11-RFP2009 - Part G - Attachment M - City of Alexandria Cloud Vendor Assessment Tool (Cloud).xlsx
XLSX spreadsheet 562 KB Posted
- Solicitation number
- 2009
- Issued by
- Alexandria City, Virginia
About this file
This file is a Cloud Vendor Assessment Tool developed by the City of Alexandria, Virginia, designed to evaluate vendors providing software and/or services that will access or host City data. The assessment tool is structured to gather comprehensive security and compliance information from prospective vendors across multiple domains, including documentation of security certifications, company background and organizational capacity, application and service security controls, authentication and authorization capabilities, business continuity and disaster recovery planning, change management procedures, data protection and encryption standards, database security, datacenter locations and ownership, physical security controls, firewall and intrusion detection systems, incident response protocols, and vulnerability scanning practices. The tool is organized into four primary sections populated by vendors: General Information (vendor contact details and product specifications), Documentation (external security frameworks and certifications), Company Overview (business background, experience, and staffing), and comprehensive Safeguards sections addressing technical and operational security controls. Completion of this assessment is required for vendors participating in the City's Third Party Security Assessment process, with responses subject to review by City security analysts to ensure compliance with City policy and state and federal law.
The assessment tool incorporates a standards crosswalk that aligns vendor responses with established security frameworks including CIS Critical Security Controls v6.1, HIPAA, ISO 27002:2013, NIST Cybersecurity Framework, NIST SP 800-171r1, and NIST SP 800-53r4. Vendors are evaluated on specific certifications and compliance standards such as SSAE 16 audits, Cloud Security Alliance STAR certification, FISMA compliance, and SOC 2 Type 2 reporting. The tool includes conditional formatting logic that reveals or hides subsequent questions based on prior answers, requiring vendors to complete sections in a specified order. Vendors must provide documentation references, detailed narratives, and supporting materials to substantiate responses. The assessment applies specifically to the Computer-Aided Dispatch/Automatic Vehicle Location (CAD/AVL) system replacement being procured for DASH (the City's transit authority), requiring vendors to demonstrate robust security safeguards for data access, storage, transmission, and recovery, with particular emphasis on ensuring City data separation from other customers and strict controls on data location and backup procedures.
View the file
Other files
Show all 25
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions City Of Alexandria Cloud Vendor Assessment Tool
| Target Audience | |
| These instructions are for vendors interested in providing the City of Alexandria, VA (CoA) with a software and/or a service. This worksheet should not be completed by a CoA entity. The purpose of this worksheet is for the vendor to submit robust security safeguard information in regards to the product (software/service) being assessed in the CoA's assessment process. | |
| Document Layout | |
| There are five main sections of the Assessment Tool, all listed below and outlined in more detail. This document is designed to have the first two sections populated first; after the Qualifiers section is completed it can be populated in any order. Within each section, answer each question top-to-bottom. Some questions are nested and may be blocked out via formatting based on previous answers. Populating this document in the correct order will ensure that questions are not answered unnecessarily. | |
| General Information | This section is self-explanatory; product specifics and contact information. GNRL-01 through GNRL-06 should be populated by a CoA entity. GNRL-07 through GNRL-14 should be populated by the Vendor. GNRL-15 and GNRL-16 are for internal use only. |
| Documentation | Focused on external documentation, CoA is interested in the frameworks that lead your security strategy and what has been done to certify these implementations. |
| Company Overview | This section is focused on company background, size, and business area experience. |
| Safeguards | The remainder of the document consists of various safeguards grouped generally by section. |
| In sections where vendor input is required there are only one or two columns that need modification, Vendor Answers and Additional Information, columns C and D respectively (see Figure 1 below). You will see that sometimes C and D are separate and other times are merged. If they are separate, C will be a selectable, drop-down box and any supporting information should be added to column D. If C and D are merged, the question is looking for the answer to be in narrative form. At the far right is a column titled “Guidance”. After answering questions, check this column to ensure you have submitted information/documentation to sufficiently answer the question. Use the “Additional Information” column to provide any requested details. | |
