baselineRFIWhich compliance frameworks and control catalogs (SOC 2, ISO 27001, NIST CSF/800-53, PCI DSS, HIPAA, GDPR) ship with pre-built control mappings, and how are cross-framework control overlaps deduplicated so one piece of evidence satisfies multiple frameworks?weight 3
Answer key — what a strong answer shows
Strong answers name specific frameworks with maintained mappings, show cross-mapping/overlap logic (one control satisfies many frameworks), and disclose which frameworks are shallow templates versus deeply maintained.
baselineRFPDescribe how evidence collection is automated (API integrations to cloud/IT systems versus manual upload) for a defined control set, and quantify the reduction in manual evidence-gathering hours with a customer reference.weight 3
Answer key — what a strong answer shows
Look for named system integrations (not generic 'we integrate with everything'), a specific hours-saved figure tied to a real customer, and honesty about which evidence still requires manual upload.
baselineRFIHow does the platform handle continuous control monitoring versus point-in-time audit snapshots — can a control show as 'failing' between audits, and how is that surfaced to control owners?weight 3
Answer key — what a strong answer shows
Strong answers describe real-time or near-real-time control status with owner notification, not just a dashboard that updates at audit time.
baselineRFIWhat risk register and risk-scoring methodology is used (qualitative, quantitative, FAIR-based), and can custom risk models or scoring weights be configured, or is it a fixed vendor methodology?weight 3
Answer key — what a strong answer shows
Look for explicit naming of the methodology and configurability; be skeptical of vendors who can't describe their scoring math beyond 'high/medium/low'.
baselineRFPDetail the vendor/third-party risk management capability — questionnaire automation, evidence review workflow, and continuous vendor risk monitoring — and how it integrates with the core control framework.weight 3
Answer key — what a strong answer shows
Strong answers show TPRM as a first-class module tied to the same control/evidence engine, not a bolted-on separate product with duplicate data entry.
baselineRFIHow are policy documents versioned, attested to by employees, and linked to specific controls, and what happens to attestation records when a policy is updated mid-cycle?weight 3
Answer key — what a strong answer shows
Look for versioned attestation history that survives policy updates (old attestations don't silently vanish or get miscounted as current).
baselineRFPProvide detail on audit-readiness workflows: can an auditor be given direct, scoped, read-only access to evidence and control status, and what is the typical time reduction for SOC 2 Type II audit prep with a named reference?weight 3
Answer key — what a strong answer shows
Strong answers describe a dedicated auditor portal/role with scoped access and a concrete time-saved figure backed by a named customer, not a generic percentage.
baselineRFIWhat is the integration depth with ticketing/remediation workflows (Jira, ServiceNow) for control failures and audit findings — bidirectional sync or one-way export?weight 3
Answer key — what a strong answer shows
Bidirectional sync (ticket status flows back to close the control finding automatically) is materially stronger than one-way export requiring manual reconciliation.
baselineRFPExplain multi-entity/multi-framework support for organizations managing several subsidiaries or business units with different compliance obligations — is this native multi-tenancy or a workaround using tags/labels?weight 3
Answer key — what a strong answer shows
Native multi-entity support (separate scoping, separate evidence, shared control library) is stronger than a single flat workspace with tags simulating separation.
baselineRFIDoes the platform support AI-governance frameworks specifically (ISO/IEC 42001, NIST AI RMF) alongside traditional compliance frameworks, or is AI governance a separate, unmapped module?weight 3
Answer key — what a strong answer shows
Strong answers show AI governance controls mapped into the same evidence/control engine as everything else, not a bolted-on standalone checklist.
baselineRFPDescribe the incident/breach management workflow and how a security incident automatically ties back to affected controls and triggers required regulatory notification timelines (e.g., 72-hour GDPR).weight 3
Answer key — what a strong answer shows
Look for automatic control-linkage and notification-deadline tracking, not a generic incident ticket with no compliance-clock awareness.
