1-CACVAT Template.xlsx

XLSX spreadsheet 562 KB Posted Jul 10, 2026

Attached to: Transportation Stipend Card Management Services
Solicitation number: 2017
Issued by: Alexandria City, Virginia

About this file

Written by GovTribe AI · Jul 16, 2026

This file is the City of Alexandria Cloud Vendor Assessment Tool (CACVAT), a security evaluation template designed for vendors providing software and services to the City of Alexandria, Virginia. The tool is intended for third-party security assessments and is not to be completed by City entities. Vendors interested in providing products or services that access or host City data are required to complete this comprehensive assessment, which will be reviewed by City security analysts to prevent data breaches and ensure compliance with City policy and local, state, and federal law. The assessment is structured in multiple sections including General Information, Documentation, Company Overview, and detailed safeguards categories, with vendors required to complete the form in a specified order to ensure all necessary questions are answered appropriately.

The CACVAT template addresses critical security dimensions including authentication and authorization, application and service security, business continuity planning, change management, data protection, database security, datacenter specifications, disaster recovery planning, firewall and networking controls, physical security, policies and procedures, systems management, and vulnerability scanning. Vendors must provide detailed information about their security frameworks, certifications (such as SSAE 16/18, CSA STAR, ISO 27001, NIST SP 800-53, and FISMA compliance), organizational structure, customer references, litigation history, incident response capabilities, encryption practices, data segregation, backup and media handling procedures, and business continuity and disaster recovery plans. The tool includes a Standards Crosswalk section that maps assessment questions to CIS Critical Security Controls, HIPAA, ISO 27002:2013, NIST Cybersecurity Framework, NIST SP 800-171, and NIST SP 800-53 requirements, ensuring vendors are evaluated against recognized industry standards and federal security guidance.

View the file

Other files

File	Type	Posted
10-Part D - General Terms Conditions Final.pdf	PDF	Jul 10, 2026
8-RFP 2017 Cost Proposal Template.xlsx	XLSX spreadsheet	Jul 10, 2026
3-Part H - Exhibit H - Information Technology - Final.docx	DOCX document	Jul 10, 2026
9-Part C - Special Terms and Conditions Final.pdf	PDF	Jul 10, 2026
11-Part G - Attachment A - Authorized Signatory Statement.pdf	PDF	Jul 10, 2026
4-Part E - RFP Instructions to Offerors Final.pdf	PDF	Jul 10, 2026
12-Part G - Attachment B - Required Information Form.pdf	PDF	Jul 10, 2026
6-Part B - RFP Scope of Work Final.pdf	PDF	Jul 10, 2026
2-Part H - Exhibit A - Definitions - Final.docx	DOCX document	Jul 10, 2026
14-Part G - Attachment D - Reference Sheet.pdf	PDF	Jul 10, 2026
5-Part F - RFP Evaluation and Method of Award Final.pdf	PDF	Jul 10, 2026
7-Part A - RFP General Information Final.pdf	PDF	Jul 10, 2026
15-Part G - Attachment E - Subcontractor List.pdf	PDF	Jul 10, 2026
16-Part G - Attachment F - No Response Form.pdf	PDF	Jul 10, 2026
13-Part G - Attachment C - Certifications.pdf	PDF	Jul 10, 2026

Show all 15

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Instructions City Of Alexandria Cloud Vendor Assessment Tool

Target Audience
These instructions are for vendors interested in providing the City of Alexandria, VA (CoA) with a software and/or a service. This worksheet should not be completed by a CoA entity. The purpose of this worksheet is for the vendor to submit robust security safeguard information in regards to the product (software/service) being assessed in the CoA's assessment process.
Document Layout
There are five main sections of the Assessment Tool, all listed below and outlined in more detail. This document is designed to have the first two sections populated first; after the Qualifiers section is completed it can be populated in any order. Within each section, answer each question top-to-bottom. Some questions are nested and may be blocked out via formatting based on previous answers. Populating this document in the correct order will ensure that questions are not answered unnecessarily.
General Information	This section is self-explanatory; product specifics and contact information. GNRL-01 through GNRL-06 should be populated by a CoA entity. GNRL-07 through GNRL-14 should be populated by the Vendor. GNRL-15 and GNRL-16 are for internal use only.
Documentation	Focused on external documentation, CoA is interested in the frameworks that lead your security strategy and what has been done to certify these implementations.
Company Overview	This section is focused on company background, size, and business area experience.
Safeguards	The remainder of the document consists of various safeguards grouped generally by section.
In sections where vendor input is required there are only one or two columns that need modification, Vendor Answers and Additional Information, columns C and D respectively (see Figure 1 below). You will see that sometimes C and D are separate and other times are merged. If they are separate, C will be a selectable, drop-down box and any supporting information should be added to column D. If C and D are merged, the question is looking for the answer to be in narrative form. At the far right is a column titled “Guidance”. After answering questions, check this column to ensure you have submitted information/documentation to sufficiently answer the question. Use the “Additional Information” column to provide any requested details.
Figure 1:
Proceed to the next tab, CACVAT - Lite, to begin.

