Posted: 6/10/2024

Question: RFQ Reference: "Access Control and Permissions Management: Granular control over access permissions to sensitive data. Automated enforcement of access controls based on user roles and data sensitivity." Question: What specific roles within your educational institution are configured within your current access control system, and do you utilize a hybrid model combining elements of role-based (RBAC) and attribute-based access control (ABAC) to manage permissions effectively in your multi-user environment? RFQ Reference: "Data Monitoring and Alerting: Real-time monitoring of data access, file activity, and permission changes. Automated alerts for suspicious or unauthorized activities." Question: What specific integration challenges have you encountered with your existing real-time monitoring tools, especially in terms of scaling to accommodate data growth and maintaining performance during peak usage periods in your educational setting? RFQ Reference: "Data Governance Dashboard: Centralized dashboard for monitoring data governance metrics, compliance status, and security posture." Question: What essential metrics and KPIs do you need to be displayed on the Data Governance Dashboard, such as incident response times, user compliance rates, or data integrity scores? How are these metrics intended to enhance strategic decision-making and operational compliance in your school system? RFQ Reference: "Scalability Concerns: Scalability to support the growing volume of data and users." Question: Could you specify the expected growth rate of your data volumes and user base over the next five years? Are there particular scalability milestones or thresholds, such as data size or number of concurrent users, that our solution should be prepared to handle effectively? RFQ Reference: "Risk Management: Requirements for identifying and managing data security risks." Question: How do you currently identify and manage potential data security risks, and what specific functionalities or features do you expect the new solution to provide to assist in these efforts? For instance, are you looking for automated risk assessment tools, real-time threat detection, or predictive analytics capabilities? RFQ Reference: "Custom Reporting: Requirements for custom reporting capabilities within the data governance solution." Question: What specific custom reporting capabilities do you require from the data governance solution? Could you detail the types of reports you need, such as compliance audits, risk assessments, or user activity analyses, and how you utilize these reports in your strategic decision-making? RFQ Reference: "Third-party Collaborations: Integration with third-party services or vendors in data processes." Question: Are there third-party services or vendors involved in your data processes that the solution must seamlessly integrate with? If so, could you specify which services or vendors are critical and describe the nature of the data exchanges or interactions that need to be supported? RFQ Reference: "Cloud vs. On-Premise: Strategic direction for future technology deployments." Question: What is the district’s strategic direction regarding the adoption of cloud versus on-premise solutions for future technology deployments? Are there specific considerations or constraints, such as data security or infrastructure readiness, that are influencing this decision? RFQ Reference: "Performance Metrics: Criteria for evaluating the success of the data governance solution." Question: What performance metrics are considered crucial for evaluating the success of the implemented data governance solution? For instance, are you focusing on metrics related to system responsiveness, user adoption rates, error reduction in data handling, or compliance with regulatory standards? RFQ Reference: "Data Encryption: Requirements for encryption of data at rest and in transit." Question: What specific requirements do you have for data encryption both at rest and in transit? Does your district mandate particular encryption standards, such as AES-256 or RSA? Are there scenarios or types of data that necessitate different levels of encryption? RFQ Reference: "User Authentication: Expectations for user authentication mechanisms within the data governance framework." Question: What types of user authentication mechanisms are you aiming to support within the data governance framework? For instance, are you considering multifactor authentication, biometric verification, or single sign-on (SSO) capabilities, and how do these fit into your overall security policy? RFQ Reference: "Data Deletion Policies: Requirements for data retention and deletion within the data governance framework." Question: Could you specify the policies around data retention and deletion that need to be managed within the solution? Are there particular types of data, such as student records or employee information, that have specific retention periods or deletion protocols according to state regulations or district policies? RFQ Reference: "Mobile Access: Requirements for mobile access to the data governance system." Question: Is mobile access to the data governance system required for your stakeholders, and if so, what are the primary security implications or concerns that need to be addressed? For example, are there specific authentication methods or data encryption levels you require for mobile access to ensure data security? RFQ Reference: "Change Management: Procedures and expectations for managing changes in IT projects." Question: How does the district manage change within IT projects, particularly in terms of introducing new data governance systems? Are there specific roles or processes that the vendor is expected to fulfill, such as providing training, documentation, or support during the transition? What are the critical success factors you consider when assessing the effectiveness of change management practices in your IT projects?