baselineRFIWhat regulatory-change monitoring is provided — does the platform proactively flag when a framework's requirements change and identify which existing controls are now out of date?weight 3
Answer key — what a strong answer shows
Strong answers describe active monitoring with control-level impact flagging; a vendor requiring the customer to manually track framework updates is materially weaker.
baselineRFIWhere is compliance evidence data itself hosted, and what data-residency/sovereignty options exist for customers in regulated jurisdictions (EU, government) who can't have their compliance evidence leave-region?weight 3
Answer key — what a strong answer shows
Look for concrete regional hosting options; be skeptical of vendors offering only a single-region SaaS with no residency control for evidence data.
baselineRFPDetail board- and executive-level reporting: can a non-technical board member get a real-time compliance posture summary, and how is trend-over-time (not just current snapshot) presented?weight 3
Answer key — what a strong answer shows
Strong answers show a dedicated executive view with trend lines, not just a raw control-count dashboard built for practitioners.
baselineRFIHow frequently are automated controls actually re-tested (continuous, daily, weekly), versus how frequently is that claimed in marketing — and can the customer configure test frequency per control criticality?weight 3
Answer key — what a strong answer shows
Ask for the real technical re-test cadence per control type, not the headline 'continuous monitoring' claim, and confirm criticality-based configurability.
baselineRFPExplain the pricing model — per framework, per control, per user/seat, or flat platform fee — and what happens to cost when a customer adds a second or third framework to an existing subscription.weight 3
Answer key — what a strong answer shows
Look for transparent incremental-framework pricing; vendors who won't disclose how multi-framework cost scales are a red flag for budget planning.
baselineRFIWhat is the typical time-to-first-value — from contract signature to the first control showing live automated evidence — and what implementation resources (customer-side FTEs, vendor professional services) does that require?weight 3
Answer key — what a strong answer shows
Strong answers give a specific week/month figure backed by a customer reference and are honest about the customer-side effort required, not just vendor-side setup time.
baselineRFPProvide a thorough review of the port authority's Cybersecurity Program using the NIST Cybersecurity Framework (CSF) version 2.0 or future versions; document assessment results on a spreadsheet for each CSF control with risk findings rated high, medium, and low.weight 3
baselineRFPPlan and prepare for a virtual meeting with the port authority's Information Security Officer (ISO) and Chief Information Officer (CIO) to review the results of the NIST audit.weight 3
baselineRFPPrepare, within 30 days, an executive summary in PowerPoint of the NIST audit results.weight 3
baselineRFPBe prepared for a 20-30 minute briefing of the executive summary to the port authority's Cybersecurity Oversight Committee and IT Steering Committee.weight 3
baselineRFPDescribe any claim submitted by any client against the prime firm within the past two (2) years related to the professional services provided by the firm or its key personnel (claim = sum in dispute exceeding 10% of firm's fee).weight 3
baselineRFPDisclose any real or perceived conflicts of interest for team members, inclusive of the prime, sub-consultants and key team members.weight 3
baselineRFPIdentify the proposed team (working titles, degrees, certificates, and licenses), demonstrate the team's experience in performing the requested services, and describe how the team meets or exceeds the required qualifications.weight 3
baselineRFPProvide an organizational chart demonstrating the relationships and hierarchy of the team and availability to support the port authority's projects; identify individuals by name, position, discipline and firm, including key back-up personnel.weight 3
baselineRFPInclude a list of recent contracts/projects in the last three (3) years, with point of contact, contact information, and brief description, for services relevant to the Scope of Services, performed by key personnel.weight 3
baselineRFPClearly describe the approaches and methods that will be used to accomplish the tasks required in the scope of services, including a summary of innovative ideas and suggestions for enhancing the scope of services.weight 3
baselineRFPOutline the team's experience providing similar services and describe how the team is able to respond to the port authority's request for services (schedule).weight 3