CACVAT - Lite

City Of Alexandria Cloud Vendor Assessment Tool - Lite				Version 2018.07
HEISC Shared Assessments Working Group
DATE-01	Date
General Information
In order to protect the City and its systems, vendors whose products and/or services will access and/or host CoA data must complete the City of Alexandria Cloud Vendor Assessment Tool. Throughout this tool, anywhere where the term data is used, this is an all-encompassing term including at least data and metadata. Answers will be reviewed by CoA security analysts upon submittal. This process will assist the City in preventing breaches of protected information and comply with CoA policy, and local, state, and federal law. This is intended for use by vendors participating in a Third Party Security Assessment and should be completed by a vendor.
GNRL-01 through GNRL-06; populated by CoA
GNRL-01	CoA Department	CoA Department
GNRL-02	CoA Department Primary Location	Primary Location
GNRL-03	CoA Department Code	CoA Department Code
GNRL-04	CoA Department Contact Name	CoA Department Contact Name
GNRL-05	CoA Department Contact Email	CoA Department Contact Email
GNRL-06	CoA Department Contact Phone Number	555-555-5555
GNRL-07 through GNRL-14; populated by Vendor
GNRL-07	Vendor Name	Vendor Name
GNRL-08	Product Name	Product Name and Version Information
GNRL-09	Product Description	Please include a brief description of the product
GNRL-10	Web Link to Product Privacy Notice	http://www.vendor.domain/privacynotice
GNRL-11	Vendor Contact Name	Vendor Contact Name
GNRL-12	Vendor Contact Title	Vendor Contact Title
GNRL-13	Vendor Contact Email	Vendor Contact E-mail Address
GNRL-14	Vendor Contact Phone Number	555-555-5555
GNRL-15 and GNRL-16; populated by CoA Security Office
GNRL-15	CoA Security Analyst/Engineer	CoA Security Analyst/Engineer Name
GNRL-16	Assessment Contact	<email>@alexandriava.gov
Instructions
Step 1: Complete each section answering each set of questions in order from top to bottom; the built-in formatting logic relies on this order. Step 2: Submit the completed City of Alexandria Cloud Vendor Assessment Tool - Lite to the City according to CoA submission procedures.
Documentation		Vendor Answers	Additional Information	Guidance
DOCU-01	Have you undergone a SSAE 16 or 18 audit?

Microsoft Office User: In 2011, Statement on Standards for Attestation Engagements (SSAE) No. 16 took effect and replaced SAS 70 as the authoritative guidance for performing a service auditor's examination. SSAE 16 established a new attestation standard (AT 801) to contain the professional guidance.

You can learn more about SSAE 16 at www.ssae16.com.

DOCU-02 Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ?

Microsoft Office User: CSA STAR Self Assessment is free and open to all cloud providers and allows them to submit self assessment reports that document compliance to CSA-published best practices.

Website: https://cloudsecurityalliance.org/star/self-assessment/ DOCU-03 Have you received the Cloud Security Alliance STAR certification?

Microsoft Office User: The CSA STAR Certification is a rigorous third party independent assessment of the security of a cloud service provider. The technology-neutral certification leverages the requirements of the ISO/IEC 27001 management system standard together with the CSA Cloud Controls Matrix, a specified set of criteria that measures the capability levels of the cloud service.

Website: https://cloudsecurityalliance.org/star/certification/

DOCU-04	Do you conform with a specific industry standard security framework? (e.g. NIST Special Publication 800-53, ISO 27001, etc.)
DOCU-05	Are you compliant with FISMA standards (indicate at what level)?

Microsoft Office User: The Federal Information Security Management Act (FISMA) is United States legislation that defines a comprehensive framework to protect government information, operations and assets against natural or man-made threats.

Website: http://www.dhs.gov/FISMA Microsoft Office User: In 2011, Statement on Standards for Attestation Engagements (SSAE) No. 16 took effect and replaced SAS 70 as the authoritative guidance for performing a service auditor's examination. SSAE 16 established a new attestation standard (AT 801) to contain the professional guidance.

You can learn more about SSAE 16 at www.ssae16.com.

Microsoft Office User: CSA STAR Self Assessment is free and open to all cloud providers and allows them to submit self assessment reports that document compliance to CSA-published best practices.

