7-Cloud Service Provider Security Checklist 2025.xlsx

This is a Cloud Service Provider Security Checklist issued by the City of Detroit for a Community Engagement Platform procurement. The City of Detroit Office of Contracting and Procurement is seeking a qualified cloud service provider to deliver and maintain a Community Engagement Platform solution for a five-year term. The checklist establishes comprehensive security and compliance requirements that all respondents must address in their proposals, including governance structures, uptime and maintenance responsibilities, and adherence to regulatory frameworks.

The security checklist requires vendors to demonstrate compliance with industry-standard security frameworks such as NIST, ISO/IEC, COBIT, or ITIL, and mandates submission of a current SOC 2 Type 2 report from the vendor's cloud hosting provider at no additional cost to the City. Critical requirements include detailed account management processes, network security controls including firewalls and intrusion detection systems, data segregation protocols in multitenant environments, dedicated virtual infrastructure, encryption and public key infrastructure implementation, and comprehensive logging and alerting capabilities. Vendors must also confirm their willingness to undergo risk assessments and privacy impact assessments for personally identifiable information storage, provide evidence of data separation controls, describe subcontractor security inheritance protocols, and document processes for secure retirement of storage media and backups. The checklist serves as the primary evaluation instrument for assessing vendor security posture and operational readiness.