5-Exhibit E- IT Security Questionnaire V16.docx

Subject: New/Updated/Upgraded Software/Appliance/Equipment Security Questions

Please answer the questions listed below, which will assist the information security team to complete a security assessment of the item in question. Please feel free to substitute server, database, or appliance for application as necessary to suit the situation.

Please DO NOT reference other documents, attachments, or additional reference materials. The questions below were carefully considered. Trying to glean the answers to specific questions from reference material requires a level of interpretation which may not be correct.

The following are REQUIRED for all applications, appliances, servers, hardware, etc. that will reside in the University Health (UH) network. Please indicate whether your product meets these requirements by checking Yes or No. Any items checked “No” MUST be approved by both the UH CIO and a department senior VP.

NOTE: CrowdStrike Falcon is deployed in Monitor mode. It will require very unusual circumstances for the CIO to approve deployment without the CrowdStrike sensor.

Vendor:______________________________ Name of Product or Service:________________________

UH Owner:___________________________

1. LAPS ONLY, no local admin accounts are allowed

2. All hardware MUST be added to the UH domain

3. All hardware will use UH GPO

4. PowerShell access will be controlled via GPO

5. SecureLink is the approved method for Remote Access

a. If SecureLink is not used, MFA is required for remote log in

6. LDAPS for AD integration

7. CrowdStrike Falcon in Monitor mode. This is waiverable only under very unusual circumstances.

8. Splunk, Infocyte, Nessus, MECM, SolarWinds agents MUST be installed

9. If SSL encryption is used, TLS 1.2 or greater is required

10. Server Reboots MUST occur every 30 – 35 days

11. Server OS Patching will be managed by UH If not managed by UH,

a. OS patches MUST be deployed within 60 days of release (non-emergency)

i. NOT just FDA labelled uncontrolled risks (proof of patch frequency will be required)

b. Emergency OS patches (like CVE-2020-1942) MUST be deployed within 72 hours (proof of compliance will be required)

1. Will this application be hosted on premise, in the cloud, or at the vendor’s site?

a. For all hosted systems, the following questions need to be answered:

i. Is our instance segregated from other customers?

ii. Is our data retrievable/”deleteable” if we sever relationships with the cloud-vendor?

iii. Who hosts the data?

iv. Can our instance be IP-fenced?

v. Does the vendor use UH data for any reason other than the application purchased?

2. Will this application or system use resources outside the United States or send data outside the United States?

a. If yes:

i. Is Support outside the United States? Where?

ii. Is data transferred outside the United States? Where?

3. Does the application comprise of HIPAA data or other sensitive data such as PHI, PII, and PCI?

4. Please provide a graphic representation (Network Wire Diagram) of the communications/network infrastructure associated with the systems communications requirements. Label all ports (such as port 80 and/or 443) and services (such as SFTP, TLS 1.1, etc.) that are used or required. Do not reference other documents.

5. Is this an Upgrade/New installation/Migration from an old version to a new version?

6. If this is an upgrade, please supply documentation with port requirements and justification. Do not reference other documents What ports are currently opened?

What ports are allowed?

What ports are required?

7. How will the vendor/contractor connect to the application:

VPN, dedicated circuit, Internet or not required?

8. How will a user/client connect to the application?

a. Is a mobile application available?

b. Is the mobile application controllable using a mobile device management system?

9. Does the vendor/contractor perform authenticated IP scans of your system/environment?

If so what tool is used?

If requested, can a copy of the results be provided?

10. Does the vendor/contractor perform application-level scans?

If so what tool is used?

If requested, can a copy of the results be provided?

11. What OS and version does this application require?

Is the OS upgradeable or does a new version of the application have to be purchased when an OS is EOL/EOS?

The vendor will be required to purchase extended support if the OS is not upgradable in place.

As new version/patches are released, can it be upgraded?

If so, who is responsible for testing new version/patch compatibility?

If the vendor must approve patches, what is the lag time between patch release and patch approval?

Can the application/appliance be restarted on a scheduled basis?

If not, please explain why.

12. Does this application support SSO, AD integration, Federation or LDAPS?

If so, which one and who performs the integration?

13. Does this application require remote access?

Is remote access required for users or support?

Is it Agent Based?

If it is, is it always on or is it session-based?

Is remote access auditable and alert able?

14. SecureLink is the ONLY approved remote access solution.

Note: University Health CIO approval is required for non-SecureLink remote access requests.

15. Does this system allow the use of CrowdStrike Falcon, anti-virus software, anti-malware software?

If so what specific vendors?

Who is responsible for installation, maintenance, etc.?

If not, what security measures are in place to compensate for not using anti-virus/malware software?

16. Does this system allow for the installation of monitoring agents such as SolarWinds, Splunk, EDR and MECM?

17. Does this system allow for the installation of Auditing GPOs, Membership to the domain?

Among other things, UH GPOs control password length and complexity as well as cached credentials. Systems must comply with UH password policy. UH does not allow for cached credential.

Please note: UH does not allow the use of ANY collaborative sites, i.e. GitHub, DropBox, OneDrive, etc.

18. Does this system communicate securely both inside and outside of the corporate network?

Please note: UH does NOT allow the use of Freeware or Shareware in our environment.

19. Does this application require “middleware”; such as, Java, Flash, I.E., PowerShell, or Adobe reader?

If so, is does it require a specific version of middleware?

Can it be patched or upgraded?

Who is responsible for maintenance, licensing, and upkeep?

Please note: Google chrome is not an allowed browser in the UH environment.

20. Does this application require any Microsoft Office products?

If so, can it use an add-on or plug in instead?

If so, what version and can it be patched?

Who is responsible for patching MS Office suite?

Please provide documentation showing requirements for MS office suite or parts of the suite.

21. Does this application require a Certificate?

If so, who provides the Certificate?

Note: Certificate must be SHA256 or better

22. Does this application require any insecure services, such as:

FTP? SFTP? FTPS? Telnet? TLS? SSL?

If so, state which one(s) and why it cannot use a more secure version Note: University Health does not allow TLS 1.0, 1.1; SSLv2, SSLv3 or FTP in the corporate environment.

23. Does this application require dedicated hardware, such as:

OVA? University Health owned/built? Is this a hardware appliance?

Can the OS be upgraded? Will a new appliance need to be purchased to upgrade the OS if it goes EOL/EOS?

The vendor will be required to purchase extended support if the OS is not upgradable in place.

24. Will this application require updates?

If so, who performs them?

What is the process?

What is the timeline?

25. Does this application require a Vendor password? What is the process for updates? Does the application require any Admin accounts? Rights? Unique naming? Does this system support LAPS?

Signed name & date _______________________________________

Version 16 Page 1 of 5 image1.png image2.png