| Location: | Vermont |
|---|---|
| Posted: | Sep 25, 2026 |
| Due: | Oct 20, 2026 |
| Agency: | State of Vermont |
| Type of Government: | State & Local |
| Category: |
|
| Publication URL: | To access bid details, please log in. |
| TITLE | QUESTIONS DUE | ANSWERS POSTED | DUE DATE | NO POSTING AFTER |
|
ANR DEC Flood Resiliency Training
Bidder Response Form Addendum 1 |
10/13/2026 04:30PM |
|
10/20/2026 04:30PM |
|
State of Vermont Bidder Response Form
Request for Proposal Name: ANR DEC Flood Resiliency Training
Vendor Instructions:
Provide the information requested in this form and submit it to the State of Vermont as part of your Request for Proposal (RFP) response. All answers must be provided within the form unless otherwise specified.
Important: This form must be completed and submitted in response to this RFP for your proposal to be considered valid. The submission must also include the eight (8) additional artifacts requested within this form (denoted by underlined green font).
See the RFP for full instructions for submitting a bid. Bids must be received by the due date and at the location specified on the cover page of the RFP.
Direct any questions you have concerning this form or the RFP to:
Mark McNally, Agency of Digital Services
State of Vermont
Office of Purchasing & Contracting
E-mail Address:
Part 1: VENDOR PROFILE
Complete the table below.
Provide a brief overview of your company including number of years in business, number of employees, nature of business, and description of clients. Identify any parent corporation and/or subsidiaries.
Is your organization currently or has it previously provided solutions and/or services to any agency or entity of the Vermont State government within the past five years? If so, include a complete list of the State entities, the solutions and/or services provided, and the dates your organization provided the State with these services in the last five years.
Provide a Financial Statement* for your company and label it Attachment #1. This requirement can be filled by:
A current Dun and Bradstreet Report that includes a financial analysis of the firm;
An Annual Report if it contains (at a minimum) a Compiled Income Statement and Balance Sheet verified by a Certified Public Accounting firm; or
Tax returns and financial statements including income statements and balance sheets for the most recent 3 years, and any available credit reports.
A confidentiality statement may be included if this financial information is considered non-public information
*Some types of procurements may require bidders to provide additional or specific financial information. Any such additional requirements will be clearly identified and explained within the RFP and may include supplemental forms in addition to this Bidder Response Form.
Disclose any judgments, pending or expected litigation, or other real potential financial reversals, which might materially affect the viability or stability of your company or indicate below that no such condition is known to exist. A confidentiality statement may be included if this information is considered non-public information
Provide a list of three references similar in size and industry (preferably another governmental entity). References shall be clients, other than the State of Vermont, who have implemented your Solution within the past 48 months.
Part 2: Vendor Proposal/Solution
Provide a description of the technology solution you are proposing.
Provide a description of the capabilities of the technology solution you are proposing.
If specific software is being proposed, provide a description of the:
Standard features and functions of the software:
The software licensing requirements for the solution:
Maximum number of concurrent users:
Give a brief description of the evolution of the system/software solution you are proposing. Include the date of the first installed site and major developments which have occurred (e.g. new versions, new modules, specific features).
List the total number of installations in the last 3 years by the year of installation.
Provide the total number of current users for the proposed system and indicate what version they are using.
Have you implemented the proposed solution for other government entities? If so, tell us who, when, and how that implementation went?
Provide a Road Map that outlines the company's short term and long term goals for the proposed solution/software and label it Attachment #2. (A confidentiality statement may be included if this information is considered non-public information)
Provide a PowerPoint (minimum of 1 slide and maximum of 10 slides) that provides an Executive level summary of your proposal to the State. Label it Attachment #3.
Describe any infrastructure, equipment, network or hardware required to implement and/or run the solution.
What is your recommended way to host this solution?
Describe how your solution can be integrated to other applications and if you offer a standard-based interface to enable integrations.
Respond to the following questions about the solution being proposed:
Part 3: Functional Requirements
The table below lists the State's Functional Requirements. Indicate the "Availability" for each requirement for your proposed solution. Use the "Vendor Comments" column to provide any additional information or explanations.
