Questions and Answers-B-33587~1.docx
DOCX document 15 KB Posted
- Attached to
- IES SOC 1 Type 2 Audits
- Solicitation number
- 23-444DHS-MIS44-B-33587
- Issued by
- St. Clair County, Illinois
About this file
The provided document contains the questions and answers related to an Invitation for Bid (IFB) issued by the Illinois Department of Human Services (DHS) for a SOC 1 Type 2 audit of the Illinois Eligibility System (IES). The IFB requires the selected vendor to perform the SOC 1 Type 2 audit, which is typically conducted over a twelve-month period from July 1 to June 30. The State of Illinois expects to award the contract within the next two months, with the audit work commencing within 6-8 weeks after the award.
The document outlines various details regarding the IES system, such as the current hosting arrangement, the number of state employees with access, and the ongoing IT vendor transition to a Software as a Service (SaaS) model. The State confirms that it will allow onsite auditors, although the majority of external audit staff are working remotely. The IFB also addresses the vendor's ability to provide additional information about their firm, qualifications, experience, and team, which will be reviewed as part of the bid evaluation process.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| BEP ADDENDUM B-33587.xlsx | XLSX spreadsheet | |
| Forms A Section V.23.2~6.docx | DOCX document | |
| Notice concerning additional Covid~39.docx | DOCX document | |
| Notice of Electronic Submission Only v.22.1~56.pdf | ||
| Goal Facilitation B-33587.txt | TXT text file | |
| DHS IFB SOC 1 Audit-B-33587.docx | DOCX document | |
| Forms B~89.docx | DOCX document | |
| BEP Utilization Plan Version 21.0~5.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
DHS IFB SOC 1 Type 2 Audit B-33587 Questions and Answers
Q1. Has the intended scope undergone any other third party review such as a ISO 27001 certification, Penetration Testing, Internal Audit, HIPAA Security Audit in prior years? If so, can the reports be provided for review prior to submitting quote?
A1. Yes. Annual URL penetration testing is a Federal CMS requirement. IES is currently under a conditional 3 year Authority to Connect with Fed CMS that expires May 2024. The next independent assessment of IES for the new ATC will take place in late 2023/early 2024. IES is annually audited by RSM and KPMG (on behalf of the IL Office of Auditor General).
Q2. Is any part of the management or maintenance of the IES outsourced to a third party, including, but not limited to:
| a) | Change management |
| b) | System development |
| c) | Configuration management |
| d) | Data backup and recovery |
| A2. | A) No |
| B) Yes. Currently Deloitte | |
| C) No | |
| D) No |
Q3. What period of coverage is the state requesting coverage for?
A3. Typically, we see SOC 1 Type 2 examination with a six, nine, or twelve month audit period. Twelve month audit period from 7/1 thru 6/30 once the audit cycle is established.
Q4. What is the deadline the State has to have a final SOC 1 Type 2 report in hand?
A4. Please see Section 1.3 of the IFB
Q5. When does the State expect to make a decision on the winning bid so we can plan expected timing with our resources?
A5. Ideally, the contract will be awarded within the next 2 months, and start within 6-8 weeks after award.
Q6. Does the organization utilize any IT vendors for data hosting, or is the data hosted in a by the State of Illinois?
A6. IES data is currently hosted on premises at the State of IL DoIT Central Computing Facility. An RFP is has been awarded to an IT vendor for the full support of the IES application as a Software as a Service (SaaS). This transition will take place in 2023-2024.
Q7. Approximately how many employees have access to the IES?
A7. There are approximately 6000 State of IL employees (individuals with @illinois.gov active directory accounts) who access IES.
Q8. Does the organization have a vendor management program in place to monitor and review vendors that are key to the services in scope?
A8. No; we don’t have a formal vendor management process.
Q9. Has an Information Security Risk Assessment been completed over the intended scope previously?
A9. Yes
Q10. Does the State of Illinois accepting of onsite auditors at this time, or is the intention for the audit to be executed remotely?
A.10. Yes, we will allow auditors to be scheduled onsite with prior approval, but the majority of external audit staff are working remotely.
Q11. If we submit an additional document with firm information, qualifications, experience, references and team information, will it be reviewed?
A11. All bids submitted by the due date and time in accordance with all requirements of this solicitation will be reviewed for responsiveness and responsibility.
File details come from the government source that posted it. Updated .