baselineRFPProvide a plan for communications and coordination between the project team, the port authority's project manager, and various stakeholders.weight 3
baselineRFPPresent detailed information on the firm's proposed fee structure for all resources for the services proposed.weight 3
baselineRFPComplete the Vendor Cybersecurity Self-Evaluation (Attachment E), submitted as a separately labeled PDF document.weight 3
baselineRFPDescribe firm profile and history: types of services offered, duration of experience providing services related to this RFP, year established, form of organization, number/size/locations of offices, and total number of employees.weight 3
baselineRFPWithin the last five (5) years, have you ever been terminated from a contract? If so, please describe the facts and circumstances surrounding the termination.weight 3
baselineRFPInclude a project organizational chart that identifies key personnel and outlines the role of any subcontractors.weight 3
baselineRFPSpecify the location of the office responsible for servicing the airport authority, describing how long this specific office has been operating and the number of employees it has.weight 3
baselineRFPProvide references including a description of similar work performed, agency name/location, contract amount, agency contact information, and duration of service.weight 3
baselineRFPIdentify all proposed subcontractors, including a description of the work each will perform and an estimate of the percentage of work assigned to each subcontractor.weight 3
baselineRFPIdentify key personnel proposed for specific tasks, including name, current location, proposed position, current assignment, level of commitment, availability, and duration of employment with the firm.weight 3
baselineRFPProvide a project organization chart delineating communication and reporting relationships among staff.weight 3
baselineRFPProvide a narrative addressing the Scope of Work and demonstrating a clear understanding of the project's needs, including approach/methodologies and a project timeline (work plan).weight 3
baselineRFPComplete the Cost Proposal (Attachment B) detailing fees for requested services, including unit costs, total labor hours, and/or average hourly rates broken down by task.weight 3
baselineRFPConfirm ability to comply with the insurance provisions in Agreement Attachment 1; if unable, identify any written exceptions or deviations to the insurance requirements.weight 3
baselineRFPConfirm authorization to do business in the applicable state.weight 3
baselineRFPConfirm no prior or current engagement that would present a conflict of interest with the municipality.weight 3
baselineRFPDescribe firm qualifications and profile, including number of employees, office locations, and ownership.weight 3
baselineRFPSubmit at least three references with contact information for clients currently or previously served.weight 3
baselineRFPProvide a proposed fee structure including a fixed fee for the engagement, itemized out-of-pocket expenses, hourly rates by role for out-of-scope work, and pricing for additional optional services.weight 3
baselineRFPConfirm the firm has the legal authority and technical capability to perform network penetration testing services and shall comply with applicable laws, including the Computer Fraud and Abuse Act, applicable state computer crime statutes, and the FBI CJIS Security Policy where applicable.weight 3
baselineRFPSupport compliance and auditing requirements aligned with standards such as NIST CSF, CJIS, ISO 27001, HIPAA, and PCI-DSS.weight 3
baselineRFPAlign with NIST CSF, CJIS, HIPAA, and PCI-DSS requirements.weight 3
baselineRFPConfirm all vendor personnel with potential access to CJIS data possess or can obtain CJIS-level clearance or equivalent background checks prior to access.weight 3
baselineRFPDetail the firm's experience in the same or similar areas of expertise, stability, and adaptability to providing the required services; describe what sets the company apart and what value it brings.weight 3
baselineRFPProvide a list of projects the company has completed of similar size, type, and complexity to this project.weight 3
baselineRFPProvide at least three (3) references for similar services, including point of contact, telephone number, and brief description of services provided.weight 3
baselineRFPDescribe how long the organization has been in business and under the same management providing similar services.weight 3
baselineRFPProvide detailed information on the qualifications and experience of the Project Manager, including project reference contacts.weight 3
