2-A04 - Risk Assessment 012026.xlsx
XLSX spreadsheet 21 KB Posted
- Attached to
- Graduate School CAS
- Solicitation number
- 745-26-P20
- Issued by
- Bexar County, Texas
About this file
This is a Risk Assessment document completed for the University of Texas Health San Antonio (UT Health SA) in January 2026, evaluating institutional compliance with information security frameworks and standards. The assessment covers 18 core risk management categories based on ISO 27005:2011 standards, including risk management programs, information security policies, human resource security, asset management, access control, cryptography, physical and environmental security, operations security, communications security, systems acquisition and development, supplier relationships, incident management, business continuity, and compliance. The institution confirmed the presence of documented risk management programs, security policies approved by management, information security awareness training, access control policies with password management standards, multi-factor authentication requirements for confidential data access, segmented network architecture with multiple security layers for internet-accessible servers, patch management strategies, incident-handling procedures, and documented business continuity plans tested periodically and approved by senior staff. Additionally, the assessment addresses artificial intelligence capabilities across 27 detailed questions, though the responding vendor indicated no current AI features, with requests for descriptions of AI solution capabilities and user input validation methods left blank.
The assessment document does not address pricing, set asides, incumbents, funding sources, or contract terms. Instead, it serves as a technical security compliance questionnaire designed to evaluate vendors' information security posture and readiness to protect sensitive institutional data, including the handling of protected health information (HIPAA considerations) and data residency requirements. The questionnaire requires vendors to certify whether data storage and processing occur exclusively within the United States and whether data access is limited to entity representatives located domestically. The assessment is directly linked to the Graduate School of Biomedical Sciences' procurement for a comprehensive application management and customer relationship management (CRM) system to replace current fragmented vendor solutions, with the successful vendor expected to integrate with the university's PeopleSoft system and existing school software while providing robust faculty review capabilities and CRM functionality for admissions tracking and prospect communication.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 6-S06 Pricing and Delivery Schedule 0725.pdf | ||
| 13-A01A General info NO BAA 0922.pdf | ||
| 12-A02 - Sample Agreement 745-26-P20.docx | DOCX document | |
| 1-A06 PDAA.xlsx | XLSX spreadsheet | |
| 3-A05 TX-Ramp 1003.pdf | ||
| 7-A07 - GDPR 1125.pdf | ||
| 10-A01C Gen Quest 0725.pdf | ||
| 8-A03 VETHUB 0126.pdf | ||
| 9-01 745-26-P20.pdf | ||
| 11-A01B Exec of Offer 1125.pdf | ||
| 5-S04 Terms Conditions 0725.pdf | ||
| 4-A01D Addenda Checklist 0725.pdf |
Show all 12
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Assessment
| Vendor Name: | ||||
| Name of person completing assessment: | ||||
| Date completed | ||||
| Questions | ||||
| Risk Management (ISO 27005:2011) | Yes/No | Evidence Requested | Evidence Provided? | Framework |
Categories & Sub-Categories 1 Does your institution have a risk management program? Yes ID.BE
ID.GV1
ID.RM
ID.RM1
2 Does your institution have a process for identifying and assessing reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper, or other records containing sensitive information? Yes ID.RA3
ID.RA6
| Information Security Policies (ISO 5) | |||
| 3 | Does your institution have an information security policy that has been approved by management? | Yes | ID.GV1 |
| Human Resource Security (ISO 7) | |||
| 4 | Do all individuals interacting with university systems receive information security awareness training? | PR.AT |
PR.AT1
5 Does your institution have a process for revoking system and building access and returning assigned assets? Yes PR.AC
PR.AC2
PR.PT3
| Asset Management (ISO 8) | ||
| 6 | Has your organization identified critical information assets and the functions that rely on them? | ID.AM |
ID.BE2
| Access Control (ISO 9) | |
| 7 | Does your institution have an access control policy for authorizing and revoking access rights to information systems? |
| Yes | PR.AC | ||
| 8 | Does your institution have a password management program that follows current security standards? | ||
| Yes | PR.IP | ||
| 9 | Does your institution assign user access rights based on assigned roles in the system? | PR.AC1 | |