Website: https://cloudsecurityalliance.org/star/self-assessment/ Microsoft Office User: The CSA STAR Certification is a rigorous third party independent assessment of the security of a cloud service provider. The technology-neutral certification leverages the requirements of the ISO/IEC 27001 management system standard together with the CSA Cloud Controls Matrix, a specified set of criteria that measures the capability levels of the cloud service.

Website: https://cloudsecurityalliance.org/star/certification/

DOCU-06	Does your organization have a data privacy policy?
Company Overview		Vendor Answers	Additional Information	Guidance
COMP-01	Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships.
COMP-02	Describe how long your organization has conducted business in this product area.
COMP-03	How many higher education, commercial customers and government customers do you serve in North America? Please provide a government customer reference if available.
COMP-04	Please explain in detail any involvement in business-related litigation in the last five years by your organization, its management, or the staff that will be providing the administrative services.
COMP-05	Describe the structure and size of your Security Office and overall information security staff. (e.g. Admin, Engineering, QA/Compliance, etc.)
COMP-06	Describe the structure and size of your Software and System Development teams. (e.g. Customer Support, Implementation, Product Management, etc.)
COMP-07	Use this area to share information about your environment that will assist those who are evaluating you company data security safeguards.
Application/Service Security		Vendor Answers	Additional Information	Guidance
HLAP-01	Can user access be customized to allow read-only access, update access, or no-access to specific types of records, record attributes, components, or functions?				APPL-04
HLAP-02	Describe or provide a reference to how user security administration is performed?				APPL-05
HLAP-03	Describe or provide a reference to the controls that are in place to secure any remote environments and connections to the City's data.				APPL-08
HLAP-04	Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system?				APPL-12
HLAP-05	Does the system provide data input validation and error messages?				APPL-20
HLAP-06	Do you employ a single-tenant or multi-tenant environment?				APPL-21
Authentication, Authorization, and Accounting		Vendor Answers	Additional Information	Guidance
HLAA-01	Can you enforce password/passphrase complexity requirements [provided by the customer]?				AAAI-02
HLAA-02	Describe or provide a reference to the types of authentication, including standards-based single-sign-on (SSO, InCommon), that are supported by the web-based interface?				AAAI-05
HLAA-03	Describe or provide a reference to the authentication and authorization systems such as Active Directory, Kerberos (what version) or a City-centralized authorization service that work with your application.				AAAI-12
HLAA-04	Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication?				AAAI-14
HLAA-05	Does your system have the capability to log security/authorization changes as well as user and administrator security (physical or electronic) events (e.g., login failures, access denied, changes accepted), and all requirements necessary to implement logging and monitoring on the system. Include information about SIEM/log collector usage.				AAAI-18
Business Continuity Plan		Vendor Answers	Additional Information	Guidance
HLBC-01	Do you have a documented Business Continuity Plan (BCP)? If so, can it be shared?				BCPL-01
HLBC-02	Is there a documented communication plan in your BCP for impacted clients?				BCPL-05
HLBC-03	Are all components of the BCP reviewed at least annually and updated as needed to reflect change?				BCPL-06
HLBC-04	Does your organization conduct an annual test of relocating to this alternate site for business recovery purposes?				BCPL-11
Change Management		Vendor Answers	Additional Information	Guidance
HLCH-01	Do you have a Change Management Plan? If so, can it be shared?				CHNG-02
HLCH-02	How and when will the City be notified of major changes to your environment that could impact our security posture?				CHNG-03
HLCH-03	Do you have documented procedures on how security risks are mitigated until patches can be applied? If so, can it be shared?				CHNG-13
HLCH-04	Do procedures exist to provide that emergency changes are documented and authorized (including after the fact approval)? If so, can it be shared?				CHNG-15
Data		Vendor Answers	Additional Information	Guidance
HLDA-01	Is CoA data physically and logically separated from that of other customers.				DATA-02
HLDA-02	Is sensitive data encrypted in transport and storage (e.g. disk encryption and at-rest)?				DATA-04
HLDA-03	Do backups containing customer data ever leave the United States of America either physically or via network routing?				DATA-25
HLDA-04	Describe or provide a reference to your media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures.				DATA-26
HLDA-05	Is any customer data visible in system administration modules/tools?				DATA-31
Database		Vendor Answers	Additional Information	Guidance
HLDB-01	Does the database support encryption of specified data elements in storage?				DBAS-01
HLDB-02	Do you currently use encryption in your database?				DBAS-02
Datacenter		Vendor Answers	Additional Information	Guidance
HLDC-01	List all datacenters and their cities, states (provinces), and countries where City data will be stored (including within the United States). Does your company own these data centers?				DCTR-10
HLDC-02	Does your company own the physical data center where City data will reside? If so, do these servers reside in a co-located data center?				DCTR-01
HLDC-03	Does the hosting provider have a SOC 2 Type 2 report available?				DCTR-02
HLDC-04	Does the physical barrier fully enclose the physical space preventing unauthorized physical contact with any of your devices?				DCTR-06
Disaster Recovery Plan		Vendor Answers	Additional Information	Guidance
HLDR-01	Do you have a Disaster Recovery Plan (DRP)? If so, can it be shared?				DRPL-01
HLDR-02	Are any disaster recovery locations outside the United States? If so, please provide the locations.				DRPL-04
HLDR-03	Are all components of the DRP reviewed at least annually and updated as needed to reflect change?				DRPL-13
Firewalls, IDS, IPS, and Networking		Vendor Answers	Additional Information	Guidance
HLFI-01	Are you utilizing a web application firewall (WAF) and / or a stateful packet inspection (SPI) firewall?				FIDP-01
HLFI-02	Do you have a documented policy for firewall change requests? If so, can it be shared?				FIDP-04
HLFI-03	Describe or provide a reference to any other safeguards used to monitor for attacks?				FIDP-09
HLFI-04	Do you monitor for intrusions on a 24x7x365 basis?				FIDP-10
Physical Security		Vendor Answers	Additional Information	Guidance
HLPH-01	Does your organization have physical security controls and policies in place? If so, can it be shared?				PHYS-01
HLPH-02	Are employees allowed to take home customer data in any form?				PHYS-02
Policies, Procedures, and Processes		Vendor Answers	Additional Information	Guidance
HLPP-01	Can you share the org chart, mission statement and policies for your information security unit?				PPPR-01
HLPP-02	Are information security principles designed into the product and / or SDLC lifecycle?				PPPR-08
HLPP-03	Do you have a formal incident response plan? If so, can it be shared?				PPPR-11
HLPP-04	Do you have a documented information security policy? If so, can it be shared?				PPPR-18
Systems Management & Configuration		Vendor Answers	Additional Information	Guidance
HLSY-01	Are systems that support this service managed via a separate management network?				SYST-01
HLSY-02	Can you provide a general summary of your systems management and configuration strategy, including servers, appliances, and mobile devices (company and employee owned).				SYST-04
Vulnerability Scanning		Vendor Answers	Additional Information	Guidance
HLVU-01	Have your systems and applications had a third party security assessment completed in the last year? If so, can the results be provided?				VULN-02
HLVU-02	Are your applications scanned for vulnerabilities prior to new releases? If so, can the results be provided?				VULN-03