A - Feature is available in the core ("out-of-the-box") solution.
D - Feature is currently under development (indicate anticipated date of availability in the Vendor comments column).
C - Feature is not available in the core solution, but can provided with customization.
N - Feature is not available.
Part 4: Non- Functional Requirements
The tables below list the State's Non-Functional Requirements. Indicate if your proposed solution complies in the "Comply" column.
Yes = the solution complies with the stated requirement.
No = the solution does not comply with the stated requirement.
N/A = Not applicable to this offering.
Describe how the requirement is met in the "Vendor Description of Compliance" column.
[Add to or modify the tables as appropriate. Consult with ADS Enterprise Architecture and/or ADS Security if assistance is needed.]
4.1
4.2
Security
As a solution vendor, you must have documented and implemented security practices for the following and have a process to audit/monitor for adherence. Indicate "Yes" or "No" in the "Comply" column or "N/A" if the requirement is not applicable to this offering. Use the "Vendor Description of Applicable Security Processes" column to describe how you meet the requirement and the "Audit/Monitor" column to indicate how you monitor for compliance. (A confidentiality statement may be included if this information is considered non-public information)
4.4 Other Non-Functional Requirements
For each requirement listed, indicate if and how you comply or type "N/A" if it is not applicable to your offering.
4.5 Data Compliance
Vendors and their solutions must adhere to applicable State and Federal standards, policies, and laws based on the type of data that will be stored, accessed, transmitted and/or controlled by the solution. If the "Type of Data" column is checked below, respond "Yes" or "No" in the "Comply" column and provide an explanation on how you comply in the "Vendor's Description of Compliance" column.
[Check the boxes that are relevant for your project. Consult ADS Enterprise Architecture or Security if assistance is needed.]
4.6 State of Vermont Cybersecurity Standard Update
Bidder shall certify by checking the box below the Solution shall not include, incorporate, rely on, utilize or be supported by any products or services subject to the limitations provided under State of Vermont Cybersecurity Standard Update, which Bidder acknowledges has been provided to it, and is available on-line at the following URL:
Bidder hereby certifies that in connection with the Request for Proposal, none of the applicable products or services will be included in or used to support State systems in a manner prohibited under the Standard.
Part 5: IMPLEMENTATION/Project Management Approach
Describe the approach you would recommend for project managing this engagement.
Provide a list of the standard project management deliverables that you would normally produce for this type of engagement.
Provide a proposed list of project phases, major milestones, and an implementation time-line. Label this Attachment #4.
What types of difficulties have other clients experienced with implementation of the proposed solution?
Describe the experience and qualifications of the Project Manager you would offer as the resource for this engagement. Provide a copy of their resume and label it Attachment #5.
Part 6: TECHNICAL Services
Describe the technical services included in your proposal (e.g., business analysis, configuration, testing, implementation, etc.).
Provide a list of the standard deliverables for the technical services described above.
Provide a description of the roles/services/tasks the State will be expected to cover as part of this engagement. Describe any additional roles/services/tasks that are optional, but would be beneficial for the State to provide.
Describe your typical conversion plan to convert data from existing systems to your proposed solution (if applicable).
Describe and attach your typical Implementation Plan (label it Attachment #6), which shall include planning for the transition to maintenance and operations.
Describe the experience and qualifications of the technical resources proposed for this engagement. Provide their resume(s) and label them Attachment #7.
Describe the training that is included in your proposal.
Describe the system, administrator, and/or user documentation that is included in your proposal.
Part 7: Maintenance and Support Services
Provide answers to the questions below regarding your company's Maintenance and Support Services:
Describe how adherence to your service levels is measured and what remedies you would provide the State when performance doesn't meet the standard?
Part 8: PRICING
Submit pricing for your proposed solution in the table below. Fill in only the lines that are applicable to your proposal. Insert lines for additional costs, but do not delete or rename any lines in the Table. Total each column and provide a total of all columns in the "Total Implementation, plus 5 Year Costs" box on the next page.
