4-Form K-12CVAT-Lite-V3.0 (1).xlsx
XLSX spreadsheet 949 KB Posted
- Attached to
- Robotic Lawn Mower
- Solicitation number
- 26-10101
- Issued by
- Missouri
About this file
K-12 Community Vendor Assessment Tool - Lite (K-12CVAT) Summary
This is a comprehensive security assessment framework document developed by the Consortium of School Networking (CoSN) Cybersecurity Advisory Team, adapted from the EDUCAUSE Higher Education Community Vendor Assessment Tool (HECVAT-Lite), for K-12 school systems and education service districts to evaluate third-party software and service vendors. The K-12CVAT Version 3.0 provides a standardized questionnaire methodology designed to streamline vendor security risk assessment across K-12 institutions while reducing the burden on vendors to respond to multiple individualized security evaluation requests. The assessment tool is structured in four main sections: General Information (vendor and product details), Documentation (security certifications and compliance frameworks), Company Overview (vendor background and business continuity capabilities), and Safeguards (technical and operational security controls organized into fourteen functional categories including application security, authentication, data protection, disaster recovery, firewalls and networking, physical security, and vulnerability scanning). The document includes detailed analyst reference guidance to assist K-12 security professionals in interpreting vendor responses, conducting follow-up inquiries, and converting qualitative answers into quantitative compliance scores using multiple security frameworks including CIS Critical Security Controls, HIPAA, ISO 27002:2013, NIST Cybersecurity Framework, NIST SP 800-171, and NIST SP 800-53r4.
The K-12CVAT serves dual purposes: vendors complete the lightweight questionnaire to demonstrate their security posture to multiple prospective K-12 customers, thereby reducing redundant assessment efforts, while school districts use the standardized response data to evaluate vendors for procurement processes, contract negotiations, and ongoing vendor management. The assessment framework addresses K-12-specific security concerns including student data privacy, compliance with state student data privacy consortium statements, and protection of personally identifiable information (PII) of students and staff. The tool includes scoring mechanisms and report generation capabilities to produce summary assessments and cross-referenced compliance mappings against various security standards, enabling institutions to make risk-based vendor selection decisions and document security due diligence activities aligned with institutional policies and regulatory requirements. The Rockwood School District in Missouri is utilizing this vendor assessment framework as part of its solicitation for a facilities management software platform to manage facility usage, work orders, assets, and capital planning.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 1-Acknowledgement Form.pdf | ||
| 3-E-Verify.doc | DOC document | |
| 1-Acknowledgment Form (RFP).docx | DOCX document | |
| 2-Anti-Discrimination Against Israel Affidavit.docx | DOCX document | |
| 5-26-10101.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
What is the K-12CVAT
Proceed to the next tab, Introduction.
What is the K-12CVAT?
For K-12 Schools and Districts
The K-12 Community Vendor Assessment Tool or K-12CVAT, is a questionnaire framework specifically designed for K-12 schools, districts and education service districts to measure vendor risk. Before you purchase a third-party solution, ask the solution provider to complete a K-12CVAT tool to confirm that information, data, and cybersecurity policies are in place to protect your sensitive school system information and constituents' PII. It is recommended that you use the K-12CVAT as part of procurement processes, including having potential solution providers complete the questionnaire as part of RFP processes and purchase evaluations.
For K-12 Solution Providers
The K-12CVAT offers a consistent and single questionnaire for solution providers to complete for potential and current K-12 organization clients to support evaluation and understanding of the risks and opportunities of your product. The advantage of the K-12CVAT is that, once completed, your assessment can be used by multiple K-12 organizations to streamline procurement processes with your K-12 clients
The K-12CVAT is based off the Educause Higher Education Community Vendor Assessment Tool - Lite (HECVAT-Lite), however, the questions are geared specifically towards K-12 education. Please make sure to use the K-12 questionnaire for your K-12 clients.
Introduction
Proceed to the next tab, Instructions.
Shared Assessments Introduction
K-12 education environments are rapidly changing and the speed of cloud service adoption is increasing. Institutions looking for ways to do more with less see cloud services as a good way to save resources. As school systems deploy or identify cloud services, they must ensure the cloud services are appropriately assessed for managing the risks to the confidentiality, integrity and availability of sensitive institutional information and the PII of constituents. Many school systems have established a cloud security assessment methodology and resources to review cloud services for privacy and security controls. Other school systems don’t have sufficient resources to assess their cloud services in this manner. On the vendor side, many cloud services providers spend significant time responding to the individualized security assessment requests made by K-12 school system customers, often answering similar questions repeatedly. Both the provider and consumer of cloud services are wasting precious time creating, responding, and reviewing such assessments.
The K-12 Community Vendor Assessment Toolkit (K-12CVAT), based off the Educause Higher Education Community Vendor Assessment Tool (or HECVAT), attempts to generalize K-12 education system information security and data protections and issues for consistency and ease of use. Some school systems may have specific issues that must be addressed in addition to the general questions sets provided in the toolkit. It is anticipated that the K-12CVAT will be revised over time to account for changes in services provisioning and the information security and data protection needs of K-12 education institutions.
The K-12 Community Vendor Assessment Toolkit:
● Helps K-12 school systems ensure that vendor services are appropriately assessed for security and privacy needs, including some that are unique to K-12 education
● Allows a consistent, easily-adopted methodology for campuses wishing to reduce costs through vendor services without increasing risks
● Reduces the burden that service providers face in responding to requests for security assessments from higher education institutions
The K-12 Community Vendor Assessment Lite is a lightweight questionnaire used to a) expedite the process and b) begin to establish the process and build the muscle of assessing vendor risk.
The K-12 Community Vendor Assessment Lite (and Toolkit) was adapted by the Consortium of School Networking (COSN) Cybersecurity Advisory Team for use in K-12 school systems with permission from Educause. The original HECVAT and toolkit was created by the Higher Education Information Security Council Shared Assessments Working Group. Its purpose is to provide a starting point for the assessment of vendor provided services and resources.
Credit to Educause for the original HECVAT toolkit from which this K-12 School System version is adapted.