baselineRFPIdentify key project staff and subconsultants, provide resumes, and demonstrate experience on projects of similar size and complexity.weight 3
baselineRFPAssess alignment to NIST CSF and applicable requirements/frameworks (e.g., NIST SP 800-53, CJIS, and other applicable regulations/standards) (Compliance & Standards Alignment).weight 3
baselineRFPProvide Compliance Mapping to NIST CSF, NIST SP 800-53, and CJIS, with all risk ratings mapped to the housing authority's internal risk register.weight 3
baselineRFPParticipate in quarterly security review with the agency.weight 3
baselineRFPProvide a letter of interest including firm history, principals, office locations, years in business, relevant licenses/certifications, and managerial capacity and financial viability to deliver the proposed services.weight 3
baselineRFPBriefly describe how your firm will meet the minimum qualifications.weight 3
baselineRFPProvide five (5) or more former or current clients, including Public Housing Authorities, for whom the proposer has performed similar services, with contact name, phone, email, scope of service, and dates.weight 3
baselineRFPComplete Form HUD-5369-C, Certifications and Representations of Offerors — Non-Construction Contract.weight 3
baselineRFPComplete the Profile and Certification Form disclosing ownership structure, diversity status (MBE/WBE/RBE/veteran-owned), debarment history, conflicts of interest with the housing authority's Commissioners/Officers, and indemnification certification.weight 3
baselineRFPIdentify all proposed subcontractors, including classification, dollar amount, location, and MBE/WBE/SBE ownership status.weight 3
baselineRFPEnsure all vendor personnel assigned to the engagement pass a background check consistent with the agency's cybersecurity and personnel policies, even though CJIS/PCI/PII/PHI access is not anticipated.weight 3
baselineRFPDemonstrate strong familiarity with and operational alignment to NIST SP 800-61 Rev. 2, CIS Controls (v8+), and applicable regulatory frameworks including HIPAA, PCI DSS, and CJIS Security Policy.weight 3
baselineRFPProvide documentation and proof of FedRAMP Authorization (at moderate risk) for any contractor cloud service offering that accesses, stores, or processes the organization's data/PII before use.weight 3
baselineRFPDemonstrate that contractor systems are compliant with FISMA and NIST SP 800-53 Rev. 5 and have received an Authority to Operate, providing evidence per the NIST risk management framework, prior to delivering services.weight 3
baselineRFPComplete security questionnaires, IT rules of behavior, certifications, assessments, or workforce training reasonably requested by the organization in a timely manner.weight 3
baselineRFPEstablish and maintain internal policies/procedures for security of services and Contractor IT systems, and provide copies of information privacy and IT security policies to the organization upon request.weight 3
baselineRFPSupport annual FISMA compliance assessments, including third-party assessments for ATO, continuous monitoring, and security penetration testing to identify vulnerabilities, and document/track findings via a Plan of Action and Milestones (POA&M).weight 3
baselineRFPNotify the organization within 24 hours if Contractor IT services lose FedRAMP Authorization, discontinue use, and identify/implement a replacement solution within 10 business days.weight 3
baselineRFPRespond within 10 business days to new or supplemental information security questionnaires that the organization may require during contract performance.weight 3
baselineRFPMaintain administrative, technical, physical, and procedural information security controls compliant with ISO 27001, and provide ISO 27001 compliance certification within 10 calendar days of contract effective date.weight 3
baselineRFPMaintain SOC 2 Type II controls and provide the most current SOC 2 Type II report within 10 calendar days of contract effective date.weight 3
baselineRFPAnnually provide, upon written request, current security policies, Standard Information Gathering (SIG) Lite documentation, SOC 2 Type II report, system ATO(s)/ISCM evidence, and ISO 27001 certifications.weight 3
baselineRFPExplain in detail how Offeror will establish and maintain safeguards to protect the confidentiality and integrity of the organization's Confidential Information in its possession.weight 3
baselineRFPProvide a statement regarding any known conflicts of interest, and propose specific and detailed measures to avoid, neutralize, or mitigate actual/potential/apparent conflicts.weight 3
baselineRFPProvide a list of any monitoring issues, audit findings, or findings of contract nonperformance related to the work within the last five years.weight 3
