include in the security contract) exceptions required by ECOS ECOS Work AITR, business under How to Order section; costs agency NA Request 1-004 (for owner/project an hourly rate of $115.50 for VITA SCM SCM Services and manager/ISO consulting services and ongoing monthly ECOS Oversight fee of $900 for ECOS Oversight Service Implementation) Cloud Services Procurement From supplier’s proposal with copy to: May require Terms and lead negotiation; Conditions (with SCM supplier redlines) consultant and Director, ECOS will assist in agency negotiations Exceptions to the Director, From review of the ECOS Assessment To agency AITR/business owner/project manager/ISO who May require ECOS Assessment ECOS responses sent the ECOS Assessment to VITA negotiation Approval assistance from Director, ECOS Exception Approval AITR/business and assigned VITA Security consultant (refer to ITRM NA Request owner/project under Tools and Templates section, 4th Policy SEC519-00, manager/ISO bullet RENEWALS Confirm with that the supplier/SaaS ECOS Assessments are good for 12 months from the date For existing Procurement If in Active cloud/SaaS Lead/ISO/ Oversight, application is in Active Oversight at the rate approved by ECOS unless the supplier/SaaS application contracts project no actions of $900 per month. goes into Active Oversight within those 12 months via the manager are agency-submitted work request 1-004. If they are in Active necessary. Oversight the ECOS Assessment remains good as long as they are in Active Oversight. If the supplier/SaaS application is not in Active Oversight, a If not in new ECOS Assessment must be done via the Active work request 1-003, available for download at: Oversight, a new ECOS under How to Order section Assessment must be
include in the contract) security exceptions required by ECOS ECOS Work Request 1-004 (for SCM Services and ECOS Oversight Service Implementation) AITR, business owner/project manager/ISO under How to Order section; costs agency an hourly rate of $115.50 for VITA SCM consulting services and ongoing monthly fee of $900 for ECOS Oversight NA Cloud Services Terms and Conditions (with supplier redlines) Procurement lead From supplier’s proposal with copy to: May require negotiation; SCM consultant and Director, ECOS will assist in agency negotiations Exceptions to the ECOS Assessment Approval Director, ECOS From review of the ECOS Assessment responses To agency AITR/business owner/project manager/ISO who sent the ECOS Assessment to VITA May require negotiation assistance from Director, ECOS Exception Approval Request AITR/business owner/project manager/ISO under Tools and Templates section, 4th bullet and assigned VITA Security consultant (refer to ITRM Policy SEC519-00, NA RENEWALS For existing cloud/SaaS contracts Procurement Lead/ISO/ project manager Confirm with that the supplier/SaaS application is in Active Oversight at the rate of $900 per month. ECOS Assessments are good for 12 months from the date approved by ECOS unless the supplier/SaaS application goes into Active Oversight within those 12 months via the agency-submitted work request 1-004. If they are in Active Oversight the ECOS Assessment remains good as long as they are in Active Oversight. If the supplier/SaaS application is not in Active Oversight, a new ECOS Assessment must be done via the work request 1-003, available for download at: under How to Order section If in Active Oversight, no actions are necessary. If not in Active Oversight, a new ECOS Assessment must be
ECOSProcedureChecklistforCloudSolutionSolicitationsandContracts20180529.docx