{"text_format":"1","workbook":"xlsx","n_sheets":4,"sheets":[" Cloud Compliance","1-Cost Submission","1-Scoring Methodology","Appendix A"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":0,"defined_names":5,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":" Cloud Compliance","index":0,"n_rows":175,"n_cols":5,"rows_kept":175,"cut":false,"hidden":false,"merged":[[156,0,156,4],[161,0,161,4],[170,0,170,4],[100,0,100,4],[8,0,8,4],[15,0,15,4],[56,0,56,4],[69,0,69,4],[110,0,110,4],[144,0,144,4],[0,0,0,4],[7,0,7,4],[6,0,6,4],[1,0,1,4],[2,0,2,4],[3,0,3,4]]}
["Technical Specifications – Requirements Matrix\nA response in the form of an Availability Code (A, E, or X) is required for each item. Brief comments or required explanation for each requirement should be entered in the table under \"Vendor Comments\". If diagrams, charts, or documents are needed in order to respond, please include them as an Attachment to your response and note the Attachment reference in your Comment. Elaborate or provide additional details on any items that could differentiate you from another Vendor. Vendor must indicate what additional costs or number of additional implementation days, if any, will be incurred as well as the estimated time frame for completion. Vendors can submit additional documentation to supplement descriptive narrative; however, a response of A,E, or X is MANDATORY in this document. \n"]
["A = Vendor will comply with the requirement."]
["E = Vendor is not able to meet the requirement, but is able to provide an alternative solution.                                                                                                    Vendor must list their alternative solution in Section V Proposal Exception Summary Form of their proposal response.                                                        Vendor must also include details explaining the alternative solution in the Vendor Comments column."]
["X = Vendor is not capable of providing the requirement or the service is not available.                                                                                                                Vendor must list these requirements in Section V Proposal Exception Summary Form of their proposal response."]
[]
["Ref #","Description","Mandatory Requirement \"M\"","Vendor Response:  A, E, or X","Vendor Comments \n(if response is \"E\", please provide details explaining the alternative solution)"]
["CLOUD COMPLIANCE SERVICES--ATTACHMENT A, CATEGORY I"]
["Responding Vendors must provide services to review cloud and offsite hosting providers for validation that the providers are adhering to the security requirements of the agency. "]
["1. CLOUD COMPLIANCE SERVICES"]
[1.1000000000000001,"The Vendor must provide security compliance reviews of cloud and offsite hosting providers, provide validation of certifications provided by hosting service providers (and other cloud service providers), and perform annual re-certifications."]
[1.2,"The Vendor must identify the security requirements and develop a security compliance checklist for use in assessing cloud and offsite hosting service providers.  Vendor must provide a sample checklist with the proposal response."]
["1.2.1","The Vendor must work with agency staff to identify the necessary security requirements based on the level of security compliance required by the agency’s internal policies, audit requirements, State of Mississippi enterprise security policies and standards, other statutory mandates, and the Vendor’s own knowledge of cybersecurity.  Vendor must detail the approach for this and any framework to be used with the proposal response to fulfill this requirement."]
[1.3,"The Vendor must use its developed security compliance checklist to perform a security assessment and verification of cloud and offsite hosting service providers."]
[1.4,"The Vendor must document the risks, and where applicable, provide a risk management strategy for items identified during the security assessment for the agency’s review."]
[1.5,"The Vendor must report detected deficiencies or vulnerabilities to the agency.  Vendor must provide a sample deficiency/vulnerability report an a sample Executive Summary (both which can be redacted) with the proposal submission."]
["2. CLOUD COMPLIANCE ASSESSMENT PLANNING"]
[2.1,"The Vendor must: "]
["2.1.1","Assemble its team members, tools, and methods required to perform the work."]
["2.1.2","Work with the agency on the development of a Compliance Assessment Plan for each engagement inclusive of all activities, work products, deliverables, and agency requirements (e.g., staff, access, networks, systems, etc.).  The plan will document the activities and provide the rules and scope for the assessment."]