Describe any assumptions you have made in relation to the above cost and pricing information.
Provide pricing information for any volume discounts that are available based on the number of software licenses purchased or support years purchased.
Provide pricing for any Functional Requirements marked as "C" (feature is not available in the core solution, but can be provided with customization).
Part 9: Terms and Conditions
Exceptions to the States standard terms, conditions, and templates is strongly discouraged. Accordingly, exceptions may result in a determination that a bidders proposal is not in the best interest of the State. However, if a bidder does wish to take exception to the State's terms, conditions, or templates they must indicate those objections in the table below. Add lines to the table below as needed. The State considers contractor documents the bidder wishes to append to the contract as exceptions.
Part 10: CERTIFICATE OF COMPLIANCE/Authorized Company Signature
NON COLLUSION: Bidder hereby certifies that the prices quoted have been arrived at without collusion and that no prior information concerning these prices has been received from or given to a competitive company. If there is sufficient evidence to warrant investigation of the bid/contract process by the Office of the Attorney General, bidder understands that this paragraph might be used as a basis for litigation.
CONTRACT TERMS: Bidder hereby acknowledges that is has read, understands and agrees to the terms of this RFP, including Attachment C: Standard State Contract Provisions, and any other contract attachments included with this RFP.
Worker Classification Compliance Requirement: In accordance with Section 32 of The Vermont Recovery and Reinvestment Act of 2009 (Act No. 54), the following provisions and requirements apply to Bidder when the amount of its bid exceeds $250,000.00.
Self-Reporting. Bidder hereby self-reports the following information relating to past violations, convictions, suspensions, and any other information related to past performance relative to coding and classification of workers, that occurred in the previous 12 months.
Subcontractor Reporting. Bidder hereby acknowledges and agrees that if it is a successful bidder, prior to execution of any contract resulting from this RFP, Bidder will provide to the State a list of all proposed subcontractors and subcontractors' subcontractors, together with the identity of those subcontractors' workers compensation insurance providers, and additional required or requested information, as applicable, in accordance with Section 32 of The Vermont Recovery and Reinvestment Act of 2009 (Act No. 54), and Bidder will provide any update of such list to the State as additional subcontractors are hired. Bidder further acknowledges and agrees that the failure to submit subcontractor reporting in accordance with Section 32 of The Vermont Recovery and Reinvestment Act of 2009 (Act No. 54) will constitute non-compliance and may result in cancellation of contract and/or restriction from bidding on future state contracts.
Executive Order 05 - 16: Climate Change Considerations in State Procurements Certification
Bidder certifies to the following (Bidder may attach any desired explanation or substantiation. Please also note that Bidder may be asked to provide documentation for any applicable claims):
Bidder owns, leases or utilizes, for business purposes, space that has received:
Energy Star(R) Certification
LEED(R), Green Globes(R), or Living Buildings ChallengeSM Certification
Other internationally recognized building certification:
____________________________________________________________________________
2. Bidder has received incentives or rebates from an Energy Efficiency Utility or Energy Efficiency Program in the last five years for energy efficient improvements made at bidder's place of business. Please explain:
_____________________________________________________________________________
3. Please Check all that apply:
Bidder can claim on-site renewable power or anaerobic-digester power ("cow-power"). Or bidder consumes renewable electricity through voluntary purchase or offset, provided no such claimed power can be double-claimed by another party.
Bidder uses renewable biomass or bio-fuel for the purposes of thermal (heat) energy at its place of business.
Bidder's heating system has modern, high-efficiency units (boilers, furnaces, stoves, etc.), having reduced emissions of particulate matter and other air pollutants.
Bidder tracks its energy consumption and harmful greenhouse gas emissions. What tool is used to do this? _____________________
Bidder promotes the use of plug-in electric vehicles by providing electric vehicle charging, electric fleet vehicles, preferred parking, designated parking, purchase or lease incentives, etc..
Bidder offers employees an option for a fossil fuel divestment retirement account.