Response: RFQ Reference: "Access Control and Permissions Management: Granular control over access permissions to sensitive data. Automated enforcement of access controls based on user roles and data sensitivity." Question: What specific roles within your educational institution are configured within your current access control system, and do you utilize a hybrid model combining elements of role-based (RBAC) and attribute-based access control (ABAC) to manage permissions effectively in your multi-user environment? We currently use AD groups and Google Groups to grant access and permissions to systems and files. We currently cannot implement ABAC which we are aware of. RFQ Reference: "Data Monitoring and Alerting: Real-time monitoring of data access, file activity, and permission changes. Automated alerts for suspicious or unauthorized activities." Question: What specific integration challenges have you encountered with your existing real-time monitoring tools, especially in terms of scaling to accommodate data growth and maintaining performance during peak usage periods in your educational setting? We currently do not have anything in place. RFQ Reference: "Data Governance Dashboard: Centralized dashboard for monitoring data governance metrics, compliance status, and security posture." Question: What essential metrics and KPIs do you need to be displayed on the Data Governance Dashboard, such as incident response times, user compliance rates, or data integrity scores? How are these metrics intended to enhance strategic decision-making and operational compliance in your school system? We would be interested in seeing what your proposed solution offers. The goal would be to utilize these KPIs to make strategic decisions and future staff training decisions. RFQ Reference: "Scalability Concerns: Scalability to support the growing volume of data and users." Question: Could you specify the expected growth rate of your data volumes and user base over the next five years? Are there particular scalability milestones or thresholds, such as data size or number of concurrent users, that our solution should be prepared to handle effectively? We are currently seeing an increase of ~10TB per year on Google Drive storage. RFQ Reference: "Risk Management: Requirements for identifying and managing data security risks." Question: How do you currently identify and manage potential data security risks, and what specific functionalities or features do you expect the new solution to provide to assist in these efforts? For instance, are you looking for automated risk assessment tools, real-time threat detection, or predictive analytics capabilities? We currently have no real solution. We are looking at all options that provide the most complete solution. RFQ Reference: "Custom Reporting: Requirements for custom reporting capabilities within the data governance solution." Question: What specific custom reporting capabilities do you require from the data governance solution? Could you detail the types of reports you need, such as compliance audits, risk assessments, or user activity analyses, and how you utilize these reports in your strategic decision-making? The items you listed would be a good start. Due to this being an open response, I do not know what all reports are available. Yes these would be used for designing future training and helping identifying perpetual issues. RFQ Reference: "Third-party Collaborations: Integration with third-party services or vendors in data processes." Question: Are there third-party services or vendors involved in your data processes that the solution must seamlessly integrate with? If so, could you specify which services or vendors are critical and describe the nature of the data exchanges or interactions that need to be supported? No, we have no current systems, you would need to focus on Google but provide information about other integrations you support. RFQ Reference: "Cloud vs. On-Premise: Strategic direction for future technology deployments." Question: What is the district’s strategic direction regarding the adoption of cloud versus on-premise solutions for future technology deployments? Are there specific considerations or constraints, such as data security or infrastructure readiness, that are influencing this decision? We would lean towards a cloud solution for our cloud solution. RFQ Reference: "Performance Metrics: Criteria for evaluating the success of the data governance solution." Question: What performance metrics are considered crucial for evaluating the success of the implemented data governance solution? For instance, are you focusing on metrics related to system responsiveness, user adoption rates, error reduction in data handling, or compliance with regulatory standards? Speed of identifying events, ability to quickly and easily rectify those events, the amount of staffs time to rectify the event. The decrease of total Data exposures reduced dramatically. RFQ Reference: "Data Encryption: Requirements for encryption of data at rest and in transit." Question: What specific requirements do you have for data encryption both at rest and in transit? Does your district mandate particular encryption standards, such as AES-256 or RSA? Are there scenarios or types of data that necessitate different levels of encryption? We currently do not have specific encryption standards, so we would appreciate any guidance in this area in building a policy. RFQ Reference: "User Authentication: Expectations for user authentication mechanisms within the data governance framework." Question: What types of user authentication mechanisms are you aiming to support within the data governance framework? For instance, are you considering multifactor authentication, biometric verification, or single sign-on (SSO) capabilities, and how do these fit into your overall security policy? We would want SSO with MFA for my admin staff. If staff would be logging in, we would need to talk through this. RFQ Reference: "Data Deletion Policies: Requirements for data retention and deletion within the data governance framework." Question: Could you specify the policies around data retention and deletion that need to be managed within the solution? Are there particular types of data, such as student records or employee information, that have specific retention periods or deletion protocols according to state regulations or district policies? We currently do not have a policy for end-user data. We would like to establish one with the setup of the new system. RFQ Reference: "Mobile Access: Requirements for mobile access to the data governance system." Question: Is mobile access to the data governance system required for your stakeholders, and if so, what are the primary security implications or concerns that need to be addressed? For example, are there specific authentication methods or data encryption levels you require for mobile access to ensure data security? If available, we would like an app on our phones that would help secure files/data saved to the local phone. RFQ Reference: "Change Management: Procedures and expectations for managing changes in IT projects." Question: How does the district manage change within IT projects, particularly in terms of introducing new data governance systems? Are there specific roles or processes that the vendor is expected to fulfill, such as providing training, documentation, or support during the transition? What are the critical success factors you consider when assessing the effectiveness of change management practices in your IT projects? We would expect training, documentation and assistance with building policies and best practices around Data Governance.

