RFP27006808 Appendix E Vendor Checklist to RI GCOP IT Policies.xlsx
XLSX spreadsheet 27 KB Posted
- Solicitation number
- RFP27006808
- Issued by
- Providence County, Rhode Island
About this file
This is a vendor checklist appendix for Rhode Island's GCOP IT Policies, applicable to the Department of Environmental Management's Reservation and Registration Management System contract opportunity. The checklist requires vendors to review and acknowledge compliance with 31 policy and security requirements established by the State of Rhode Island's Department of Information Technology (DoIT). Vendors must indicate agreement or rejection for each applicable policy item, including Access Control, Audit and Accountability, Configuration Management, Contingency Planning, Federal Tax Information Access, Identification and Authorization, IT Systems Acquisition, Media Handling and Security, Personnel Security, Physical and Environmental Security, Security Planning, System Maintenance, and Systems Communications Protection policies. Additionally, vendors must address requirements for Multi-Factor Authentication (MFA), Artificial Intelligence (AI) use, accessibility and usability standards, and data breach protocols. The checklist mandates completion and submission of the ETSS CyberSecurity Questionnaire as part of the vendor evaluation process.
The checklist identifies 14 policies marked as "Not Applicable" to this specific procurement, including Assessment and Authorization Monitoring, Awareness and Training, Bring Your Own Device Security, Incident Handling and Response, Information Technology Project Approval, Mobile Devices Service and Support, Risk Assessment, Security and Risk Program Management, Security Planning, Social Networking, State Network Device Security, and Supply Chain Risk Management. Vendors must provide detailed responses explaining their compliance capabilities for each applicable policy area, with supporting documentation available through the linked policy files. This document serves as a mandatory compliance verification tool ensuring that any vendor providing software solutions and management services for the state's reservation and registration systems meets Rhode Island's comprehensive information security and governance standards.
View the file
Other files
Show all 31
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Addendum B Checklist
| Addendum B Checklist | VENDOR NAME:_______________________________ SOLUTION/PRODUCT:__________________________ DATE: ______________________________________ | ||||
| Policy / Item | Link | Description / Purpose | Enter: Agree ( A ) or Reject ( R ) (for rows which are applicable) | Comments | |
| 1 | Access Control Policy | ETSS_Policy_10-10_Access_Control__AC_.pdf | Employees and vendors accessing State or Rhode Island information resources who use password authentication shall use a password that complies with this policy. | ||
| 2 | Assessment, Authorization, and Monitoring Policy | ETSS_Policy_10-23_Assessment__Authorization__and_Monitoring__CA_.pdf | To establish policy for the effective implementation of security controls to safeguard State of Rhode Island IT system resources, infrastructure, and data. | Not Applicable | |
| 3 | Audit and Accountability Policy | ETSS_Policy_10-13_Audit_and_Accountability__AU_.pdf | To provide the Agency with policy, standards and guidelines for establishing and effectively managing an Information Systems Audit and Accountability program at the Agency. | ||
| 4 | Awareness and Training Policy | ETSS_Policy_10-26_Awareness_and_Training__AT_.pdf | To establish policy that ensures information system users are aware of current threats to information security and are adequately trained to perform their assigned roles and responsibilities in a manner that maintains system security. | Not Applicable | |
| 5 | Bring Your Own Device Security Policy | DOIT_Bring_Your_Own_Device_Security_Policy_4-1-16.pdf | To establish a Bring Your On Device Security Policy for the effective management of personally owned mobile devices used to access State networks, applications and/or data and to ensure the confidentiality, integrity, and availability of State networks, applications and data. | Not Applicable | |
| 6 | Configuration Management Policy | ETSS_Policy_10-14_Configuration_Management__CM_.pdf | To establish a Configuration Management Policy for effectively managing risk associated with changes to and tha have an impact on system configurations, baseline configuration settings and overall information system security, | ||
| 7 | Contingency Planning Policy | ETSS_Policy_10-28_Contingency_Planning__CP_.pdf | To establish policy for effective contingency planning that enables the restoration and continuity of operations of mission-critical assets and business functions. | ||
