5. City-Risk-Assessment_v1.1.xlsx
XLSX spreadsheet 37 KB Posted
- Solicitation number
- SFGOV-0000011976
- Issued by
- San Francisco County, San Francisco City, California
About this file
This is a City Risk Assessment scoring document used by the City and County of San Francisco (CCSF) to evaluate vendor security compliance across cloud service offerings. The assessment comprises a comprehensive security control framework organized into multiple domains including Application & Interface Security, Audit Assurance & Compliance, Business Continuity Management, Data Security & Information Lifecycle Management, Datacenter Security, Encryption & Key Management, Governance and Risk Management, Human Resources, Identity & Access Management, Infrastructure & Virtualization Security, Interoperability & Portability, Mobile Security, Security Incident Management, Supply Chain Management, and Threat and Vulnerability Management. The document contains approximately 100 specific control questions designed to verify that vendors meet established security baselines and industry best practices such as ISO 27001 and SOC 2 compliance.
The scoring methodology identifies three response categories for each control: "Yes" (control implemented), "No" (control not implemented), and "Not Applicable" (control does not apply). For each control question, the document specifies the high-level city expectation and remediation pathway if a vendor answers "No." Key requirements include implementation of automated source code analysis, SOC 2/ISO 27001 audit report access, annual penetration testing, business continuity planning with multiple service providers, encryption of data at rest and in transit using open standards, role-based access controls following least privilege principles, separate production and non-production environments, incident response planning, and annual security reviews of third-party providers. The assessment requires vendors to demonstrate technical controls, documented policies and procedures, employee training programs, and ongoing operational visibility through service level agreement reporting to CCSF.
View the file
Other files
Show all 50
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Scoring
| Legend | Scoring Methodology | ||||
| Section Heading | Control Heading | Original ID | Control Question | Vendor Response | Vendor Response to Required Control Description |
(if Answered YES or N/A) Krochik, Stanley (TIS): If answered yes, provide information about the control.
If answered not applicable, explain why it does not apply. High Level City Expectation To Address Control Gap (if Answered NO to Control Question)
| Application & Interface Security | Application Security | AIS-01.2 | Do you use an automated source code analysis tool to detect security defects in code prior to production? | Adopt an automated source code analysis tool to detect security defects in code prior to production. |
| AIS-01.5 | (SaaS only) Do you review your applications for security vulnerabilities and address any issues prior to deployment to production? | Review your applications for security vulnerabilities and address any issues prior to deployment to production. | ||
| Customer Access Requirements | AIS-02.1 | Are all identified security, contractual, and regulatory requirements for customer access contractually addressed and remediated prior to granting customers access to data, assets, and information systems? | Contractually address and remediate all identified security, contractual, and regulatory requirements for customer access prior to granting customers access to data, assets, and information systems. | |
| Data Integrity | AIS-03.1 | Does your data management policies and procedures require audits to verify data input and output integrity routines? | Create data management policies and procedures that require audits to verify data input and output integrity routines. Subsequently, publish policies and procedures to person or people responsible for data integrity. | |
| Audit Assurance & Compliance | Independent Audits | AAC-02.1 | Will you allow City and County of San Francisco (CCSF) to view your SOC2/ISO 27001 or similar third-party audit or certification reports? | Allow CCSF to view SOC2/ISO27001 or similar third-party audit or certification reports upon request and signature of non-disclosure agreement (NDA). |
| AAC-02.2 | Do you conduct network penetration tests of your cloud service infrastructure at least annually? | Conduct network penetration tests of your cloud service infrastructure at least annually. | ||
| AAC-02.3 | Do you conduct application penetration tests of your cloud infrastructure regularly as prescribed by industry best practices and guidance? | Conduct application penetration tests of your cloud infrastructure regularly as prescribed by industry best practices and guidance. | ||
| AAC-02.6* | Will the results of the penetration tests be available to CCSF at their request? | Make results of the penetration tests available to CCSF at their request. | ||
| AAC-02.7* | Will the results of internal and external audits be available to CCSF at their request? | Make results of internal and external audits available to CCSF at their request. | ||
