The Commonwealth of Pennsylvania has developed a risk management framework that We understand that the DOR requires a vendor to integrates all Commonwealth monitor and adhere to all changes or additions to security polices and applicable any Commonwealth security policies or federal regulations, i.e. IRS procedure or any changes to any applicable 1075, NIST 800-53, HIPAA federal or state law, statute, rule or regulation Security and Privacy, etc., and including IRS 1075, NIST 800-53, HIPAA has imported this framework Tab - Security and Privacy Rules etc. We understand into a governance, risk and 18 Technical Appendix O.1 that this requires a comprehensive risk compliance (eGRC) Requirements framework which can leverage solution. This eGRC solution governance, risk and compliance (eGRC) solution could be utilized to periodically to periodically assess the solution as well as to assesses the new modernized monitor and incorporate new changes in security integrated tax system as well as regulations. Does DOR expect offeror to integrate monitor and incorporate new with a Commonwealth preferred risk regulatory changes in security solution? regulations. No direct integration with this eGRC solution is anticipated.
18 Tab - Technical Requirements Appendix O.1 We understand that the DOR requires a vendor to monitor and adhere to all changes or additions to any Commonwealth security policies or procedure or any changes to any applicable federal or state law, statute, rule or regulation including IRS 1075, NIST 800-53, HIPAA Security and Privacy Rules etc. We understand that this requires a comprehensive risk framework which can leverage governance, risk and compliance (eGRC) solution to periodically assess the solution as well as to monitor and incorporate new changes in security regulations. Does DOR expect offeror to integrate with a Commonwealth preferred risk regulatory solution? The Commonwealth of Pennsylvania has developed a risk management framework that integrates all Commonwealth security polices and applicable federal regulations, i.e. IRS 1075, NIST 800-53, HIPAA Security and Privacy, etc., and has imported this framework into a governance, risk and compliance (eGRC) solution. This eGRC solution could be utilized to periodically assesses the new modernized integrated tax system as well as monitor and incorporate new changes in security regulations. No direct integration with this eGRC solution is anticipated.
Solicitation_43.docx&OriginalFileName=Questions%20and%20Answers%20Tax%20Modernization.%20rev%20(2.24.17).docx