for internal and external users?
Are multifactor authentication (MFA) and least-privilege principles enforced?
4. Detection & Monitoring
What tools or processes are used to detect cybersecurity events? How is anomaly detection incorporated into your operations?
5. Incident Response
Is there an incident response plan in place? Can it be shared upon request? Are tabletop exercises or simulations conducted regularly?
6. Recovery Planning
How do you ensure continuity of critical services during and after a cyber incident? Do you have documented disaster recovery and business continuity plans?
7. Third-Party & Supply Chain Security
Do you vet subcontractors or suppliers for cybersecurity risks?
Are SLAs or contracts in place with third parties that define cybersecurity responsibilities?
File details come from the government source that posted it. Updated .