| Information System Regulatory Mapping | AAC-03.1 | Do you have a program in place that includes the ability to monitor changes to the regulatory requirements in relevant jurisdictions, adjust your security program for changes to legal requirements, and ensure compliance with relevant regulatory requirements? | Develop program that includes the ability to monitor changes to the regulatory requirements in relevant jurisdictions, adjust your security program for changes to legal requirements, and ensure compliance with relevant regulatory requirements. | |
| Business Continuity Management & Operational Resilience | Business Continuity Planning | BCR-01.1* | Does your organization have a plan or framework for business continuity management or disaster recovery management? | Adopt plan or framework for business continuity management or disaster recovery management. |
| BCR-01.2* | Do you have more than one provider for each service you depend on? | Acquire more than one provider for each service you depend on. | ||
| BCR-01.7* | Will you share your business continuity and redundancy plans with CCSF? | Share your business continuity and redundancy plans with CCSF. | ||
| Business Continuity Testing | BCR-02.1 | Are business continuity plans subject to testing at planned intervals or upon significant organizational or environmental changes to ensure continuing effectiveness? | Test business continuity plans at planned intervals or upon significant organizational or environmental changes to ensure continuing effectiveness. | |
| Policy | BCR-10.1 | Are policies and procedures established and made available for all personnel to adequately support services operations’ roles? | Create policies and procedures if they do not exist. Subsequently, publish policies and procedures and make them available for all personnel to adequately support services operations’ roles. | |
| Retention Policy | BCR-11.1 | Do you have technical capabilities to enforce CCSF data retention policies? | Adopt technical capabilities to enforce CCSF data retention policies. | |
| BCR-11.3 | Have you implemented backup or recovery mechanisms to ensure compliance with regulatory, statutory, contractual or business requirements? | Implement backup or recovery mechanisms to ensure compliance with regulatory, statutory, contractual or business requirements. | ||
| BCR-11.7 | Do you test your backup or redundancy mechanisms at least annually? | Test your backup or redundancy mechanisms at least annually. | ||
| Change Control & Configuration Management | Unauthorized Software Installations | CCC-04.1 | Do you have controls in place to restrict and monitor the installation of unauthorized software onto your systems? | Adopt controls that restrict and monitor the installation of unauthorized software onto your systems. |
| Data Security & Information Lifecycle Management | E-commerce Transactions | DSI-03.1 | Will you provide standardized (e.g. ISO/IEC) non-proprietary encryption algorithms (3DES, AES, etc.) to CCSF in order for them to protect their data if it is required to move through public networks (e.g., the Internet)? | Adopt and provide standardized (e.g. ISO/IEC) non-proprietary encryption algorithms (3DES, AES, etc.) to CCSF in order for them to protect their data if it is required to move through public networks (e.g., the Internet). |
| DSI-03.2 | Do you utilize open encryption methodologies any time your infrastructure components need to communicate with each other via public networks (e.g., Internet-based replication of data from one environment to another)? | Utilize open encryption methodologies any time your infrastructure components need to communicate with each other via public networks (e.g., Internet-based replication of data from one environment to another). | ||
| Nonproduction Data | DSI-05.1 | Do you have procedures in place to ensure production data shall not be replicated or used in non-production environments? | Create procedures to ensure production data is not replicated or used in non-production environments if they do not exist. Subsequently, publish procedures for person or people responsible for nonproduction data. | |
| Secure Disposal | DSI-07.1 | Do you support the secure deletion (e.g., degaussing/cryptographic wiping) of archived and backed-up data? | Support the secure deletion (e.g., degaussing/cryptographic wiping) of archived and backed-up data. | |
| DSI-07.2 | Can you provide a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of CCSF data once a customer has exited your environment or has vacated a resource? | Create procedures for CCSF offboarding if they do not exist. Subsequently, publish said procedures for person or people responsible for secure disposal of CCSF data. | ||
| Datacenter Security | Asset Management | DCS-01.2 | Do you maintain a complete inventory of all of your critical assets located at all sites/ or geographical locations and their assigned ownership? | Maintain a complete inventory of all of your critical assets located at all sites or geographical locations and their assigned ownership. |