Posted: 6/12/2024

Question: Point 2 under "Data Discovery and Classification" in Exhibit A - "Classification of data based on sensitivity, compliance requirements, and business relevance." Q) Please detail the number of existing data sources. Point 2 under Access Control and Permissions Management in Exhibit A - "Granular control over access permissions to sensitive data." Q) How many users are expected to use this solution? Point 2 under Compliance and Reporting in Exhibit A - "Generation of compliance reports and audit trails." How many reports does the vendor have to provide? Point 1 under Data Governance Dashboard in Exhibit A - "Centralized dashboard for monitoring data governance metrics, compliance status, and security posture." Q) What metrics does the vendor need to provide? Please elaborate on the term "security posture" Point 1 under User Behavior Analytics in Exhibit A - "Detection of anomalous user behavior indicative of insider threats or data breaches." Q) Please disclose the data sources (Size, format, etc) that will be used for the User Behavior Analytics. Point 1 under "Integration and Scalability Analytics" in Exhibit A Q) What is the current architecture in place? Point 4 under Evaluation Criteria - "Compliance with the specified requirements and scope of work" Q) Could the bidder please provide the expected amount for the RFQ? Q) Does the vendor have to create a data warehouse to transform the data for the required feature? Q) Can work for this project be done outside of U.S territory? Q) Can the project be carried out onsite or offsite? Q) Could you please disclose what software licenses the bidder has in place? Any preferences? Q) Please elaborate on what security measures are expected from the vendor? Q) What resources are expected to be provided by the vendor for this project? Q) Is the bidder open to the inclusion of maintenance within the proposal?

