RFI - DMS-2324-073 - GRC.pdf

4050 Esplanade Way Tallahassee, FL 32399-0950

Ron DeSantis, Governor Pedro Allende, Secretary

Florida Department of Management Services

Request For Information (RFI)

Governance, Risk, and Compliance Platform Solutions

RFI Advertisement Number: DMS-23/24-073

Begin Date: March 19, 2024 End Date: April 16, 2024

Refer ALL Inquiries to:

Araceli Serna, Procurement Officer

Departmental Purchasing Department of Management Services

4050 Esplanade Way, Suite 260 Tallahassee, FL 32399-0950 dms.purchasing@dms.fl.gov

Pursuant to rule 60A-1.042, Florida Administrative Code (F.A.C.), an agency may request information by issuing a written Request for Information. Agencies may use Requests for Information in circumstances including, but not limited to, determining whether to competitively procure a commodity or contractual services, determining what solicitation process to use for a specific need, or researching general, special, and/or technical specifications for a solicitation.

The sole purpose of this RFI is to obtain information from the vendor community. The Department is not seeking bids or proposals, and no contract award will result from this RFI.

RFI No. DMS-23/24073 Page 2 of 7

I. INTRODUCTION

The Department of Management Services (Department) is issuing this Request for Information (“RFI”) to the vendor community to obtain information on Governance, Risk, and Compliance (“GRC”) platform solutions.

This is an RFI as defined in section 287.012(22), Florida Statutes (“F.S.”), for planning purposes only. This is not a solicitation for offers. The information gathered from this RFI may be used to develop a future solicitation. Please monitor the MyFloridaMarketPlace (“MFMP”) Vendor Information Portal for any changes or notices prior to submitting a response.

II. PURPOSE OF A REQUEST FOR INFORMATION

Rule 60A-1.042, F.A.C., provides that an agency may request information by issuing a written RFI. Agencies are authorized to use an RFI in circumstances including, but not limited to, determining whether to competitively procure a commodity or contractual services, determining what solicitation process to use for a specific need, or researching general, special, and/or technical specifications for a solicitation.

A vendor’s response to an RFI is not an offer and the agency may not use the vendor’s submission to justify a contract with that vendor without otherwise complying with Chapter 287, F.S. and rule 60A-1.042, F.A.C. Vendors submitting a response to an agency’s RFI are not prohibited from responding to any related subsequent solicitation. Any future purchase of the commodity or services will be conducted in accordance with applicable law.

The Vendor’s response to this RFI may be used to prepare future solicitations and may result in subsequent vendor meetings.

III. GOALS

The Department is seeking information from vendors regarding their GRC platform solutions. Information should be provided about scalable GRC platforms which may be purchased or licensed by the Department for deployment across various Florida agencies (“Enterprise”). The platform should enable select users to manage the cybersecurity risk landscape across the Enterprise and to identify and detect gaps in effectiveness across people, processes, and technology.

The Department is interested in information regarding vendors’ GRC platform solutions, including how the vendors’ GRC platforms can provide holistic risk measurement and risk reduction, while being capable of solving unique and undefined agency specific needs.

Primary GRC users include the enterprise’s risk management personnel, inspector general personnel, compliance personnel, cybersecurity personnel, and IT risk management personnel. Information regarding the GRC solution should include the following:

The GRC platform's ability to measure and track cybersecurity and IT risks.

The GRC platform’s ability to allow the Department’s cybersecurity personnel to manage enterprise risk by collaborating with third parties outside of the Department, including the Enterprise inspector general community.

The GRC platform’s ability to perform automated functions, including but not limited to, risk management, risk governance, risk identification and analysis, risk monitoring, risk response, risk planning, compliance, and risk reporting functions.

IV. RESPONSE SUBMISSION

The Department requests the following information:

RFI No. DMS-23/24073 Page 3 of 7

A. Company Information:

1. Primary contact

2. Address

3. Phone

4. Email

B. GRC Platform Information:

1. Describe the Vendor’s GRC platform’s specifications, including the platform’s ability to meet or exceed the contemplated functional and technical capabilities, including the ability to:

a. identify and assess risk (both qualitative and quantitative) across an entity;

b. structure risk assessment process flow (initiating assessment, use of assessment questionnaires, completing assessment, approval);

c. provide risk response and perform risk mitigation;

d. perform ongoing monitoring through automated compliance checks and use of key risk indicators;

e. maintain a centralized risk register of all identified events, risks, and potential impacts;

f. perform policy management capabilities, including a centralized policy repository to store, manage, and update policies and procedures, and communicate policies throughout an organization; and

g. perform vendor and third-party risk management.

