4-IT Risk Assessment questionnaire v6.xlsx
XLSX spreadsheet 31 KB Posted
- Attached to
- Project Financing Management Software
- Solicitation number
- RFP260050
- Issued by
- Bath County, Kentucky
About this file
This file is an IT Risk Assessment questionnaire (version 6) from the Louisville Metro Technology Services Department in Kentucky, designed to evaluate vendor security capabilities for the Project Financing Management Software procurement. The comprehensive questionnaire contains 21 sections covering critical security domains including general information handling, access controls, data protection, disaster recovery, audit logging, physical security, and compliance requirements. Vendors are required to respond to detailed yes/no questions about their security practices, with options to substitute a SOC2 audit report for the questionnaire, and must provide information about their point of contact, product details, and bid number.
The questionnaire emphasizes stringent security requirements including PCI and HIPAA compliance, encryption standards (256-bit AES for data at rest and TLS 1.2 for data in transit), multi-factor authentication, role-based access controls, and comprehensive audit trails. Key focus areas include protection of confidential information (PII, PHI, PFI, CHD), business associate agreements for healthcare data, background checks for personnel with data access, regular third-party security assessments, and robust disaster recovery planning with annual testing requirements. The assessment also addresses specialized requirements for credit card processing compliance, data lifecycle management, system availability assurances, and secure software development practices, reflecting Louisville Metro's commitment to protecting sensitive housing and community development project data.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 10-Submission Instructions - RFP260050.pdf | ||
| 6-Federal Terms for Non-Construction CDBG-Funded Contracts.pdf | ||
| 3-W9 2024.pdf | ||
| 5-Info, Addenda Signatures-Federal RFP.pdf | ||
| 7-SAM Certification.pdf | ||
| 11-Bid Tab.pdf | ||
| 2-Procurement - LMCO ban the box.pdf | ||
| 9-RFP260050 Specifications.pdf | ||
| 8-Certifications-Lobbying Telecommunications.docx | DOCX document | |
| 1-GFE Docs.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
Louisville Metro Technology Services Department Information Security Questionnaire
| Vendor Information | |||
| Name of Point of Contact: | |||
| Date: | Note: A SOC2 audit report may be substituted for this questionnaire. | ||
| Vendor Name: | |||
| Product Name: | |||
| Vendor Website URL: | |||
| Vendor Contact Name: | |||
| Vendor Contact Email: | |||
| Vendor Contact Phone: | |||
| Bid #: | |||
| Section 1 General Information | |||
| Information on the solution, including type of information being handled, any requirements, or regulations, that the solution may fall under. | Yes Or No | Notes | |
| 1.1 | Does the type of information processed or stored by the solution include confidential information (e.g., PII, PHI, PFI, CHD, research and development data)? | ||
| 1.2 | Is the solution designed to comply with PCI, HIPAA, and other requirements? | ||
| 1.3 | Does the Vendor outsource management or support of the solution? | ||
| 1.4 | Does the Vendor have processes to monitor changes to regulations, and to implement applicable changes in a timely manner? | ||
| 1.5 | Is the solution hosted vendor-hosted or SaaS based? | ||
| 1.6 | If yes to 1.5, does the security design of the solution's infrastructure allow for segregation of each customer's application environment and data? | ||
| 1.7 | Verify and control and/or limit connections to, and use of, external information systems? | ||
| Section 2 Business Associate Agreement | |||
| Does the solution involve a vendor or other third party transmitting, processing or storing Metro protected health information (PHI)? | Yes Or No | Notes | |
| 2.1 | Has a Business Associate Agreement been signed? | ||
| Section 3 Access Controls | |||
| Information on the solution itself. Including type of information being handled, any requirements, or regulations, that the solution may fall under | Yes Or No | Notes | |
| 3.1 | Does the solution operate on the premise that "access that is not explicitly authorized is forbidden"? | ||
| 3.2 | Does the solution allow for defining access based on least privilege (or "need to know")? | ||
| 3.3 | Does the solution allow the use of generic ID's and logins for access? | ||
| 3.4 | Does the solution support role based access control? | ||
| 3.5 | Does the solution have a configurable, automatic logoff feature after a period of inactivity? | ||
| 3.6 | Does the solution require secure methods of access (SSH, etc.) for technical support or 3rd party access? | ||
| 3.7 | Does the solution use two factor authentication technologies for remote access? | ||
| 3.8 | Does the solution have functionality to identify inactive accounts? | ||
| 3.9 | Does the solution provide emergency access (only) for authorized personnel while maintaining appropriate security controls? | ||
| 3.1 | Does the solution integrate with Active Directory for user authentication? | ||
| 3.11 | Does the solution support the use of mobile devices? If yes, does the solution have the ability to protect, or to prevent, access to data stored on the mobile device? | ||
| 3.12 | Does the solution provide various levels of security based on the classification of the data? | ||
| 3.13 | Does the solution allow for restriction of access based on source IP address? | ||
| 3.14 | Does the Vendor limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems)? | ||
| 3.15 | Does the Vendor limit information system access to the types of transactions and functions that authorized users are permitted to execute? | ||
| 3.16 | Does the vendor verify and control and/or limit connections to, and use of, external information systems? | ||
| Section 4 User ID's and Passwords | |||
| Login credentials required for accessing a system adhering to current best security practices. | Yes Or No | Notes | |
| 4.1 | Does the solution require unique user IDs for each user? | ||
| 4.2 | Does the solution require both a unique user ID and password for authentication? | ||
| 4.3 | Does the solution support the use of complex passwords? If Yes, does it include: | ||
| Minimum of 9 Characters? |
Does the solution support the use of 3 of the following 4 requirements for passwords?
Upper case Lower case Number Special Character
| 4.4 | Does the solution have configurable settings for password history and change requirements? | ||
| 4.5 | Does the solution include configurable account lockout settings? | ||
| 4.6 | Are the Passwords unreadable during login? | ||
| 4.7 | Are the Passwords always encrypted in storage? | ||
| 4.8 | Are all default passwords are changed during system installation? | ||
| Section 5 Data Protection | |||
| Methods used for protecting sensitive/confidential information being stored, or transmitted, by a solution. | Yes Or No | Notes | |
| 5.1 | Encryption Controls - Data At Rest | ||
| 5.1.1 | Does the solution provide encryption of data at rest? | ||
| 5.1.2 | Is data at rest encrypted using at least a 256 bit encryption key? | ||
| 5.1.3 | Does solution use known secure encryption algorithms with strong keys? | ||
| 5.1.4 | Are there Management Policies and Procedures in place to protect the use and storage of cryptographic keys? | ||
| 5.1.5 | Are data encryption policies enforced for all workstations or laptops that store confidential information? | ||
| 5.1.6 | Is any data housed, stored, or located outside of the continental United States? | ||
| 5.2 | Encryption Controls - Data in Transit | ||
| 5.2.1 | Does the solution securely transmits data over public networks? | ||
| 5.2.2 | Does the solutions uses HTTPS/TLSv1.2 256 bit or better protection for data in transit? | ||
| 5.2.3 | Does the solution transmit bulk data in flight via secure methods (e.g., secure VPN, SFTP, SCP, FTPS, etc…)? | ||
| 5.2.4 | Does the solution support the use of email encryption if confidential data is emailed (e.g. TLS, PGP, etc…)? | ||
| Section 6 Disclosure of Security Exposures | |||
| Due to security breach notification laws or data breach notification laws, entities subject to a data breach are required to notify their customers and other parties about the breach, and take steps to remediate issues caused by the breach. | Yes Or No | Notes | |
| 6.1 | Does the Vendor have procedures to notify LMG following the discovery of a breach without reasonable delay, and the notification procedure meets Federal and State requirements? | ||
| 6.2 | Does disclosure notification include the identification of data and each individual whose private data has been, or is reasonably believed to have been accessed, acquired, or disclosed during the breach? | ||
| 6.3 | When a breach is discovered, does the Vendor assign ownership of a breach, for reporting purposes, to a specific individual/team? | ||
| Section 7 Unauthorized Access to LMG Data | |||
| Vendor is vetting its personnel that may have access to customer data, and performs due diligence for agreements regarding access to confidential/sensitive data. | Yes Or No | Notes | |
| 7.1 | Does the Vendor conduct background checks of staff as part of hiring practice? | ||
| 7.2 | Is the Vendor's workforce is required to sign a confidentiality agreement? | ||
| 7.3 | Does the Vendor workforce understand their responsibilities regarding copying or disclosing information they are entrusted with? | ||
| 7.4 | Does the vendor control Information Posted or Processed on Publicly Accessible Information Systems? | ||
| 7.5 | Does the vendro identify Information System Users, Processes Acting on Behalf of Users and Devices? | ||
| 7.6 | Does the vendor uthenticate ( or verify ) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems? | ||
| Section 8 Disaster Recover/Business Continuity | |||
| A disaster recovery plan is a process or procedure to protect business continuity in the event of a disaster affecting business IT infrastructure. | Yes Or No | Notes | |
| 8.1 | Has the vendor conducted Risk Assessment, and and impact | ||
| 8.2 | Has the vendor developed and documented Disaster Recovery and Business Continuity Plans? | ||
| 8.3 | Has Disaster Recovery Plan been tested within the last year? If not, when? | ||
| 8.4 | Does the solution has a data recovery plan and procedures? | ||
| 8.5 | Are the tape backups encrypted using 256 bit AES encryption? | ||
| Section 9 Audit Login | |||
| Audit trails, or audit logs, are security-relevant chronological records to provide documentary evidence of the sequence of activities that affect specific operations, procedures, or events. | Yes Or No | Notes | |
| 9.1 | Does the solution record all exceptions and security relevant events in application and system logs? | ||
| 9.2 | Are all audit logs secured from modifications? | ||
| 9.3 | Are the Application Audit logs recorded? | ||
| 9.4 | Are the logs regularly reviewed to examine user IDs, dates and times of log on and log off, log in failures, changes to security parameters and other security actions? | ||
| 9.5 | Are the System logs are reviewed at a defined frequency, and are retained for as long as required? | ||
