5-Attachment A - Cybersecurity Requirements.pdf

ATTACHMENT A

1. Account Security

2. Single Sign On Does the system support single sign on with

Microsoft Azure?

1. Multi-Factor Authentication (MFA) If the system does not support Microsoft

Azure SSO, does it have its own multi-factor authentication?

What methods does the system support for the 2nd factor?

Can the system be setup to require MFA for all accounts?

2. Complex passwords Can the system be set up to require complex passwords including upper case, lower case, numbers, and special characters?

3. Minimum password length Can the minimum password length be set to at least 20 characters?

4. Rotation frequency Can the system be setup to allow us to require password changes every 90, 60, and 30 days?

2. Vulnerability Management

1. Scanning frequency How frequently are systems scanned for vulnerabilities?

Are all endpoints included in those scans including network and IOT devices?

- What programs are being used?

- What ability does Bernco have on helping setup the security posture settings within applications and systems used?

- Is there a reporting cadence for vulnerabilities detected by the system(s) in place?

2. Patching cadence What is the standard patching cadence for clients, servers, network devices, IOT devices?

3. Zero-day patching SLA What is the service level agreement for patching zero-day vulnerabilities?

3. Endpoint Security

1. Detection and Remediation Is an endpoint detection remediation solution in place for clients and servers?

- What programs are being used?

Is the system setup to automatically remediate aberrant behavior or only detect it?

4. Security Information and Event Monitoring (SIEM)

1. SIEM In place with alerting Is a SIEM in place and if so, what log files does it ingest?

Who is alerted of SIEM alerts and how are those responded to?

5. Security Operations Center (SOC)

1. Levels of incident and SLA Is a Security Operations Center in place?

If so, is it staffed internally or outsourced?

Is it a 24x7 operation?

Are there established alert and response levels such as Critical, High, Medium, Low/Informational?

Are their service level response times for each type of alert?

How are incidences reported to the customer?

6. PEN Testing

1. Penetration Testing Is regular penetration (PEN) testing being performed?

If so, at what frequency?

Is this done internally as well as externally?

Does it include web applications as well as infrastructure?

Does PEN testing include foreign country IP address origination as well as US addresses?

7. Backups

1. Frequency What is the frequency for full and incremental backups?

Where are backups stored?

What are the retention durations for various types of backups (database vs. VM/System backups)?

Are provisions in place to protect backups from ransomware?

2. Testing Are backups regularly tested for backup integrity?

If so, how frequently does that testing occur?

3. Air-gapped Are air-gapped backs in place?

If not, what measures are in place to protect backups from ransomware?

8. Incident Response

1. Incident Response Plan Is an incident response plan in place?

Is it used consistently for all incidents?

Is it updated regularly based on learning from previous incidents?

2. Incident Notification Does the incident response plan include appropriate notification of incidents to customers and stakeholders?

If so, is there a service level agreement for how quickly that notification occurs after discovery of the incident and if so what is it?

3. Breach Notification If an incident results in the breach of information, what is the service level for communicating that breach to affected parties?

9. Encryption

1. Encryption at Rest Is data encrypted at rest?

2. Encryption in transit Is data encrypted while in transit?

If so what encryption method/level is used?

10. File Transfers

1. File Transfers Can SFTP be used rather than FTP?