RFP-DAA-2016000062 Questions Answers - Data Privacy Security Final.docx
DOCX document 38 KB Posted
- Solicitation number
- RFP DAAA 2016000062 5
- Issued by
- Denver County, Denver City, Colorado
About this file
This document is a Questions and Answers record for RFP-DAA-2016000062 issued by the Colorado Department of Education regarding Grade 10 and College Entrance Exams Data Privacy & Security Requirements. The RFP seeks a contractor to manage test data with stringent security and privacy controls. The document addresses key operational aspects including contractor responsibilities for data distribution to post-secondary institutions, security audit and penetration testing requirements, background check procedures for employees, and data access protocols. The State confirmed that Grade 11 exam results may be used for college applications within Colorado and other states, that independent third-party penetration tests are acceptable, and that pre-employment background checks conducted within one year of contract award satisfy requirements. Additionally, the State clarified that scoring subcontractors are permissible subject to approval, provided data is encrypted in transit and at rest, and that such subcontractors must be bound by identical confidentiality terms as the primary contractor.
The document establishes critical data handling provisions requiring contractors to implement 24/7 secure data storage access, though restricted access areas without proprietary information may be acceptable under nondisclosure agreements. Contractors retain discretion in breach notification methods provided compliance with Colorado Revised Statutes Section 6-1-716 and State approval. The State emphasized that student consent cannot override contractual restrictions on data uses and disclosures, and that mandatory security training applies to all team members with access to contract-related facilities, systems, and materials. Data deletion requests may be initiated by the State under circumstances such as student ineligibility, and the State indicated willingness to negotiate reasonable language regarding "system data" delivery based on industry standards and the selected contractor's infrastructure upon contract award.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| RFP-DAA-2016000062 Grade 10 and College Entrance Exams - Final.docx | DOCX document | |
| RFP-DAA-2015000238 Revised Attachment 4 11-4-2015.docx | DOCX document | |
| RFP-DAA-2016000062 Questions Answers - General Final.docx | DOCX document | |
| Attachment 8 - Revised 11-17-15.docx | DOCX document | |
| RFP-DAA-2016000062 Modification #4-Attachment 9 item 9.5.docx | DOCX document | |
| RFP-DAA-2016000062 Exhibit 1 - CDE personal services IT contract tempate 10-26-15.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
OFFEROR’S QUESTIONS and
COLORADO DEPARTMENT OF EDUCATION RESPONSE
RFP-DAA-2016000062
Grade 10 and College Entrance Exams
Data Privacy & Security Requirements Questions & Answers
Note: All CDE answers are printed in BOLD
Offeror inquires have been reproduced as received.
| Page |
| RFP requirement |
| Question & Answer |
| 18 |
| 1.TT.3 |
| Is it the state’s intent to enable students to use the results of the Grade 11 exam to apply to colleges within Colorado and other states? |
Answer: Yes
Does the State recognize that prohibitions on distributing confidential data “to any third party” would include post-secondary educational institutions and seriously affect Colorado students seeking admission to college?
Answer: Paragraph 1.TT.3. states “Confidential Information and/or State Data and Records of any kind shall not be distributed or sold to any third party or used by Contractor or its agents in any way, except as authorized by the Contract or approved in writing by the State”. Emphasis added. The contract will address distribution of test results to post-secondary educational institutions.
| 18-19 |
| 1.TT.4 |
| Will Colorado accept ACT’s independent third-party penetration tests to satisfy the security audit/penetration testing requirement? |
Answer: Yes. Results must be provided to CDE.
| 18-19 |
| 1.TT.4 |
| If Contractor and subcontractor(s) perform pre-employment background checks on all employees, is that sufficient to satisfy the background check requirement? |
Answer: Yes, if the pre-employment background check occurs within one year of the contract award.
| 18-19 |
| 1.TT.4 |
| This section requests access to secure data storage 24 hours a day, 7 days a week. Is restricting access to areas that do not contain trade secret/proprietary information acceptable to the State? |
Answer: Possibly – it would depend on what the contractor claims as trade secret/proprietary. The state is willing to have its personnel or its third party contractors sign a mutually acceptable nondisclosure agreement.
| 19 |
| 1.TT.6 |
| Would the Contractor have discretion to employ any method for notifying residents in the event of a security breach, provided such method was consistent with any existing statutory requirements for breach notification? |
Answer: Yes as long as the method is consistent with Colorado statutes (see C.R.S. Section 6-1-716) and Contractor collaborates with and receives CDE approval of the method to be employed prior to the notification.
| 19-20 |
| 1.TT.7 |
| Will the State permit the Contractor to forward State Data to a third party vendor to assist with scoring (or other assessment specific tasks)? Or is the Contractor prohibited from doing so based on provisions that relate to transferring data to any other facility or location except for the authorized and approved purposes of backup and disaster recovery? |
Answer: Subject to approval by the Department, scoring subcontractors are allowable. Data could be transferred to a scoring subcontractor as long as the data is encrypted in transit and at rest. Any subcontractors will be subject to the same confidentiality (privacy/security) terms and conditions as the awarded contractor.
| 20 |
| 1.TT.8 |
| Can the state further describe the term “all system data” and, in particular, the “schema and transformation definitions” cited with this requirement? How would the state prefer that these data are presented? |
Answer: This will depend on the vendor’s underlying infrastructure. Upon selection of a contractor, CDE will negotiate reasonable language based on industry standards for turning over data.
| 21 |
| 1.TT.13.b |
| Does “user account” pertain to only the accounts of team members with access to State data? |
Answer: Yes.
| 21 |
| 1.TT.13.h |
| Is mandatory security training required of all team members or only those working on the contract with the State? |
Answer: Only those working on the contract with the State. All employees who have access or come into contact with the facilities, systems, and materials involved with secure data also must be trained.
| 21 |
| 1.TT.14.5 |
| Please describe the circumstances that would lead a School, District, or Local Education Agency request to delete student data. What type of data does the requirement refer to? |
Answer: This section will be revised at the time of contract negotiations to refer to State request to delete student data. Circumstances could include things such as student is ineligible to take the test.
| 22 |
| 1.VV |
| Is a student of legal age, or his/her parent or legal guardian, permitted to provide consent in order to override contractual restrictions on data uses/disclosures? |
Answer: No. Non-parties to the contract cannot override contractual provisions.
| 108 |
| Attachment 3 |
| Please describe the features that distinguish “individual student level files” and “individual student level reports”. |
Answer: “Individual student level files” refer to a data file containing individual (rather than aggregate) student scores. “Individual student level reports” refer to individual student score reports, typically intended for distribution to students and/or parents.
- 1 -image1.png
File details come from the government source that posted it. Updated .