2-A04 - Risk Assessment 0128.xlsx
XLSX spreadsheet 21 KB Posted
- Attached to
- OMS Coding and Billing Services
- Solicitation number
- RFP 745-26-P14
- Issued by
- Bexar County, Texas
About this file
This is a risk assessment document completed for the University of Texas Health Science Center at San Antonio (UTHSCSA) related to RFP 745-26-P14 for OMS Coding and Billing Services. The assessment evaluates the vendor's compliance with information security standards across 78 criteria aligned with ISO 27005:2011 and NIST frameworks. Key evaluation areas include risk management programs, information security policies, human resource security, asset management, access control, cryptography, physical security, operations security, incident management, business continuity planning, and compliance monitoring. The assessment specifically addresses whether the vendor has documented processes for identifying risks, enforcing access controls with multi-factor authentication, implementing encryption for data in transit and at rest, maintaining audit logs, conducting vulnerability testing and penetration testing, and responding to security incidents. Additionally, the assessment includes sections on data localization requirements, data flow diagrams, and governance inquiries regarding HIPAA compliance and Texas HB130 requirements.
The assessment document also includes a comprehensive section on artificial intelligence and machine learning capabilities, requiring vendors to disclose whether their solutions incorporate AI features, large language models, or machine learning functionality planned within the next 12 months. Vendors must provide detailed responses regarding AI risk models, the ability to disable AI features during incidents, data protection mechanisms to prevent sensitive data ingestion into AI models, logging and audit capabilities, supply chain risk mitigation for AI components, machine learning training data validation and monitoring, and regular testing for algorithmic bias and unintended consequences. The document requests explanations regarding the sourcing of Chinese companies for genomic instruments, geographic location of data storage and processing, and validation procedures for user inputs. No specific pricing information, award dates, contract terms, or incumbent vendor details are included in this risk assessment document.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 3-A06 PDAA.xlsx | XLSX spreadsheet | |
| 10-A01C Gen Quest 0725.pdf | ||
| 1-A07 - BAA.docx | DOCX document | |
| 9-01 745-26-P14.pdf | ||
| 13-A02 - Sample Agreement 745-26-P14.doc | DOC document | |
| 7-A05 TX-Ramp 1003.pdf | ||
| 12-A03 VETHUB 0126.pdf | ||
| 8-S06 Pricing and Delivery Schedule 0725.pdf | ||
| 6-A01B Exec of Offer 0126.pdf | ||
| 5-A01D Addenda Checklist 0725.pdf | ||
| 14-Question Clarification 1.pdf | ||
| 4-S04 Terms Conditions 0725.pdf | ||
| 11-A01A General info 0922.pdf |
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Assessment
| Vendor Name: | ||||
| Name of person completing assessment: | ||||
| Date completed | ||||
| RFP Name | OMS Coding and Billin Services | |||
| RFP Number | 745-26-P14 | |||
| Questions | ||||
| Risk Management (ISO 27005:2011) | Yes/No | Evidence Requested | Evidence Provided? | Framework |
Categories & Sub-Categories 1 Does your institution have a risk management program? Yes ID.BE
ID.GV1
ID.RM
ID.RM1
2 Does your institution have a process for identifying and assessing reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper, or other records containing sensitive information? Yes ID.RA3
ID.RA6
| Information Security Policies (ISO 5) | |||
| 3 | Does your institution have an information security policy that has been approved by management? | Yes | ID.GV1 |
| Human Resource Security (ISO 7) | |||
| 4 | Do all individuals interacting with university systems receive information security awareness training? | PR.AT |
PR.AT1
5 Does your institution have a process for revoking system and building access and returning assigned assets? Yes PR.AC
PR.AC2
PR.PT3
| Asset Management (ISO 8) | ||
| 6 | Has your organization identified critical information assets and the functions that rely on them? | ID.AM |
ID.BE2
| Access Control (ISO 9) | |
| 7 | Does your institution have an access control policy for authorizing and revoking access rights to information systems? |
| Yes | PR.AC | ||
| 8 | Does your institution have a password management program that follows current security standards? | ||
| Yes | PR.IP | ||
| 9 | Does your institution assign user access rights based on assigned roles in the system? | PR.AC1 | |
| 10 | Does your institution have a policy that enforces the concept of least privilege? | PR.AC4 | |
| 11 | Does your institution require multi-factor authentication for systems which access confidential or regulated data? | PR.AC7 | |