["2.1.2.1","Vendor must Include a sample plan with the proposal submitted in response to this RFP."]
["2.1.2.2","Vendor must assign a project manager, with at least 5 years experience, that organizes and manages all aspects of the compliance assessment. The vendor project manager’s tasks will include, but is not limited to:"]
["2.1.2.2.1","Coordinating meetings;"]
["2.1.2.2.2","Determining dates and timeline of the assessment;"]
["2.1.2.2.3","Collecting information to be used to perform the assessment; "]
["2.1.2.2.4","Assisting agency personnel in defining a scope that is comprehensive; and "]
["2.1.2.2.5","Assisting agency personnel in defining the proper information the vendor needs for the scope to be realized."]
["2.1.3","Vendor must confirm the scope(s), methods(s), timing, frequency and other elements required to successfully perform the work."]
["2.1.4","Provide Deliverable 1: Cloud Compliance Assessment Plan.                      Deliverable 1 should include:"]
["2.1.4.1","Vendor must provide an agreed-to approach and project roles/responsibilities.  Vendor must describe their standard approach and provide a sample assessment plan with the proposal response."]
["2.1.4.2","Vendor must provide technical details."]
["2.1.4.3","Vendor must provide cloud and offsite hosting service providers to be assessed in the assessment plan developed for each engagement."]
["2.1.4.4","Vendor must work with the cloud and offsite hosting service providers to agree upon and provide the type and level of testing permitted."]
["2.1.4.4.1","Vendor must coordinate with the cloud and offsite hosting service provider in determining the compliance activities to be performed during the assessment. "]
["2.1.4.5","Vendor must provide logistical details of the assessment."]
["2.1.4.5.1","Vendor must assist the agency in identifying all agency and any third-party resources that will be required to assist with performing the compliance assessment."]
["2.1.4.6","Data handling requirements "]
["2.1.4.6.1","Vendor must assist the agency in identifying data handling requirements for all data related to the assessment including:"]
["2.1.4.6.1.1","Storage of agency data during the compliance assessment;"]
["2.1.4.6.1.2","Data storage upon conclusion of the compliance assessment;"]
["2.1.4.6.1.3","Transmission of data during and/or after the compliance assessment; and "]
["2.1.4.6.1.4","Removal of data from systems upon conclusion."]
["2.1.4.6.1.4.1","Vendor must create a manifest."]
["2.1.4.6.1.4.2","Vendor must document anything put on any agency/3rd party systems."]
["2.1.4.6.1.4.3","Vendor must demonstrate that those items have been removed at the end/conclusion of the engagement."]
["2.1.4.7","Guidance for incident handling:"]
["2.1.4.7.1","Vendor must describe the issue resolution escalation process that will be used within the Vendor’s organization to resolve any problems or issues that may arise during the course of a compliance assessment."]
["2.1.4.8","Legal Considerations:"]
["2.1.4.8.1","Vendor must assist the agency with evaluating potential legal concerns before performing a compliance assessment."]
["2.1.4.9","Compliance Assessment Period (Beginning to End Dates):"]
["2.1.4.9.1","Vendor must provide a schedule/timetable for all activities and milestones for the entire project period."]
["2.1.4.10","Availability:"]
["2.1.4.10.1","Vendor must be able to schedule an initial kickoff meeting within fifteen (15) calendar days of the agency’s official request for services."]
["2.1.4.10.2","Vendor must be able to commence the compliance assessment within forty (40) calendar days, or mutually agreed upon time-frame, of the agency’s official request for services."]
["2.1.4.11","Deliverables:"]
["2.1.4.11.1","Vendor must provide a listing of all deliverables planned for the project."]
["2.1.4.11.2","Vendor must finalize and submit all deliverables to the agency within 25 (twenty-five) calendar days, or mutually agreed upon time-frame, of the compliance assessment’s end date."]
["3. CLOUD COMPLIANCE ASSESSMENT SETUP"]
[3.1,"The Vendor must:"]
["3.1.1","Work with the agency to identify all cloud and offsite hosting providers used by the agency."]