(C) EDUCAUSE 2019
This work is licensed under a Creative Commons Attribution-Noncommercial-ShareAlike 4.0 International License (CC BY-NC-SA 4.0).
Instructions K-12 Vendor Assessment Tool - Lite - Instructions
| Target Audience |
| These instructions are for vendors interested in providing the school system with a software and/or a service. |
This worksheet should not be completed by the K-12 school system entity. The purpose of this worksheet is for the vendor to submit robust security safeguard information in regards to the product (software/service) being assessed in the Institution's assessment process.
| Document Layout |
| There are four main sections of the K-12 Community Vendor Assessment Tool - Lite, all listed below and outlined in more detail. Within each section, answer each question top-to-bottom. Some questions are nested and may be blocked out via formatting based on previous answers. Populating this document in the correct order improves efficiency. |
Do not overwrite selection values (data validation) in column C of the K-12CVAT - Lite tab.
| General Information | This section is self-explanatory; product specifics and contact information. GNRL-01 through GNRL-10 should be populated by the Vendor. GNRL-11 and GNRL-12 are for K-12 School System/Institution use only. |
| Documentation | Focused on external documentation, the Institution is interested in the frameworks that guide your security strategy and what has been done to certify these implementations. |
| Company Overview | This section is focused on company background, size, and business area experience. |
| Safeguards | The remainder of the document consists of various safeguards, grouped generally by section. |
| In sections where vendor input is required there are only one or two columns that need modification, Vendor Answers and Additional Information, columns C and D respectively (see Figure 1 below). You will see that sometimes C and D are separate and other times are merged. If they are separate, C will be a selectable, drop-down box and any supporting information should be added to column D. If C and D are merged, the question is looking for the answer to be in narrative form. At the far right is a column titled “Guidance”. After answering questions, check this column to ensure you have submitted information/documentation to sufficiently answer the question. Use the “Additional Information” column to provide any requested details. | |
| Figure 1: | |
| Definitions and Data Zones | |
| Institution | Any school, school district, education service district or K-12 institution using the K-12 Education Community Vendor Assessment Tool Lite |
| Institution Data Zone | The country/region in which an Institution is located, including all laws and regulations in-scope within that country/region. |
| Vendor Data Zone | The country/region in which a vendor is headquartered and/or serves its products/services, including all laws and regulations in-scope within that country/region. |
| Customers from different regions may expect vary protections of data (e.g. GDPR), this is the Institution Data Zone. Vendors may handle data differently depending on the country or region where data is stored, this is the Vendor Data Zone. |
As a vendor, if your security practices vary based on your region of operation, you may want to populate a K-12CVAT in the context for each security zone (strategy). That said, Institutions from different data zones may still use vendor responses from other state Data Zones. If your security practices are the same across all regions of operations, indicate "All" in your Vendor Data Zone.
Example A: If vendor ABC is headquartered and stores data in Canada, and provides services to only customers in Canada, ABC should state "Canada" in both Data Zone fields.
Example B: If vendor ABC is headquartered and stores data in Canada, and additionally provides services to customers in the United Kingdom, ABC may want to assure customers in the United Kingdom that their data is handled properly for their region. In that case, ABC should state "Canada" in the Vendor Data Zone and "United Kingdom" in the Institution Data Zone.
Example C: If your security strategy is broad and doesn't fit this statement model, provide a brief summary in each field and the Institution's Security Analyst can assess your response.
| Data Reporting |
| To update data in the Report tabs, click Refresh All in the Menu tab. Input provided in the K-12CVAT tab is assessed a preliminary score pending Institution's Security Analyst review. |
| Proceed to the next tab, K-12CVAT - Lite. |
| For Institution's Security Analysts |
| 1. Raw vendor answers can be viewed on the K-12CVAT tab. |
2. To begin your assessment, review the Analyst Report tab, ensuring that you select the appropriate security standard used in your institution (cell B7) before you begin.
3. Review the Analyst Reference tab for guidance and question/response interpretation.
4. Select compliance states for the outstanding non-compliant or short-answer questions in column G. Once all subjective questions are evaluated and compliance indicated, move to the Summary Report tab.
5. To update the report's data, select Refresh All in the Data menu. Review details in the Summary Report and based on your assessment, follow-up with vendor for clarification(s) or add the Summary Report output to your Institution's reporting documents.
