10.3.2 S2377 Cloud Hosting Questionnaire.xlsx
XLSX spreadsheet 22 KB Posted
- Attached to
- Centralized Credentialing
- Solicitation number
- 40DHHS-S2377
- Issued by
- Churchill County, Nevada
About this file
This document is a Cloud Hosting Questionnaire for the Centralized Credentialing RFP issued by the State of Nevada. The questionnaire covers various security and privacy concerns such as data segregation, data-at-rest and data-in-transit protection, vulnerability management, identity management, physical and personnel security, availability, application security, incident response, compliance, business continuity and disaster recovery, logs and audit trails, and legal and contractual issues. The contract opportunity involves the state of Nevada and the jurisdictions of Carson City.
The document requests information on the cloud hosting provider's capabilities to address the state's security and compliance requirements, as well as details on liability, intellectual property, and end-of-service support. The questionnaire does not provide specific details on pricing, set asides, incumbents, funding sources, or other financial information.
View the file
Other files
Show all 25
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Cloud Hosting Checklist
| RFP # | |||
| NV CENTRALIZED CREDENTIALING RFP Attachment xx - Cloud Hosting Questionnaire | |||
| Area | Topic | Specific concerns | Answer |
| Security and Privacy | Data segregation | How will you separate and segregate Nevada's data from other customers' data? | |
| Data-at-rest protection | Where will you store Nevada's data? |
| What encryption algorithms do you use for data-at-rest? |
| What kind of authentication and access control procedures are in place? |
| What documentation is available for auditors? |
Data-in-transit protection How do you get data from Nevada to you?
How do you transfer data from one place to another?
Other data protection What are your data leak prevention capabilities? (if applicable)
| Can any third party (your service providers) access Nevada's data, and if so, how? |
| Can you ensure that all Nevada's data is erased at the end of service? |
| Vulnerability management | Can you show evidence of your vulnerability management program? |
| How often do you scan for vulnerabilities on your network and applications? | |
| Can the State of Nevada conduct an external vulnerability assessment on your network, and if so, how? | |
| What is your vulnerability remediation process? |
| Do you have a third-party perform independent vulnerability and penetration testing? | |
| Identity management | Can you integrate directly with my directories, and if so, how? |
| Review the architecture of integration. Ensure it doesn't create a security risk for my own infrastructure. |
| If you keep your own user accounts: |
| How do you secure user IDs and access credentials? |
| How do you handle user churns (e.g., provision and deprovision accounts)? |
| Can you support SSO, and if so, which standards? |
Can you support federation, and if so, which standards?
Physical and personnel security Is there restricted and monitored access to critical assets 24x7?
| Do you perform background checks on all relevant personnel, and if so, how extensive? |
| Do you document employee access to customer data? |
| Have you gone through a SAS 70 audit, and if so, type I or type II? Can you share the audit result? | |
| Availability | How many nines do you guarantee in the SLA? |
| What availability measures do you employ to guard against threats and errors? |
| Do you use multiple ISPs? |
Do you have DDoS protection, and if so, how?
Can you provide availability historical data?
What is your downtime plan (e.g., service upgrade, patch, etc.)?
| What is your peak load, and do you have enough capacity for such a load? | |
| Application security | Do you follow OWASP guidelines for application development? |
| Do you have a rigorous testing and acceptance procedure for outsourced and packaged application code? | |
| What about third-party apps (components) that you use in your services? | |
| What application security measures (if any) do you use in your production environment (e.g., application-level firewall, database auditing)? | |
| Incident response | What is your procedure for handling a data breach? |
Can notification occur within a specified time period?
| In what format do notifications go out, and what info do they contain? | ||
| Privacy | Ensure that critical data (e.g., social security number) is properly masked and that only authorized individuals have access to the entirety of the data. | |
| Show me how you protect digital identities and credentials and use them in cloud applications. | ||
| What data do you collect about me (logs, etc.)? How is it stored? How is the data used? How long will it be stored? | ||
| Under what conditions might third parties, including government agencies, have access to my data? | ||
| Can you guarantee that third-party access to shared logs and resources won’t reveal critical information about my organization? | ||
| Compliance | Business continuity and disaster recovery | Do you have any DR and BC planning documents, and if so, can we review them? |
| Ensure that the procedures are at least as robust as our own. |
Can we do a BC audit?
Where are your recovery data centers located?
What service-level guarantee can you offer under DR conditions?
| Logs and audit trails | Can you accommodate timely forensic investigation (e.g., eDiscovery)? |
| Can we agree on provisions in the SLA for investigation? |
What would we have access to? How?
| How long do you keep logs and audit trails? Can you keep them as long as we desire? |
| Can we have dedicated storage of logs and audit trails, and if so, how? |
| Show evidence of tamper-proofing for logs and audit trails. |
| Specific compliance requirements | Are your data centers under local compliance requirements? If so, which ones? |
| Do the local compliance requirements violate our own? |
Are you SAS-70 compliant (if applicable)?
Are you ISO-27001 compliant (if desired)?
Can you prove that you are compliant for HIPAA?
| Other Legal and Contractual Issues | Liability | What recourse actions (e.g., financial compensation, early exit of contracts, etc.) can we agree on in the event of a security incident or failure to meet SLA? |
| Under what conditions will the agreed upon recourse actions apply? | ||
| Intellectual property | Can we stipulate in the SLA that all my data (or applications), including all replicated and redundant copies, are owned by me? Ensure that your service agreement does not lead you to relinquish any IP rights. | |
| Scrutinize the language in the terms-of-service that govern the ownership of and rights to information that you place in the cloud. | ||
| End-of-service support | Specify what the cloud vendor will deliver at the end-of-service period. | |
| Will data be packaged and delivered back to me, and if so, in what format? | ||
| How soon will I have all my data back? |
| Will any remaining copies of data be erased completely from your network? If so, how soon will it happen? |
| Specify any fees that may be incurred at the end of the service. |
Page &P of &N
File details come from the government source that posted it. Updated .