| Figure 1: | |
| Proceed to the next tab, CACVAT - Lite, to begin. |
CACVAT - Lite
| City Of Alexandria Cloud Vendor Assessment Tool - Lite | Version 2018.07 | |||
| HEISC Shared Assessments Working Group | ||||
| DATE-01 | Date | |||
| General Information | ||||
| In order to protect the institution and its systems, vendors whose products and/or services will access and/or host CoA data must complete the City of Alexandria Cloud Vendor Assessment Tool. Throughout this tool, anywhere where the term data is used, this is an all-encompassing term including at least data and metadata. Answers will be reviewed by CoA security analysts upon submittal. This process will assist the institution in preventing breaches of protected information and comply with CoA policy, state, and federal law. This is intended for use by vendors participating in a Third Party Security Assessment and should be completed by a vendor. | ||||
| GNRL-01 through GNRL-06; populated by CoA | ||||
| GNRL-01 | CoA Department | CoA Department Name | ||
| GNRL-02 | CoA Department Primary Location | Primary Location | ||
| GNRL-03 | CoA Department Code | CoA Department Code | ||
| GNRL-04 | CoA Department Contact Name | CoA Department Contact Name | ||
| GNRL-05 | CoA Department Contact Email | CoA Department Contact Email | ||
| GNRL-06 | CoA Department Contact Phone Number | 555-555-5555 | ||
| GNRL-07 through GNRL-14; populated by Vendor | ||||
| GNRL-07 | Vendor Name | Vendor Name | ||
| GNRL-08 | Product Name | Product Name and Version Information | ||
| GNRL-09 | Product Description | Please include a brief description of the product | ||
| GNRL-10 | Web Link to Product Privacy Notice | http://www.vendor.domain/privacynotice | ||
| GNRL-11 | Vendor Contact Name | Vendor Contact Name | ||
| GNRL-12 | Vendor Contact Title | Vendor Contact Title | ||
| GNRL-13 | Vendor Contact Email | Vendor Contact E-mail Address | ||
| GNRL-14 | Vendor Contact Phone Number | 555-555-5555 | ||
| GNRL-15 and GNRL-16; populated by Institution Security Office | ||||
| GNRL-15 | CoA Security Analyst/Engineer | CoA Security Analyst/Engineer Name | ||
| GNRL-16 | Assessment Contact | <email>@alexandriava.gov | ||
| Instructions | ||||
| Step 1: Complete each section answering each set of questions in order from top to bottom; the built-in formatting logic relies on this order. Step 2: Submit the completed City of Alexandria Cloud Vendor Assessment Tool - Lite to the Institution according to institutional procedures. | ||||
| Documentation | Vendor Answers | Additional Information | Guidance | |
| DOCU-01 | Have you undergone a SSAE 16 audit? |
Microsoft Office User: In 2011, Statement on Standards for Attestation Engagements (SSAE) No. 16 took effect and replaced SAS 70 as the authoritative guidance for performing a service auditor's examination. SSAE 16 established a new attestation standard (AT 801) to contain the professional guidance.
You can learn more about SSAE 16 at www.ssae16.com.
DOCU-02 Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ?
Microsoft Office User: CSA STAR Self Assessment is free and open to all cloud providers and allows them to submit self assessment reports that document compliance to CSA-published best practices.
Website: https://cloudsecurityalliance.org/star/self-assessment/ DOCU-03 Have you received the Cloud Security Alliance STAR certification?
Microsoft Office User: The CSA STAR Certification is a rigorous third party independent assessment of the security of a cloud service provider. The technology-neutral certification leverages the requirements of the ISO/IEC 27001 management system standard together with the CSA Cloud Controls Matrix, a specified set of criteria that measures the capability levels of the cloud service.
Website: https://cloudsecurityalliance.org/star/certification/
| DOCU-04 | Do you conform with a specific industry standard security framework? (e.g. NIST Special Publication 800-53, ISO 27001, etc.) |
| DOCU-05 | Are you compliant with FISMA standards (indicate at what level)? |
Microsoft Office User: The Federal Information Security Management Act (FISMA) is United States legislation that defines a comprehensive framework to protect government information, operations and assets against natural or man-made threats.
Website: http://www.dhs.gov/FISMA Microsoft Office User: In 2011, Statement on Standards for Attestation Engagements (SSAE) No. 16 took effect and replaced SAS 70 as the authoritative guidance for performing a service auditor's examination. SSAE 16 established a new attestation standard (AT 801) to contain the professional guidance.
You can learn more about SSAE 16 at www.ssae16.com.
Microsoft Office User: CSA STAR Self Assessment is free and open to all cloud providers and allows them to submit self assessment reports that document compliance to CSA-published best practices.
Website: https://cloudsecurityalliance.org/star/self-assessment/ Microsoft Office User: The CSA STAR Certification is a rigorous third party independent assessment of the security of a cloud service provider. The technology-neutral certification leverages the requirements of the ISO/IEC 27001 management system standard together with the CSA Cloud Controls Matrix, a specified set of criteria that measures the capability levels of the cloud service.