&"Helvetica,Regular"&12&K000000 &P

Standards Crosswalk

City Of Alexandria Cloud Vendor Assessment Tool - Lite - Standards Crosswalk							Version beta1.06b
CACVAT Shared Assessments Working Group
Documentation		CIS Critical Security Controls v6.1	HIPAA	ISO 27002:2013	NIST Cybersecurity Framework	NIST SP 800-171r1	NIST SP 800-53r4
DOCU-01	Have you undergone a SSAE 16 or 18 audit?

You can learn more about SSAE 16 at www.ssae16.com.			15.2.1	SA-9
	DOCU-02	Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ?

Microsoft Office User: CSA STAR Self Assessment is free and open to all cloud providers and allows them to submit self assessment reports that document compliance to CSA-published best practices.

Website: https://cloudsecurityalliance.org/star/self-assessment/			15.2.1	PE-2, PE-3, PE-5, PE-11, PE-13, PE-14, SA-9
	DOCU-03	Have you received the Cloud Security Alliance STAR certification?

Website: https://cloudsecurityalliance.org/star/certification/			15.2.1		PE-2, PE-3, PE-5, PE-11, PE-13, PE-14, SA-9
	DOCU-04	Do you conform with a specific industry standard security framework? (e.g. NIST Special Publication 800-53, ISO 27001, etc.)		18.1.1		SA-9
	DOCU-05	Are you compliant with FISMA standards (indicate at what level)?