K-12CVAT
K-12 Community Vendor Assessment Tool (CVAT) - Lite Version 3.0
| DATE-01 | Date | mm/dd/yyyy | ||||
| General Information | ||||||
| In order to protect the institution (school, district or service district) and its systems, vendors whose products and/or services will access and/or host institutional data must complete the K-12 Community Vendor Assessment Toolkit. Throughout this tool, anywhere where the term data is used, this is an all-encompassing term including at least data and metadata. Answers will be reviewed by institution security analysts upon submittal. This process will assist the institution in preventing breaches of protected information and comply with institution policy, state, and federal law. This is intended for use by vendors and should be completed by the vendor. | ||||||
| GNRL-01 through GNRL-15; populated by Vendor | ||||||
| GNRL-01 | Vendor Name | Vendor Name | ||||
| GNRL-02 | Product Name | Product Name and Version Information | ||||
| GNRL-03 | Product Description | Brief Description of the Product | ||||
| GNRL-04 | Web Link to Product Privacy Notice | http://www.vendor.domain/privacynotice | ||||
| GNRL-05 | Vendor Contact Name | Vendor Contact Name | ||||
| GNRL-06 | Vendor Contact Title | Vendor Contact Title | ||||
| GNRL-07 | Vendor Contact Email | Vendor Contact E-mail Address | ||||
| GNRL-08 | Vendor Contact Phone Number | 555-555-5555 | ||||
| GNRL-09 | Vendor Data Zone | See Instructions tab for guidance | ||||
| GNRL-10 | Institution Data Zone | See Instructions tab for guidance | ||||
| GNRL-11 and GNRL-12; populated by Institution's Information Technology or Security Office | ||||||
| GNRL-11 | School Organization Security Analyst/Engineer | Institution's Security Analyst/Engineer Name | ||||
| GNRL-12 | Assessment Contact | ticket#@yourdomain.edu | ||||
| Instructions | ||||||
| Step 1: Complete each section answering each set of questions in order from top to bottom; the built-in formatting logic relies on this order. Step 2: Submit the completed K-12 Community Vendor Assessment Toolkit - Lite to the institution according to institutional procedures. | ||||||
| Documentation | Vendor Answers | Additional Information | Guidance | |||
| DOCU-01 | Have you undergone a SSAE 18 audit? | |||||
| DOCU-02 | Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ? | |||||
| DOCU-03 | Have you received the Cloud Security Alliance STAR certification? | |||||
| DOCU-04 | Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.) Please identify which one under "additional information" | |||||
| DOCU-05 | Are you compliant with FISMA standards? | |||||
| DOCU-06 | Would you sign the Student Data Privacy Consortium statement for the state in which our district is located? (https://sdpc.a4l.org/) | |||||
| Company Overview | Vendor Answers | Additional Information | Guidance | |||
| COMP-01 | Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships. | Include circumstances that may involve off-shoring or multi-national agreements. | ||||
| COMP-02 | Describe how long your organization has conducted business in this product area. | Include the number of years and in what capacity. | ||||
| COMP-03 | Do you have existing K-12 customers? | |||||
| COMP-04 | Have you had a significant cybersecurity incident that has disrupted availability for longer than 8 hours? | |||||
| COMP-05 | Have you had a security event in the last 5 years that impacted privacy, operations, data, customers, what steps did you take to handle the incident? | |||||
| COMP-06 | Do you have a formal risk management and cybersecurity program in place? | |||||
| COMP-07 | If applicable, do you have dedicated customer support and product management? | APPL-04 | ||||
| COMP-08 | If applicable, do you have dedicated software and systems development teams? | |||||
| COMP-09 | Use this area to share information about your environment that will assist those who are assessing your company data security program. | Share any details that would help information security analysts assess your product. | APPL-05 | |||
| Application/Service Security | Vendor Answers | Additional Information | Guidance | APPL-08 | ||
| HLAP-01 | Does you system support various permission levels (for example, role based access control) for end users? | APPL-01 | ||||
| HLAP-02 | Do you enforce additional security controls for privileged access users (e.g. system administrators)? | APPL-02 | ||||
| HLAP-03 | Can employees access protected or sensitive data remotely? | APPL-03 | ||||
| HLAP-04 | Is an audit log of access maintained by the system? | |||||
| HLAP-05 | If necessary would you be willing to share systems schematics, diagrams, data flow diagrams, etc. ? | APPL-04 | ||||
| HLAP-06 | Has your system been tested for input validation errors and do you have appropriate error messaging? | APPL-05 | ||||
| HLAP-07 | Is district data appropriately segmented and secured from other organization's data or access and can you demonstrate through reports? | APPL-06 | ||||
| HLAP-08 | Do you have a quality multi tenancy environment with good reporting? | APPL-06 | ||||
| Authentication, Authorization, and Accounting | Vendor Answers | Additional Information | Guidance | |||
| HLAA-01 | Do you have strong authentication in place including MFA and additional controls for privileged access accounts? | AAAI-01 | ||||
| HLAA-02 | Does your web-based interface support authentication, including standards-based single-sign-on? (e.g. SAMAL, OAuth, ClassLink, etc.) | AAAI-05 | ||||
| HLAA-03 | Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication? | AAAI-12 | ||||
| HLAA-04 | Do K-12 district staff have access to audit logs that allow them to see actions and activities taken by their users? | AAAI-15 | ||||
| Business Continuity Plan | Vendor Answers | Additional Information | Guidance | BCPL-06 | ||
| HLBC-01 | Do you have a documented Business Continuity Plan (BCP)? | QUAL-04 | ||||
| HLBC-02 | Is there a documented communication plan in your BCP for impacted clients? | BCPL-05 | ||||
| HLBC-03 | Are all components of the BCP reviewed at least annually and updated as needed to reflect change? | BCPL-06 | ||||
| HLBC-04 | Does your organization regularly test the failover or recovery of production environment for the purposes of BCP and continuity? | BCPL-11 | ||||
| Change Management | Vendor Answers | Additional Information | Guidance | |||
| HLCH-01 | Do you have a documented and currently followed change management process (CMP) for standard and emergency changes? | CHNG-01 | ||||