["3.1.2","Work with the agency to identify key/critical assets and their current protections.  Vendor must describe the standard questionnaire used and/or provide a list of what a normal request for information looks like when beginning an assessment."]
["3.1.3","Work with the agency to identify agency security requirements based on the level of security compliance required by the agency’s internal policies, audit requirements, State of Mississippi enterprise security policies and standards, or other statutory mandates.  Vendor will use this information to develop a comprehensive security compliance checklist for the agency’s assessments."]
["3.1.3.1","The vendor-developed checklist may share common elements among agencies the vendor performs assessments for, but the checklist will still need to be unique and tailored to each agency.  Vendor must provide a sample baseline checklist with the proposal response."]
["3.1.3.2","The vendor-developed checklist must indicate the origin of each requirement, referencing the appropriate policy, standard, mandate, etc. (all applicable) in a manner that allows the agency to easily determine why each item is included."]
["3.1.4","Confirm to the agency point of contact that the Vendor is ready for compliance assessment as agreed with the agency and seek the approval to proceed."]
["3.1.5","Provide Deliverable 2: Ready to Proceed Authorization.                               Deliverable 2 should include: "]
["3.1.5.1","Verification that all vendor services are ready for compliance assessment execution;  "]
["3.1.5.2","Verification that the security compliance checklist is comprehensive;"]
["3.1.5.3","Verification that agency is prepared for compliance assessment execution; and"]
["3.1.5.4","Written authorization to proceed."]
["4. CLOUD COMPLIANCE ASSESSMENT EXECUTION"]
[4.0999999999999996,"Vendor Must:"]
["4.1.1","Perform applicable compliance assessment activities;"]
["4.1.2","Complete all agreed-to steps and methods under the State-agreed general method of the test."]
["4.1.3","Follow a systematic process to securely collect, handle, and store results. "]
["4.1.3.1","It should be noted that if agency data is acquired during the compliance assessment, it must be kept to a minimum. For example, a database of agency data should not be maintained on the Vendor’s machines or systems."]
["4.1.4","Provide Deliverable 3: Cloud Compliance Executive Report.                        Deliverable 3 should include:"]
["4.1.4.1","A listing of all cloud and offsite hosting providers used by the agency."]
["4.1.4.1.1","The list should also indicate the date the last compliance assessment was performed for each cloud and offsite hosting provider."]
["4.1.4.2","A summary describing the scope and comprehensive nature of the compliance assessment.  Vendor should provide a sample assessment summary with the proposal."]
["4.1.4.2.1","If the Vendor believes that the compliance assessment engagement was not thorough enough to provide a holistic view of the compliance level for each cloud and offsite hosting provider assessed, Vendor must provide details about what additional compliance assessment activities are missing."]
["4.1.4.3","An overview of critical deficiencies identified during the compliance assessment. The deficiencies should be prioritized based on the risk to the agency."]
["4.1.4.3.1","Critical deficiency documentation should include the potential impact, likelihood of exploitation, and suggested remediation."]
["4.1.4.4","An overall compliance assessment rating:  The rating should accurately describe the security posture of the agency based on the weaknesses and vulnerabilities identified.  Vendor must describe the methodology used and provide a sample of the compliance assessment rating to be used with the proposal.  In addition to providing the rating, the vendor should provide a brief statement describing why the rating was selected.                                                                                                The ratings shall be defined as:"]
["4.1.4.4.1","Excellent:  No issues were identified;"]
["4.1.4.4.2","Good:  The only issues identified are minor ones that the vendor advises are added to a long-term project list;"]
["4.1.4.4.3","Needs Improvement:  There were major issues identified that the vendor advises are added to a short-term project list; and"]
["4.1.4.4.4","Poor:  There were critical issues identified that the vendor advises need to be addressed immediately."]
["4.1.4.5","A recommendations summary of the high-level set of actionable recommendations based on the compliance assessment results.  Vendor must provide a sample recommendations summary with their proposal response."]
