RMS_SaaS_Questionnaire.pdf
PDF 124 KB Posted
- Attached to
- Records Management System
- Solicitation number
- 958-0915-26
- Issued by
- Trinity County, California
About this file
This SaaS Questionnaire Checklist is an evaluation document used by Solano County, California to assess Records Management System vendor proposals for RFP #958-0915-26. The questionnaire addresses critical security and operational capabilities required for a cloud-hosted platform to manage official and vital records. Key evaluation areas include data encryption standards and key management, single sign-on and multi-factor authentication capabilities, data segregation across customers, data handling upon contract termination, breach notification protocols, disaster recovery planning with defined recovery point objectives (RPO) and recovery time objectives (RTO), staff security training and insider threat prevention measures, security threat monitoring and logging with audit trail retention periods, and regular security assessments including penetration testing and vulnerability scanning. A mandatory pre-proposal conference is scheduled for October 28, 2025, at 10:00 am, with proposal submissions due by December 12, 2025, at 5:00 pm. The contract term is three years beginning May 1, 2026, and terminating April 30, 2029, with two potential one-year renewal options.
Vendors must hold Attorney General certification as Electronic Recording Delivery System providers and maintain SOC 2 Type II and ISO 27001 security certifications to demonstrate compliance with standards for safeguarding sensitive data including personally identifiable information (PII), HIPAA, and PCI DSS requirements. The estimated maximum contract budget is $1,000,000 over the three-year period. The system must support 99.99% uptime, maintain data residency within the United States, provide comprehensive API interoperability, and integrate with existing county systems and the SECURE electronic recording delivery system while complying with California Assembly Bills 1466 and 1785. The target go-live date is June 30, 2027. Mandatory deliverables include data migration, system configuration, comprehensive training, and ongoing maintenance. Funding is contingent upon state budget approvals and federal government fund allocations. The county reserves the right to reject any or all proposals and make partial awards, with no set-aside designations explicitly outlined for disadvantaged enterprises, though a preference for local contractors is demonstrated.
View the file
Other files
Show 40 more
50 files listed here. See the rest on GovTribe.
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
SaaS Questionnaire Checklist
Data Access, Security, Segregation & Encryption Does your solution provide encryption of data at rest and in transit?
What encryption algorithm do you use, and how do you manage encryption keys?
Does your solution support Single Sign-On (SSO)?
Does your solution support Multi-Factor Authentication (MFA)?
How is data and application separated from other customers?
How does your application ensure the security of data?
What happens to data when our contract ends or if we decide to stop using your service?
Do you have breach notification policy in place? If so, can you describe how you notify customers in the event of a data breach?
Backup/Disaster Recovery Do you have disaster recovery plan in place? How often is it tested?
What is your recovery point objective (RPO) and recovery time objective (RTO) for service continuity?
Where are the (DR) centers located?
User Training and Awareness Do you provide security training or awareness programs for your staff?
What kind of security measures do you have in place to prevent insider threats?
Security Monitoring and Logging How do you monitor and detect security threats or vulnerabilities in your environment?
Do you maintain audit logs of user activity and system events? How long are they retained?
Do you conduct regular security assessments, such as penetration tests or vulnerability scans?
Certification Do you have SOC 2 Type 2 certification?
Can you provide details on the certification or standards you comply with for safeguarding sensitive data, such as PII, HIPAA and PCI DCSS?
File details come from the government source that posted it. Updated .