| HLCH-02 | Will the district be notified of changes to your environment that could impact the district's security posture or service availability? | CHNG-03 | ||||
| HLCH-03 | Do you have policy and procedure, currently implemented, guiding how known vulnerabilities and zero day attack risks are mitigated until patches are available and applied? | CHNG-13 | ||||
| Data | Vendor Answers | Additional Information | Guidance | |||
| HLDA-01 | Do you logically separate institution's data from that of other customers? | DATA-01 | ||||
| HLDA-02 | Is sensitive data encrypted in transport? (e.g. system-to-client) | DATA-03 | ||||
| HLDA-03 | Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)? | DATA-04 | ||||
| HLDA-04 | Do backups containing institution data ever leave the United States, either physically or via network routing? | DATA-23 | ||||
| HLDA-05 | Do you have a media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures? | DATA-24 | ||||
| HLDA-06 | Is any institution data visible in system administration modules/tools? | DATA-29 | ||||
| Database | Vendor Answers | Additional Information | Guidance | |||
| HLDB-01 | Does the database implement encryption of specified data elements in storage consistent with current encryption standards? | DBAS-01 | ||||
| Datacenter | Vendor Answers | Additional Information | Guidance | DCTR-02 | ||
| HLDC-01 | Will any institution data leave the United States? | DCTR-09 | ||||
| HLDC-02 | Does your company own the physical data center where the institution's data will reside? | DCTR-01 | ||||
| HLDC-03 | Does the hosting provider have a SOC 2 Type 2 report available? | DCTR-02 | ||||
| Disaster Recovery Plan | Vendor Answers | Additional Information | Guidance | DRPL-13 | ||
| HLDR-01 | Do you have a Disaster Recovery Plan (DRP)? | QUAL-05 | ||||
| HLDR-02 | Are any disaster recovery locations outside the institution's of the United States? | DRPL-04 | ||||
| HLDR-03 | Are all components of the DRP reviewed at least annually and updated as needed to reflect change? | DRPL-12 | ||||
| Firewalls, IDS, IPS, and Networking | Vendor Answers | Additional Information | Guidance | |||
| HLFI-01 | Are you utilizing a web application firewall (WAF) and/or a stateful packet inspection (SPI) firewall? | FIDP-01 | FIDP-02 | |||
| HLFI-02 | Do you have a documented policy for firewall change requests? | FIDP-04 | ||||
| HLFI-03 | Do you have automated threat monitoring and notification systems enabled? (for example, SEIM, EDPM, etc.) | FIDP-09 | ||||
| HLFI-04 | Is there a 24x7x365 monitoring and response process in place for intrusions? | |||||
| Physical Security | Vendor Answers | Additional Information | Guidance | |||
| HLPH-01 | Does your organization have physical security controls and policies in place? | PHYS-01 | ||||
| HLPH-02 | Are employees allowed to access or transport customer data, copy or store customer data on personally owned devices, or physically remove data from the protected infrastructure of your organization? | PPPR-08 | ||||
| Policies, Procedures, and Processes | Vendor Answers | Additional Information | Guidance | PPPR-11 | ||
| HLPP-01 | Can you share the organization chart, mission statement, and policies for your information security unit? | PPPR-18 | ||||
| HLPP-02 | Are information security principles designed into the product lifecycle (e.g. are you incorporating and upgrading security as an essential design element)? | PPPR-08 | ||||
| HLPP-03 | Do you have a formal, documented incident response plan that covers physical and cyber incident response and defined severity levels? | PPPR-10 | ||||
| HLPP-04 | Do you have a documented information security policy? | PPPR-16 | ||||
| Systems Management & Configuration | Vendor Answers | Additional Information | Guidance | |||
| HLSY-01 | Do you employ network and administrative segmentation in the management of this service? (for example, systems supporting the service managed via a separate management network, separate administrative controls and access, etc.) | SYST-01 | ||||
| HLSY-02 | Do you have standard hardened configurations for severs, appliances and mobile devices? | |||||
| HLSY-03 | Do you encrypt company owned mobile devices? | VULN-03 | ||||
| Vulnerability Scanning | Vendor Answers | Additional Information | Guidance | |||
| HLVU-01 | Have your systems and applications had a third party security assessment completed in the last year? | VULN05 | VULN-02 | |||
| HLVU-02 | Are your applications scanned for vulnerabilities [that are remediated]? | |||||
| HLVU-03 | Are your systems scanned for vulnerabilities [that are remediated]? |
000000 &P
Standards Crosswalk K-12 Community Vendor Assessment Tool (K-12CVAT) - Standards Crosswalk
| Documentation | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | |
| DOCU-01 | Have you undergone a SSAE 18 audit? |
ID#AAAAW90Jpfc (2022-03-17 03:18:20) In 2011, Statement on Standards for Attestation Engagements (SSAE) No. 16 took effect and replaced SAS 70 as the authoritative guidance for performing a service auditor's examination. SSAE 16 established a new attestation standard (AT 801) to contain the professional guidance.
| You can learn more about SSAE 16 at www.ssae16.com. | 15.2.1 | SA-9 | ||
| DOCU-02 | Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ? |
ID#AAAAW90Jpgs (2022-03-17 03:18:20) CSA STAR Self Assessment is free and open to all cloud providers and allows them to submit self assessment reports that document compliance to CSA-published best practices.
| Website: https://cloudsecurityalliance.org/star/self-assessment/ | 15.2.1 | PE-2, PE-3, PE-5, PE-11, PE-13, PE-14, SA-9 | ||
| DOCU-03 | Have you received the Cloud Security Alliance STAR certification? |
ID#AAAAW9rj3qo (2022-03-17 03:18:20) The CSA STAR Certification is a rigorous third party independent assessment of the security of a cloud service provider. The technology-neutral certification leverages the requirements of the ISO/IEC 27001 management system standard together with the CSA Cloud Controls Matrix, a specified set of criteria that measures the capability levels of the cloud service.
| Website: https://cloudsecurityalliance.org/star/certification/ | 15.2.1 | PE-2, PE-3, PE-5, PE-11, PE-13, PE-14, SA-9 | ||||
| DOCU-04 | Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.) Please identify which one under "additional information" | 18.1.1 | SA-9 | |||
| DOCU-05 | Are you compliant with FISMA standards? |
ID#AAAAW9riBSA (2022-03-17 03:18:20) The Federal Information Security Management Act (FISMA) is United States legislation that defines a comprehensive framework to protect government information, operations and assets against natural or man-made threats.
