BITSIGHT Software System

California entity is requesting proposals for the provision of the BITSIGHT software system.

Submit all required forms, including Exhibit 6 - Community Business Enterprise (CBE) Information form in Excel format
Comply with all applicable programs, policies, and ordinances
Certify compliance for participating municipalities, priority clause (disastrous events), federal uniform guideline clause, and electronic catalog
Certify that the firm or its staff members are not restricted, excluded, or suspended from providing goods or services under any federal or state funded health care program
Comply with off-peak delivery requirements if applicable
Provide California Sellers Permit Number or Sellers Certificate of Registration-Use Tax Number
Certify no conflict of interest
Certify familiarity with the County Lobbyist Ordinance
Certify independent price determination and acknowledgement of solicitation restrictions
Certify zero tolerance policy on human trafficking
Attest willingness to consider GAIN/GROW participants and provide access to employee-mentoring program
Certify compliance with the County's Defaulted Property Tax Reduction Program
Certify Contractor Employee Jury Service Program
If requesting preference, be certified as a Community Business Enterprise (CBE) by the County of Los Angeles Department of Consumer and Business Affairs (DCBA)
For Local Small Business Enterprise (LSBE) preference, perform a commercially useful function
Comply with all conflict of interest laws, ordinances, and regulations
Maintain a company-wide Information Security Program and Privacy Program
Protect the confidentiality, integrity, and availability of County Information
Encrypt all workstations, portable devices, and removable media storing County Information in accordance with FIPS 140-2 or County CISO approval
Encrypt County Information transmitted on networks outside Contractor's control using TLS or IPSec with a minimum 128-bit cipher strength
Do not store County Information in the cloud or any online storage provider without written authorization from the County's CISO
Manage all mobile devices storing County Information with a Mobile Device Management (MDM) system
Maintain the latest operating system security patches and virus definitions on all workstations/Personal Computers
Perform virus scans at least monthly
Return or destroy County Information upon County's written request or contract termination/expiration
Destroy County Information by cross-cut shredding paper/film or purging/destroying electronic media consistent with NIST Special Publication 800-88
Provide a written attestation and certified documentation from a media destruction firm for destruction of County Information
Locate all facilities processing County Information in secure areas with perimeter security
Maintain physical and environmental controls for facilities processing County Information
Monitor and manage all Information processing facilities, including implementing operational procedures, change management, and incident response procedures
Deploy adequate anti-malware software and back-up systems
Have business continuity and disaster recovery plans, including a geographically separate back-up data center
Control access to County systems, services, and/or Information, including network access controls, multi-factor authentication, and regular user access reviews
Monitor systems to detect deviation from access control policies and identify suspicious activity
Eradicate County Information from hardware, storage media, or removable media before disposal or off-site servicing
Promptly notify the County's Chief Information Security Officer, Departmental Information Security Officer, and Chief Privacy Officer of any Security or Privacy Incidents within 24 hours of detection
Cooperate with the County to investigate incidents and assist forensic investigators/law enforcement
Allow the County or its third-party designee to perform audits and tests of the Contractor's environment
Ensure all subcontractors and third parties comply with the terms and conditions of the Information Security and Privacy Exhibit
Obtain advanced approval from the County's Chief Information Security Officer and/or Chief Privacy Officer prior to subcontracting services
Secure and maintain cyber liability insurance coverage with limits of at least $2,000,000.00 per occurrence and in the aggregate
Add the County as an additional insured to its cyber liability insurance policy
For Software as a Service (SaaS), provide software/firmware enhancements, upgrades, and replacements at no cost
For SaaS, store and process County Information only in the continental United States and ensure unencrypted data does not traverse borders
For SaaS, conduct an annual System and Organization Controls (SOC 2 type II) audit or equivalent
For SaaS, notify County of proposed subcontractors at least 30 days prior and obtain written consent
For SaaS, provide a complete, portable, and secure copy of all County Information at termination
For SaaS, provide reasonable termination assistance services at no additional cost
For Contractor hardware connecting to County systems, maintain inventory, manage access control, keep operating systems and applications up to date, continuously identify and remediate vulnerabilities, encrypt all devices, and maintain industry-standard endpoint antivirus/antimalware protection
For application source code, use the County Git repository for the entire project lifecycle and document design, data flow, security diagrams, configuration settings, and user guides within the repository

$1,000,000 – $5,000,000

County Of Los Angeles

Organization overview and procurement intelligence available on paid plans.

A government entity in California is seeking a vendor to provide the BITSIGHT software system. The selected vendor will be responsible for supplying and possibly implementing the software as required by the organization.

Interested companies should have the capability to deliver BITSIGHT software and support the entity's requirements for installation or integration.

Overview

Fit Score

SUMMARY

KEY REQUIREMENTS

BUDGET

Issuing Agency

DESCRIPTION

Similar RFPs