Website: http://www.dhs.gov/FISMA			18.1.1			SA-9
	DOCU-06	Does your organization have a data privacy policy?		§164.308(a)(1)(i)	18.1.4	ID.GV-3	ID.GV-3	SA-9
	Company Overview		CIS Critical Security Controls v6.1	HIPAA	ISO 27002:2013	NIST Cybersecurity Framework	NIST SP 800-171r1	NIST SP 800-53r4
	COMP-01	Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships.
	COMP-02	Describe how long your organization has conducted business in this product area.
	COMP-03	How many higher education, commercial customers and government customers do you serve in North America? Please provide a government customer reference if available.			15.2.1
	COMP-04	Please explain in detail any involvement in business-related litigation in the last five years by your organization, its management, or the staff that will be providing the administrative services.			15.2.2
	COMP-05	Describe the structure and size of your Security Office and overall information security staff. (e.g. Admin, Engineering, QA/Compliance, etc.)			15.2.1
	COMP-06	Describe the structure and size of your Software and System Development teams. (e.g. Customer Support, Implementation, Product Management, etc.)			14.2.1			SA-3, SA-15, SC-2, PM-2, PM-10, SI-5,PM-3
	COMP-07	Use this area to share information about your environment that will assist those who are evaluating you company data security safeguards.			15.2.1
	Application/Service Security		CIS Critical Security Controls v6.1	HIPAA	ISO 27002:2013	NIST Cybersecurity Framework	NIST SP 800-171r1	NIST SP 800-53r4
	HLAP-01	Can user access be customized to allow read-only access, update access, or no-access to specific types of records, record attributes, components, or functions?	CSC 14		9.2.2	PR.AC-4	3.1.1, 3.1.2, 3.1.7	AC-2, AC-3, AC-6	APPL-03
	HLAP-02	Describe or provide a reference to how user security administration is performed?	CSC16		9.1.1	PR.AC-4, PR.PT-3	3.4.9	CM-11	APPL-04
	HLAP-03	Describe or provide a reference to the controls that are in place to secure any remote environments and connections to the City's data.	CSC 12		6.2	PR.PT-3	3.1.12, 3.1.13, 3.1.14, 3.1.14, 3.1.15, 3.1.8, 3.1.20, 3.7.5, 3.8.2, 3.13.7	AC-3, CM-7; NIST SP 800-46	APPL-07
	HLAP-04	Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system?	CSC 2		12.1.1	ID.AM-1, ID.AM-2, ID.AM-4		CA-9, SC-4	APPL-11
	HLAP-05	Does the system provide data input validation and error messages?	CSC 16		14.2.5	PR.DS-6			APPL-18
	HLAP-06	Do you employ a single-tenant or multi-tenant environment?	CSC 12		14.2.5			RA-2	APPL-19
	Authentication, Authorization, and Accounting		CIS Critical Security Controls v6.1	HIPAA	ISO 27002:2013	NIST Cybersecurity Framework	NIST SP 800-171r1	NIST SP 800-53r4
	HLAA-01	Can you enforce password/passphrase complexity requirements [provided by the customer]?	CSC 16		9.2.3, 9.3.1, 9.4.3	PR.AC-1	3.5.7	IA-5(1)	AAAI-02
	HLAA-02	Describe or provide a reference to the types of authentication, including standards-based single-sign-on (SSO, InCommon), that are supported by the web-based interface?	CSC 16		9.1.1, 9.2.3, 9.3.1, 9.4.3	PR.AC-1	3.5.1	IA-2, IA-5	AAAI-05
	HLAA-03	Describe or provide a reference to the authentication and authorization systems such as Active Directory, Kerberos (what version) or a City-centralized authorization service that work with your application.	CSC 16		9.4.3	PR.AC-1, PR.AC-4			AAAI-12
	HLAA-04	Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication?	CSC 16		9.4.3	PR.AC-1, PR.AC-4			AAAI-14
	HLAA-05	Does your system have the capability to log security/authorization changes as well as user and administrator security (physical or electronic) events (e.g., login failures, access denied, changes accepted), and all requirements necessary to implement logging and monitoring on the system. Include information about SIEM/log collector usage.	CSC 6		12.4	PR.PT-1	3.1.7, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.4.3, 3.7.1, 3.7.6, 3.10.4, 3.10.5	AU-2(3), AU-6, AU-12, AC-6(9), CM-3, MA-2, MA-5, PE-3	AAAI-18