Bidder offers products or services that reduce waste, conserve water, or promote energy efficiency and conservation. Please explain:
____________________________________________________________________________
____________________________________________________________________________
Please list any additional practices that promote clean energy and take action to address climate change:
_____________________________________________________________________________
____________________________________________________________________________
_____________________________________________________________________________
Certification Regarding Use of Contract Funds for Lobbying. The following provision is applicable to the Contractor for contracts over $100,000.00, and Contractor shall include this clause in all its subcontracts over $100,000.00.
1. The prospective contractor certifies, to the best of his or her knowledge and belief, under the penalties of perjury under the laws of the State of Vermont and the United States that on behalf of the person, firm, association, or corporation he or she represents, that:
a. No Federal appropriated funds have been paid or will be paid, by or on behalf of the undersigned, to any person for influencing or attempting to influence an officer or employee of any Federal agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with the awarding of any Federal contract, the making of any Federal grant, the making of any Federal loan, the entering into of any cooperative agreement, and the extension, continuation, renewal, amendment, or modification of any Federal contract, grant, loan, or cooperative agreement.
b. If any funds other than Federal appropriated funds have been paid or will be paid to any person for influencing or attempting to influence an officer or employee of any Federal agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with this Federal contract, grant, loan, or cooperative agreement, the undersigned shall complete and submit Standard Form-LLL, "Disclosure Form to Report Lobbying," in accordance with its instructions.
2. This certification is a material representation of fact upon which reliance was placed when this transaction was made or entered into. Submission of this certification is a prerequisite for making or entering into this transaction imposed by 31 U.S.C. 1352. Any person who fails to file the required certification shall be subject to a civil penalty of not less than $10,000 and not more than $100,000 for each such failure.
3. The prospective contractor also agrees that they shall require that the language of this certification be included in all lower tier subcontracts, which exceed $100,000 and that all such recipients shall certify and disclose accordingly.
For your bid to be considered valid, this Bidder Response Form must be signed by a duly authorized representative of the bidder, and submitted as part of the response to the proposal.
I am authorized to submit a proposal to the State of Vermont in response to this RFP on behalf of my organization. The information provided as part of my organization's response is a true and accurate representation of my organization's ability to meet the State of Vermont's business needs as expressed in this RFP.
| Item | Detail |
|---|---|
| Company Name: | [insert the name that you do business under] |
| Physical Address: | [if more than one office - put the address of your head office] |
| Postal Address: | [e.g. P.O Box address] |
| Business Website: | [url address] |
| Type of Entity (Legal Status): | [sole trader/partnership/limited liability company or specify other] |
| Primary Contact: | [name of the person responsible for communicating with the Buyer] |
| Title: | [job title or position] |
| Email Address: | [email] |
| Phone Number: | [landline] |
| Fax Number: | [fax] |
| Reference 1 | Detail | Detail |
|---|---|---|
| Reference Company Name: | [insert the name that you do business under] | [insert the name that you do business under] |
| Company Address: | [address] | [address] |
| Type of Industry: | [industry type: e.g., government, telecommunications, etc.] | [industry type: e.g., government, telecommunications, etc.] |
| Contact Name: | [if applicable] | [if applicable] |
| Contact Phone Number: | [phone] | [phone] |
| Contact Email Address: | [email] | [email] |
| Description of system(s) implemented: | [description] | [description] |
| Date of Implementation: | [date] | [date] |
| Reference 2 | Reference 2 | Detail |
| Reference Company Name: | Reference Company Name: | [insert the name that you do business under] |
| Company Address: | Company Address: | [address] |
| Type of Industry: | Type of Industry: | [industry type: e.g., government, telecommunications, etc.] |
| Contact Name: | Contact Name: | [if applicable] |
| Contact Phone Number: | Contact Phone Number: | [phone] |