Website: https://cloudsecurityalliance.org/star/certification/
| DOCU-06 | Does your organization have a data privacy policy? | ||||
| Company Overview | Vendor Answers | Additional Information | Guidance | ||
| COMP-01 | Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships. | ||||
| COMP-02 | Describe how long your organization has conducted business in this product area. | ||||
| COMP-03 | How many higher education, commercial customers and government customers do you serve in North America? Please provide a higher education customer reference if available. | ||||
| COMP-04 | Please explain in detail any involvement in business-related litigation in the last five years by your organization, its management, or the staff that will be providing the administrative services. | ||||
| COMP-05 | Describe the structure and size of your Security Office and overall information security staff. (e.g. Admin, Engineering, QA/Compliance, etc.) | ||||
| COMP-06 | Describe the structure and size of your Software and System Development teams. (e.g. Customer Support, Implementation, Product Management, etc.) | ||||
| COMP-07 | Use this area to share information about your environment that will assist those who are evaluating you company data security safeguards. | ||||
| Application/Service Security | Vendor Answers | Additional Information | Guidance | ||
| HLAP-01 | Can user access be customized to allow read-only access, update access, or no-access to specific types of records, record attributes, components, or functions? | APPL-04 | |||
| HLAP-02 | Describe or provide a reference to how user security administration is performed? | APPL-05 | |||
| HLAP-03 | Describe or provide a reference to the controls that are in place to secure their remote environment and connection to institution's data. | APPL-08 | |||
| HLAP-04 | Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system? | APPL-12 | |||
| HLAP-05 | Does the system provide data input validation and error messages? | APPL-20 | |||
| HLAP-06 | Do you employ a single-tenant or multi-tenant environment? | APPL-21 | |||
| Authentication, Authorization, and Accounting | Vendor Answers | Additional Information | Guidance | ||
| HLAA-01 | Can you enforce password/passphrase complexity requirements [provided by the institution]? | AAAI-02 | |||
| HLAA-02 | Describe or provide a reference to the types of authentication, including standards-based single-sign-on (SSO, InCommon), that are supported by the web-based interface? | AAAI-05 | |||
| HLAA-03 | Describe or provide a reference to the authentication and authorization systems such as Active Directory, Kerberos (what version) or a institution centralized authorization service that work with your application. | AAAI-12 | |||
| HLAA-04 | Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication? | AAAI-14 | |||
| HLAA-05 | Does your system have the capability to log security/authorization changes as well as user and administrator security (physical or electronic) events (e.g., login failures, access denied, changes accepted), and all requirements necessary to implement logging and monitoring on the system. Include information about SIEM/log collector usage. | AAAI-18 | |||
| Business Continuity Plan | Vendor Answers | Additional Information | Guidance | ||
| HLBC-01 | Do you have a documented Business Continuity Plan (BCP)? If so, can it be shared? | BCPL-01 | |||
| HLBC-02 | Is there a documented communication plan in your BCP for impacted clients? | BCPL-05 | |||
| HLBC-03 | Are all components of the BCP reviewed at least annually and updated as needed to reflect change? | BCPL-06 | |||
| HLBC-04 | Does your organization conduct an annual test of relocating to this alternate site for business recovery purposes? | BCPL-11 | |||
| Change Management | Vendor Answers | Additional Information | Guidance | ||
| HLCH-01 | Do you have a Change Management Plan? If so, can it be shared? | CHNG-02 | |||
| HLCH-02 | How and when will the Institution be notified of major changes to your environment that could impact our security posture? | CHNG-03 | |||
| HLCH-03 | Do you have documented procedures on how security risks are mitigated until patches can be applied? If so, can it be shared? | CHNG-13 | |||
| HLCH-04 | Do procedures exist to provide that emergency changes are documented and authorized (including after the fact approval)? If so, can it be shared? | CHNG-15 | |||
| Data | Vendor Answers | Additional Information | Guidance | ||
| HLDA-01 | Is institution data physically and logically separated from that of other customers. | DATA-02 | |||
| HLDA-02 | Is sensitive data encrypted in transport and storage (e.g. disk encryption and at-rest)? | DATA-04 | |||
| HLDA-03 | Do backups containing institution data ever leave the United States of America either physically or via network routing? | DATA-25 | |||
| HLDA-04 | Describe or provide a reference to your media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures. | DATA-26 | |||
| HLDA-05 | Is any institution data visible in system administration modules/tools? | DATA-31 | |||
| Database | Vendor Answers | Additional Information | Guidance | ||
| HLDB-01 | Does the database support encryption of specified data elements in storage? | DBAS-01 | |||
| HLDB-02 | Do you currently use encryption in your database? | DBAS-02 | |||
| Datacenter | Vendor Answers | Additional Information | Guidance | ||
