RFP27006808 Appendix F ETSS Security Questionnaire.xlsm
XLSM spreadsheet 43 KB Posted
- Solicitation number
- RFP27006808
- Issued by
- Providence County, Rhode Island
About this file
Summary
This is a security questionnaire appendix (Appendix F) for RFP27006808 issued by the Rhode Island Department of Environmental Management (DEM) for the Reservation and Registration Management System project. The questionnaire document is an Excel-based assessment tool designed to evaluate vendors' security capabilities and compliance with security requirements for the proposed software solution. The questionnaire serves as part of the vendor qualification and selection process, requiring bidders to demonstrate their security posture, data protection measures, and adherence to industry standards and regulatory requirements applicable to reservation and registration management systems.
The ETSS Security Questionnaire functions as a due diligence instrument to assess vendor readiness in critical security domains including information security governance, access controls, data protection, incident response, and compliance certifications. Vendors responding to this RFP must complete the questionnaire comprehensively to substantiate their ability to protect sensitive reservation and registration data. The questionnaire format allows for systematic evaluation of all bidders against consistent security criteria, enabling DEM to make informed decisions regarding vendor selection based on demonstrated security capabilities and organizational maturity in protecting state information assets.
View the file
Other files
Show all 31
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Engagement Risk Assessment Data Engagements CI001 CI002 CI003 GSPG001 GSPG002 GSPG003 GSPG004 GSPG005 GSPG005A GSPG006 GSPG006A GSPG006B AC001 AC002 AC003 AT001 AT002 AT003 AU001 AU002 CM001 CM002 CM003 CM004 IA001 IA002 IR001 IR002 MA001 MA002 MP001 PE001 PE002 RA001 RA002-1 RA002-2 RA003 RA003-2 SA001 SA002 SA003 SC001 SC002 SI001 SI002 CL001 CL002-1 CL002-2 DR001 DR002 PNS001 PNS002 SCDM001 SCDM002 DPS001 DPS002 DPS003 ADI001 Reviewer Submitter
Instructions How to Complete the Security Questionnaire (last update date: 8/22/25)
As the Vendor completing this Questionnaire, the Security Questionnaire tab is where work will be completed. The file contains 3 columns, in column A you will see the question, Column B is where the answer will be provided, and in Column C is the answer format accepted in Column B.
The two types of formatting accepted for answers are Yes/No drop downs and free text values.
For the cases in which you need to select Yes or No, there's a dropdown. Click the arrow on the appropriate cell in Column B to display your drop down options.
1. Enable Macros when you first open the spreadsheet.
2. Per design when you complete question 5, if you select "Yes" to whether you have an active FedRamp authorization or current year ISO27001/27002 or SOC 2 Type 2 attestation, you only need to specify which type of certification you have (e.g. FedRamp, ISO27001/27002, SOC 2 Type 2) in question 6 which will complete the questionnaire for your organization. If you answer "No" to question 5, you must complete all the remaining questions in the questionnaire.
Security Questionnaire
| Question | Answer | Options/Type of response |
| Legal Name of the Company | Text | |
| Address and Location of Operations | Text | |
| Contact Information of the Security Team | Text | |
| Do you have an active FedRamp authorization or current year ISO27001/27002, or SOC 2 Type 2 attestation? | Values List (Yes, No) | |
| Please select one from the list | Values List | |
| Do you have a written information security policy? | Values List (Yes, No) | |
| How often is your security policy reviewed and updated? | Text | |
| Describe the roles and responsibilities of your information security team | Text | |
| Do you have a Security System Plan (SSP)? | Values List (Yes, No) | |
| Do you have a current year SAS70, SSAE16 or PCI attestation? | Values List (Yes, No) | |
| If not within current year, do you have a bridge letter to accompany the reports for the current year? | Values List (Yes, No) | |
| Please Provide details if needed. | Text | |
| How do you manage access to systems and data, including remote access? | Text | |
| Describe your user authentication and authorization processes. Please note if you require use of multifactor authentication (MFA). | Text | |
| How do you ensure least privilege principles and separation of duties are followed in your organization? | Text | |
| What type of security awareness training do you provide to your employees? | Text | |
| How frequently is this training updated and provided? | Text | |
| Do you provide role-specific cyber security training? | Values List (Yes, No) | |
| Describe your audit logging processes. Include a high-level summary of what events are logged, and how long are logs retained? | Text | |
| How do you ensure the integrity of your logging and monitoring systems? | Text | |
| Describe your process for managing changes to system configurations. | Text | |
| Do changes require an approval by a change board or designee? | Values List (Yes, No) | |
| How do you ensure compliance with your configuration baselines? | Text | |
| Are changes tested and reviewed? | Values List (Yes, No) | |
| Do you provide unique identifiers for all users in your environment? | Values List (Yes, No) | |
| How do you manage cryptographic controls for securing authentication processes? | Text | |
| Describe your incident response plan. How are incidents identified, assessed, and remediated? | Text | |
| What is your process for reporting security incidents? How do your 3rd parties report to you? | Text | |
| What are your procedures for system maintenance? | Text | |
| How do you ensure that maintenance activities do not compromise security? | Text | |
| How do you manage and protect your digital and physical media containing sensitive information? Describe your data destruction and disposal processes. | Text | |
| What physical security measures are in place at your facilities? | Text | |
| How do you protect your systems from environmental risks? | Text | |
| Describe your risk assessment methodology and framework. How frequently are risk assessments conducted? | Text | |
| Do you maintain a risk register? | Values List (Yes, No) | |
| How do you incorporate findings from risk assessments into your security strategy? | Text | |
| Is penetration testing performed? | Values List (Yes, No) | |
| If yes (penetration testing is performed), how frequently and by whom? | Text | |
| How do you evaluate the security of software and services before an acquisition? | Text | |
| Describe the security requirements you impose on your vendors. | Text | |
| How do you enforce these requirements to the sub-processers or 3rd parties of these vendors? | Text | |
| What measures do you take to protect your network and data transmissions? | Text | |
| Describe your approach to network segregation, firewall management, and intrusion detection systems. | Text | |
| Describe your processes for patch management and vulnerability scanning. | Text | |
| Describe your virus prevention, detection, and update processes. | Text | |
| Which industry-specific security standards or regulations are you compliant with, if any? | Text | |
| Have you ever been subject to a data breach or security incident? | Values List (Yes, No) | |
| If so, provide details on how it was addressed. | Text | |
| Summarize your disaster recovery plan, including overview of backup procedures and scenarios for primary/secondary hosting facility disasters. | Text | |
| Does your data center have an HVAC system, fire extinguishing system, and a generator? | Text | |
| Describe the physical and electronic security measures for your data center and applications. | Text | |
| Are employees subject to thorough background checks? | Values List (Yes, No) | |
| Who configures and deploys servers? Are the procedures documented? | Text | |
| Describe the policies and procedures for hardening servers. | Text | |
| What are your customer confidentiality policies and how are they enforced? | Text | |
| What are your procedures for handling and destroying sensitive data? | Text | |
| What is your data governance policy? | Text | |
| Please provide any additional information or comments that you think are relevant to your information security posture. | Text |
Sheet2
| Yes | FedRamp authorization |
| No | current year ISO27001/27002 |
| SOC 2 Tye 2 attestation |
File details come from the government source that posted it. Updated .