| Contact Email Address: | Contact Email Address: | [email] |
| Description of system(s) implemented: | Description of system(s) implemented: | [description] |
| Date of Implementation: | Date of Implementation: | [date] |
| Reference 3 | Detail |
|---|---|
| Reference Company Name: | [insert the name that you do business under] |
| Company Address: | [address] |
| Type of Industry: | [industry type: e.g., government, telecommunications, etc.] |
| Contact Name: | [if applicable] |
| Contact Phone Number: | [phone] |
| Contact Email Address: | [email] |
| Description of system(s) implemented: | [description] |
| Date of Implementation: | [date] |
| Vendor Response/Explanation | Vendor Response/Explanation | |
|---|---|---|
| Question | Yes or No | |
| Does the solution use Service Oriented Architecture for integration? | ||
| Does the solution use a Rules Engine for business rules? | ||
| Does the solution use any Master Data Management? | ||
| Does the solution use any Enterprise Content Management software? | ||
| Does the solution use any Case Management software? | ||
| Does the solution use any Business Intelligence software? | ||
| Does the solution use any Database software? | ||
| Does the solution use any Business Process Management software? | ||
| Is this a browser based solution and if so what browsers do you support? | ||
| Does the solution include an API for integration? |
| ID # | Functional Requirement Description | Availability | Vendor Comments |
|---|---|---|---|
| 1 Training Content | 1 Training Content | 1 Training Content | 1 Training Content |
| A | Develop plain-language self-guided education and outreach training modules on flood resiliency. | ||
| B | Create separate technical content geared for the public for each training topic: * River corridor & floodplain basic concepts * River management principles & practices * FEMA Flood Hazard Maps * River Corridor Maps * Elevation Certificates * Flood Insurance basics * Letter of Map Changes (LOMC) * Floodplain development * Flood disclosure laws * What happens after a flood * NAI standards | ||
| C | Create separate technical content (or build on created content for the public) geared to Municipal Officials for each training topic: * Different flood hazard area regulations: National Flood Insurance Program (NFIP), State Minimum Flood Hazard Standards & river corridor regulations * Flood elevations & river corridor determinations * Floodplain permitting * Managing violations & variances * Substantial Improvement & Substantial Damage * Municipal responsibilities after a flood * Different flood hazard mapping comparisons * Project siting guidance | ||
| D | Include engaging videos and/or other multimedia. | ||
| E | Incorporate learning checks into training modules | ||
| F | Develop 10-15 training modules. | ||
| G | Each module should be approximately 5-15 minutes long. | ||
| H | Cover floodplain management, river corridor concepts, flood hazards, and related topics. | ||
| I | Include summaries and actionable steps at the end of each training | ||
| J | Provide support materials such as To-do lists, Toolkits, and Action items | ||
| K | Adapt materials for in-person instructor-led training. | ||
| L | Conduct 1-2 pilot training sessions before public release. | ||
| M | Incorporate feedback from pilots into final materials. | ||
| 2 Learning Platform | 2 Learning Platform | 2 Learning Platform | 2 Learning Platform |
| A | Host all online training. | ||
| B | Make public training freely available. | ||
| C | Allow optional user registration. | ||
| D | Allow registered users to resume training. | ||
| E | Collect limited user information including: Username Municipal affiliation and role (if applicable) | ||
| F | Track learner progress for registered users | ||
| G | Track module completion for registered users | ||
| H | Allow the State to identify municipalities that access training. | ||
| I | Allow analysis of: User types Modules viewed Training utilization | ||
| J | Be accessible through: Learning Management System; E-learning platform; Application; or equivalent solution. | ||
| K | Provide State staff admin login credentials. | ||
| L | Provide State staff orientation/training on use of the platform. | ||
| 3 Project Management Deliverables | 3 Project Management Deliverables | 3 Project Management Deliverables | 3 Project Management Deliverables |
| A | Conduct project kickoff meeting. | ||
| B | Produce meeting notes | ||
| C | Develop draft project plan | ||
| D | Produce final project plan. | ||
| E | Define hosting solution. | ||
| F | Identify learning objectives. | ||
| G | Develop educational content. | ||
| H | Produce in-person training materials. | ||
| I | Produce progress reports. | ||
| J | Publish online content. | ||
| K | Launch hosting platform. | ||
| L | Complete outreach reporting. | ||
| M | Produce final summary report. |