["4.1.4.5.1","The recommendations must be presented in such a way to help the agency understand their exposure and implement measures to mitigate it. "]
["4.1.4.5.2","The recommendations must be prioritized based on the risk to the agency."]
["4.1.5","Provide Deliverable 4:  Security Compliance Checklist.                               Deliverable 4 should include:"]
["4.1.5.1","Vendor must provide a completed security compliance checklist for each cloud and offsite hosting provider assessed that clearly identifies where the cloud or offsite hosting provider does and does not comply with specific policy requirements."]
["4.1.5.1.1","The checklist must include a comments section for each item that provides details for policy requirements where the cloud or offsite hosting provider is not compliant."]
["4.1.5.1.2","The Vendor must include a check box with the following options so that the agency can document their remediation status for this engagement and ongoing tracking:"]
["4.1.5.1.2.1","Remediated"]
["4.1.5.1.2.2","Mitigated"]
["4.1.5.1.2.3","Acceptable Risk"]
["4.1.5.1.2.4","False Positive"]
["4.1.6","Provide Deliverable 5:  Results Report.                                                        Deliverable 5 should include:"]
["4.1.6.1","Results collected from the compliance assessment used to determine the Vendor’s conclusion(s) and recommendations. "]
["5. CLOUD COMPLIANCE ASSESSMENT COMPLETION"]
[5.0999999999999996,"Vendor must: "]
["5.1.1","Provide Deliverable 6: Compliance Assessment Completion Report.          Deliverable 6 should include:"]
["5.1.1.1","Vendor may be required to make one or more on-site (or remote - at the customer's discretion) oral presentation(s) of the findings, if so desired, to Management and Executive level staff.  Vendor must be prepared to discuss the details, methods, duration and other aspects of the assessment."]
["5.1.1.2","Vendor must verify with the agency Single Point of Contact (SPOC) that all deliverables have been successfully completed and all appropriate documentation has been provided."]
["5.1.2","Provide Deliverable 7:  Data Destruction Certificate.                                   Deliverable 7 should include:"]
["5.1.2.1","Vendor will, at the conclusion of the project, immediately destroy any and all agency-specific elements provided for the compliance assessment, or discovered during the test from all Vendor equipment and files (electronic, paper or otherwise) and issue a certification to the agency attesting that no sensitive agency data or information pertaining to the assessment is in the possession of the Vendor, present in any Vendor systems, or maintained by any Vendor team members as a group or individually in any form."]
["5.1.2.2","Vendor will, at the conclusion of the project, include a completed copy of Certificate of Destruction located in RFP 4350 Exhibit B Certification of Destruction."]
["5.1.2.3","All data destruction and sanitization of equipment is to be performed using procedures consistent with the Elemental Security Platform (ESP) and National Institute of Standards and Technology (NIST) special publication 800-88."]
["5.1.2.4","Vendors must provide a detailed description of the process used to destroy the data along with a statement adhering to the requirement found in 5.1.2.1. with the proposal response to fulfill this requirement."]
["6. PROJECT MANAGEMENT"]
[6.1,"Project Management for Master Agreement:"]
["6.1.1","The Vendor will identify a Single Point of Contact (SPOC).  The duties of the SPOC shall include, but not be limited to:"]
["6.1.1.1","Supporting the management of the Agreement;"]
["6.1.1.2","Supporting the delivery of services to the State;"]
["6.1.1.3","Facilitating dispute resolution; and,"]
["6.1.1.4","Advising ITS of performance under the terms and conditions of the Agreement."]
["6.1.2","ITS reserves the right to require a change in the current SPOC if the assigned SPOC is not, in the opinion of ITS, adequately serving the needs of the State."]
["6.1.3","Vendor must provide to ITS a monthly status report. At a minimum, the following information must be included:"]
["6.1.3.1","Total number of cloud compliance assessment engagements completed, the number in process, and the number in the queue. "]
["6.1.3.1.1","Details should include agency name, cloud or offsite hosting provider name, date assessment was completed, and total cost for assessment services."]