| 8 | Federal Tax Information Access Policy | ETSS_Policy_10-11_Federal_Tax_Information_Access__FTI_.pdf | To establish policy that adequately protects and ensures the confidentiality of federal tax information (FTI) in accordance with Internal Revenue Service (IRS) has issued Publication 1075 entitled “Tax Information Security Guidelines for Federal, State, and Local Agencies” (IRS Publication 1075). | ||
| 9 | Identification and Authorization Policy | ETSS_Policy_10-20_Identification_and_Authentication__IA_.pdf | To establish policy for identifying and authenticating user access to information systems and network resources that ensures user access is authorized, confidential and sensitive data is protected, and accountability is maintained. | ||
| 10 | Incident Handling and Response Policy | ETSS_Policy_10-12_Incident_Handling_and_Response__IR_.pdf | To establish policy for the effective and timely management of IT security related incidents to safeguard State of Rhode Island IT resources, infrastructure, and data. | Not Applicable | |
| 11 | Information Technology Project Approval Policy | IT-07-02_Information_Technology_Project_Approval_Policy_2022.pdf | Prior to the expenditure of State resources, the State CDO/CIO will ensure that all major information technology (IT) efforts are consistent with the State of Rhode Island's strategic direction and will be delivered within the DoIT Project Management Framework. | Not Applicable | |
| 12 | IT Systems and Services Acquisition Policy | ETSS_Policy_10-17_System_and_Services_Acquisition__SA_.pdf | This policy provides requirements for the IT system and service acquisition process required to assure that information systems are acquired using controls sufficient to safeguard the State’s information systems. | ||
| 13 | Media Handling and Security Policy | ETSS_Policy_05-01_Media_Protection__MP_.pdf | To establish policy for effectively handling and securing media in a manner that protects the confidentiality and integrity of data maintained on digital and non-digital media. | ||
| 14 | Mobile Devices Service and Support Policy 09-01 | ETSS_Policy_09-01_Mobile_Devices_Service_and_Support_Policy.pdf | Identify the process and procedures for the procurement and support of cellular telephones and mobile broadband devices (commonly referred to as air cards or hotspots). | Not Applicable | |
| 15 | Personnel Security Policy | ETSS_Policy_10-21_Personnel_Security__PS_.pdf | To establish a personnel security policy that provides effective governance of personnel to ensure the security of sensitive information systems and data. | ||
| 16 | Physical and Environmental Security Policy | ETSS_Policy_10-16_Physical_and_Environmental_Security__PE_.pdf | To establish policy for the implementation of adequate physical and environmental security controls at data centers and facilities where data centers reside to ensure the protection of information systems and supporting components and infrastructure from physical and environmental hazards. | ||
| 17 | Risk Assessment Policy | ETSS_Policy_10-25_Risk_Assessment__RA__.pdf | To establish policy that effectively manages inherent risk, vulnerabilities, threats, and countermeasures based on the criticality of the information system and data to ensure its confidentiality, integrity, and availability, and achieve an acceptable level of enterprise risk. | Not Applicable | |
| 18 | Security and Risk Program Management | ETSS_PM-1_Security_and_Risk_Program_Management_Rev1.2.pdf | The Security and Risk Management Program defines the foundation for information technology security in Rhode Island. It establishes the Statewide information security standards, providing direction for the Chief Information Security Officer (CISO) to establish a set of standards for information technology security to maximize the functionality, security, and interoperability of the State’s distributed information technology assets, including, but not limited to, data classification and management, communications, and encryption technologies. These standards apply to all executive branch agencies. | Not Applicable | |
| 19 | Security Planning Policy | ETSS_Policy_10-18_Security_Planning__PL_.pdf | To establish policy for the effective management of Enterprise risk via a security planning program to ensure the confidentiality, integrity, and availability of information systems and data. | Not Applicable | |
| 20 | Social Networking Policy | IT-10-09_Policy_on_Social_Networking.pdf | This policy is aimed at allowing state agencies and departments the benefit of using social networking for the performance of state business, to communicate with the public, protect the infrastructure and legal interests of the State of Rhode Island and assure that adequate bandwidth is available to conduct State business without interruption | Not Applicable | |