	Business Continuity Plan		CIS Critical Security Controls v6.1	HIPAA	ISO 27002:2013	NIST Cybersecurity Framework	NIST SP 800-171r1	NIST SP 800-53r4
	HLBC-01	Do you have a documented Business Continuity Plan (BCP)? If so, can it be shared?	CSC 10		17.1.1	PR.IP-9	3.12.2	AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34	BCPL-01
	HLBC-02	Is there a documented communication plan in your BCP for impacted clients?	CSC 10		17.1.2	PR.IP-9	3.12.2	AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34	BCPL-05
	HLBC-03	Are all components of the BCP reviewed at least annually and updated as needed to reflect change?	CSC 10		17.1.2	PR.IP-9	3.12.2	AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34	BCPL-06
	HLBC-04	Does your organization conduct an annual test of relocating to this alternate site for business recovery purposes?	CSC 10		17.1.3	PR.IP-9		AC-5, CP-4, CP-10; NIST SP 800-34	BCPL-11
	Change Management		CIS Critical Security Controls v6.1	HIPAA	ISO 27002:2013	NIST Cybersecurity Framework	NIST SP 800-171r1	NIST SP 800-53r4
	HLCH-01	Do you have a Change Management Plan? If so, can it be shared?	CSC 10		12.1.2	PR.IP-3	3.4.3, 3.4.4	CM-3, CM-4, CM-5	CHNG-01
	HLCH-02	How and when will the City be notified of major changes to your environment that could impact our security posture?	CSC 10		12.1.2			CM-3, CM-4, CM-5	CHNG-03
	HLCH-03	Do you have documented procedures on how security risks are mitigated until patches can be applied? If so, can it be shared?	CSC 13	§164.308(a)(1)(ii)(B)	12.6.1			CM-3, CM-4, CM-5	CHNG-13
	HLCH-04	Do procedures exist to provide that emergency changes are documented and authorized (including after the fact approval)? If so, can it be shared?	CSC 10		12.1.2	PR.IP-3		CM-3, CM-4, CM-5	CHNG-15
	Data		CIS Critical Security Controls v6.1	HIPAA	ISO 27002:2013	NIST Cybersecurity Framework	NIST SP 800-171r1	NIST SP 800-53r4
	HLDA-01	Is CoA data physically and logically separated from that of other customers.	CSC 12			PR.AC-2, PR.IP-5	3.1.3, 3.8.1	AC-4, MP-2, MP-4	DATA-02
	HLDA-02	Is sensitive data encrypted in transport and storage (e.g. disk encryption and at-rest)?	CSC 13		8.2.3, 10.1.1	PR.DS-1, PR.DS-2	3.1.19, 3.8.1	MP-2, AC-19(5)	DATA-04
	HLDA-03	Do backups containing customer data ever leave the United States of America either physically or via network routing?	CSC 13		12.3.1		3.8.9	CP-9, MP-5	DATA-25
	HLDA-04	Describe or provide a reference to your media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures.	CSC 13		8.3.1	PR.DS-3	3.7.1, 3.7.2, 3.8.3	CP-9 MP-6, NIST SP 800-60, NIST SP 800-88, AC-2, AC-6, IA-4, PM-2, PM-10, SI-5, MA-2, MA-3, MP-6	DATA-26
	HLDA-05	Is any customer data visible in system administration modules/tools?	CSC 13, CSC 14		14.2.5	PR.AC-4			DATA-31
	Database		CIS Critical Security Controls v6.1	HIPAA	ISO 27002:2013	NIST Cybersecurity Framework	NIST SP 800-171r1	NIST SP 800-53r4
	HLDB-01	Does the database support encryption of specified data elements in storage?	CSC 13		10.1.1	PR.DS-1			DBAS-01
	HLDB-02	Do you currently use encryption in your database?	CSC 13		10.1.1	PR.DS-1, PR.DS-2			DBAS-02
	Datacenter		CIS Critical Security Controls v6.1	HIPAA	ISO 27002:2013	NIST Cybersecurity Framework	NIST SP 800-171r1	NIST SP 800-53r4
	HLDC-01	List all datacenters and their cities, states (provinces), and countries where City data will be stored (including within the United States). Does your company own these data centers?	CSC 12		11.2.1				DCTR-10
	HLDC-02	Does your company own the physical data center where City data will reside? If so, do these servers reside in a co-located data center?	CSC 14		11.1.1	PR.AC-2, PR.IP-5			DCTR-01
	HLDC-03	Does the hosting provider have a SOC 2 Type 2 report available?	CSC 13		11.1.1				DCTR-02
	HLDC-04	Does the physical barrier fully enclose the physical space preventing unauthorized physical contact with any of your devices?	CSC 14		11.1.1, 11.1.2	PR.AC-2	3.8.1, 3.8.2		DCTR-06