["6.1.3.2","Compliance assessment reports for agency assessment engagements to ITS.  Only the reports that are required for agency compliance with the State of MS Enterprise Security Program are required to be submitted."]
["6.1.3.2.1","The compliance assessment reports must be electronically submitted to the customer and ITS in a secure manner. Vendor must describe how the assessment reports will be submitted.    "]
["6.1.4","The Vendor will carry out the provisioning of services of the Agreement under the direction and control of ITS."]
[6.2,"Project Management for Agency Engagements:"]
["6.2.1","The Vendor will designate a SPOC and provide project management for each agency engagement related to this agreement."]
["6.2.2","The Vendor will work with each state agency's designated SPOC for agency engagements related to this agreement. "]
["6.2.3","The Vendor is responsible for the coordination and delivery of the overall Project."]
["6.2.4","The Vendor will ensure that an appropriate “Project Kickoff” occurs and that all details of the master plan and all integrated work plans are agreed to by the State from project commencement."]
["6.2.5","The Vendor will work with agency SPOC to ensure that the Project is staffed appropriately."]
["6.2.5.1","Vendor must immediately report any project staffing change to the agency SPOC."]
["6.2.6","The Vendor will ensure that required testing activities across both technical and operational components are completed to minimize Project risk."]
["6.2.7","The Vendor will collaborate with the task areas to ensure appropriate cross-team communication and delivery."]
["6.2.8","The Vendor will be required to provide weekly updates to agency staff providing a current status of project activities.  The Vendor must provide a sample weekly status report with the proposal.                                                                               The status should include an updated project plan that includes:"]
["6.2.8.1","Completed activities;"]
["6.2.8.2","Completion percentage of the activities in progress;"]
["6.2.8.3","Activities not performed;"]
["6.2.8.4","Issues encountered, proposed resolutions, and actual resolutions;"]
["6.2.8.5","Anticipated tasks to be completed in the next week; and"]
["6.2.8.6","Proposed changes or delays."]
["6.2.9","Deliverables will not be considered complete until the agency SPOC has formally accepted them."]
["6.2.10","Vendor must agree to follow the 'Key Tasks' document attached to RFP Category I. The Key Tasks document lists tasks that the Vendor and Agency will either “support” or “perform”.   See Appendix A 'Key Tasks' for a table detailing support and perform duties."]
["6.2.10.1","For purposes of the Project, “Perform” means that the party assigned the task has the duty and ultimate responsibility to take all appropriate steps to complete or facilitate the identified task unless otherwise provided for between the parties, subject to the supporting party completing its interdependent responsibilities. The term, “Support” means that the party has the duty and responsibility to provide ancillary support or assistance which may be necessary to enable the party providing the “Perform” task to complete that task unless otherwise provided for by the parties. See Appendix A 'Key Tasks' for a table detailing support and perform duties. "]
[6.3,"Issue Resolution Escalation - The Vendor must describe within the proposal response the issue resolution escalation process that will be used within the Vendor’s organization to resolve any problems or issues that may arise during the course of an assessment."]
["7. PROJECT PLAN"]
[7.1,"Vendor must provide Deliverable 8:  Master Project Plan                               Deliverable 8 should include:"]
["7.1.1","The Vendor will create a master project plan to the agency SPOC for approval.  The Vendor must include a sample master project plan with the proposal.  The Vendor will deliver the Master Project Plan before the Assessment begins.          The plan will include:"]
["7.1.1.1","Project Integration;"]
["7.1.1.2","Project Scope;"]
["7.1.1.3","Project Time;"]
["7.1.1.4","Project Quality;"]
["7.1.1.5","Project Staffing;"]
["7.1.1.6","Project Communications; and"]
["7.1.1.7","Project Risks/Issues."]
["7.1.2","Vendor must ensure a common understanding of the work plan."]
["7.1.3","Vendor must ensure a common understanding of the deliverables expected."]
["8. DELIVERABLES PRESENTATION/SUBMISSION REQUIREMENTS "]
[8.1,"The Vendor must be able to provide a hard copy and electronic copy of all deliverables."]