| HLDC-01 | List all datacenters and their cities, states (provinces), and countries where institution data will be stored (including within the United States). Does your company own these data centers? | DCTR-10 | |||
| HLDC-02 | Does your company own the physical data center where institution data will reside? If so, do these servers reside in a co-located data center? | DCTR-01 | |||
| HLDC-03 | Does the hosting provider have a SOC 2 Type 2 report available? | DCTR-02 | |||
| HLDC-04 | Does the physical barrier fully enclose the physical space preventing unauthorized physical contact with any of your devices? | DCTR-06 | |||
| Disaster Recovery Plan | Vendor Answers | Additional Information | Guidance | ||
| HLDR-01 | Do you have a Disaster Recovery Plan (DRP)? If so, can it be shared? | DRPL-01 | |||
| HLDR-02 | Are any disaster recovery locations outside the United States? If so, please provide the locations. | DRPL-04 | |||
| HLDR-03 | Are all components of the DRP reviewed at least annually and updated as needed to reflect change? | DRPL-13 | |||
| Firewalls, IDS, IPS, and Networking | Vendor Answers | Additional Information | Guidance | ||
| HLFI-01 | Are you utilizing a web application firewall (WAF) and / or a stateful packet inspection (SPI) firewall? | FIDP-01 | |||
| HLFI-02 | Do you have a documented policy for firewall change requests? If so, can it be shared? | FIDP-04 | |||
| HLFI-03 | Describe or provide a reference to any other safeguards used to monitor for attacks? | FIDP-09 | |||
| HLFI-04 | Do you monitor for intrusions on a 24x7x365 basis? | FIDP-10 | |||
| Physical Security | Vendor Answers | Additional Information | Guidance | ||
| HLPH-01 | Does your organization have physical security controls and policies in place? If so, can it be shared? | PHYS-01 | |||
| HLPH-02 | Are employees allowed to take home customer data in any form? | PHYS-02 | |||
| Policies, Procedures, and Processes | Vendor Answers | Additional Information | Guidance | ||
| HLPP-01 | Can you share the org chart, mission statement and policies for your information security unit? | PPPR-01 | |||
| HLPP-02 | Are information security principles designed into the product and / or SDLC lifecycle? | PPPR-08 | |||
| HLPP-03 | Do you have a formal incident response plan? If so, can it be shared? | PPPR-11 | |||
| HLPP-04 | Do you have a documented information security policy? If so, can it be shared? | PPPR-18 | |||
| Systems Management & Configuration | Vendor Answers | Additional Information | Guidance | ||
| HLSY-01 | Are systems that support this service managed via a separate management network? | SYST-01 | |||
| HLSY-02 | Can you provide a general summary of your systems management and configuration strategy, including servers, appliances, and mobile devices (company and employee owned). | SYST-04 | |||
| Vulnerability Scanning | Vendor Answers | Additional Information | Guidance | ||
| HLVU-01 | Have your systems and applications had a third party security assessment completed in the last year? If so, can the results be provided? | VULN-02 | |||
| HLVU-02 | Are your applications scanned for vulnerabilities prior to new releases? If so, can the results be provided? | VULN-03 |
&"Helvetica,Regular"&12&K000000 &P
Standards Crosswalk
| Higher Education Cloud Vendor Assessment Tool - Lite - Standards Crosswalk | Version beta1.06b | ||||||
| HEISC Shared Assessments Working Group | |||||||
| Documentation | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |
| DOCU-01 | Have you undergone a SSAE 16 audit? |
Microsoft Office User: In 2011, Statement on Standards for Attestation Engagements (SSAE) No. 16 took effect and replaced SAS 70 as the authoritative guidance for performing a service auditor's examination. SSAE 16 established a new attestation standard (AT 801) to contain the professional guidance.
| You can learn more about SSAE 16 at www.ssae16.com. | 15.2.1 | SA-9 | ||
| DOCU-02 | Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ? |
Microsoft Office User: CSA STAR Self Assessment is free and open to all cloud providers and allows them to submit self assessment reports that document compliance to CSA-published best practices.
| Website: https://cloudsecurityalliance.org/star/self-assessment/ | 15.2.1 | PE-2, PE-3, PE-5, PE-11, PE-13, PE-14, SA-9 | ||
| DOCU-03 | Have you received the Cloud Security Alliance STAR certification? |
Microsoft Office User: The CSA STAR Certification is a rigorous third party independent assessment of the security of a cloud service provider. The technology-neutral certification leverages the requirements of the ISO/IEC 27001 management system standard together with the CSA Cloud Controls Matrix, a specified set of criteria that measures the capability levels of the cloud service.
| Website: https://cloudsecurityalliance.org/star/certification/ | 15.2.1 | PE-2, PE-3, PE-5, PE-11, PE-13, PE-14, SA-9 | ||||
| DOCU-04 | Do you conform with a specific industry standard security framework? (e.g. NIST Special Publication 800-53, ISO 27001, etc.) | 18.1.1 | SA-9 | |||
| DOCU-05 | Are you compliant with FISMA standards (indicate at what level)? |
Microsoft Office User: The Federal Information Security Management Act (FISMA) is United States legislation that defines a comprehensive framework to protect government information, operations and assets against natural or man-made threats.
