Response to Offeror Questions document.pdf

Department Of Health, Office of Public Health Preparedness and Response

RFP No. 25-0901005-012

State of South Dakota 600 East Capitol Ave

Pierre, SD 57501 605-280-5238

Date: February 3, 2025

Subject: Questions and Answers for RFP No. 25-0901005-012

In accordance with the subject Request for Proposal (RFP), the following are answers to questions which have been submitted prior to February 3, 2025, 5:00pm (CST). These questions are for informational purposes only; they do not alter the requirements specified within the RFP.

Any changes to the RFP will be accomplished by the Office of Procurement Management through the use of an addendum.

1. Question: Can you provide a clearer explanation of communities most impacted by disasters, and how cybersecurity in the healthcare systems is relevant to them?

Answer: Communities most impacted by disasters are those that experience disruptions in transportation, power, housing, or emergency services. These communities are more vulnerable during disasters and need extra support to maintain essential services and recover. Cybersecurity is crucial for healthcare systems in these communities, as healthcare facilities rely on digital systems to deliver care and manage resources during disasters. A cyber-attack could disrupt these systems, making it harder for people to get the help they need.

2. Question: What practices and/or systems does the SD HCC have in place to align with the

Healthcare and Public Health (HPH) Sector-Specific Cybersecurity Performance Goals

(CPGs) to enhance cyber preparedness and resiliency?

Answer: The SD HCC currently does not have a specific cybersecurity plan in place, but it does have a communications plan to support coordination and information sharing. While there isn’t a formal cybersecurity plan yet, efforts to improve preparedness and resiliency will include alignment with the Healthcare and Public Health (HPH) Sector-Specific Cybersecurity

Performance Goals (CPGs) in the future.

3. Question: When evaluating healthcare services (EHR, medical devices, various systems, etc.) for vulnerabilities to cyber events, does the SD HCC want evaluations of specific instances of those services, or general evaluations based on technology, threat landscape, and exposure?

Answer: The assessment does not require evaluating specific instances, but rather a general evaluation. It should aim to identify gaps in the facilities' cybersecurity, potential threats, and areas of exposure.

600 East Capitol Ave

4. Question: Who are the key informants and stakeholders we should engage with in order to provide a comprehensive assessment of the SD HCC?

Answer: The SD HCC includes approximately 180 hospitals, long term care facilities, emergency management, and emergency medical services across the state. Once the RFP is awarded and the contract process begins, more detailed information on key stakeholders will be provided.

5. Question: For partners who are local, are in-person interviews an option?

Answer: Yes, in-person interviews are available as long as virtual interviews follow the same set of questions. However, due to the tight timeline and quick turnaround needed for this project, virtual interviews may be a more efficient choice.

6. Question: Does the SD HCC maintain a central staff that oversees all of the facilities administrative, physical and technical security controls? Are these the key informants?

Answer: No. Each facility independently manages its own administrative, physical, and technical security controls.

7. Question: Does the SD HCC have an existing cybersecurity plan in place today?

Answer: No. However, individual facilities may have some variation of a cybersecurity plan.

8. Question: Are there specific healthcare facilities or types within the SD HCC that should receive priority, and how many physical locations are in scope for assessment, including the distance between them?

Answer: There are approximately 180 healthcare facilities and health systems within the SD

HCC, spread across the state. Due to the wide distribution of these facilities, it is challenging to provide specific mileage between each one. There is no designated priority level for specific facilities at this time.

600 East Capitol Ave

9. Question: How many distinct environments (e.g., on-prem, cloud, hybrid) need to be evaluated, and what is the size and complexity of the infrastructure, including the number of systems, asset types, and the nature of information involved?

Answer: Each health system has its own unique setup, so it's difficult to determine the overall complexity of the systems. The main focus is to evaluate whether these facilities have any kind of mitigation system in place to protect against cybersecurity attacks that could affect their healthcare systems and patient care.

10. Question: Do you want to assess specific infrastructure components (e.g., servers, firewalls, routers, wireless environments, cloud systems), and do you have any existing technical documentation (number of documents, total pages) available on request?

Answer: The primary objective is to assess whether each healthcare facility has infrastructure components in place to protect the systems they currently use, essentially determining a "yes or no" answer regarding the presence of such protections. Additionally, if protections are in place, the evaluation will focus on whether they are adequate to mitigate the risk of a cyber-attack that could disrupt operations and patient care. Each healthcare facility and health system maintain its own technical documentation based on the systems they utilize, and it will be at the discretion of each facility to determine whether they wish to share this information.

11. Question: Is there a defined budget or funding cap for this project, and can you share a budget with prospective bidders?

Answer: The potential partner will be required to provide a detailed budget that includes all costs related to the provision of the required services. At this time, there is no specified budget cap, and prospective bidders should outline their full financial requirements for the project.