| Controlled Access Points | DCS-02.1 | Are physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) implemented for all areas housing sensitive data and information systems? | Maintain physical security perimeters (e.g., fences, walls, barriers, guards, gates, electronic surveillance, physical authentication mechanisms, reception desks, and security patrols) implemented for all areas housing sensitive data and information systems. | |
| User Access | DCS-09.1 | Do you restrict physical access to information assets and functions by users and support personnel? | Restrict physical access to information assets and functions by users and support personnel. | |
| Encryption & Key Management | Entitlement | EKM-01.1* | Do you have key management policies binding keys to identifiable owners? | Adopt key management policies binding keys to identifiable owners. |
| Key Generation | EKM-02.1 | Do you have a capability to allow creation of unique encryption keys for CCSF? | Adopt capability to allow creation of unique encryption keys for CCSF. | |
| Encryption | EKM-03.1 | Do you encrypt CCSF data at rest (on disk/storage) within your environment? | Encrypt CCSF data at rest (on disk/storage) within your environment. | |
| Governance and Risk Management | Baseline Requirements | GRM-01.1 | Do you have documented information security baselines for every component of your infrastructure (e.g., hypervisors, operating systems, routers, DNS servers, etc.)? | Document information security baselines for every component of your infrastructure (e.g., hypervisors, operating systems, routers, DNS servers, etc.). |
| Policy | GRM-06.1 | Are your information security policies and procedures made available to all impacted personnel and business partners, authorized by accountable business role/function and supported by the information security management program as per industry best practices (e.g. ISO 27001, SOC 2)? | Create information security policies and procedures that are authorized by accountable business role/function and supported by the information security management program as per best practices (e.g. ISO27001, SOC2) if they do not exist. Subsequently, publish said policies and procedures to impacted personnel and business partners. | |
| Policy Enforcement | GRM-07.1 | Is a formal disciplinary or sanction policy established for employees who have violated security policies and procedures? | Create formal disciplinary or sanction policy if one does not exist. Subsequently, enforce policy for employees who have violated security policies and procedures. | |
| Policy Reviews | GRM-09.1 | Will you notify CCSF when you make material changes to your information security and/or privacy policies? | Notify CCSF when you make material changes to your information security and/or privacy policies. | |
| GRM-09.2 | Do you perform, at minimum, annual reviews to your privacy and security policies? | Perform, at minimum, annual reviews to your privacy and security policies. | ||
| Program | GRM-11.1* | Do you have a documented, organization-wide program in place to manage risk? | Document and adopt an organization-wide program to manage risk. | |
| Human Resources | Asset Returns | HRS-01.1 | Upon termination of contract or business relationship, are employees and business partners adequately informed of their obligations for returning organizationally-owned assets? | Upon termination of contract or business relationship, adequately inform employees and business partners of their obligations for returning organizationally-owned assets. |
| Background Screening | HRS-02.1 | Pursuant to local laws, regulations, ethics, and contractual constraints, are all employment candidates, contractors, and involved third parties subject to background verification? | Pursuant to local laws, regulations, ethics, and contractual constraints, complete background verifification for all employment candidates, contractors, and involved third parties. | |
| Employment Agreements | HRS-03.1 | Do your employment agreements incorporate provisions and/or terms in adherence to established information governance and security policies? | Incorporate provisions and/or terms in adherence to established information governance and security policies with your employment agreements. | |
| Employment Termination | HRS-04.1 | Are documented policies, procedures, and guidelines in place to govern change in employment and/or termination? | Govern change in employment and/or termination with documented policies, procedures, and guidelines. | |
| Training / Awareness | HRS-09.5 | Are personnel trained and provided with awareness programs at least once a year? | Train and provide personnel with awareness programs at least once a year. | |
| Identity & Access Management | Audit Tools Access | IAM-01.1 | Do you restrict, log, and monitor access to your information security management systems (e.g., hypervisors, firewalls, vulnerability scanners, network sniffers, APIs, etc.)? | Restrict, log, and monitor access to your information security management systems (e.g., hypervisors, firewalls, vulnerability scanners, network sniffers, APIs, etc.). |