Website: http://www.dhs.gov/FISMA slight wording change
| -Josh Callahan | 18.1.1 | SA-9 | ||||||
| DOCU-06 | Would you sign the Student Data Privacy Consortium statement for the state in which our district is located? (https://sdpc.a4l.org/) | §164.308(a)(1)(i) | 18.1.4 | ID.GV-3 | ID.GV-3 | SA-9 | ||
| Company Overview | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| COMP-01 | Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships. | |||||||
| COMP-02 | Describe how long your organization has conducted business in this product area. | |||||||
| COMP-03 | Do you have existing K-12 customers? | 15.2.1 | ||||||
| COMP-04 | Have you had a significant cybersecurity incident that has disrupted availability for longer than 8 hours? | 15.2.2 | ||||||
| COMP-04.5 | Have you had more than one security event in the last 5 years that impacted privacy, operations, data, customers, what steps did you take to handle the incident? IF yes, please describe the steps you took to improve your security and reduce risk. | 15.2.2 | ||||||
| COMP-05 | Have you had a security event in the last 5 years that impacted privacy, operations, data, customers, what steps did you take to handle the incident? | 15.2.1 | ||||||
| COMP-06 | Do you have a formal risk management and cybersecurity program in place? | 14.2.1 | SA-3, SA-15, SC-2, PM-2, PM-10, SI-5,PM-3 | |||||
| COMP 07 | If applicable, do you have dedicated software and systems development teams? | 14.2.1 | ||||||
| COMP-08 | If applicable, do you have dedicated software and systems development teams? | 15.2.1 | ||||||
| Application/Service Security | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLAP-01 | Does you system support various permission levels (for example, role based access control) for end users? | CSC 14 | 9.2.2 | PR.AC-4 | 3.1.1, 3.1.2, 3.1.7 | AC-2, AC-3, AC-6 | APPL-03 | |
| HLAP-02 | Do you enforce additional security controls for privileged access users (e.g. system administrators)? | CSC 16 | 9.1.1 | PR.AC-4, PR.PT-3 | 3.4.9 | CM-11 | APPL-04 | |
| HLAP-03 | Can employees access protected or sensitive data remotely? | CSC 12 | 6.2 | PR.PT-3 | 3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.8, 3.1.20, 3.7.5, 3.8.2, 3.13.7 | AC-3, CM-7; NIST SP 800-46 | APPL-07 | |
| HLAP-04 | Is an audit log of access maintained by the system? | CSC 2 | 12.1.1 | ID.AM-1, ID.AM-2, ID.AM-4 | CA-9, SC-4 | APPL-11 | ||
| HLAP-05 | If necessary would you be willing to share systems schematics, diagrams, data flow diagrams, etc. ? | CSC 16 | 14.2.5 | PR.DS-6 | APPL-18 | |||
| HLAP-06 | Has your system been tested for input validation errors and do you have appropriate error messaging? | CSC 12 | 14.2.5 | RA-2 | APPL-19 | |||
| Authentication, Authorization, and Accounting | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLAA-01 | Do you have strong authentication in place including MFA and additional controls for privileged access accounts? | CSC 16 | 9.2.3, 9.3.1, 9.4.3 | PR.AC-1 | 3.5.7 | IA-5(1) | AAAI-02 | |
| HLAA-02 | Does your web-based interface support authentication, including standards-based single-sign-on? (e.g. SAMAL, OAuth, ClassLink, etc.) | CSC 16 | 9.1.1, 9.2.3, 9.3.1, 9.4.3 | PR.AC-1 | 3.5.1 | IA-2, IA-5 | AAAI-05 | |
| HLAA-03 | Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication? | CSC 16 | 9.4.3 | PR.AC-1, PR.AC-4 | AAAI-12 | |||
| HLAA-04 | Do K-12 district staff have access to audit logs that allow them to see actions and activities taken by their users? | CSC 16 | 9.4.3 | PR.AC-1, PR.AC-4 | AAAI-14 | |||
| Business Continuity Plan | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLBC-01 | Do you have a documented Business Continuity Plan (BCP)? | CSC 10 | 17.1.1 | PR.IP-9 | 3.12.2 | AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34 | BCPL-01 | |
| HLBC-02 | Is there a documented communication plan in your BCP for impacted clients? | CSC 10 | 17.1.2 | PR.IP-9 | 3.12.2 | AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34 | BCPL-05 | |
| HLBC-03 | Are all components of the BCP reviewed at least annually and updated as needed to reflect change? | CSC 10 | 17.1.2 | PR.IP-9 | 3.12.2 | AU-7, AU-9, IR-4, AC-5, CP-4, CP-10; NIST SP 800-34 | BCPL-06 | |
| HLBC-04 | Does your organization regularly test the failover or recovery of production environment for the purposes of BCP and continuity? | CSC 10 | 17.1.3 | PR.IP-9 | AC-5, CP-4, CP-10; NIST SP 800-34 | BCPL-11 | ||
| Change Management | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLCH-01 | Do you have a documented and currently followed change management process (CMP) for standard and emergency changes? | CSC 10 | 12.1.2 | PR.IP-3 | 3.4.3, 3.4.4 | CM-3, CM-4, CM-5 | CHNG-01 | |
| HLCH-02 | Will the district be notified of changes to your environment that could impact the district's security posture or service availability? | CSC 10 | 12.1.2 | CM-3, CM-4, CM-5 | CHNG-03 | |||
| HLCH-03 | Do you have policy and procedure, currently implemented, guiding how known vulnerabilities and zero day attack risks are mitigated until patches are available and applied? | CSC 13 | §164.308(a)(1)(ii)(B) | 12.6.1 | CM-3, CM-4, CM-5 | CHNG-13 | ||
| Data | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLDA-01 | Do you logically separate institution's data from that of other customers? | CSC 12 | PR.AC-2, PR.IP-5 | 3.1.3, 3.8.1 | AC-4, MP-2, MP-4 | DATA-02 | ||
| HLDA-02 | Is sensitive data encrypted in transport? (e.g. system-to-client) | CSC 13 | 8.2.3, 10.1.1 | PR.DS-1, PR.DS-2 | 3.1.19, 3.8.1 | MP-2, AC-19(5) | DATA-04 | |
| HLDA-03 | Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)? | CSC 13 | 8.2.3, 10.1.1 | PR.DS-1 | 3.1.19, 3.8.1 | MP-2, AC-19(5) | ||
| HLDA-04 | Do backups containing institution data ever leave the United States, either physically or via network routing? | CSC 13 | 12.3.1 | 3.8.9 | CP-9, MP-5 | DATA-25 | ||
| HLDA-05 | Do you have a media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures? | CSC 13 | 8.3.1 | PR.DS-3 | 3.7.1, 3.7.2, 3.8.3 | CP-9 MP-6, NIST SP 800-60, NIST SP 800-88, AC-2, AC-6, IA-4, PM-2, PM-10, SI-5, MA-2, MA-3, MP-6 | DATA-26 | |
| HLDA-06 | Is any institution data visible in system administration modules/tools? | CSC 13, CSC 14 | 14.2.5 | PR.AC-4 | DATA-31 | |||
| Database | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLDB-01 | Does the database implement encryption of specified data elements in storage consistent with current encryption standards? | CSC 13 | 10.1.1 | PR.DS-1 | DBAS-01 | |||
| Datacenter | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLDC-01 | Will any institution data leave the United States? | CSC 12 | 11.2.1 | DCTR-10 | ||||
| HLDC-02 | Does your company own the physical data center where the institution's data will reside? | CSC 14 | 11.1.1 | PR.AC-2, PR.IP-5 | DCTR-01 | |||