12. Question: Is there flexibility in the project timeline for unforeseen challenges?

Answer: The project timeline may be evaluated during the contract period should unforeseen challenges occur”. Adjustments to the timeline will depend on various factors, including federal requirements and guidelines.

13. Question: Does the State plan to select a single vendor or multiple vendors, and how many vendors/partners need to be surveyed during the project?

600 East Capitol Ave

Answer: The state plans to select a single vendor for this project. With approximately 180 facilities within the South Dakota Health Care Coalition, the goal is to reach and assess the majority of these facilities during the project.

14. Question: Is the State open to exploring offshore hybrid staffing models, and are there any incumbent vendors involved that are eligible to bid on this RFP?

Answer: The State is not open to considering offshore hybrid staffing models, and there are no current vendors involved who are eligible to bid on this request for proposals.

15. Question: Can you describe the cybersecurity structure (centralized or decentralized), capabilities (e.g., MDR, SOC, IAM), and any compliance standards the assessment should align with (e.g., HIPAA, NIST CSF)?

Answer: Each facility manages its own IT and cybersecurity framework, so the vendor should determine whether it’s centralized or decentralized, along with specific capabilities (e.g., MDR, SOC, IAM) during the assessment. The primary focus will be on evaluating cybersecurity capabilities, with technical details addressed as needed. All healthcare facilities and systems must comply with HIPAA and Joint Commission standards. The assessment will also consider additional compliance with other relevant standards, such as NIST CSF, where applicable.

16. Question: Does the assessment need to include penetration testing, vulnerability testing, or simulated attack scenarios (e.g., for external/internal hosts, wireless networks), and do you have specific requirements for third-party vendor connections or persistent connections for cybersecurity assessment?

Answer: Penetration testing, vulnerability testing, or simulated attack scenarios are not required as part of this assessment. However, based on the outcomes of the assessment, a cybersecurity plan will be developed, which will be evaluated and tested. The potential vendor conducting the assessment may recommend mitigation actions, which could include penetration testing, vulnerability testing, or simulated attack scenarios as part of future exercises. Specific requirements for third-party vendor connections or persistent connections for the cybersecurity assessment are not applicable to this assessment.

17. Question: Do you have incident response, disaster recovery, and business continuity plans in place, and are they regularly reviewed?

600 East Capitol Ave

Answer: Each facility has emergency and disaster response plans in place, which align with hazard vulnerability assessments conducted annually. These plans are regularly reviewed to ensure they remain up to date and effective; however, it is up to the individual facilities and healthcare systems to ensure that these reviews are happening as required.

18. Question: How do you respond to emerging threats like ransomware, and are there predefined recovery time objectives (RTOs) or recovery point objectives (RPOs) for downtime scenarios?

Answer: The assessment will aim to determine if facilities and healthcare systems have established response capabilities for emerging threats, such as ransomware. Additionally, it will evaluate whether predefined recovery time objectives (RTOs) or recovery point objectives

(RPOs) are in place for downtime scenarios.

19. Question: Which cloud service providers (e.g., AWS, Microsoft Azure, Google Cloud

Platform, or others like OVH or RackSpace) are used, and what is the structure of the environment (e.g., production, development, UAT)? Please include details on the purpose of the cloud services, the type of service (IaaS, SaaS, PaaS), the number of tenants, application services used, and the availability of network schemas or logical diagrams.

Answer: As each facility and healthcare system manages its own IT systems, the specific use and strategy for different cloud providers would need to be addressed directly with each facility during the assessment. However, the primary focus of the assessment is to evaluate cybersecurity capabilities, rather than delving into the technical details of each cloud provider’s strategy, including the structure, services, and network diagrams.

20. Question: Are virtual machines or containers used in the evaluated environments, and how are they distributed across cloud and on-prem systems?

Answer: Each facility operates differently in how they manage their information technology systems, so the use of virtual machines or containers, and how they are distributed across cloud and on-prem systems, would need to be addressed directly with each facility during the assessment. However, the primary focus of the assessment is to evaluate cybersecurity capabilities, rather than delving into the technical details of the infrastructure.

600 East Capitol Ave

21. Question: Would you like to include a tabletop exercise as part of the assessment, focusing on specific incidents like ransomware or data breaches, and how many facilities are involved in this exercise?

Answer: A tabletop exercise will not be part of the current assessment.

22. Question: Do you have a comprehensive risk assessment or impact analysis in place, and how many clinical and operational functions are in scope for the risk and controls assessment?

Answer: Each healthcare system and its associated facilities are required to conduct a Hazard

Vulnerability Risk assessment and may also perform additional internal risk assessments or impact analyses based on their specific needs. However, this is something that should be asked of each facility during the assessment. There are about 180 healthcare facilities and systems within the SD HCC, with the goal of assessing the majority of these facilities during the project.