[8.1999999999999993,"The electronic version of the remediation plan must be in a format such as Word or Excel that can be edited by the agency/entity.  Vendor must provide a sample remediation plan with the proposal."]
[8.3000000000000007,"The Vendor must be willing to work with agency on the specific format for all documentation provided as a deliverable."]
[8.4,"The Vendor must ensure that all deliverables are provided to the customer in a secure manner.  Vendor must describe how all deliverables will be provided to the customer securely."]
["9. STATEMENT OF WORK (SOW)"]
[9.1,"The Vendor will use the Assessment Plan to develop a Statement of Work (SOW).  The SOW will provide, at a minimum, the following components"]
["9.1.1","Scope of the assessment that includes a listing of the high-level activities to be performed, along with the responsibilities and accountable parties (Vendor, State, other) to carry out the activity;"]
["9.1.2","Description of any assumptions or constraints;"]
["9.1.3","Description of the planning phase to review priorities, and establish recommendations and timetables for implementation;"]
["9.1.4","Outline of the process to be used in providing these services (interviews, scans, analysis, etc.), including a listing of key individuals that must be available on the customer side to assist in the data gathering, investigation, and review process;"]
["9.1.5","Description of the reports generated and provided as a result of the assessment;"]
["9.1.6","List of the deliverables resulting from these services; and "]
["9.1.7","Itemized description of the total cost of the project based on the pricing proposed in this RFP."]
["10. COST PROPOSAL"]
[10.1,"The Vendor must propose a maximum, fixed amount for all services requested in Attachment  A, Category I - Cloud Compliance, Cost Submission, including professional services, and any travel, subsistence or lodging costs. A fixed price proposal must be submitted using the tables in Attachment A, Category I - Cloud Compliance, Cost Information Submission."]
[10.199999999999999," The Vendor must include and complete all parts of the Attachment   A, Category I - Cloud Compliance, Cost Submission, in a clear and accurate manner.  The Vendor must summarize all costs in  Attachment   A, Category I - Cloud Compliance, Cost Submission."]
[10.3,"The Vendor must fully and explicitly itemize the costs on a separate document as supporting documentation of how they were derived, including any assumptions made.  These costs must include all initial, one-time purchase prices, as well as, all recurring costs."]
[10.4,"The Vendor must provide a fully loaded onsite and remote hourly rate for general security consulting services for which a per-instance cost cannot be determined based on the specifications included in Attachment A, Category I - Cloud Compliance section of this RFP. This rate must be provided in Attachment   A, Category I - Cloud Compliance, Cost Submission table.  "]

{"sheet":"1-Cost Submission","index":1,"n_rows":22,"n_cols":6,"rows_kept":22,"cut":false,"hidden":false,"merged":[[17,0,17,4],[18,0,18,4],[19,0,19,4],[20,0,20,4],[21,0,21,4],[0,0,0,5],[5,0,5,4],[16,0,16,4],[3,0,3,5],[1,0,1,5],[12,0,12,5]]}
["ATTACHMENT A, CATEGORY I"]
["CLOUD COMPLIANCE COST INFORMATION SUBMISSION"]
[]
["Vendors must propose a summary of all applicable project costs in the matrix that follows.  Any cost not listed in this section may result in the Vendor providing those products or services at no charge to the State or face disqualification."]
[]
["Cloud Compliance Services"]
["Function/Expertise/Service","Not-to-exceed cost for an Extra Small Cloud/Offsite Hosting Implementation*","Not-to-exceed cost for a Small Cloud/Offsite Hosting Implementation*","Not-to-exceed cost for a Medium Cloud/Offsite Hosting Implementation*","Not-to-exceed cost for a Large Cloud/Offsite Hosting Implementation*","No-to-exceed cost    for an Unlimited Cloud/Offsite Hosting Implementation *"]
["Cloud or Offsite Hosting Provider Compliance Services","$","$","$","$","$"]
["Security Consulting","$","$","$","$","$"]
["Other:  (Specify)","$","$","$","$","$"]
["Other:  (specify)","$","$","$","$","$"]
["Other:  (specify)","$","$","$","$","$"]
["If Change Order Rate varies depending on the level of support, Vendor should specify the Change Order Rate according to position. "]
["Fully-loaded On-site Change Order Rate","$"]
["Remote Change Order Rate","$"]
[]
["*Cloud/Offsite Hosting Implementation Size Definitions: "]
["Extra Small Cloud/Offsite Hosting Implementation   – Less than 25 devices and less than 75 IP addresses"]
["Small Cloud/Offsite Hosting Implementation – Between 25 and 100 devices and between 75 and 300 IP addresses"]
["Medium Cloud/Offsite Hosting Implementation – Between 100 and 500 devices and between 300 and 1,500 IP addresses"]
["Large Cloud/Offsite Hosting Implementation – Between 500 and 2,000 devices and between 1,500 and 6,000 IP addresses"]
["Unlimited  – Unlimited devices and IP addresses"]

{"sheet":"1-Scoring Methodology","index":2,"n_rows":20,"n_cols":3,"rows_kept":20,"cut":false,"hidden":false,"merged":[[3,0,3,3],[0,0,0,3],[1,0,1,3]]}
["ATTACHMENT A, CATEGORY I"]
["CLOUD COMPLIANCE SCORING METHODOLOGY"]
[]
["For the evaluation of this category of the RFP, the Evaluation Team will use the following categories and possible points:"]
[]
[null,"Category","Possible Points"]
[null,"Non-Cost Categories:"]
[null,"Cloud Compliance Services",20]
[null,"Cloud Compliance Assessment Planning",10]
[null,"Cloud Compliance Assessment Setup ",10]
[null,"Cloud Compliance Assessment Execution",20]
[null,"Cloud Compliance Assessment Completion",8]
[null,"Project Management ",20]
[null,"Project Plan",4]
[null,"Deliverables Presentation/Submission Requirements",4]
[null,"Statement of Work (SOW)",4]
[null,"Total Non-Cost Points:",{"$f":"SUM(C8:C16)","v":100}]
[null,"Total Cost Points:","Not Evaluated"]
[null,"Total Base Points:",100]
[null,"Maximum Possible Points:",100]

{"sheet":"Appendix A","index":3,"n_rows":18,"n_cols":3,"rows_kept":18,"cut":false,"hidden":false,"merged":[[2,0,2,2],[1,0,1,2],[0,0,0,2]]}
["APPENDIX A, CATEGORY I"]
[]
["Item 6.2.10: For purposes of the Project, “Perform” means that the party assigned the task has the duty and ultimate responsibility to take all appropriate steps to complete or facilitate the identified task unless otherwise provided for between the parties, subject to the supporting party completing its interdependent responsibilities. The term, “Support” means that the party has the duty and responsibility to provide ancillary support or assistance which may be necessary to enable the party providing the “Perform” task to complete that task unless otherwise provided for by the parties."]
["Key Tasks","Agency ","Vendor"]
["Conduct Project kick-off meeting","Support","Perform"]
["Create and Maintain a project work plan and any related deliverable sub plans","Support","Perform"]
["Review Deliverables and manage the Agency’s approvals","Perform","Support"]
["Prepare and conduct project meetings ","Support","Perform"]
["Create Project Status Reports ","Support","Perform"]
["Report and manage issues and risks","Support","Perform"]
["Monitor and report schedule and scope changes","Support","Perform"]
["Identify Agency stakeholders and manage expectations ","Perform","Support"]
["Assist with on-boarding for the Vendor resources","Support","Perform"]
["Assist with on-boarding for the Agency resources","Perform","Support"]
["Confirm Agency Project staffing ","Perform","Support"]
["Confirm Vendor Project staffing ","Support","Perform"]
["Verify Project Completion and Receipt of all Deliverables","Support","Perform"]
["Remediate/Correct Deficient Deliverables","Support","Perform"]