| HLDC-03 | Does the hosting provider have a SOC 2 Type 2 report available? | CSC 13 | 11.1.1 | DCTR-02 | ||||
| Disaster Recovery Plan | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLDR-01 | Do you have a Disaster Recovery Plan (DRP)? | CSC 10 | 17.1.1 | PR.IP-9 | 3.12.2 | AC-5, CP-4, CP-10, NIST SP 800-34 | DRPL-01 | |
| HLDR-02 | Are any disaster recovery locations outside the institution's of the United States? | CSC 10, CSC 12 | 17.1.1 | PR.IP-9 | AC-5, CP-4, CP-10, NIST SP 800-34 | DRPL-04 | ||
| HLDR-03 | Are all components of the DRP reviewed at least annually and updated as needed to reflect change? | CSC 10 | 17.1.1 | PR.IP-9 | 3.12.2 | AC-5, CP-4, CP-10, NIST SP 800-34 | DRPL-13 | |
| Firewalls, IDS, IPS, and Networking | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLFI-01 | Are you utilizing a web application firewall (WAF) and/or a stateful packet inspection (SPI) firewall? | CSC 9 | 13.1.1 | PR.DS-5 | FIDP-01 | |||
| HLFI-02 | Do you have a documented policy for firewall change requests? | CSC 9 | 12.1.2 | PR.AC-5 | FIDP-04 | |||
| HLFI-03 | Do you have automated threat monitoring and notification systems enabled? (for example, SEIM, EDPM, etc.) | CSC 19 | 12.4.1 | 3.6.1, 3.14.6, 3.14.7 | IR-2, IR-4, IR-9 | FIDP-09 | ||
| HLFI-04 | Is there a 24x7x365 monitoring and response process in place for intrusions? | CSC 19 | 12.4.1 | DE.CM-1, DE.CM-2, DE.CM-7 | 3.6.1, 3.14.6, 3.14.7 | IR-2, IR-4, IR-10 | FIDP-10 | |
| Physical Security | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLPH-01 | Does your organization have physical security controls and policies in place? | CSC 3 | 11.1.1 | PR.AC-2, PR.AT-5, PR.IP-5, DE.CM-2 | 3.8.2, 3.10.1, 3.10.2, 3.10.5, 3.10.6, 3.12.1 | MP-4, PE-2, PE-5, PE-6, PE-17 | PHYS-01 | |
| HLPH-02 | Are employees allowed to access or transport customer data, copy or store customer data on personally owned devices, or physically remove data from the protected infrastructure of your organization? | CSC 13 | 8.2.3 | PR.AC-2, PR.AC-4, PR.DS-1, PR.DS-3, PR.DS-5 | 3.8.1, 3.8.5, 3.8.7 | MP-2, MP-5, MP-7 | PHYS-02 | |
| Policies, Procedures, and Processes | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLPP-01 | Can you share the organization chart, mission statement, and policies for your information security unit? | 5.1.1 | ID.GV-2 | 3.9.1, 3.9.2 | PM-2, PM-10, SI-5, CA-5, PM-1 | PPPR-01 | ||
| HLPP-02 | Are information security principles designed into the product lifecycle (e.g. are you incorporating and upgrading security as an essential design element)? | CSC 4 | 14.2.1 | PR.IP-2 | 3.13.2 | CA-5, CM-3, PM-1, SA-15, SA-3, SA-8, SC-2 | PPPR-08 | |
| HLPP-03 | Do you have a formal, documented incident response plan that covers physical and cyber incident response and defined severity levels? | CSC 19 | 16.1.5 | PR.IP-9 | 3.6.1, 3.12.2 | CA-5, PM-1, IR-4, IR-5, IR-7, IR-8 | PPPR-11 | |
| HLPP-04 | Do you have a documented information security policy? | CSC 17 | §164.308(a)(1)(i) | 5.1.1 | ID.GV-3 | CA-5, PM-1 | PPPR-18 | |
| Systems Management & Configuration | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLSY-01 | Do you employ network and administrative segmentation in the management of this service? (for example, systems supporting the service managed via a separate management network, separate administrative controls and access, etc.) | CSC 12 | 13.1.1 | PR.PT-4 | 3.1.3 | AC-4 | SYST-01 | |
| HLSY-02 | Do you have standard hardened configurations for severs, appliances and mobile devices? | CSC 3 | ||||||
| HLSY-03 | Do you encrypt company owned mobile devices? | CSC 13 | 12.1.1 | PR.IP-1, PR.IP-2 | 3.1.18, 3.7.1, 3.13.13 | CM-2, CM-6, CM-3, AC-19, MA-2 | SYST-04 | |
| Vulnerability Scanning | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | ||
| HLVU-01 | Have your systems and applications had a third party security assessment completed in the last year? | CSC 4 | 12.6.1 | DE.CM-8 | 3.11.1, 3.11.2, 3.11.3 | SI-2 | VULN-02 | |
| HLVU-02 | Are your applications scanned for vulnerabilities [that are remediated]? | CSC 4 | DE.CM-8 | 3.11.1, 3.11.2, 3.11.3 | SI-2 | VULN-03 |
| CIS Critical Security Controls v6.1 | 4 |
| HIPAA | 5 |
| ISO 27002:2013 | 6 |
| NIST Cybersecurity Framework | 7 |
| NIST SP 800-171r1 | 8 |
| NIST SP 800-53r4 | 9 |
000000 &P
Analyst Report K-12CVAT - Analyst Report Version 3.0
| Instructions | |||
| Step 1: Select the security framework used at your institution in cell B10. Step 2: Convert qualitative vendor responses into quantitative values, starting at cell G32. Step 3: Review converted values, ensuring full population of report. Step 4: Move to the Summary Report tab. | |||
| Vendor Name | Vendor Name | Product Name | Product Name and Version Information |
| Vendor Contact Name | Vendor Contact Name | Product Description | Brief Description of the Product |
| Vendor Contact Title | Vendor Contact Title | CVAT Version | Lite 3.0 |
| Vendor Email Address | Vendor Contact E-mail Address | Date Prepared | mm/dd/yyyy |
Institution's Security Framework NIST Cybersecurity Framework
| Report Sections | Max_Score | Score | Score % |
| Documentation | 100 | 0 | 0% |
| Company | 120 | 0 | 0% |
| Application Security | 150 | 0 | 0% |
| Authentication, Authorization, and Accounting | 85 | 0 | 0% |
| Business Continuity | 55 | 0 | 0% |
| Change Management | 65 | 0 | 0% |
| Data | 225 | 0 | 0% |
| Database | 60 | 0 | 0% |
| Datacenter | 120 | 0 | 0% |
| Disaster Recovery | 70 | 0 | 0% |
| Firewalls, IDS, IPS, and Networking | 140 | 0 | 0% |
| Physical Security | 80 | 0 | 0% |
| Policies, Procedures, and Processes | 160 | 0 | 0% |
| Systems Management & Configuration | 45 | 0 | 0% |
| Vulnerability Scanning | 80 | 0 | 0% |
| Overall Score | F | 0 | 0.00% |
| Qualitative Questions | Convert Qualitative Answer to Quantitative Value | |||||||
| ID | Question | Vendor Answer | Compliant? | |||||
| COMP-01 | Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships. | 0 | No | |||||
| COMP-02 | Describe how long your organization has conducted business in this product area. | 0 | No | |||||
| COMP-09 | Use this area to share information about your environment that will assist those who are assessing your company data security program. | 0 | No | 0 | ||||
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Analyst Reference K-12 Community Vendor Assessment Tool (K-12CVAT) - Lite - Analyst Reference
| Instructions |
| Use this reference guide to assess vendor responses in relation to your institution's environment. The context of K-12CVAT questions can change, depending on implementation specifics so these recommendations and follow-up response are not exhaustive and are meant to improve assessment and report capabilities within your institution's security/risk assessment program. |