| 10 | Does your institution have a policy that enforces the concept of least privilege? | PR.AC4 | |
| 11 | Does your institution require multi-factor authentication for systems which access confidential or regulated data? | PR.AC7 | |
| 12 | Does your institution have procedures to regularly review users' access to ensure only needed privileges are applied? | PR.AC4 |
PR.AT2
13 Does your institution employ specific measures to secure remote access services? PR.AC3
PR.MA2
14 Does your institution employ technologies to block or restrict unencrypted sensitive information from traveling to untrusted networks? DE.AE1
PR.PT4
PR.DS5
| 15 | Does your institution have an authentication system in place that applies higher levels of authentication to protect resources with higher levels of sensitivity? | PR.AC7 |
| 16 | Does your institution have standards for isolating sensitive data and procedures and technologies in place to protect it from unauthorized access and tampering? | PR.DS |
PR.DS6
DE.CM7
PR.AC5
| Cryptography (ISO 10) | ||
| 17 | Does your institution use appropriate/vetted encryption methods to protect sensitive data in transit? | PR.DS2 |
| 18 | Does your institution use appropriate/vetted encryption methods to encrypt data at rest? | PR.DS2 |
| 19 | Do your policies indicate when encryption should be used (e.g., at rest, in transit, with sensitive or confidential data, etc.)? | PR.DS1 |
PR.DS2
| Physical and Environmental Security (ISO 11) | ||
| 20 | Do your institution's data centers include controls to ensure that only authorized parties are allowed physical access? | PR.AC2 |
| 21 | Does your institution have a media-sanitization process that is applied to equipment prior to disposal, reuse, or release? | PR.PT2 |
| Operations Security (ISO 12) | ||
| 22 | Are changes to information systems tested, authorized, and reported? | PR.IP3 |
| 23 | Are methods used to detect, quarantine, and eradicate known malicious code on information systems including workstations, servers, and mobile computing devices? | DE.AE2 |
DE.CM1
DE.CM2
DE.CM3
DE.CM4
DE.CM5
RS.AN1
| 24 | Does your institution have a segmented network architecture to provide different levels of security based on the information's classification? | Yes | ID.AM5 |
| 25 | Are Internet-accessible servers protected by more than one security layer (firewalls, network IDS, host IDS, application IDS)? | Yes | PR.PT |
PR.PT1
26 Are security-related activities such as hardware configuration changes, software configuration changes, access attempts, and authorization and privilege assignments automatically logged? PR.IP3
PR.AT2
27 Does your institution regularly review administrative and operative access to audit logs? PR.MA
PR.MA1
PR.MA2
PR.PT1
| 28 | Does your institution regularly review audit logs for access activity and abnormal activity? | PR.PT1 |
| Communications Security (ISO 13) | ||
| 29 | Does your institution continuously monitor your wired and wireless networks for unauthorized access? | DE.CM1 |
DE.CM7
| Systems Acquisition, Development, and Maintenance (ISO 14) | ||
| 30 | Are new information systems or enhancements to existing information systems validated against defined security requirements? | ID.BE5 |
DE.DP2
31 Does your institution have a patch management strategy in place and responsibilities assigned for monitoring and promptly responding to patch releases, security bulletins, and vulnerability reports? Yes ID.RA1
ID.RA2
ID.RA5
PR.IP12
RS.MI3
| Supplier Relationships (ISO 15) | ||
| 32 | Does your institution have a process in place for assessing that external information system providers comply with appropriate security requirements? | ID.AM4 |
DE.CM6
RS.CO5
33 Does your institution have a process in place where vendors go through a risk management process related to ensuring the confidentiality, processing integrity and security of UT Health SA’s data. DE.CM-6
STA-08
RA-4
| 34 | Has there been an external, independent review of the information security and technology environment within the past 12 months (i.e., ISO 27001, SOC 2, HITRUST, FedRAMP, FISMA, etc.)? | RA | |
| 35 | Has your institution had a significant breach in the last 5 years (i.e., compromise of security that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to protected data that is transmitted, stored, or processed)? | RA | |
| Information Security Incident Management (ISO 16) | |||
| 36 | Are incident-handling procedures in place to report and respond to security events throughout the incident life cycle, including the definition of roles and responsibilities? | Yes | PR.IP9 |
DE.AE5
RS.AN2
RS.AN4
RS.MI
RS.MI1
RSMI2
37 Are there procedures in place for security incident response, including the identification, resolution, and reporting of events? RS.AN