| 12 | Does your institution have procedures to regularly review users' access to ensure only needed privileges are applied? | PR.AC4 |
PR.AT2
13 Does your institution employ specific measures to secure remote access services? PR.AC3
PR.MA2
14 Does your institution employ technologies to block or restrict unencrypted sensitive information from traveling to untrusted networks? DE.AE1
PR.PT4
PR.DS5
| 15 | Does your institution have an authentication system in place that applies higher levels of authentication to protect resources with higher levels of sensitivity? | PR.AC7 |
| 16 | Does your institution have standards for isolating sensitive data and procedures and technologies in place to protect it from unauthorized access and tampering? | PR.DS |
PR.DS6
DE.CM7
PR.AC5
| Cryptography (ISO 10) | ||
| 17 | Does your institution use appropriate/vetted encryption methods to protect sensitive data in transit? | PR.DS2 |
| 18 | Does your institution use appropriate/vetted encryption methods to encrypt data at rest? | PR.DS2 |
| 19 | Do your policies indicate when encryption should be used (e.g., at rest, in transit, with sensitive or confidential data, etc.)? | PR.DS1 |
PR.DS2
| Physical and Environmental Security (ISO 11) | ||
| 20 | Do your institution's data centers include controls to ensure that only authorized parties are allowed physical access? | PR.AC2 |
| 21 | Does your institution have a media-sanitization process that is applied to equipment prior to disposal, reuse, or release? | PR.PT2 |
| Operations Security (ISO 12) | ||
| 22 | Are changes to information systems tested, authorized, and reported? | PR.IP3 |
| 23 | Are methods used to detect, quarantine, and eradicate known malicious code on information systems including workstations, servers, and mobile computing devices? | DE.AE2 |
DE.CM1
DE.CM2
DE.CM3
DE.CM4
DE.CM5
RS.AN1
| 24 | Does your institution have a segmented network architecture to provide different levels of security based on the information's classification? | Yes | ID.AM5 |
| 25 | Are Internet-accessible servers protected by more than one security layer (firewalls, network IDS, host IDS, application IDS)? | Yes | PR.PT |
PR.PT1
26 Are security-related activities such as hardware configuration changes, software configuration changes, access attempts, and authorization and privilege assignments automatically logged? PR.IP3
PR.AT2
27 Does your institution regularly review administrative and operative access to audit logs? PR.MA
PR.MA1
PR.MA2
PR.PT1
| 28 | Does your institution regularly review audit logs for access activity and abnormal activity? | PR.PT1 |
| Communications Security (ISO 13) | ||
| 29 | Does your institution continuously monitor your wired and wireless networks for unauthorized access? | DE.CM1 |
DE.CM7
| Systems Acquisition, Development, and Maintenance (ISO 14) | ||
| 30 | Are new information systems or enhancements to existing information systems validated against defined security requirements? | ID.BE5 |
DE.DP2
31 Does your institution have a patch management strategy in place and responsibilities assigned for monitoring and promptly responding to patch releases, security bulletins, and vulnerability reports? Yes ID.RA1
ID.RA2
ID.RA5
PR.IP12
RS.MI3
| Supplier Relationships (ISO 15) | ||
| 32 | Does your institution have a process in place for assessing that external information system providers comply with appropriate security requirements? | ID.AM4 |
DE.CM6
RS.CO5
33 Does your institution have a process in place where vendors go through a risk management process related to ensuring the confidentiality, processing integrity and security of UT Health SA’s data. DE.CM-6
STA-08
RA-4
| 34 | Has there been an external, independent review of the information security and technology environment within the past 12 months (i.e., ISO 27001, SOC 2, HITRUST, FedRAMP, FISMA, etc.)? | RA | |
| 35 | Has your institution had a significant breach in the last 5 years (i.e., compromise of security that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to protected data that is transmitted, stored, or processed)? | RA | |
| Information Security Incident Management (ISO 16) | |||
| 36 | Are incident-handling procedures in place to report and respond to security events throughout the incident life cycle, including the definition of roles and responsibilities? | Yes | PR.IP9 |
DE.AE5
RS.AN2
RS.AN4
RS.MI
RS.MI1
RSMI2
37 Are there procedures in place for security incident response, including the identification, resolution, and reporting of events? RS.AN
RS.MI
| Information Security Aspects of Business Continuity Management (ISO 17) | |||