Analyst tip #1: For any answer that is deemed "non-compliant" by your institution, ask the vendor if there is a timeline for implementation, a sincere commitment to customer development engagement, and/or possible implementation of compensating control(s) that offsite the risks of another component.
Analyst tip #2: If a vendor's response to a follow-up inquiry is vague or seems off-point or dismissive, respond back to the vendor contact with clear expectations for a response. Responses that fail to meet expectations thereafter should be negatively assessed based on your institution's risk tolerance and the criticality of the data involved.
Analyst tip #3: The most important tip - reject a K-12CVAT from a vendor if; the vendor provides the institution with a insufficiently populated K-12CVAT; or the vendor responses are vague and/or do not answer questions directly; or significant discrepancies are found, making the K-12CVAT difficult to assess.
| Documentation | Reason for Question | Follow-up Inquiries/Responses | ||||
| DOCU-01 | Have you undergone a SSAE 18 audit? | Standard documentation, relevant to institutions requiring a vendor to undergo SSAE 16 audits. | Follow-up inquiries for SSAE 16 content will be institution/implementation specific. | |||
| DOCU-02 | Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ? | Many vendors have populated a CAIQ or at least a self-assessment. Although lacking in some areas important to Higher Ed, these documents are useful for supplemental assessment. | Follow-up inquiries for CSA content will be institution/implementation specific. | |||
| DOCU-03 | Have you received the Cloud Security Alliance STAR certification? | If a vendor is STAR certified, vendor responses can theoretically be more trusted since CSA has verified their responses. Trust, but verify for yourself, as needed. | If STAR certification is important to your institution you may have specific follow-up details for documentation purposes. | |||
| DOCU-04 | Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.) Please identify which one under "additional information" | The details of the standard are not the focus here, it is the fact that a vendor builds their environment around a standard and that they continually evaluate and assess their security programs. | In an ideal world, a vendor will conform to an industry framework that is adopted by an institution. When this synergy does not exist, the interpretation of the vendor's responses must be interpreted in the context of the institution's environment. Follow-up inquires for industry frameworks (and levels of adoption) will be institution/implementation specific. | |||
| DOCU-05 | Are you compliant with FISMA standards? | For institutions that collaborate with the United States government, FISMA compliance may be required. | Follow-up inquiries for FISMA compliance will be institution/implementation specific. | |||
| DOCU-06 | Would you sign the Student Data Privacy Consortium statement for the state in which our district is located? (https://sdpc.a4l.org/) | Managing and protecting institution data is the reason organizations perform security and risk assessments. Privacy policies outline how vendors will obtain, use, share, and protect institutional data and as such, should be robust in its language. Beware of vaguely worded privacy policies. | Inquire about any privacy language the vendor may have. It may not be ideal but there may be something available to assess or enough to have your legal counsel or policy/privacy professionals review. | |||
| Company Overview | Reason for Question | Follow-up Inquiries/Responses | ||||
| COMP-01 | Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships. | Defining scale of company (support, resources, skillsets), General information about the organization that may be concerning. | Follow-up responses to this one are normally unique to their response. Vague answers here usually result in some footprinting of a vendor to determine their "reputation". | |||
| COMP-02 | Describe how long your organization has conducted business in this product area. | We want to establish longevity of a solution and whether or not a vendor is new to the HE space. | Normally a vendor will state their overall longevity but not talk about the software/service/product under evaluation. Follow-up's includes specific questions about the origins of the software/service/product and references will be requested. | |||
| COMP-03 | Do you have existing K-12 customers? | K23 Education is a unique vertical. A vendor's response to this question can help an analyst set the context for all vendor responses. Established and/or mature software/product/services are more likely to have current K-12 customers, and therefore understand the environment that we operate in. | A simple "Yes" without any references or supporting information should be questioned. Question the size of institutions that are using the software/product/service and the scope of their implementations. | |||
| COMP-04 | Have you had a significant cybersecurity incident that has disrupted availability for longer than 8 hours? | We want transparency from the vendor and an honest answer to this question, regardless of the response, is a good step in building trust. | If a vendor says "No", it is taken at face value. If you organization is capable of conducting reconnaissance, it is encouraged. If a vendor has experienced a data disruption that impacted service delivery, evaluate the circumstances of the incident and what they did to restore services. | |||
| COMP-05 | Have you had a security event in the last 5 years that impacted privacy, operations, data, customers, what steps did you take to handle the incident? | We want transparency from the vendor and an honest answer to this question, regardless of the response, is a good step in building trust. | If a vendor says "No", it is taken at face value. If you organization is capable of conducting reconnaissance, it is encouraged. If a vendor has experienced a breach, evaluate the circumstance of the incident and what the vendor has done in response to the breach. | |||
| COMP-06 | Do you have a formal risk management and cybersecurity program in place? | Understanding the security program size (and capabilities) of a vendor has a significant impact on their ability to respond effectively to a security incident. The size of a vendor will determine their SO size, or lack thereof. Use the knowledge of this response when evaluating other vendor statements. | Vague responses to this question should be investigated further. Vendors without dedicated security personnel commonly have no security or security is embedded or dual-homed within operations (administrators). Ask about separation of duties, principle of least privilege, etc. - there are many ways to get additional program state information from the vendor. | |||