RS.MI
| Information Security Aspects of Business Continuity Management (ISO 17) | |||
| 38 | Does your institution have a documented business continuity plan for information technology that is based on a business impact analysis, is periodically tested, and has been reviewed and approved by senior staff or the board of trustees? | Yes | PR.IP9 |
ID.RA4
ID.RA5
DE.AE4
RS.AN2
| 39 | Are backup copies made according to pre-defined schedules, encrypted, and securely stored? | PR.IP4 |
| Compliance (ISO 18) | ||
| 40 | Does your institution perform periodic application and network layer vulnerability testing or penetration testing against critical information systems? | ID.A2 |
PR.IP12
DE.CM8
| 41 | Are you performing independent audits on information systems to identify strengths and weaknesses? | Yes | PR.PT1 | |
| HIPAA General | Yes, No, N/A | |||
| 42 | Geographically speaking, is data stored and processed only in the US? If not, list location(s) outside of the US: | |||
| 43 | Will data be accessed only by entity representatives located outside the US? If no, list location(s) outside of the US: | |||
| Data Flow Diagram | Yes/No | |||
| 44 | Please provide a data flow diagram showing how data flows from UTHSCSA to your cloud. | Yes | ||
| Artificial Intelligence | Yes/No | |||
| 45 | Does your solution have AI features, or are there plans to implement AI features in the next 12 months? | |||
| 46 | Does your solution leverage machine learning (ML) or do you plan to do so in the next 12 months? | |||
| 47 | Does your solution leverage a large language model (LLM) or do you plan to do so in the next 12 months? | |||
| 48 | Does your solution have an AI risk model when developing or implementing your solution's AI model? | |||
| 49 | Can your solution's AI features be disabled by tenant and/or user? | |||
| 50 | Have your staff completed responsible AI training? | |||
| 51 | Please describe the capabilities of your solution's AI features. | None | ||
| 52 | Does your solution support business rules to protect sensitive data from being ingested by the AI model? | |||
| 53 | Are your AI developer's policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks conspicuously posted, unambiguous, and implemented effectively? | |||
| 54 | Have you identified and measured AI risks? | |||
| 55 | In the event of an incident, can your solution's AI features be disabled in a timely manner? | |||
| 56 | If disabled because of an incident, can your solution's AI features be re-enabled in a timely manner? | |||
| 57 | Do you have documented technical and procedural processes to address potential negative impacts of AI as described by the AI Risk Management Framework (RMF)? | |||
| 58 | If sensitive data is introduced to your solution's AI model, can the data be removed from the AI model by request? | |||
| 59 | Is user input data used to influence your solution's AI model? | |||
| 60 | Do you provide logging for your solution's AI feature(s) that includes user, date, and action taken? | |||
| 61 | Please describe how you validate user inputs. | None | ||
| 62 | Do you plan for and mitigate supply-chain risk related to your AI features? | |||
| 63 | Do you separate ML training data from your ML solution data? | |||
| 64 | Do you authenticate and verify your ML model's feedback? | |||
| 65 | Is your ML training data vetted, validated, and verified before training the solution's AI model? | |||
| 66 | Is your ML training data monitored and audited? | |||
| 67 | Have you limited access to your ML training data to only staff with an explicit business need? | |||
| 68 | Have you implemented adversarial training or other model defense mechanisms to protect your ML-related features? | |||
| 69 | Do you make your ML model transparent through documentation and log inputs and outputs? | |||
| 70 | Do you watermark your ML training data? | |||
| 71 | Do you limit your solution's LLM privileges by default? | |||
| 72 | Is your LLM training data vetted, validated, and verified before training the solution's AI model? | |||
| 73 | Do any actions taken by your solution's LLM features or plugins require human intervention? | |||
| 74 | Do you limit multiple LLM model plugins being called as part of a single input? | |||
| 75 | Do you limit your solution's LLM resource use per request, per step, and per action? | |||
| 76 | Do you leverage LLM model tuning or other model validation mechanisms? | |||
| 77 | Is the AI-enabled system regularly tested for biases, inequities, or other unintended consequences? |
Explanations
| Item No. | Request | Description |
| 51 | Please describe the capabilities of your solution's AI features. | |
| 61 | Please describe how you validate user inputs. |
File details come from the government source that posted it. Updated .