	Disaster Recovery Plan		CIS Critical Security Controls v6.1	HIPAA	ISO 27002:2013	NIST Cybersecurity Framework	NIST SP 800-171r1	NIST SP 800-53r4
	HLDR-01	Do you have a Disaster Recovery Plan (DRP)? If so, can it be shared?	CSC 10		17.1.1	PR.IP-9	3.12.2	AC-5, CP-4, CP-10
NIST SP 800-34	DRPL-01
	HLDR-02	Are any disaster recovery locations outside the United States? If so, please provide the locations.	CSC 10, CSC 12		17.1.1	PR.IP-9		AC-5, CP-4, CP-10
NIST SP 800-34	DRPL-04
	HLDR-03	Are all components of the DRP reviewed at least annually and updated as needed to reflect change?	CSC 10		17.1.1	PR.IP-9	3.12.2	AC-5, CP-4, CP-10
NIST SP 800-34	DRPL-13
	Firewalls, IDS, IPS, and Networking		CIS Critical Security Controls v6.1	HIPAA	ISO 27002:2013	NIST Cybersecurity Framework	NIST SP 800-171r1	NIST SP 800-53r4
	HLFI-01	Are you utilizing a web application firewall (WAF) and / or a stateful packet inspection (SPI) firewall?	CSC 9		13.1.1	PR.DS-5			FIDP-01
	HLFI-02	Do you have a documented policy for firewall change requests? If so, can it be shared?	CSC 9		12.1.2	PR.AC-5			FIDP-04
	HLFI-03	Describe or provide a reference to any other safeguards used to monitor for attacks?	CSC 19		12.4.1		3.6.1, 3.14.6, 3.14.7	IR-2, IR-4, IR-9	FIDP-09
	HLFI-04	Do you monitor for intrusions on a 24x7x365 basis?	CSC 19		12.4.1	DE.CM-1, DE.CM-2, DE.CM-7	3.6.1, 3.14.6, 3.14.7	IR-2, IR-4, IR-10	FIDP-10
	Physical Security		CIS Critical Security Controls v6.1	HIPAA	ISO 27002:2013	NIST Cybersecurity Framework	NIST SP 800-171r1	NIST SP 800-53r4
	HLPH-01	Does your organization have physical security controls and policies in place? If so, can it be shared?	CSC 3		11.1.1	PR.AC-2, PR.AT-5, PR.IP-5, DE.CM-2	3.8.2, 3.10.1, 3.10.2, 3.10.5, 3.10.6, 3.12.1	MP-4, PE-2, PE-5, PE-6, PE-17	PHYS-01
	HLPH-02	Are employees allowed to take home customer data in any form?	CSC 13		8.2.3	PR.AC-2, PR.AC-4, PR.DS-1, PR.DS-3, PR.DS-5	3.8.1, 3.8.5, 3.8.7	MP-2, MP-5, MP-7	PHYS-02
	Policies, Procedures, and Processes		CIS Critical Security Controls v6.1	HIPAA	ISO 27002:2013	NIST Cybersecurity Framework	NIST SP 800-171r1	NIST SP 800-53r4
	HLPP-01	Can you share the org chart, mission statement and policies for your information security unit?			5.1.1	ID.GV-2	3.9.1, 3.9.2	PM-2, PM-10, SI-5, CA-5, PM-1	PPPR-01
	HLPP-02	Are information security principles designed into the product and / or SDLC lifecycle?	CSC 4		14.2.1	PR.IP-2	3.13.2	CA-5, CM-3, PM-1, SA-15, SA-3, SA-8, SC-2	PPPR-08
	HLPP-03	Do you have a formal incident response plan? If so, can it be shared?	CSC 19		16.1.5	PR.IP-9	3.6.1, 3.12.2	CA-5, PM-1, IR-4, IR-5, IR-7, IR-8	PPPR-11
	HLPP-04	Do you have a documented information security policy? If so, can it be shared?	CSC 17	§164.308(a)(1)(i)	5.1.1	ID.GV-3		CA-5, PM-1	PPPR-18
	Systems Management & Configuration		CIS Critical Security Controls v6.1	HIPAA	ISO 27002:2013	NIST Cybersecurity Framework	NIST SP 800-171r1	NIST SP 800-53r4
	HLSY-01	Are systems that support this service managed via a separate management network?	CSC 12		13.1.1	PR.PT-4	3.1.3	AC-4	SYST-01
	HLSY-02	Can you provide a general summary of your systems management and configuration strategy, including servers, appliances, and mobile devices (company and employee owned).	CSC 3		12.1.1	PR.IP-1, PR.IP-2	3.1.18, 3.7.1, 3.13.13	CM-2, CM-6, CM-3, AC-19, MA-2	SYST-04
	Vulnerability Scanning		CIS Critical Security Controls v6.1	HIPAA	ISO 27002:2013	NIST Cybersecurity Framework	NIST SP 800-171r1	NIST SP 800-53r4
	HLVU-01	Have your systems and applications had a third party security assessment completed in the last year? If so, can the results be provided?	CSC 4		12.6.1	DE.CM-8	3.11.1, 3.11.2, 3.11.3	SI-2	VULN-02
	HLVU-02	Are your applications scanned for vulnerabilities prior to new releases? If so, can the results be provided?	CSC 4			DE.CM-8	3.11.1, 3.11.2, 3.11.3	SI-2	VULN-03