| COMP-07 | If applicable, do you have dedicated customer support and product management? | Understanding the support team size (and capabilities) of a vendor has a significant impact on their ability to respond to support requests. The size of a vendor will determine the availability of trained support and product management. Use the knowledge of this response when evaluating other vendor statements. | Follow-up inquiries for vendor team strategies will be unique to your institution and may depend on the underlying infrastructures needed to support a system for your specific use case. | APPL-04 | ||
| COMP-08 | If applicable, do you have dedicated software and systems development teams? | Understanding the development team size (and capabilities) of a vendor has a significant impact on their ability to produce and maintain code, adhering to secure coding best practices. The size of a vendor will determine their use of dedicated development teams, or lack thereof. Use the knowledge of this response when evaluating other vendor statements. | Follow-up inquiries for vendor team strategies will be unique to your institution and may depend on the underlying infrastructures needed to support a system for your specific use case. | |||
| COMP-09 | Use this area to share information about your environment that will assist those who are assessing your company data security program. | For the vendors that K-12CVAT may not cover, this gives the vendor a chance to support their other responses. Beware when this area is populated with sales hype or other non-relevant information. Thorough documentation, supporting evidence, and/or robust responses go a long way in building trust in this assessment process. | This is a freebie to help the vendor state their "case". If a vendor does not add anything here (or it is just sales stuff), we can assume it was filled out by a sales engineer and questions will be evaluated with higher scrutiny. | APPL-05 | ||
| Application/Service Security | Reason for Question | Follow-up Inquiries/Responses | APPL-08 | |||
| HLAP-01 | Does you system support various permission levels (for example, role based access control) for end users? | Understanding access control capabilities allows us to estimate the type of maintenance efforts will be involved to manage a system. Depending on the users, concerns may or not be elevated. The value of this question is largely determined by the deployment strategy and use case of the software/product/service under review. This question is specific to end-users. | Ask the vendor to summarize the best practices to restrict/control the access given to the institution's end-users without the use of RBAC. Make sure to understand the administrative requirements/overhead introduced in the vendor's environment. | APPL-01 | ||
| HLAP-02 | Do you enforce additional security controls for privileged access users (e.g. system administrators)? | Managing a software/product/service may rely on various professionals to administrate a system. This question is focused on how administration, and the segregation of functions, can be implemented within the system. Securing the administration portion of a system has additional implications (e.g. logging, administration, etc.) beyond that of end-users. | Ask the vendor to summarize the best practices for securing their system(s) administratively without the use of RBAC. Make sure to understand the administrative requirements/overhead introduced in the vendor's environment. | APPL-02 | ||
| HLAP-03 | Can employees access protected or sensitive data remotely? | Telecommuting in the IT world is common - an institution should know that proper safeguards are in place, if remote access is allowed. Vendor responses vary greatly on this so confirm the context of the response if it is not clear. Many cloud services can only be managed remotely so there is often a gray area to interpret for this response. | Ask the vendor to summarize the reasoning behind this business process and request additional documentation that outlines the security controls implemented to safeguard institutional data. | APPL-03 | ||
| HLAP-04 | Is an audit log of access maintained by the system? | An audit log of access maintained by the system can be an important component of accountability and ensuring that access can be accounted for. | Ask the vendor to describe the level of auditing of access available in the system. | |||
| HLAP-05 | If necessary would you be willing to share systems schematics, diagrams, data flow diagrams, etc. ? | Many systems can be used a variety of ways. We want these implementation type diagrams so that we can understand the "real" use of the product. | Additional requests for documentation are made when other parts of the K-12CVAT are insufficient. Although helpful, many vendors do not provide supporting documentation. We try to be specific with our follow-up questions so that vendors understand we are not looking for 20-50 page whitepapers (sales documentation). | APPL-04 | ||
| HLAP-06 | Has your system been tested for input validation errors and do you have appropriate error messaging? | Input validation is a secure coding best practices so confirming its implementation is normally a high priority. Error messages (to the system and user) can be used to detect abnormal use and to better protect institutional data. Depending on the criticality of data and the flow of said data, an institution's risk tolerance will be unique to their environment. | Inquire about any planned improvements to these capabilities. Ask about their product(s) roadmap and try to understand how they prioritize security concerns in their environment. | APPL-05 | ||
| HLAP-07 | Is district data appropriately segmented and secured from other organization's data or access and can you demonstrate through reports? | A vendor's response to this question can reveal a system's infrastructure quickly. Off-point responses are common here so general follow-up is often needed. Understanding how a vendor segments its customers data (or doesn't) affects various other controls, including network settings, use of encryption, access, etc.). A vendor's response here will influence potential follow-up inquiries for other K-12CVAT questions. | Ask the vendor to summarize how a data segmentation is enforced in the environment/strategy is implemented and what compensating controls they have in place to ensure appropriate levels of confidentiality and integrity. |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .