4.23 Exhibit 7 Cyber Review Template Rev.41.xlsx
XLSX spreadsheet 30 KB Posted
- Solicitation number
- CZ-2664-06012025
About this file
The document is a comprehensive Cyber Review Template designed for vendors working with the Jet Propulsion Laboratory (JPL), covering 15 detailed areas of cybersecurity assessment. The template requires vendors to provide extensive information about their organizational information security practices, including details on sensitive data protection, physical and network security, endpoint and server security, administrative controls, data backup, incident response, and security training.
Key areas of focus include verifying the vendor's capabilities in protecting JPL's sensitive data (such as PII, export-controlled information, and confidential business data), ensuring robust cybersecurity measures across network infrastructure, implementing access controls, maintaining comprehensive security policies, and demonstrating incident response readiness. The template seeks detailed responses across areas like application security, encryption practices, third-party audit certifications, password management, and systematic approaches to identifying and mitigating potential security risks when handling JPL's sensitive information.
View the file
Other files
Show all 26
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Template
| Exhibit No.: 7 | |||
| Subcontract No.: | |||
| Dated: 2/27/2025 | |||
| Total Pages 11 | |||
| Vendor Organizational Information | |||
| Yes | No | ||
| 1. Is there a Chief Information Security Officer (CISO) for your organization? | |||
| a. If 'Yes', CISO Name: | |||
| b. Title: | |||
| c. E-Mail Address: | |||
| d. Phone Number: | |||
| 2. What services will be provided to JPL? |
| 3. Who is responsible specifically for information security and privacy? |
| a. Name: |
| b. Title: |
| c. E-Mail Address: |
| d. Phone Number: |
| 4. JPL PO number (if it exists) |
| 5. JPL Contract number (if exists) |
| 6. JPL RFP number or name (if exists) |
| 7. JPL Point of Contact (POC) |
| Area 1. Sensitive Data Protection | |||
| 1. Do you process or store the following JPL information: | Yes | No | |
| a. Privacy information aka Personally Identifiable Information (PI or PII)? | |||
| Social Security Numbers (SSN, EIN, Taxpayer ID), Driver's License, Bank Accounts number with PIN | |||
| b. JPL ITAR or EAR data also known as Export Controlled Data? | |||
| (International Traffic in Arms Regulations) or (Export Administration Regulation) | |||
| c. JPL non-public information including Business Discreet, Confidential, Proprietary, | |||
| Proposal Sensitive, Controlled Unclassified Information (CUI), For Official Use Only (FOUO)? | |||
| (Business Discreet: employment-related records, financial information, acquisition-related records, |
pre-decisional documents, correspondence between JPL and other divisions of Caltech, and business metrics.)
2. What local information security and privacy policies do you have?
| Yes | No | |
| a. Do you have an information security and/or privacy plan? | ||
| If 'Yes', briefly describe: |
| Yes | No | |
| b. Do you allow incidental personal use of equipment containing sensitive data as identified above? | ||
| 3. Are you familiar with NIST SP800-122, Guide to Protecting Personally Identifiable Information (PII)? | ||
| a. Have you had any challenges in complying with NIST SP800-122? | ||
| b. How do you train your technicians about sensitive data protection? |
4. Sensitive data identification: Identify whether you handle, store or process, where you harbor, and what safeguards you apply to the following data:
| a. Social Security Numbers |
| b. Driver's License Numbers |
| c. State ID Card Numbers |
| d. Credit Card Numbers |
| e. Bank Account Information |
| f. Passwords, PINs, Security |
or Access Codes
| g. Export Controlled Information | ||
| Yes | No | |
| 5. Do you assign classification levels to the data you receive and send to JPL using FIPS PUB 199? | ||
| 6. Do you plan to share JPL data with any third parties |
(e.g. research entities, parent corporations, federal agencies, state agencies)?
| a. Which types of data? |
| b. For what purposes/services? |
| c. What written agreements are there for these transactions? |
| 7. What vendors do you outsource or subcontract services or |
infrastructure to that involve JPL data or services?
a. Which types of data or access to data do you share with them in order to perform the function?
| b. For what purposes/services? |
| c. What written agreements are in place to |
oversee these transactions?
| d. How, and how often, do you verify that subcontractors are protecting JPL data that you've provided to them? | ||
| Yes | No | |
| 8. Do you routinely scan workstations and servers hosting JPL's privacy data? | ||
| a. What tool(s) do you use? | ||
| b. How often do you scan? | ||
| c. Who ensures proper action is taken to securely discard data or to secure remaining data? |
| d. How long do you retain the reports? |
| 9. If you harbor JPL Export Controlled data, how do you limit access to U.S. Persons? |
10. If you harbor JPL Export Controlled Data, how do you ensure storage and transmission remains in the U.S.?
| Area 2: Physical Security |
| 1. Where are all servers storing or processing JPL data located? |
| Yes | No | |
| a. Are they all in facility with secure, limited, physical access? | ||
| b. Do you keep logs for ingress/egress to location? | ||
| c. Are all servers housed in a data center located behind the data center firewall? | ||
| d. Are exceptions documented? | ||
| e. If you are storing, handling, or processing Export Controlled data, are all servers |
(including back-up, failover and DR) in a secure data center located within the U.S.?
f. If servers are not in the Data Center, what physical and environmental controls are in place?
| Area 3: Application Security | ||
| Yes | No | |
| 1. Do you scan web applications for vulnerabilities such as cross site scripting before deploying operationally and at least monthly thereafter? | ||
| a. What tool(s) do you use? | ||
| b. How often? | ||
| c. Who ensures proper action is taken to update all software? | ||
| d. How long do you retain the reports? | ||
| Yes | No | |
| 2. Do you perform security code reviews during each phase of development? | ||
| a. Do you have a development and test environment that is separated from production? | ||
| b. Do you have your system configured to regularly patch system components, OS and applications? | ||
| 3. Do you configure your applications to use a web proxy to protect local hosts, ports and protocols? |
| Area 4: Endpoint Security | ||
| Yes | No | |
| 1. Do you have anti-virus software installed with regular updates and scans scheduled? | ||
| a. Do you have anti-malware installed and configured for regular updates and scans? | ||
| b. Do you regularly patch system components, OS, middleware, and applications? | ||
| c. Do you have a personal firewall configured for each system? | ||
| d. Do you perform normal (non-admin) activities using a regular user account |
instead of an admin account?
e. Do you avoid sharing JPL data on insecure networks?
| Area 5: Network Security | ||
| Yes | No | |
| 1. Do you have IP reputation and URL filtering in place? | ||
| 2. Do you configure DDoS protection in your network for addresses used by JPL? | ||
| 3. Do you scan systems for vulnerabilities (especially servers) regularly? | ||
| a. What tool(s) do you use? | ||
| b. How often? | ||
| c. Who reviews the reports? | ||
| d. Who ensures proper action is taken to resolve the problems? | ||
| e. How long do you retain the reports? | ||
| Yes | No | |
| 4. Do you operate a split DNS to segregate internal and external zones? | ||
| 5. Do you have a current configured Intrusion Detection System (IDS)? | ||
| 6. Do you limit elevated remote access to the internal network to Virtual Private Network (VPN) connections? | ||
| 7. Do you offer native IPv6 connectivity? | ||
| 8. Do you operate a "Next-Generation" firewall to secure applications at the URL level? | ||
| 9. Do you operate a web application firewall that provides URL |
filtering and blocking protection for your internal network?
| 10. Do you operate an Intrusion Prevention System (IPS)? |
| 11. Do you have Host-based Intrusion Detection Systems (HIDS) operating in the environment that will host, store |
or process JPL data?
12. Do you operate both inbound Defense-in-Depth controls *and* outbound to monitor unauthorized attempts to reach internet hosts?
13. What segmentation and zones do you operate on your DMZ and internal network that affect JPL data?
(identify zone, port, protocol and services allowed and blocked including direction)
Area 6: Server Security
1. What segregation, isolation or tenancy is configured to isolate JPL data from other systems (single-tenancy preferred)?
| Yes | No | |
| 2. Do you have an inventory of equipment that will store or process JPL data? | ||
| a. If 'Yes', how many and what type of workstations? |
b. If 'Yes', how many and what type of servers?
3. What standards (DISA STIG, CIS Guideline or other) do you use to harden your systems?
| Yes | No | |
| 4. Do you run currently supported operating systems and set them to patch automatically? | ||
| 5. With what frequency do you apply critical security updates to hardware, operating systems, databases, |
middleware, and applications?
| 6. How do you identify and patch third party software on all systems? | ||
| a. What tool(s) do you use? | ||
| b. How often does it scan? | ||
| Yes | No | |
| 7. Do you install anti-virus software on all systems, and set signature files to automatically update? | ||
| 8. Do you remove or disable unneeded services and software, especially those that are network-accessible? | ||
| a. Do you remove RDP? | ||
| b. If it stays, have you configured it limit access? | ||
| c. Do you disable or secure remote access from system-to-system (e.g., rlogin)? | ||
| 9. Have you enabled the local firewall on all systems? | ||
| 10. To what systems do you apply encryption at rest? | ||
| Yes | No | |
| 11. Do you log activities on systems? | ||
| a. Who reviews the logs? | ||
| b. How often are the logs reviewed? | ||
| c. Who ensures proper action is taken in |
response to any findings?
d. How long do you retain the reports?
| Area 7: Administrative Security | ||
| Yes | No | |
| 1. Does each Administrator have an administrative-level username/passphrase set that is unique to that |
individual and different from their standard user acct?
| 2. Do you use the same password for all systems? |
| a. How do you manage the administrator passwords for your systems? |
| Yes | No | |
| 3. Have you changed all default passwords for applications to strong passwords? | ||
| a. Do you use the same password for all your applications? | ||
| b. Have you ensured there are no blank SQL passwords? | ||
| c. How do you manage the passwords? |
| Yes | No | |
| 4. Do you have any systems that are administrated by a third party vendor? | ||
| a. If 'Yes', How do you ensure they are applying proper security measures? |
| 5. Who is granted administrative rights to workstations? |
| 6. How do you review, approve, document the operational necessity for those |
with admin rights?