| 38 | Does your institution have a documented business continuity plan for information technology that is based on a business impact analysis, is periodically tested, and has been reviewed and approved by senior staff or the board of trustees? | Yes | PR.IP9 |
ID.RA4
ID.RA5
DE.AE4
RS.AN2
| 39 | Are backup copies made according to pre-defined schedules, encrypted, and securely stored? | PR.IP4 |
| Compliance (ISO 18) | ||
| 40 | Does your institution perform periodic application and network layer vulnerability testing or penetration testing against critical information systems? | ID.A2 |
PR.IP12
DE.CM8
| 41 | Are you performing independent audits on information systems to identify strengths and weaknesses? | Yes | PR.PT1 | |
| 42 | If this requisition involves genomic instruments, are any parts of the equipment sourced from China? | None | Texas HB130 | |
| HIPAA General | Yes, No, N/A | |||
| 43 | Geographically speaking, is data stored and processed only in the US? If not, list location(s) outside of the US: | |||
| 44 | Will data be accessed only by entity representatives located outside the US? If no, list location(s) outside of the US: | |||
| Data Flow Diagram | Yes/No | |||
| 45 | Please provide a data flow diagram showing how data flows from UTHSCSA to your cloud. | Yes | ||
| Artificial Intelligence | Yes/No | |||
| 46 | Does your solution have AI features, or are there plans to implement AI features in the next 12 months? | |||
| 47 | Does your solution leverage machine learning (ML) or do you plan to do so in the next 12 months? | |||
| 48 | Does your solution leverage a large language model (LLM) or do you plan to do so in the next 12 months? | |||
| 49 | Does your solution have an AI risk model when developing or implementing your solution's AI model? | |||
| 50 | Can your solution's AI features be disabled by tenant and/or user? | |||
| 51 | Have your staff completed responsible AI training? | |||
| 52 | Please describe the capabilities of your solution's AI features. | None | ||
| 53 | Does your solution support business rules to protect sensitive data from being ingested by the AI model? | |||
| 54 | Are your AI developer's policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks conspicuously posted, unambiguous, and implemented effectively? | |||
| 55 | Have you identified and measured AI risks? | |||
| 56 | In the event of an incident, can your solution's AI features be disabled in a timely manner? | |||
| 57 | If disabled because of an incident, can your solution's AI features be re-enabled in a timely manner? | |||
| 58 | Do you have documented technical and procedural processes to address potential negative impacts of AI as described by the AI Risk Management Framework (RMF)? | |||
| 59 | If sensitive data is introduced to your solution's AI model, can the data be removed from the AI model by request? | |||
| 60 | Is user input data used to influence your solution's AI model? | |||
| 61 | Do you provide logging for your solution's AI feature(s) that includes user, date, and action taken? | |||
| 62 | Please describe how you validate user inputs. | None | ||
| 63 | Do you plan for and mitigate supply-chain risk related to your AI features? | |||
| 64 | Do you separate ML training data from your ML solution data? | |||
| 65 | Do you authenticate and verify your ML model's feedback? | |||
| 66 | Is your ML training data vetted, validated, and verified before training the solution's AI model? | |||
| 67 | Is your ML training data monitored and audited? | |||
| 68 | Have you limited access to your ML training data to only staff with an explicit business need? | |||
| 69 | Have you implemented adversarial training or other model defense mechanisms to protect your ML-related features? | |||
| 70 | Do you make your ML model transparent through documentation and log inputs and outputs? | |||
| 71 | Do you watermark your ML training data? | |||
| 72 | Do you limit your solution's LLM privileges by default? | |||
| 73 | Is your LLM training data vetted, validated, and verified before training the solution's AI model? | |||
| 74 | Do any actions taken by your solution's LLM features or plugins require human intervention? | |||
| 75 | Do you limit multiple LLM model plugins being called as part of a single input? | |||
| 76 | Do you limit your solution's LLM resource use per request, per step, and per action? | |||
| 77 | Do you leverage LLM model tuning or other model validation mechanisms? | |||
| 78 | Is the AI-enabled system regularly tested for biases, inequities, or other unintended consequences? |
Explanations
| Item No. | Request | Description |
| 42 | Please list Chinese companies. | |
| 51 | Please describe the capabilities of your solution's AI features. | |
| 61 | Please describe how you validate user inputs. |
File details come from the government source that posted it. Updated .