| 21 | State Network Device Security Policy 10-04 | ETSS_Policy_10-04_State_Network_Device_Security.pdf | Establish policy and guidance for appropriately managing and securing State Network Devices. Protect employees and the workplace environment through reducing the risk of compromising state data, disruption of network resources, and legal-related issues. The intent of this policy is to maintain the confidentiality and integrity of state data, ensure the availability of network resources, and assist in the reduction of financial and legal penalties associated with non-compliance of federal and state programs. | Not Applicable | |
| 22 | Supply Chain Risk Management Policy | ETSS_Policy_10-30_Supply_Chain_Risk_Management__SR_.pdf | Establish policy for the identification, assessment, selection, and implementation of risk management processes and mitigating controls to help manage commercially available information and communications technology supply chain risks. | Not Applicable | |
| 23 | System and Information Integrity Policy | ETSS_Policy_10-29_System_and_Information_Integrity__SI_.pdf | To establish policy for effective system and information integrity security controls to safeguard State of Rhode Island information system resources, infrastructure, and data. | ||
| 24 | System Maintenance Policy | ETSS_Policy_10-24_System_Maintenance__MA_.pdf | To establish policy for effective and secure maintenance, repair, and diagnostic requirements of information systems and system components, both on-site or off-site, to ensure the confidentiality, integrity, and availability of data. | ||
| 25 | Systems and Communications Protection Policy | ETSS_Policy_10-15_System_and_Communications_Protection_Policy__SC_.pdf | To establish policy for effective information system, network, and communications security and ensure the confidentiality, integrity, and availability of information resources. | ||
| 26 | Technology Acceptable Use Policy | Policy_00-02_Technology_Acceptable_Use_Policy_2022.pdf | To establish policy for the acceptable use of State network resources. Protect employees and the workplace environment through reducing the risk of compromising State data, disruption of network resources, and legal related issues. | ||
| 27 | MFA | As defined in Addendum B | |||
| 28 | AI | As defined in Addendum B | |||
| 29 | Accessibility and Usability | As defined in Addendum B | |||
| 30 | Data Breach | As defined in Addendum B | |||
| 31 | ETSS CyberSecurity Questionnaire | ETSS CyberSecurity Questions regarding the vendor solution/product being utilized for the State of Rhode Island. | See the ETSS CyberSecurity Questionnaire | COMPLETE AND SUBMIT QUESTIONNAIRE |
https://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-10_Access_Control__AC_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-12_Incident_Handling_and_Response__IR_.pdfhttps://rigov-policies.s3.amazonaws.com/IT-07-02_Information_Technology_Project_Approval_Policy_2022.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-17_System_and_Services_Acquisition__SA_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_05-01_Media_Protection__MP_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_09-01_Mobile_Devices_Service_and_Support_Policy.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-21_Personnel_Security__PS_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-16_Physical_and_Environmental_Security__PE_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-25_Risk_Assessment__RA__.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_PM-1_Security_and_Risk_Program_Management_Rev1.2.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-18_Security_Planning__PL_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-23_Assessment__Authorization__and_Monitoring__CA_.pdfhttps://rigov-policies.s3.amazonaws.com/IT-10-09_Policy_on_Social_Networking.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-04_State_Network_Device_Security.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-30_Supply_Chain_Risk_Management__SR_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-29_System_and_Information_Integrity__SI_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-24_System_Maintenance__MA_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-15_System_and_Communications_Protection_Policy__SC_.pdfhttps://rigov-policies.s3.amazonaws.com/Policy_00-02_Technology_Acceptable_Use_Policy_2022.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-13_Audit_and_Accountability__AU_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-26_Awareness_and_Training__AT_.pdfhttps://rigov-policies.s3.amazonaws.com/DOIT_Bring_Your_Own_Device_Security_Policy_4-1-16.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-14_Configuration_Management__CM_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-28_Contingency_Planning__CP_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-11_Federal_Tax_Information_Access__FTI_.pdfhttps://rigov-policies.s3.amazonaws.com/ETSS_Policy_10-20_Identification_and_Authentication__IA_.pdf
File details come from the government source that posted it. Updated .