| Section 10 Information Security Policies | |||
| A documents that state in writing how a company plans to protect physical and information technology assets. Security policies are considered to be ‘living documents’, meaning that the document is never finished but continuously updated as technology and employee requirements change. Security policies may include an acceptable use policy, explanations for how security measurements will be carried out and enforced, and a procedure for evaluating the effectiveness of policies to ensure corrections will be made. | Yes Or No | Notes | |
| 10.1 | Does the Vendor have an Information Security Code of Conduct and Information Security policies that are reviewed at least annually? | ||
| 10.2 | Does the Vendor have an individual that is responsible for their IT Security Program? (Please provide title) | ||
| 10.3 | Does the Vendor have a Risk Management Program that includes information technology related risks? | ||
| Section 11 Physical and Environmental Security | |||
| Physical and Environmental security programs define measures or controls that protect organizations from loss of connectivity and availability of computer processing caused by theft, fire, flood, intentional destruction, unintentional damage, mechanical equipment failure and power failures. Physical security measures should be sufficient to deal with foreseeable threats and should be tested periodically for their effectiveness and functionality. | Yes Or No | Notes | |
| 11.1 | Has a SSAE16 or SOC2 audit of data center controls been performed? | ||
| 11.2 | Is a current report available for review? | ||
| 11.3 | Do the Physical controls for the facilities, where systems are housed, include controls such as locks, keys, biometrics, fences, card-key access, cameras and raised floors? | ||
| 11.4 | Do the Environmental controls for the facilities, where systems are housed, include controls such as backup power, fire suppression, temperature controls, UPS and backup generator? | ||
| 11.5 | Does the Vendor have a policy and processes in place for the secure disposal and reuse of IT equipment and media disposal? | ||
| 11.6 | Does the vendor limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals | ||
| 11.7 | Does the vendor escort Visitors and Monitor Visitor Activity | ||
| 11.8 | Does the vendor maintain Audit Logs of Physical Access | ||
| 11.9 | Does the vendor control and Manage Physical Access Devices | ||
| Section 12 Data Loss-Leakage | |||
| If sensitive data is given to a third party, some data may be found in an unauthorized place. Investigations must be performed if data leaked from one or more third parties, or if it was independently gathered by other means. | Yes Or No | Notes | |
| 12.1 | Does the Vendor have methods to identify data leaving the organization in an unauthorized manner? | ||
| 12.2 | Does the vendor sanitize or destroy information system media containing Federal contract information before disposal or release for reuse | ||
| Section 13 Software Development and Change Control | |||
| A software development life-cycle is a clearly defined process for use during development, and maintenance of a solution. Used for planning, implementing, and evaluation of changes. | Yes Or No | Notes | |
| 13.1 | Does the Vendor closely manage outsourced software development processes? | ||
| 13.2 | Are the best practices for secure design and solution development (e.g. OWASP) utilized? | ||
| 13.3 | Does the vendor have separate development, test and production environments; and access for programming staff to production is restricted? | ||
| 13.4 | Is detailed security testing of the application, including peer review, part of the software development process? | ||
| 13.5 | Do Change Management procedures include testing, approval of code changes prior to implementation and back-out plans? | ||
| 13.6 | Does Vendor conduct continuous testing to ensure that code changes to the application do not introduce unforeseen risks? | ||
| 13.8 | Does the Vendor provide information regarding 3rd party applications that solution utilizes? | ||
| 13.9 | Does the Vendor uses the minimum data necessary for solution setup and ongoing processing? | ||
| 13.1 | Do vendor procedures include de-identifying confidential data used for testing? | ||
| 13.11 | Does the vendor provide protection from malicious code at appropriate locations within organizational information systems? | ||
| 13.12 | Does the vendor update Malicious Code Protection Mechanisms when new releases are available? | ||
| 13.13 | Does the vendor perform periodic scans of information systems and real-time scans of files from external sources as files are downloaded, opened or executed | ||
| Section 14 Application Control | |||