| IAM-01.2 | Do you monitor and log privileged access (e.g., administrator level) to information security management systems? | Monitor and log privileged access (e.g., administrator level) to information security management systems. | ||
| User Access Policy | IAM-02.1 | Do you have controls in place ensuring timely removal of systems access that is no longer required for business purposes? | Adopt controls that ensure timely removal of systems access that is no longer required for business purposes. | |
| IAM-02.4* | Do you have procedures and technical measures in place for data access segmentation in multi-tenant system architectures? | Create procedures and technical measures in place for data access segmentation in multi-tenant system architectures. Subsequently, publish procedures for person or people responsible for data access segmentation. | ||
| Policies and Procedures | IAM-04.1 | Do you manage and store the identity of all personnel who have access to the IT infrastructure, including their level of access? | Manage and store the identity of all personnel who have access to the IT infrastructure, including their level of access. | |
| Source Code Access Restriction | IAM-06.1 | Are controls in place to prevent unauthorized access to your application, program, or object source code, and assure it is restricted to authorized personnel only? | Adopt controls that prevent unauthorized access to your application, program, or object source code, and assure it is restricted to authorized personnel only. | |
| IAM-06.2 | Are controls in place to prevent unauthorized access to CCSF application, program, or object source code, and assure it is restricted to authorized personnel only? | Adopt controls that prevent unauthorized access to CCSF application, program, or object source code, and assure it is restricted to authorized personnel only. | ||
| User Access Restriction / Authorization | IAM-08.1 | Do you document how you grant, approve and enforce access restrictions to CCSF credentials following the rules of least privilege? | Document how you grant, approve and enforce access restrictions to CCSF credentials following the rules of least privilege. | |
| User Access Reviews | IAM-10.1 | Do you require a periodical authorization and validation (e.g. at least annually) of the entitlements for all system users and administrators (exclusive of users maintained by CCSF), based on the rule of least privilege, by business leadership or other accountable business role or function? | Require a periodical authorization and validation (e.g. at least annually) of the entitlements for all system users and administrators (exclusive of users maintained by CCSF), based on the rule of least privilege, by business leadership or other accountable business role or function. | |
| User Access Revocation | IAM-11.1 | Is timely deprovisioning, revocation, or modification of user access to the organizations systems, information assets, and data implemented upon any change in status of employees, contractors, customers, business partners, or involved third parties? | Dprovisioning, revocation, or modification of user access to the organizations systems, information assets, and data implemented upon any change in status of employees, contractors, customers, business partners, or involved third parties must be completed in a timely manner. | |
| User ID Credentials | IAM-12.1* | Do you support use of, or integration with, CCSF-based Single Sign On (SSO) solutions to your service? | Support use of, or integration with, CCSF-based Single Sign On (SSO) solutions to your service. | |
| IAM-12.2* | Do you use open standards to delegate authentication capabilities to CCSF? | Use open standards to delegate authentication capabilities to CCSF. | ||
| IAM-12.3* | Do you support identity federation standards (e.g., SAML, SPML, WS-Federation, etc.) as a means of authenticating/authorizing users? | Support identity federation standards (e.g., SAML, SPML, WS-Federation, etc.) as a means of authenticating/authorizing users. | ||
| IAM-12.6* | Will you provide CCSF with strong (multifactor) authentication options (e.g., digital certs, tokens, biometrics, etc.) for user access? | Provide CCSF with strong (multifactor) authentication options (e.g., digital certs, tokens, biometrics, etc.) for user access? | ||
| Infrastructure & Virtualization Security | Audit Logging / Intrusion Detection | IVS-01.1 | Are file integrity (host) and network intrusion detection (IDS) tools implemented to help facilitate timely detection, investigation by root cause analysis, and response to incidents? | Implement file integrity (host) and network intrusion detection (IDS) tools to help facilitate timely detection, investigation by root cause analysis, and response to incidents. |
| IVS-01.2 | Is physical and logical user access to audit logs restricted to authorized personnel? | Restrict physical and logical user access to audit logs strictly to authorized personnel. | ||
| IVS-01.5 | Are audit logs reviewed on a regular basis for security events (e.g., with automated tools)? | Review audit logs on a regular basis for security events (e.g., with automated tools). | ||