Compliance:

h. perform control assessments including performance of test of design or test of effectiveness;

i. support and map to multiple standard frameworks such as NIST CSF, FISMA, CJIS as per state's requirements;

j. configure assessments against standard frameworks;

k. support use of custom frameworks (ex. Rule 60GG-2, Florida Administrative Code); and

l. perform continuous control monitoring.

Reporting:

m. provide overall risk assessment reports of controls, risks, and ratings including the ability to generate heat maps, dashboards, and have customizable formatting for reports; and

n. report to third parties and executives.

Access Management:

RFI No. DMS-23/24073 Page 4 of 7

o. provide multi-tenancy functionality such that each individual entity has access to only its own tenant while simultaneously supporting an enterprise-wide view for the State’s cybersecurity office;

p. provide role-based access within a tenant, cross-tenants, and enterprise wide; and

q. provide separate independent role/view specific to vendors, auditors, and employees.

Integrations:

r. import legacy data through integrations or flat files;

s. provide list of native data integration features included with the platform; and

t. support upstream and downstream data flow using integration with various systems e.g.: Asset Management, CMDB, EDR, etc.

Implementation Support:

u. provide a clear implementation plan and resourcing, including setup, testing and training, to meet the desired go-live date;

v. established and documented implementation/administration manuals and user guides; and

w. provide in-class training and assistance using online and offline mediums for system administrators and end-users.

Please provide information on the level of Customer Support provided with the solution; such as,

x. level of user and technical support, e.g., 24/7;

y. access to support across multiple formats including phone, email, chat and online knowledge base;

z. the change management and routine maintenance processes;

aa. the range of service level agreements (SLAs) available such as defining metrics for performance, issue resolution, requests and audits, in addition to availability, and RTO and RPO metrics; and

bb. An archiving and e-discovery capability directly or as an add-on that supports retention policy-based management, e-discovery features, indexing and search. Including the ability to archive data based on an event, such as a legal hold.

Please provide information on solution security; such as, the ability of the vendor to provide:

cc. a third-party security audit, within the past year, by an accredited auditing firm and/or show Federal Risk and Authorization Management Program (FedRAMP) or StateRAMP status as authorized, in-process, ready or other with the appropriate reporting agencies;

dd. security policies and procedures which govern the solution;

RFI No. DMS-23/24073 Page 5 of 7

ee. Descriptions of the configurable controls that extend data and transaction security and compliance to third-party platforms or the solution's hosting providers; and

ff. Descriptions of system and application logging in place to record any changes being made to the record, as well as, who made the changes, time stamp and any additional information the tool might perform to ensure data security via data encryptions and compliance with standardized frameworks (to protect confidential and/or sensitive data and comply to any necessary standards).

2. Provide a draft contract and associated service level agreements for the GRC platform.

3. Provide one or more current contracts with governmental entities. If the contracts include cooperative purchasing/piggyback language, identify the section.

4. Identify any cooperative purchasing agreements where the solution may be purchased.

5. Identify potential solutions for governance, risk, and compliance beyond the provision of a GRC platform.

6. Provide pricing options, such as user and enterprise subscriptions vs. volume based, and/or transaction based pricing.

7. Provide additional information for consideration. Where possible, use a question-and-answer format.

8. Provide testimonials or references.

PLEASE NOTE: Any submitted material is subject to the Public Records Act, section 119.07, F.S.

V. RESPONSE SUBMISSION

Responses shall be submitted as follows:

1. Responses shall be submitted via email only

2. The email Subject Line shall be titled: DMS-2324-073

3. Response Files should follow this naming convention:

Company Name_DMS-2324-073_RFI; and

4. The response must be submitted via the email to dms.purchasing@dms.fl.gov

5. A redacted copy must also be submitted, if the vendor is asserting the existence of confidential, proprietary, or trade secret information. See section XI herein.

***ALL EMAILS SHALL CONTAIN THE RFI NUMBER IN THE SUBJECT LINE OF THE EMAIL***

VI. PROCESS

Responses to this RFI will be reviewed by the Department for informational purposes only and will not result in the award of a contract.

Responding to the RFI does not prevent a vendor from being eligible to contract with an agency pursuant to section 287.057(19)(c), F.S.