| Website: http://www.dhs.gov/FISMA | 18.1.1 | SA-9 | |||||||
| DOCU-06 | Does your organization have a data privacy policy? | §164.308(a)(1)(i) | 18.1.4 | ID.GV-3 | ID.GV-3 | SA-9 | |||
| Company Overview | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |||
| COMP-01 | Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships. | ||||||||
| COMP-02 | Describe how long your organization has conducted business in this product area. | ||||||||
| COMP-03 | How many higher education, commercial customers and government customers do you serve in North America? Please provide a higher education customer reference if available. | 15.2.1 | |||||||
| COMP-04 | Please explain in detail any involvement in business-related litigation in the last five years by your organization, its management, or the staff that will be providing the administrative services. | 15.2.2 | |||||||
| COMP-05 | Describe the structure and size of your Security Office and overall information security staff. (e.g. Admin, Engineering, QA/Compliance, etc.) | 15.2.1 | |||||||
| COMP-06 | Describe the structure and size of your Software and System Development teams. (e.g. Customer Support, Implementation, Product Management, etc.) | 14.2.1 | SA-3, SA-15, SC-2, PM-2, PM-10, SI-5,PM-3 | ||||||
| COMP-07 | Use this area to share information about your environment that will assist those who are evaluating you company data security safeguards. | 15.2.1 | |||||||
| Application/Service Security | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |||
| HLAP-01 | Can user access be customized to allow read-only access, update access, or no-access to specific types of records, record attributes, components, or functions? | CSC 14 | 9.2.2 | PR.AC-4 | 3.1.1, 3.1.2, 3.1.7 | AC-2, AC-3, AC-6 | APPL-03 | ||
| HLAP-02 | Describe or provide a reference to how user security administration is performed? | CSC16 | 9.1.1 | PR.AC-4, PR.PT-3 | 3.4.9 | CM-11 | APPL-04 | ||
| HLAP-03 | Select the controls that are in place to secure their remote environment and connection to the institution's data. | CSC 12 | 6.2 | PR.PT-3 | 3.1.12, 3.1.13, 3.1.14, 3.1.14, 3.1.15, 3.1.8, 3.1.20, 3.7.5, 3.8.2, 3.13.7 | AC-3, CM-7; NIST SP 800-46 | APPL-07 | ||
| HLAP-04 | Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system? | CSC 2 | 12.1.1 | ID.AM-1, ID.AM-2, ID.AM-4 | CA-9, SC-4 | APPL-11 | |||
| HLAP-05 | Does the system provide data input validation and error messages? | CSC 16 | 14.2.5 | PR.DS-6 | APPL-18 | ||||
| HLAP-06 | Do you employ a single-tenant or multi-tenant environment? | CSC 12 | 14.2.5 | RA-2 | APPL-19 | ||||
| Authentication, Authorization, and Accounting | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |||
| HLAA-01 | Can you enforce password/passphrase complexity requirements [provided by the Institution]? | CSC 16 | 9.2.3, 9.3.1, 9.4.3 | PR.AC-1 | 3.5.7 | IA-5(1) | AAAI-02 | ||
| HLAA-02 | Select the types of authentication, including standards-based single-sign-on (SSO, InCommon), that are supported by the web-based interface? | CSC 16 | 9.1.1, 9.2.3, 9.3.1, 9.4.3 | PR.AC-1 | 3.5.1 | IA-2, IA-5 | AAAI-05 | ||
| HLAA-03 | Select the authentication and authorization systems such as Active Directory, Kerberos (what version) or a university centralized authorization service that work with your application. | CSC 16 | 9.4.3 | PR.AC-1, PR.AC-4 | AAAI-12 | ||||
| HLAA-04 | Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication? | CSC 16 | 9.4.3 | PR.AC-1, PR.AC-4 | AAAI-14 | ||||
| HLAA-05 | Does your system have the capability to log security/authorization changes as well as user and administrator security (physical or electronic) events (e.g., login failures, access denied, changes accepted), and all requirements necessary to implement logging and monitoring on the system. Include information about SIEM/log collector usage. | CSC 6 | 12.4 | PR.PT-1 | 3.1.7, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.4.3, 3.7.1, 3.7.6, 3.10.4, 3.10.5 | AU-2(3), AU-6, AU-12, AC-6(9), CM-3, MA-2, MA-5, PE-3 | AAAI-18 | ||