&"Helvetica,Regular"&12&K000000 &P

Credits

This evaluation is based off of the HECVAT (Higher Education Cloud Assessment Tool), with modifications to fit the needs of the City of Alexandria. Credits are below, under a Creative Commons Attribution-Noncommercial-ShareAlike 4.0 International License (CC BY-NC-SA 4.0).

Acknowledgments

The Higher Education Information Security Council Shared Assessments Working Group contributed their vision and significant talents to the conception, creation, and completion of this resource.

Members that contributed to Phase II (2017) of this effort are:

•Jon Allen, Baylor University

•Samantha Birk, IMS Global Learning Consortium

•Jeff Bohrer, IMS Global Learning Consortium

•Sarah Braun, University of Colorado - Denver

•David Cassada, University of California - Davis

•Matthew Dalton, University of Massachusetts Amherst

•Charles Escue, Indiana University

•Joanna Grama, EDUCAUSE

•Todd Herring, REN-ISAC

•Kolin Hodgson, University of Notre Dame

•Tom Horton, Cornell University

•Leo Howell, North Carolina State University

•Alex Jalso, West Virginia University

•Nick Lewis, Internet2

•Wyman Miles, Cornell University

•Kim Milford, REN-ISAC

•Valerie Vogel, EDUCAUSE

Members that contributed to Phase I (2016) of this effort are:

•Jon Allen, Baylor University

•John Bruggeman, Hebrew Union College, Jewish Institute of Religion

•Charles Escue, Indiana University

•Joanna Grama, EDUCAUSE

•Karl Hassler, University of Delaware

•Todd Herring, REN-ISAC

•Nick Lewis, Internet2

•Kim Milford, REN-ISAC

•Craig Munson, Minnesota State Colleges & Universities

•Mitch Parks, University of Idaho

•Laura Raderman, Carnegie Mellon University

•Valerie Vogel, EDUCAUSE

ChangeLog

Version	Date	Description of Change
v0.6	8/4/16	Merged initial comments and suggestions of sub-group members.
v0.7	8/14/16	Completed base formulas for all Guidance fields. Changed Qualifer formatting to make questions readable (and optional).
v0.8	8/15/16	Added SOC2T2 question to datacenter section.
v0.9	8/16/16	Added Systems and Configuration Management section, added MDM, sep. management networks, system configuration images, Internal audit processes and procedures.
v0.91	8/24/16	Added input from WG meeting on 8/22, removed RiskMgmt section, added question ID's, and removed dup network question.
v0.92	8/25/16	Added Introduction, Sharing Read Me, and Acknowledgements tabs and content. Also updated report specifics in Documentation.
v0.93	8/26/16	Integrated grammatical corrections set by Karl, fixed a minor formula error in a guidance cell.
v0.94	8/26/16	Added Instructions tab, adjusted question ID background color, updated DRP/BCP copy error.
v0.95	9/21/16	Changed document title to HECVAT. Integrated KDH input.
v0.96	9/23/16	Added input from NL, 36 modifications across all sections.
v0.97	9/26/16	Updated Sharing Read Me tab with final language and options table.
v0.98	10/6/16	Sharing Confirmation section added, updated instructions, updated Sharing Read Me tab, fixed a ton of conditional formatting issues.
v1.00	10/17/16	Finalized for distribution.
v1.01	11/16/16	Corrections for grammar, conditional formatting, and question clarification.
v1.02	11/21/16	Added tertiary services narrative question (DNS, ISP, etc…).
v1.03	11/23/16	Grammar and spelling cleanup.
v1.06	10/24/17	Added standards crosswalk and Cloud Broker Index (CBI) information, changed HLAP-03, HLAA-02, HLAA-03, and HLDA-04 to freeform text. Changed University mentions to Institution.

Values

Campus

Answers

Yes

N/A

DRPTestingSchedule

Quarterly

Semi-annually

Annually

Other

NetworkTypes

Exclusive VLAN

Shared VLAN

Physically Separate

Flat Shared Network

Other

Consulting

On-premises

Remotely

DR Types

Cold

Hot

Tenants

Single-tenant

Multiple-tenant

SharedAssessmentsConfirmation

Yes; OK to Share

No; Sharing Disallowed

SharedAssessmentListingConfirmation

Yes; OK to List

No; Listing Disallowed

UptimeTiers

Tier I

Tier II

Tier III

Tier IV

N/A

image2.tiff

File details come from the government source that posted it. Updated Jul 16, 2026.