| Clock Synchronization | IVS-03.1 | Do you use a synchronized time-service protocol (e.g., NTP) to ensure all systems have a common time reference? | Use a synchronized time-service protocol (e.g., NTP) to ensure all systems have a common time reference. | |
| OS Hardening and Base Controls | IVS-07.1 | Are operating systems hardened to provide only the necessary ports, protocols, and services to meet business needs using technical controls (e.g., antivirus, file integrity monitoring, and logging) as part of their baseline build standard or template? | Harden operating systems to provide only the necessary ports, protocols, and services to meet business needs using technical controls (e.g., antivirus, file integrity monitoring, and logging) as part of their baseline build standard or template. | |
| Production / Non-Production Environments | IVS-08.1 | For your SaaS or PaaS offering, will you provide CCSF with separate environments for production and test processes? | For your SaaS or PaaS offering, provide CCSF with separate environments for production and test processes. | |
| IVS-08.3 | Do you logically and physically segregate production and non-production environments? | Logically and physically segregate production and non-production environments. | ||
| Segmentation | IVS-09.1 | Are system and network environments protected by a firewall or virtual firewall to ensure business and customer security requirements? | Protect system and network environments by a firewall or virtual firewall to ensure business and customer security requirements. | |
| IVS-09.3* | Have you implemented the necessary measures for the appropriate isolation and segmentation of CCSF access to infrastructure system and network components, in adherence to established policies, legal, statutory, and regulatory compliance obligations? | Implement the necessary measures for the appropriate isolation and segmentation of CCSF access to infrastructure system and network components, in adherence to established policies, legal, statutory, and regulatory compliance obligations. | ||
| IVS-09.5* | Are system and network environments protected by a firewall or virtual firewall to ensure protection and isolation of sensitive data? | Protect system and network environments by a firewall or virtual firewall to ensure protection and isolation of sensitive data. | ||
| VMM Security - Hypervisor Hardening | IVS-11.1 | Do you restrict personnel access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems based on the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls and TLS-encapsulated communications to the administrative consoles)? | Restrict personnel access to all hypervisor management functions or administrative consoles for systems hosting virtualized systems based on the principle of least privilege and supported through technical controls (e.g., two-factor authentication, audit trails, IP address filtering, firewalls and TLS-encapsulated communications to the administrative consoles). | |
| Wireless Security | IVS-12.1 | Are policies and procedures established and mechanisms configured and implemented to protect the wireless network environment perimeter and to restrict unauthorized wireless traffic? | Establish policies and procedures, configure and implement mechanisms to protect the wireless network environment perimeter and to restrict unauthorized wireless traffic. | |
| IVS-12.2 | Are policies and procedures established and mechanisms implemented to ensure wireless security settings are enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, SNMP community strings)? | Establish policies and procedures and implement mechanisms to ensure wireless security settings are enabled with strong encryption for authentication and transmission, replacing vendor default settings (e.g., encryption keys, passwords, SNMP communitystrings). | ||
| IVS-12.3 | Are policies and procedures established and mechanisms implemented to protect wireless network environments and detect the presence of unauthorized (rogue) network devices for a timely disconnect from the network? | Establish policies and procedures and implement mechanisms to protect wireless network environments and detect the presence of unauthorized (rogue) network devices for a timely disconnect from the network. | ||
| Interoperability & Portability | APIs | IPY-01.1 | Do you publish a list of all APIs available in the service and indicate which are standard and which are customized? | Publish a list of all APIs available in the service and indicate which are standard and which are customized. |
| Mobile Security | Approved Applications | MOS-03.1 | Do you have a policy enforcement capability (e.g., XACML) to ensure that only approved applications and those from approved application stores can be loaded onto a mobile device? | Adopt a policy enforcement capability (e.g., XACML) to ensure that only approved applications and those from approved application stores can be loaded onto a mobile device. |
| Security Incident Management, E-Discovery, & Cloud Forensics | Incident Management | SEF-02.1 | Do you have a documented security incident response plan? | Document security incident response plan. |