7. What other options such as two-factor authentication (TFA) do you use for elevated access?
| Area 8: Data Backup and Disaster Recovery | ||
| Yes | No | |
| 1. Do you mirror or back up servers on a regular schedule? | ||
| a. Is the mirrored or backed-up data stored offsite? | ||
| b. Is the mirrored or backed-up data encrypted? | ||
| 2. Do you have a fully documented, up-to-date disaster recovery plan? | ||
| a. If you answered 'Yes', please describe or attach: |
| Yes | No | |
| 3. Do all portable devices have password protection enabled? | ||
| a. Do all laptops have full-disk encryption installed? | ||
| b. How do you secure portable devices? | ||
| c. How do you deal with security of PDAs and cell phones? |
| Area 9: Secure Data Deletion | ||
| Yes | No | |
| 1. Do you have a documented process for the secure disposal of data stored on drives, |
servers, and portable devices?
| a. What methods do you use to ensure this occurs with all devices? |
| b. What provision do you make for secure data deletion upon contract termination? |
| Area 10: Security Audits, Attestations, Certifications and Accreditations | ||
| Yes | No | |
| 1. Do you have documented third party security audits routinely performed on your systems, |
applications and data?
a. Who performs these audits?
2. Provide any third-party attestations of compliance with standards e.g., FedRAMP, ISO/IEC 27001:2005, SSAE 16, or PCI DSS 2.0
3. How do you continuously monitor your risk?
| Area 11: Access Controls | ||
| Yes | No | |
| 1. Do you document password controls including setting strong passwords, periodic changes, |
reuse and sharing restrictions?
| 2. Do you ensure that only authorized personnel have access to the systems, applications and data? |
| 3. What procedures and restrictions govern wireless, remote and mobile device access? |
4. What is your support for integrated Identity Management using SAML 2.0?
| Area 12: Policies | ||
| Yes | No | |
| 1. Do you have documented policies for system development life cycle? | ||
| 2. Do you have documented policies for contingency planning? | ||
| 3. Do you have documented policies for continuous monitoring? | ||
| 4. Do you have documented policies for risk management? | ||
| 5. Do you have documented policies for incident handling and response? | ||
| 6. Do you have documented policies for security configuration? | ||
| 7. Do you have documented policies for information privacy? | ||
| 8. Do you have documented policies for media protection and sanitization? | ||
| 9. Do you have documented policies for access controls? | ||
| 10. Do you have documented policies for network security? | ||
| 11. Do you have documented policies for encryption? | ||
| 12. Do you have documented policies for personnel security? | ||
| 13. Do you have documented policies for interface/interconnection security? |
| Area 13: Incident Response | ||
| Yes | No | |
| 1. Do you have a fully documented, up-to-date, local, incident response procedure? | ||
| a. If you answered 'Yes', please describe or attach: |
b. If 'Yes', what basis is used to categorize, track and report incidents, e.g., NIST SP800-61?
c. What is your notification time to alert JPL if there is a security incident with JPL data?
d. What special provisions do you make for Export Controlled data tracking and incident reporting?
e. What special provisions do you make for privacy information tracking and incident reporting?
| Yes | No | |
| f. Have you had any security or privacy incidents in the last four years? | ||
| i. If 'Yes', briefly describe: |
ii. If 'Yes', what actions did you take to prevent it happening again?
| Area 14: Data Management |
| 1. To what transmissions of JPL data will you apply encryption? |
| 2. Do you have any web sites that will actively collect personal information from JPL users? | ||
| a. If so, what kind of data? | ||
| Yes | No | |
| b. Are there controls to avoid users entering sensitive data when not requested? | ||
| c. Do you post a privacy notice for visitors? | ||
| 3. Do you have system architecture or block diagrams to represent data and process flows to and from JPL? | ||
| a. If 'Yes', please provide the access or integration diagrams with data elements | ||
| b. If 'Yes', please provide a port, protocol and service map that shows all JPL data flows |
| Area I5: Security Training and Awareness |
| 1. What kinds of Cyber Security awareness and training activities do you undertake for users to increase knowledge of risks, and the actions everyone can take to reduce the risks? |
2. What kinds of Cyber Security awareness and training activities do you undertake for system administrators or database administrators to increase knowledge of risks, and the actions everyone can take to reduce the risks?
3. What kinds of Cyber Security awareness and training activities do you undertake specific to developers and developer coding practices to increase knowledge of risks, and the actions everyone can take to reduce the risks?
4. What kinds of Cyber Security awareness and training activities do you undertake specific to privacy information or export controlled data to increase knowledge of risks, and the actions everyone can take to reduce the risks?
File details come from the government source that posted it. Updated .