| Business Continuity Plan | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |||
| HLBC-01 | Do you have a documented Business Continuity Plan (BCP)? If so, can it be shared? | CSC 10 | 17.1.1 | PR.IP-9 | 3.12.2 | AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34 | BCPL-01 | ||
| HLBC-02 | Is there a documented communication plan in your BCP for impacted clients? | CSC 10 | 17.1.2 | PR.IP-9 | 3.12.2 | AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34 | BCPL-05 | ||
| HLBC-03 | Are all components of the BCP reviewed at least annually and updated as needed to reflect change? | CSC 10 | 17.1.2 | PR.IP-9 | 3.12.2 | AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34 | BCPL-06 | ||
| HLBC-04 | Does your organization conduct an annual test of relocating to this alternate site for business recovery purposes? | CSC 10 | 17.1.3 | PR.IP-9 | AC-5, CP-4, CP-10; NIST SP 800-34 | BCPL-11 | |||
| Change Management | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |||
| HLCH-01 | Do you have a Change Management Plan? If so, can it be shared? | CSC 10 | 12.1.2 | PR.IP-3 | 3.4.3, 3.4.4 | CM-3, CM-4, CM-5 | CHNG-01 | ||
| HLCH-02 | How and when will the Institution be notified of major changes to your environment that could impact our security posture? | CSC 10 | 12.1.2 | CM-3, CM-4, CM-5 | CHNG-03 | ||||
| HLCH-03 | Do you have documented procedures on how security risks are mitigated until patches can be applied? If so, can it be shared? | CSC 13 | §164.308(a)(1)(ii)(B) | 12.6.1 | CM-3, CM-4, CM-5 | CHNG-13 | |||
| HLCH-04 | Do procedures exist to provide that emergency changes are documented and authorized (including after the fact approval)? If so, can it be shared? | CSC 10 | 12.1.2 | PR.IP-3 | CM-3, CM-4, CM-5 | CHNG-15 | |||
| Data | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |||
| HLDA-01 | Is university data is physically and logically separated from that of other customers. | CSC 12 | PR.AC-2, PR.IP-5 | 3.1.3, 3.8.1 | AC-4, MP-2, MP-4 | DATA-02 | |||
| HLDA-02 | Is sensitive data encrypted in transport and storage (e.g. disk encryption and at-rest)? | CSC 13 | 8.2.3, 10.1.1 | PR.DS-1, PR.DS-2 | 3.1.19, 3.8.1 | MP-2, AC-19(5) | DATA-04 | ||
| HLDA-03 | Do backups containing university data ever leave the United States of America either physically or via network routing? | CSC 13 | 12.3.1 | 3.8.9 | CP-9, MP-5 | DATA-25 | |||
| HLDA-04 | Describe or provide a reference to your media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures. | CSC 13 | 8.3.1 | PR.DS-3 | 3.7.1, 3.7.2, 3.8.3 | CP-9 MP-6, NIST SP 800-60, NIST SP 800-88, AC-2, AC-6, IA-4, PM-2, PM-10, SI-5, MA-2, MA-3, MP-6 | DATA-26 | ||
| HLDA-05 | Is any university data visible in system administration modules/tools? | CSC 13, CSC 14 | 14.2.5 | PR.AC-4 | DATA-31 | ||||
| Database | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |||
| HLDB-01 | Does the database support encryption of specified data elements in storage? | CSC 13 | 10.1.1 | PR.DS-1 | DBAS-01 | ||||
| HLDB-02 | Do you currently use encryption in your database? | CSC 13 | 10.1.1 | PR.DS-1, PR.DS-2 | DBAS-02 | ||||
| Datacenter | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |||
| HLDC-01 | List all datacenters and their cities, states (provinces), and countries where university data will be stored (including within the United States). Does your company own these data centers? | CSC 12 | 11.2.1 | DCTR-10 | |||||
| HLDC-02 | Does your company own the physical data center where university data will reside? If so, do these servers reside in a co-located data center? | CSC 14 | 11.1.1 | PR.AC-2, PR.IP-5 | DCTR-01 | ||||
| HLDC-03 | Does the hosting provider have a SOC 2 Type 2 report available? | CSC 13 | 11.1.1 | DCTR-02 | |||||
| HLDC-04 | Does the physical barrier fully enclose the physical space preventing unauthorized physical contact with any of your devices? | CSC 14 | 11.1.1, 11.1.2 | PR.AC-2 | 3.8.1, 3.8.2 | DCTR-06 | |||
| Disaster Recovery Plan | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |||