VII. PRESENTATIONS

After the Department receives responses to this RFI, and at the sole discretion of the Department, one or more vendors may be selected to demonstrate to the Department the products and services related to the information submitted in the RFI response. The purpose is for the Department to learn about the most current solutions available.

RFI No. DMS-23/24073 Page 6 of 7

Any presentation should be direct in nature and remain on topic. The presentation moderator will remind vendors that the meeting is for information gathering only. Vendors are encouraged to bring technical representatives to the presentations.

VIII. TIMELINE

Listed below are important dates and times when actions should be taken or completed. If the Department finds it necessary to update any of the dates and/or times noted, it will be accomplished by an addendum to the RFI. All times listed below are in Eastern Standard Time (EST).

Date Time Description 3/19/2024 TBD Release of RFI 3/27/204 4:00 p.m. Questions due to the email address in Section V.

4/5/2024 TBD Anticipated answers to questions

4/16/2024 4:00 p.m. Responses are due to the email address in Section

V.

To Be Determined TBD Presentations, if applicable.

IX. CHANGES TO THE RFI

The Department will post addenda to the RFI on the Florida Vendor Information Portal (VIP) at MyFloridaMarket Place Vendor Information Portal. Each vendor is responsible for monitoring the VIP for new or changing information.

X. RFI QUESTIONS AND CONTACT WITH DMS

Vendors shall address all questions regarding this RFI in writing to the email address identified in Section XIII. DMS will post answers to questions on VIP as noted in Section VIII., Timeline.

XI. CONFIDENTIAL, PROPRIETARY, OR TRADE SECRET INFORMATION

If vendor considers any portion of the documents, data or records submitted in response to this RFI to be confidential, proprietary, trade secret or otherwise not subject to disclosure pursuant to Chapter 119, Florida Statutes, the Florida Constitution or other authority, vendor must mark the document as “Confidential” and simultaneously provide the Department with a separate redacted copy of its response and briefly describe in writing the grounds for claiming exemption from the public records law, including the specific statutory citation for such exemption. This redacted copy shall contain the Department’s RFI name, number, and the name of the vendor on the cover, and shall be clearly titled “Redacted Copy.” The Redacted Copy should only redact those portions of material that the vendor claims are confidential, proprietary, trade secret or otherwise not subject to disclosure.

In the event of a request for public records pursuant to Chapter 119, Florida Statutes, the Florida Constitution or other authority, to which documents that are marked as confidential are responsive, the Department will provide the Redacted Copy to the requestor. If a requestor asserts a right to the Confidential Information, the Department will notify the vendor such an assertion has been made. It is the vendor’s responsibility to assert that the information in question is exempt from disclosure under chapter 119 or other applicable law.

If the Department becomes subject to a demand for discovery or disclosure of the Confidential Information of the vendor in a legal proceeding, the Department shall give the vendor prompt notice of the demand prior to releasing the information (unless otherwise prohibited by applicable law). The vendor shall be responsible for defending its determination that the redacted portions of its response are confidential, proprietary, trade secret, or otherwise not subject to disclosure.

RFI No. DMS-23/24073 Page 7 of 7

By submitting a response, the vendor agrees to protect, defend, and indemnify the Department for any and all claims arising from or relating to the vendor’s determination that the redacted portions of its response are confidential, proprietary, trade secret, or otherwise not subject to disclosure. If vendor fails to submit a redacted copy of information it claims is confidential, the Department is authorized to produce the entire documents, data, or records submitted to the Department in answer to a public records request for these records.

XII. VENDOR COSTS

Vendors are responsible for all costs associated with the preparation, submission, and any potential meeting to discuss this RFI. The Department will not be responsible for any vendor-related costs associated with responding to this request.

XIII. PROCUREMENT OFFICER

If you have administrative questions concerning this RFI, please contact:

Araceli Serna DMS Departmental Purchasing Phone: (850) 414-7509 Email: dms.purchasing@dms.fl.gov

**ALL EMAILS SHALL CONTAIN THE RFI NUMBER IN THE SUBJECT LINE OF THE EMAIL**

XIV. SPECIAL ACCOMMODATIONS

Any person with a disability requiring special accommodations to participate in the RFI shall contact the Department contact person at the phone number above at least five working days prior to the submission deadline for Questions and/or Responses. If you are hearing or speech impaired, please contact this office by using the Florida Relay Services which can be reached at 1 (800) 955-8771 (TDD).

Certified Business Enterprises are encouraged to participate in the RFI process.

END OF RFI NO.: DMS-23/24-073