| Application control is a security practice that blocks or restricts unauthorized applications from executing in ways that put data at risk. | Yes Or No | Notes | |
| 14.1 | Does the Vendor environment utilize methods to detect and block application level software attacks? | ||
| Section 15 Anti-Malware and Vulnerability Management | |||
| A cyclical practice of identifying, classifying, remediating, and mitigating vulnerabilities, especially in software and firmware. This is integral to computer security and network security. | Yes Or No | Notes | |
| 15.1 | Does the solution support the use of anti-malware protection? | ||
| 15.2 | Does the Vendor have processes to monitor and manage system vulnerabilities to computer viruses, bugs, and malware? | ||
| 15.3 | Does the vendor have a comprehensive patch and vulnerability management program to include internal systems as well as external services, software, and products along with reliable customer notifications? | ||
| 15.4 | Does the Vendor scan for system vulnerabilities on a regular basis? | ||
| 15.5 | Does the Vendor have procedures in place to determine if assets have been compromised? | ||
| 15.6 | Does the Vendor have a patch management program that includes testing patches prior to implementation? | ||
| 15.7 | Does the Vendor have a configuration management program? | ||
| Section 16 Attestation of Internal Security Controls by a 3rd Party | |||
| Outside audits, or evaluations, of systems to ensure that proper security controls are in place; and to satisfy requirements for adherence and/or compliance to regulations. | Yes Or No | Notes | |
| 16.1 | Does the Vendor regularly engage 3rd parties to perform evaluations of their systems? | ||
| 16.2 | Will the Vendor allow LMG to designate a 3rd party to carry out audits as defined in the agreement? | ||
| 16.3 | Does the Vendor have SOC2 audit covering application controls? | ||
| 16.4 | Does the 3rd party meet the requirments of this Risk Assessment Questionairre? | ||
| 16.5 | If 1099 consultantsa are utilzied, do they have background checks? | ||
| Section 17 Acceptance and Processing of Credit Cards | |||
| If a solution is integrating a payment system, or would be accepting payments, it is important to safeguard this system according to best security practices. | Yes Or No | Notes | |
| 17.1 | If the solution stores, processes, or transmits cardholder data (such as a point of sale payment application), has it been validated for PCI compliance by a qualified assessor? | ||
| 17.2 | Is the Vendor compliant with the Payment Card Industry Data Security Standard (PCI DSS)? | ||
| 17.3 | Is cardholder data (e.g., credit card #, authorization code, cardholder name) stored on local systems? | ||
| Section 18 Data Life Cycle Controls | |||
| A data life cycle is policy-based controlling the flow of data, from creation and storage, to the time that it becomes obsoleted and deleted. | Yes Or No | Notes | |
| 18.1 | Does the Vendor agree to end of contract separation provisions related to data? | ||
| 18.2 | Does the Vendor have a defined process for secure disposal of customer's data? | ||
| Section 19 System Availability | |||
| Availability is the probability that a system will work as required when required during the period of its deployment. | Yes Or No | Notes | |
| 19.1 | Does the Vendor have measures in place to assure system availability (i.e., data mirroring, redundant servers, fail-over, etc.)? | ||
| 19.2 | Does the solution meet the business owner's system availability requirements? | ||
| 19.3 | Does the solution support the use of third party backup software? | ||
| 19.4 | Does the vendor actively manage services that are contracted/outsourced to 3rd parties, that can impact system availability? | ||
| Section 20 Control Communications At System Boundaries | |||
| Communications can be monitored, controlled, and protected at boundary components and by restricting or prohibiting interfaces in organizational systems. |
| Yes Or No | Notes | ||
| 20.1 | Does the vendor monitor, control, and protect organizational communications (i.e., Information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of information systems. | ||
| 20.2 | Does the vendor implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks | ||
| Section 21 Identify and Manage Information System Flaws | |||
| Organizations identify systems that are affected by announced software and firmware flaws including potential vulnerabilities resulting from those flaws | Yes Or No | Notes | |
| 21.1 | Does the organziation identify, report and correct Information and Information Flaws in a timely manner |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
| N/A |
| No |
| Partial |
| Yes |
File details come from the government source that posted it. Updated .