| ID # | Hosting | Comply | Vendor's Description of Compliance |
|---|---|---|---|
| H1 | Any technical solution must be hosted in a data center. | ||
| H2 | Any hosting provider must provide for back-up and disaster recovery models and plans as needed for the solution. | ||
| H3 | Any hosting provider will abide by ITIL best practices for change requests, incident management, problem management and service desk. |
| ID # | Application Solution | Comply | Vendor's Description of Compliance |
|---|---|---|---|
| A1 | Any solutions vendor must provide for the backup/recovery, data retention and disaster recovery of a contracted/hosted application solution. | ||
| A2 | Any solutions vendor must provide for application management and design standard of all technology platforms and environments for the application solution (Development, Staging, Productions, DR, etc.) | ||
| A3 | Any solutions vendor must engage the State of Vermont using Service Level Agreements for system and application performance, incident reporting and maintenance. | ||
| A4 | The State owns any data they enter, migrate, or transmit into the solution and the vendor shall allow the State to pull or copy this data at any time free of charge. | ||
| A5 | As a contract deliverable, the vendor shall supply an up-to-date data dictionary that represents all data respective of the solution it will provide. The data dictionary must contain the following attributes: The technology (RDBMS platform) that hosts the data source, i.e. Oracle, SQL Server, MySQL, DB2, etc. The location where the data source is hosted Thorough descriptions of each table in the data source Thorough descriptions of each column within each table in the data source. In addition to business definitions, column descriptions must include the following detail: schema names; file group names (if applicable); data types; lengths; primary and foreign key constrains; applied formatting; applied calculations; applied aggregations; NULL-ability; default values. | ||
| ID # | Non-Functional Requirement Description | Comply | Vendor's Description of Applicable Security Processes | Audit/Monitor Process |
|---|---|---|---|---|
| S1 | Input validation | |||
| S2 | Output encoding | |||
| S3 | Authentication and password management | |||
| S4 | Session management | |||
| S5 | Access control | |||
| S6 | Cryptographic practices | |||
| S7 | Error handling and logging | |||
| S8 | Data protection from unauthorized use, modification, disclosure or destruction (accidental or intentional). | |||
| S9 | Communication security | |||
| S10 | System configuration | |||
| S11 | Database security | |||
| S12 | File management | |||
| S13 | Memory management | |||
| S14 | Fraud detection | |||
| S15 | General coding practices | |||
| S16 | POA&M management | |||
| S17 | Risk Assessment Practices including but not limited to vulnerability assessment and pen testing | |||
| S18 | Incident response planning and testing | |||
| S19 | System Security Plan delivery | |||
| Additional Logon Requirements | ||||
| S20 | Login is also routed through the State's central identity provider login page-Okta for external users, Entra for internal users-ensuring state-approved authenticators and user experience | |||
| S21 | Authentication for both internal and external users is handled via SAML 2.0 or OIDC only, and in conformance with their respective standards. | |||
| Authentication is validated in DEV and TEST environments, in addition to PROD, when directed by the State. | ||||
| Applications serving both internal and external users support two identity providers with separate URLs. Where an application cannot support two providers, the State may agree to handle routing through a single IDP upon request. | ||||
| Applications dependent on internal/external user status can reliably determine that status from OIDC claims or SAML attributes | ||||
| Users with incomplete profiles are blocked from application functionality until profile requirements are met. | ||||
| User profile data is sourced from the State's identity provider at each login and kept current. Upon State request, the application provides a real-time update endpoint keyed to the user's persistent subject identifier. | ||||
| User identity is anchored to a persistent subject identifier issued by the State's identity provider, not a mutable attribute such as email. | ||||
| Where OIDC claims or SAML attributes indicate insufficient identity proofing for the application's requirements as defined by the State, users are redirected to id.vermont.gov with State-specified parameters. | ||||
| Application session length is configurable per agency requirements. Identity provider session length is determined by the State | ||||
| Logout terminates both the application session and the SSO session simultaneously. | ||||
| New users are provisioned under least privilege by default, with access elevated only after administrator approval within the application. Where approved by the State, permissions may be tied to identity provider security groups | ||||
| The application supports self-service entry, where users can log in and are informed they require elevated access if any access is restricted to a subset of the IDP. |
| A | Training should be available on demand. | ||
| B | Training should be accessible from the State Flood Training website or linked from it. | ||
| C | Adhere to Web accessibility standards | ||
| D | Training should be produced in: SCORM format or video format. | ||
| E | Training content must support future updates. | ||
| F | Content should accommodate policy changes. | ||
| G | Content should accommodate program changes. | ||
| H | Educational materials should be reusable. | ||
| I | Materials should be adaptable for live training. | ||
| J | Platform should provide: * Aggregated reporting. * User analytics. * Module usage analytics. * Municipal participation information. * Training progress information. * Viewing statistics. | ||
| Type of Data | Applicable State & Federal Standards, Policies, and Laws | Comply | Vendor's Description of Compliance |
|---|---|---|---|
| Publicly available information | NIST 800-171 | ||
| Confidential Personally Identifiable Information (PII) | State law on Notification of Security Breaches State Law on Social Security Number Protection State law on the Protection of Personal Information National Institute of Standards & Technology: NIST SP 800-53 Revision 4 "Moderate" risk controls Privacy Act of 1974, 5 U.S.C. 552a. | ||
| Payment Card Information | Payment Card Industry Data Security Standard (PCI DSS) v 3.2 | ||
| Federal Tax Information | Internal Revenue Service Tax Information Security Guidelines for Federal, State and Local Agencies: IRS Pub 1075 | ||
| Personal Health Information (PHI) | Health Insurance Portability and Accountability Act of 1996: HIPAA The Health Information Technology for Economic and Clinical Health Act HITECH Code of Federal Regulations 45 CFR 95.621 |
| Type of Data | Applicable State & Federal Standards, Policies, and Laws | Comply | Vendor's Description of Compliance |
|---|---|---|---|
| Affordable Care Act Personally Identifiable Information (PII) | Internal Revenue Service Tax Information Security Guidelines for Federal, State and Local Agencies IRS Pub 1075 Minimum Acceptable Risk Standards for Exchanges MARS-E 2.0 (Scroll down the page) | ||
| Medicaid Information | Medicaid Information Technology Architecture MITA3.0 Code of Federal Regulations 45 CFR 95.621 | ||
| Prescription Information | State law on the Confidentiality of Prescription Information | ||
| Student Education Data | Family Educational Rights and Privacy Act: FERPA | ||
| Personal Information from Motor Vehicle Records | Driver's Privacy Protection Act (Title XXX) ("DPPA") 18 U.S.C. Chapter 123, 2721 - 2725 | ||
| Criminal Records | Criminal Justice Information Security Policy: CJIS | ||
| Other sensitive data | Data that does not fit into the above categories but is sensitive and requires additional protection. | ||
| Other: describe | [List what's applicable or delete this line.] |
| Questions | Vendor Response |
|---|---|
| Service: Customer Phone &/or Email Support | Service: Customer Phone &/or Email Support |
| What is the method for contacting technical support? | |
| What are the hours of operation for support? | |
| What is the turnaround time for responses? | |
| What is the escalation process for support issues? | |
| Who comprises the support team and what are their qualifications? | |
| Define your response resolution metrics and how you capture and report them. | |
| Service: Incident/Security Breach Notification and Process | Service: Incident/Security Breach Notification and Process |
| Describe your identification and notification process for security breaches. | |
| Service: Data Management | Service: Data Management |
| Describe how data is stored, retained and backed-up (including frequency). | |
| Service: Hosting | Service: Hosting |
| Describe the hosting service and associated service levels. |
| Questions | Vendor Response |
|---|---|
| Service: Scheduled Maintenance/Downtime | Service: Scheduled Maintenance/Downtime |
| What is the frequency of scheduled maintenance and downtime? | |
| What is the notification process for scheduled maintenance and downtime? | |
| Describe how "maintenance" updates are tested with customers prior to installing them in their live environments. | |
| Service: System Upgrades | Service: System Upgrades |
| Are software upgrades provided as part of the software support contract? | |
| Describe your software upgrade process. | |
| How often are new versions released? | |
| Is documentation and training provided for system upgrades? | |
| Are there additional costs for upgrades and/or new releases? | |
| Describe how and when the State will have an opportunity to test system upgrades/releases prior to live installation. | |
| Describe how the State will validate post installation and how changes will be backed out in the event that a problem is encountered. |
| Questions | Vendor Response |
|---|---|
| Service: Bug Fixes and Minor Enhancements | Service: Bug Fixes and Minor Enhancements |
| Describe the frequency and process for providing, testing, and installing bug fixes and minor enhancements. | |
| Service: Disaster Recovery | Service: Disaster Recovery |
| Describe the disaster recovery services included in this proposal for any non-state hosted services. | |
| What is your standard RPO and RTO? | |
| Describe the plan your company has in place for its own disaster recovery of any sites that may be involved in support of this proposal. |
| Cost Type | One Time (Implementation) | Year 1 | Year 2 | Year 3 | Year 4 | Year 5 |
|---|---|---|---|---|---|---|
| Software | ||||||
| Enterprise Application: License Fees | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Maintenance &/or License Fee Add-Ons | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Subscription cost | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Storage Limitations and/or Additional Fees | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Database Software: License Fees | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Middleware Tools: License Fees | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Operating System Software: License Fees | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Upgrade Costs for Later Years | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Support and Maintenance Fees | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | |
| Implementation Services | ||||||
| Project Management | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Requirements | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Design (Architect Solution) | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Development (Build, Configure or Aggregate)/Testing | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| System Testing | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Defect Removal | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Implement/Deploy or Integrate | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Quality Management | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Cost Type | One Time (Implementation) | Year 1 | Year 2 | Year 3 | Year 4 | Year 5 |
| Implementation Services Continued | ||||||
| Training | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | |
| $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | |
| Telecom | $0.00 | |||||
| Bandwidth | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | |
| Hardware | $0.00 | |||||
| Computing Hardware | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Storage and Backup Hardware | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Network Hardware | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| Facilities/Data Center | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | |
| $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | |
| Hosting | $0.00 | |||||
| Hosting Fees | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 |
| $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | $0.00 | |
| Total Base Costs | $0.00 |
| Total Implementation plus Five Year Costs | $ 0.00 |
|---|
| Clause Location | Exception | Proposed Verbiage |
|---|---|---|
| [indicate RFP, exhibit, attachment or addendum, section & page number] | [briefly describe your concern about this clause] | [describe your suggested alternative wording for the clause or your solution] |
| [indicate RFP, exhibit, attachment or addendum, section & page number] | [briefly describe your concern about this clause] | [describe your suggested alternative wording for the clause or your solution] |
| [indicate RFP, exhibit, attachment or addendum, section & page number] | [briefly describe your concern about this clause] | [describe your suggested alternative wording for the clause or your solution] |
| Summary of Detailed Information | Date of Notification | Outcome |
|---|---|---|
| Signature: | |
|---|---|
| Full name: | |
| Title: | |
| Company: | |
| Date: |

With GovernmentContracts, you can:
...ANR DEC Flood Resiliency Training Request Date: 9/22/2026 9:34:23 AM Open Date: Closing ...
State Government of Vermont
Bid Due: 11/06/2026
...TITLE QUESTIONS DUE ANSWERS POSTED DUE DATE NO POSTING AFTER ANR DEC Flood ...
State of Vermont
Bid Due: 11/06/2026
...and Cable, Windows and Window Decor, Electrical Contractor, Construction (Non Building), Classroom/Training...
State Government of Vermont
Bid Due: 11/20/2026
...: Job Contract Locations: Washington Keywords: Conference/Training Coordination, Health Care Services...
State Government of Vermont
Bid Due: 11/19/2029