| SEF-02.4 | Have you tested your security incident response plans in the last year? | Test security incident response plan on an annual basis. | ||
| Incident Reporting | SEF-03.1 | Are workforce personnel and external business relationships adequately informed of their responsibility, and, if required, consent and/or contractually required to report all information security events in a timely manner? | Adequately inform workforce personnel and external business relationships of their responsibility, and, if required, provide consent and/or contractually require to report all information security events in a timely manner. | |
| SEF-03.2 | Do you have predefined communication channels for workforce personnel and external business partners to report incidents in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations? | Predefine communication channels for workforce personnel and external business partners to report incidents in a timely manner adhering to applicable legal, statutory, or regulatory compliance obligations. | ||
| Incident Response Legal Preparation | SEF-04.4 | Will you enforce and attest to CCSF data separation when producing data in response to legal subpoenas? | Enforce and attest to CCSF data separation when producing data in response to legal subpoenas. | |
| Supply Chain Management, Transparency, and Accountability | Incident Reporting | STA-02.1 | Will you make security incident information available to CCSF periodically through electronic methods (e.g., portals)? | Make security incident information available to CCSF periodically through electronic methods (e.g., portals). |
| Network / Infrastructure Services | STA-03.1 | Do you collect capacity and use data for all relevant components of your cloud service offering? | Collect capacity and use data for all relevant components of your cloud service offering? | |
| Third Party Agreements | STA-05.4 | Do third-party agreements include provision for the security and protection of information and assets? | Include provision for the security and protection of information and assets with third-party agreements. | |
| STA-05.5 | Do you have the capability to recover data for CCSF in the case of a failure or data loss? | Adopt the capability to recover data for CCSF in the case of a failure or data loss. | ||
| STA-05.6* | Do you have the capability to restrict the storage of CCSF data to specific countries or geographic locations? | Adopt capability to restrict the storage of CCSF data to specific countries or geographic locations. | ||
| Supply Chain Governance Reviews | STA-06.1* | Do you review the risk management and governance processes of partners to account for risks inherited from other members of that partner's supply chain? | Review the risk management and governance processes of partners to account for risks inherited from other members of that partner's supply chain. | |
| Supply Chain Metrics | STA-07.1* | Are policies and procedures established, and supporting business processes and technical measures implemented, for maintaining complete, accurate, and relevant agreements (e.g., SLAs) between providers and CCSF? | Create policies and procedures established, and establish supporting business processes and technical measures, for maintaining complete, accurate, and relevant agreements (e.g., SLAs) between providers and CCSF. | |
| STA-07.4 | Will you provide CCSF with ongoing visibility and reporting of your operational Service Level Agreement (SLA) performance? | Provide CCSF with ongoing visibility and reporting of your operational Service Level Agreement (SLA) performance. | ||
| Third Party Audits | STA-09.1 | Do you mandate annual information security reviews and audits of your third party providers to ensure that all agreed upon security requirements are met? | Mandate annual information security reviews and audits of your third party providers to ensure that all agreed upon security requirements are met. | |
| Threat and Vulnerability Management | Antivirus / Malicious Software | TVM-01.1 | Do you have anti-malware programs that support or connect to your cloud service offerings installed on all of your IT infrastructure network and systems components? | Adopt anti-malware programs that support or connect to your cloud service offerings installed on all of your IT infrastructure network and systems components. |
| Vulnerability / Patch Management | TVM-02.5 | Do you have a capability to patch vulnerabilities across all of your computing devices, applications, and systems? | Adopt tool that will patch vulnerabilities across all computing devices, applications, and systems. | |
| Mobile Code | TVM-03.1 | Is mobile code authorized before its installation and use, and the code configuration checked, to ensure that the authorized mobile code operates according to a clearly defined security policy? | Authorize mobile code before it is installed and used, and check the code configuration, to ensure that the authorized mobile code operates according to a clearly defined security policy. |
Sheet1
| List |
| Yes |
| No |
| Not Applicable |
File details come from the government source that posted it. Updated .