| HLDR-01 | Do you have a Disaster Recovery Plan (DRP)? If so, can it be shared? | CSC 10 | 17.1.1 | PR.IP-9 | 3.12.2 | AC-5, CP-4, CP-10 | |||
| NIST SP 800-34 | DRPL-01 | ||||||||
| HLDR-02 | Are any disaster recovery locations outside the United States? If so, please provide the locations. | CSC 10, CSC 12 | 17.1.1 | PR.IP-9 | AC-5, CP-4, CP-10 | ||||
| NIST SP 800-34 | DRPL-04 | ||||||||
| HLDR-03 | Are all components of the DRP reviewed at least annually and updated as needed to reflect change? | CSC 10 | 17.1.1 | PR.IP-9 | 3.12.2 | AC-5, CP-4, CP-10 | |||
| NIST SP 800-34 | DRPL-13 | ||||||||
| Firewalls, IDS, IPS, and Networking | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |||
| HLFI-01 | Are you utilizing a web application firewall (WAF) and / or a stateful packet inspection (SPI) firewall? | CSC 9 | 13.1.1 | PR.DS-5 | FIDP-01 | ||||
| HLFI-02 | Do you have a documented policy for firewall change requests? If so, can it be shared? | CSC 9 | 12.1.2 | PR.AC-5 | FIDP-04 | ||||
| HLFI-03 | Describe or provide a reference to any other safeguards used to monitor for attacks? | CSC 19 | 12.4.1 | 3.6.1, 3.14.6, 3.14.7 | IR-2, IR-4, IR-9 | FIDP-09 | |||
| HLFI-04 | Do you monitor for intrusions on a 24x7x365 basis? | CSC 19 | 12.4.1 | DE.CM-1, DE.CM-2, DE.CM-7 | 3.6.1, 3.14.6, 3.14.7 | IR-2, IR-4, IR-10 | FIDP-10 | ||
| Physical Security | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |||
| HLPH-01 | Does your organization have physical security controls and policies in place? If so, can it be shared? | CSC 3 | 11.1.1 | PR.AC-2, PR.AT-5, PR.IP-5, DE.CM-2 | 3.8.2, 3.10.1, 3.10.2, 3.10.5, 3.10.6, 3.12.1 | MP-4, PE-2, PE-5, PE-6, PE-17 | PHYS-01 | ||
| HLPH-02 | Are employees allowed to take home customer data in any form? | CSC 13 | 8.2.3 | PR.AC-2, PR.AC-4, PR.DS-1, PR.DS-3, PR.DS-5 | 3.8.1, 3.8.5, 3.8.7 | MP-2, MP-5, MP-7 | PHYS-02 | ||
| Policies, Procedures, and Processes | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |||
| HLPP-01 | Can you share the org chart, mission statement and policies for your information security unit? | 5.1.1 | ID.GV-2 | 3.9.1, 3.9.2 | PM-2, PM-10, SI-5, CA-5, PM-1 | PPPR-01 | |||
| HLPP-02 | Are information security principles designed into the product and / or SDLC lifecycle? | CSC 4 | 14.2.1 | PR.IP-2 | 3.13.2 | CA-5, CM-3, PM-1, SA-15, SA-3, SA-8, SC-2 | PPPR-08 | ||
| HLPP-03 | Do you have a formal incident response plan? If so, can it be shared? | CSC 19 | 16.1.5 | PR.IP-9 | 3.6.1, 3.12.2 | CA-5, PM-1, IR-4, IR-5, IR-7, IR-8 | PPPR-11 | ||
| HLPP-04 | Do you have a documented information security policy? If so, can it be shared? | CSC 17 | §164.308(a)(1)(i) | 5.1.1 | ID.GV-3 | CA-5, PM-1 | PPPR-18 | ||
| Systems Management & Configuration | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |||
| HLSY-01 | Are systems that support this service managed via a separate management network? | CSC 12 | 13.1.1 | PR.PT-4 | 3.1.3 | AC-4 | SYST-01 | ||
| HLSY-02 | Can you provide a general summary of your systems management and configuration strategy, including servers, appliances, and mobile devices (company and employee owned). | CSC 3 | 12.1.1 | PR.IP-1, PR.IP-2 | 3.1.18, 3.7.1, 3.13.13 | CM-2, CM-6, CM-3, AC-19, MA-2 | SYST-04 | ||
| Vulnerability Scanning | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |||
| HLVU-01 | Have your systems and applications had a third party security assessment completed in the last year? If so, can the results be provided? | CSC 4 | 12.6.1 | DE.CM-8 | 3.11.1, 3.11.2, 3.11.3 | SI-2 | VULN-02 | ||
| HLVU-02 | Are your applications scanned for vulnerabilities prior to new releases? If so, can the results be provided? | CSC 4 | DE.CM-8 | 3.11.1, 3.11.2, 3.11.3 | SI-2 | VULN-03 |
&"Helvetica,Regular"&12&K000000 &P
Credits
| This evaluation is based off of the HECVAT (Higher Education Cloud Assessment Tool), with modifications to fit the needs of the City of Alexandria. Credits are below, under a Creative Commons Attribution-Noncommercial-ShareAlike 4.0 International License (CC BY-NC-SA 4.0). |
| Acknowledgments |