baselineRFPProvide an explanation of the methodology, strategy, and workflow to be utilized, together with procedures to ensure compliance with federal/State requirements.weight 3
baselineRFPAre there parts of your solution that can be carved out for MWBE and SDVOB subcontracting opportunities? If so, which part(s)? If not, explain why.weight 3
baselineRFPRespond affirmatively that Proposer and subcontractors will have, prior to commencement of work, all necessary licenses, certifications, approvals, and other credentials to perform the Scope of Work.weight 3
baselineRFPProvide the last two years of the company's most recent tax returns or, if available, audited financial statements.weight 3
baselineRFPProvide vendor company introduction: company name, address, Federal EIN or SSN, Tax ID/DUNS, and the name, title, phone, email, and signature of the vendor's responsible contact person, plus any other persons authorized to represent the company regarding this RFP.weight 3
baselineRFPIn the Management Summary, reflect the Vendor's understanding of the services desired and its ability to meet the RFP's requirements, describe the Vendor's approach to the proposal, and clearly indicate any options or alternatives.weight 3
baselineRFPComplete the Vendor Qualifications and Prior Experience information (TVE Sheet 4), including a Company Profile, SAM.gov registration status, prior experience, project management approach, data management approach, and cost management approach.weight 3
baselineRFPTo validate prior experience, provide at least three references: each reference's name, company name, contact information, project scope, description of services, relationship length, and name/contact information of the principal contact, covering relevant experience within the last two years.weight 3
baselineRFPComplete the Vendor Capacity information (TVE Sheet 6) and specify the estimated number of professional personnel, consultants, and technicians who will be engaged in the work, describing each individual's experience level and responsibilities.weight 3
baselineRFPComplete the Vendor Execution information (TVE Sheet 7): identify what technologies, services, and agreements are being offered and the contributions from the Vendor itself versus its partners, and identify any major requirements that cannot be met by the Vendor.weight 3
baselineRFPParse the Vendor's standard contracts and agreements terms and conditions against the Terms and Conditions requirements (TVE Sheet 8), and provide all applicable contracts and agreements in electronic format, to support development of standardized lightweight contracts.weight 3
baselineRFPComplete the Pricing information (TVE Sheet 9) and the Payments information (TVE Sheet 10), proposing standardized, streamlined, easy-to-use pricing and payment models adaptable to the association's method.weight 3
baselineRFPInclude any additional information pertinent to the Vendor's capabilities and experience in the proposal.weight 3
baselineRFPDescribe the Vendor's flexibility with respect to lightweight contracts and simple invoice/payment options intended to facilitate speedy deployments of OT cybersecurity technologies across the utility sector, and the ease of use and simplicity of the Vendor's proposed Deployment Execution Strategies and Methods.weight 3
baselineRFPConfirm the Vendor's fee structure or costs and describe how it is streamlined, standardized, and easy-to-use to facilitate speedy deployments across the utility sector.weight 3
baselineRFPProvide Information Security Policy and Procedure Development or Review.weight 3
baselineRFPDemonstrate a solid customer base utilizing the proposed solution, including cities similar in size and service delivery to the agency, and successful experience implementing the proposed software in the applicable state to fully comply with record tracking and reporting requirements.weight 3
baselineRFPIn the Letter of Transmittal, state your organization's understanding of the work to be accomplished; commit to performing the implementation work within the scheduled time period upon award; summarize service fee costs and state whether fees are fixed, complete, inclusive, or negotiable; confirm the proposal remains valid for 180 days; and name the individuals authorized to make representations for your organization, with titles, addresses, emails, and phone numbers.weight 3
baselineRFPProvide a Company Profile including organizational size, how long in business, public or private entity status, whether local/regional/national/international in scope, and a listing of other similar governmental customers using the proposed solution.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