Response: Point 2 under "Data Discovery and Classification" in Exhibit A - "Classification of data based on sensitivity, compliance requirements, and business relevance." Q) Please detail the number of existing data sources. Sources would be from end user devices. Sources to be evaluated would be Google Point 2 under Access Control and Permissions Management in Exhibit A - "Granular control over access permissions to sensitive data." Q) How many users are expected to use this solution? Depends on your solution Point 2 under Compliance and Reporting in Exhibit A - "Generation of compliance reports and audit trails." How many reports does the vendor have to provide? The solution should be providing reports as needed from day one. Point 1 under Data Governance Dashboard in Exhibit A - "Centralized dashboard for monitoring data governance metrics, compliance status, and security posture." Q) What metrics does the vendor need to provide? You should be able to demo your preposed solution and show a dashboard that identifies high concerns, and stats on the solution and data being monitored. Please elaborate on the term "security posture" Identify data that is exposed that contains secured data. Point 1 under User Behavior Analytics in Exhibit A - "Detection of anomalous user behavior indicative of insider threats or data breaches." Q) Please disclose the data sources (Size, format, etc) that will be used for the User Behavior Analytics. Already answered Point 1 under "Integration and Scalability Analytics" in Exhibit A Q) What is the current architecture in place? Already Answered Point 4 under Evaluation Criteria - "Compliance with the specified requirements and scope of work" Q) Could the bidder please provide the expected amount for the RFQ? Already Answered Q) Does the vendor have to create a data warehouse to transform the data for the required feature? I do not know your proposed solution and it’s requirements, so I can’t answer this question. Q) Can work for this project be done outside of U.S territory? No Q) Can the project be carried out onsite or offsite? Depends on the solution proposed. Q) Could you please disclose what software licenses the bidder has in place? I am not the bidder I can not answer what license you have in place. Any preferences? N/A Q) Please elaborate on what security measures are expected from the vendor? Follow NIST and CISA standards Q) What resources are expected to be provided by the vendor for this project? Whatever is needed for deployment Q) Is the bidder open to the inclusion of maintenance within the proposal? I am not the bidder so I do not know if you are open to this.

Posted: 6/12/2024

Question: Due to the short turnaround time between the Q&A and RFP submittal deadline, is it possible to extend the RFQ due date by 1 week? Many of the answers to the questions need to be factored into the pricing model.

Response: No

Posted: 6/12/2024

Question: Dear Whitfield county Schools We are seeking detailed proposals for a comprehensive data governance program. In order to ensure that your proposal aligns with our requirements, please provide detailed responses to the queries listed below. We appreciate your thoroughness and adherence to our format guidelines to facilitate our review process. Documentation Specifications * What are the required formats for the deliverables related to this RFQ? * Are there any specific font type, font size, or page layout requirements for the submission of reports and other documentation? Systems Overview * Could you provide a list of all existing systems that will be included under the Data Governance program? * What technologies and platforms are these systems currently built on? Data Volume and System Usage * For each system mentioned, what is the current volume of records or the overall database size? * Approximately how many users access each of these systems regularly? * What has been the historical annual growth rate in data volume for these systems over the past 3-5 years? Projected Growth * What is the anticipated percentage increase in the size of each system's data over the next year? Over the next five years? * What is the expected percentage growth in the user base for each system over the same periods? Cloud Infrastructure and Preferences * Does your organization currently utilize any cloud infrastructure for data storage or processing? * If so, who are your current cloud service providers, and what services are they providing? * Does your organization have a preference for any particular cloud service provider or technology for future implementations?

Response: Documentation Specifications * What are the required formats for the deliverables related to this RFQ? PDF * Are there any specific font type, font size, or page layout requirements for the submission of reports and other documentation? No Systems Overview * Could you provide a list of all existing systems that will be included under the Data Governance program? Already Answered * What technologies and platforms are these systems currently built on? N/A Data Volume and System Usage * For each system mentioned, what is the current volume of records or the overall database size? Already Answered * Approximately how many users access each of these systems regularly? 15000 * What has been the historical annual growth rate in data volume for these systems over the past 3-5 years? Already Answered Projected Growth * What is the anticipated percentage increase in the size of each system's data over the next year? Already Answered Over the next five years? * What is the expected percentage growth in the user base for each system over the same periods? less than 2% Cloud Infrastructure and Preferences * Does your organization currently utilize any cloud infrastructure for data storage or processing? Already Answered * If so, who are your current cloud service providers, and what services are they providing?Already Answered * Does your organization have a preference for any particular cloud service provider or technology for future implementations? Must be in the US.