| The Higher Education Information Security Council Shared Assessments Working Group contributed their vision and significant talents to the conception, creation, and completion of this resource. |
| Members that contributed to Phase II (2017) of this effort are: |
| •Jon Allen, Baylor University |
| •Samantha Birk, IMS Global Learning Consortium |
| •Jeff Bohrer, IMS Global Learning Consortium |
| •Sarah Braun, University of Colorado - Denver |
| •David Cassada, University of California - Davis |
| •Matthew Dalton, University of Massachusetts Amherst |
| •Charles Escue, Indiana University |
| •Joanna Grama, EDUCAUSE |
| •Todd Herring, REN-ISAC |
| •Kolin Hodgson, University of Notre Dame |
| •Tom Horton, Cornell University |
| •Leo Howell, North Carolina State University |
| •Alex Jalso, West Virginia University |
| •Nick Lewis, Internet2 |
| •Wyman Miles, Cornell University |
| •Kim Milford, REN-ISAC |
| •Valerie Vogel, EDUCAUSE |
| Members that contributed to Phase I (2016) of this effort are: |
| •Jon Allen, Baylor University |
| •John Bruggeman, Hebrew Union College, Jewish Institute of Religion |
| •Charles Escue, Indiana University |
| •Joanna Grama, EDUCAUSE |
| •Karl Hassler, University of Delaware |
| •Todd Herring, REN-ISAC |
| •Nick Lewis, Internet2 |
| •Kim Milford, REN-ISAC |
| •Craig Munson, Minnesota State Colleges & Universities |
| •Mitch Parks, University of Idaho |
| •Laura Raderman, Carnegie Mellon University |
| •Valerie Vogel, EDUCAUSE |
ChangeLog
| Version | Date | Description of Change |
| v0.6 | 8/4/16 | Merged initial comments and suggestions of sub-group members. |
| v0.7 | 8/14/16 | Completed base formulas for all Guidance fields. Changed Qualifer formatting to make questions readable (and optional). |
| v0.8 | 8/15/16 | Added SOC2T2 question to datacenter section. |
| v0.9 | 8/16/16 | Added Systems and Configuration Management section, added MDM, sep. management networks, system configuration images, Internal audit processes and procedures. |
| v0.91 | 8/24/16 | Added input from WG meeting on 8/22, removed RiskMgmt section, added question ID's, and removed dup network question. |
| v0.92 | 8/25/16 | Added Introduction, Sharing Read Me, and Acknowledgements tabs and content. Also updated report specifics in Documentation. |
| v0.93 | 8/26/16 | Integrated grammatical corrections set by Karl, fixed a minor formula error in a guidance cell. |
| v0.94 | 8/26/16 | Added Instructions tab, adjusted question ID background color, updated DRP/BCP copy error. |
| v0.95 | 9/21/16 | Changed document title to HECVAT. Integrated KDH input. |
| v0.96 | 9/23/16 | Added input from NL, 36 modifications across all sections. |
| v0.97 | 9/26/16 | Updated Sharing Read Me tab with final language and options table. |
| v0.98 | 10/6/16 | Sharing Confirmation section added, updated instructions, updated Sharing Read Me tab, fixed a ton of conditional formatting issues. |
| v1.00 | 10/17/16 | Finalized for distribution. |
| v1.01 | 11/16/16 | Corrections for grammar, conditional formatting, and question clarification. |
| v1.02 | 11/21/16 | Added tertiary services narrative question (DNS, ISP, etc…). |
| v1.03 | 11/23/16 | Grammar and spelling cleanup. |
| v1.06 | 10/24/17 | Added standards crosswalk and Cloud Broker Index (CBI) information, changed HLAP-03, HLAA-02, HLAA-03, and HLDA-04 to freeform text. Changed University mentions to Institution. |
Values
| Campus |
| Answers |
| Yes |
| No |
| N/A |
| DRPTestingSchedule |
| Quarterly |
| Semi-annually |
| Annually |
| Other |
| NetworkTypes |
| Exclusive VLAN |
| Shared VLAN |
| Physically Separate |
| Flat Shared Network |
| Other |
| Consulting |
| On-premises |
| Remotely |
| DR Types |
| Cold |
| Hot |
| Tenants |
| Single-tenant |
| Multiple-tenant |
| SharedAssessmentsConfirmation |
| Yes; OK to Share |
| No; Sharing Disallowed |
| SharedAssessmentListingConfirmation |
| Yes; OK to List |
| No; Listing Disallowed |
| UptimeTiers |
| Tier I |
| Tier II |
| Tier III |
| Tier IV |
| N/A |
image2.tiff
File details come from the government source that posted it. Updated .