7-ITB-26-00196 VendorSecuritySoftwareQuestionnaire.xlsx
XLSX spreadsheet 176 KB Posted
- Attached to
- Security Access Control Cameras State and local contract opportunity
- Solicitation number
- ITB-26-00196
- Issued by
- Hillsborough County, Florida
About this file
This is a Vendor Security and Compliance Questionnaire for software products, issued by Hillsborough County, Florida in connection with a Security Access Control Cameras procurement (ITB-26-00196). The questionnaire is designed to assess vendor compliance with NIST SP 800-53 security standards across multiple domains, including system and services acquisition, system and information integrity, access control, audit and accountability, identification and authorization, system and communications protections, and incident handling. The document requests detailed information about the vendor's software application, development practices, security testing methodologies, and product capabilities through a comprehensive 95-question assessment covering secure architecture design, threat modeling, code review processes, penetration testing frequency, vulnerability management, and patch availability.
The questionnaire evaluates critical product functionality requirements for Hillsborough County's environment, including user identification and authentication capabilities, password management standards, encryption protocols, access control configurations, logging and audit trail functions, and remote access restrictions. Vendors must demonstrate support for PKI-based authentication, 128-bit AES encryption minimum standards, FIPS 140-2 compliance, syslog protocol implementation, and role-based access controls. The assessment also requires vendors to confirm their commitment to security patch availability, change management processes, and audit rights for the County. This security questionnaire is a prerequisite evaluation for vendors participating in the five-year, $461,365.28 contract for installation, inspection, testing, preventative maintenance, and repair of closed-circuit surveillance systems, access control systems, and intercom systems across multiple Hillsborough County Water Resources Department facilities.
View the file
Other files for this state and local contract opportunity
| File | Type | Posted |
|---|---|---|
| 3-Substitute W9 Form.pdf.pdf | ||
| 4-Direct Deposit Authorization Form 5.15.2025.pdf.pdf | ||
| 8-ITB-26-00196 Security Access Controls Cameras.pdf | ||
| 5-ITB-26-00196 Attachment A.pdf | ||
| 1-Drug Free Workplace Form.doc | DOC document | |
| 6-ITB-26-00196 Insurance Requirements.pdf | ||
| 2-Insurance Certificate.doc | DOC document |
On GovTribe
Work with this file on GovTribe
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Syst. & Serv. Acquisition P&P
VENDOR SECURITY & COMPLIANCE QUESTIONNAIRE - SOFTWARE PRODUCT
Name: Email: Phone: Date:
Company Name: Company Website:
| Software Application Information |
| Name of Application: Type of Application (Web, Mobile, etc.): |
| Application Development Language (Java, .NET, iOS, etc.): |
| PLEASE PLACE AN "X" IN EITHER YES, NO, OR N/A AND PLEASE PROVIDE COMMENTS AS YOU DEEM APPROPRIATE | YES | NO | N/A | Comments |
| NIST SP 800-53 System & Services Acquisition Policy and Procedures | ||||
| 1. Do you perform a secure architecture design review? | ||||
| 2. Do you incorporate threat modeling into the business requirements/design process of your SDLC? | ||||
| 3. Do you perform secure code reviews against the entire code base in the development phase? | ||||
| 4. Is there a security expert who performs the review? (Describe who conducts the code review). | ||||
| 5. Do you use automated code review tools? | ||||
| 6. Do all developers receive formal software security training? | ||||
| 7. Do you outsource any development? (Provide the name of the company and location) | ||||
| 8. Are the security defects identified being shared with the developers to prevent reoccurrence? | ||||
| 9. Are QA testing procedures in place to determine whether security features are effective? | ||||
| 10. Do you use dynamic scanning against web apps while in the QA phase? | ||||
| 11. Do you remediate security vulnerabilities identified? | ||||
| 12. Does your QA process involve fuzz testing (small/large numbers, binary sequences, negative values, command line inputs random values, etc.)? | ||||
| 13. How often do you perform penetration testing (pen testing) of the application? | ||||
| 14. Who performs the pen test? | ||||
| 15. Are pen testing results managed through a defect or vulnerability management system where results are assigned for remediation? | ||||
| 16. Do you currently have any un-remediated pen test issues in the application under review? | ||||
| 17. Do you promptly notify customers of newly identified vulnerabilities in the solution or any supporting technologies? | ||||
| NIST SP 800-53 System and Information Integrity | ||||
| 18. Do you provide freely available security patches to address vulnerabilities in supported versions of your software? | ||||
| 19. Do you have a documented change management process? | ||||
| NIST SP 800-53 Access Control | ||||
| 20. Does the product support the creation of unique user identifiers and associated authentication features that can be integrated using lightweight access directory protocol and secure lightweight directory access protocol? | ||||
| 21. Does the product allow configuration of access control groups for unique user identifiers? | ||||
| 22. Is the product capable of demonstrating approval of unique user identifiers by an authorizing party (e.g., super user/administrator)? | ||||
| 23. Does the product support access restrictions based on group assignments, including unique identifiers or groups which can read, write and execute files, commands or code associated with commands? | ||||
| 24. Does the product allow unique user identifiers to be activated, deactivated, and/or deleted? | ||||
| 25. Does the product support the ability to automatically disable access based on a preset period of time established by the Hillsborough County? | ||||
| 26. Does the product support audit logging and email notification in the event of account creation, modification, disabling, and termination actions? | ||||
| 27. Does the product support automatic logout in the event inactivity from unique user identifiers? | ||||
| 28. Does the product allow the monitoring and reporting (e.g., email) of system account usage? | ||||
| 29. Does the product support automated alerts in the event that a unique user identifier or system account is used outside of a preset period of time as determined by the Hillsborough County? | ||||
| 30. Does the product allow reporting on atypical usage of unique user identifier or system accounts via electronic mail? | ||||
| 31. Does the product support reporting on user privileges via electronic mail? | ||||
| 32. Is the product capable of tracking and monitoring the assignment of privileged roles (Priviledged roles are defined as unique user identifiers or system accounts with read, write, and execute permissions) via electronic mail? | ||||
| 33. Does the product support the ability to restrict access to it by Internet Protocol Address? | ||||
| 34. Does the product support assignment of discretionary or mandatory access control? | ||||
| 35. Does the product support the ability to restrict information flow control on metadata? | ||||
| 36. Is the product capable of preventing encrypted data from bypassing content-checking mechanisms? | ||||
| 37. Does the product allow configuration of unique user identifiers and system accounts with different access permissions separating key functions based on user or group (i.e., seperation of duties)? | ||||
| 38. Is the product capable of restricting access based on role or group (e.g., group account policy)? | ||||
| NIST SP 800-53 Audit and Accountability | ||||
| 39. Is the product capable of logging unsuccessful logon attempts and automatically disabling unique user identifiers or system accounts based on a present number of unsuccessful attempts as defined by the Hillsborough County? | ||||
| 40. Does the product support configuration of a logon banner prior to permitting access that has content defined by the Hillsborough County? | ||||
| 41. Does the product support logging of last successful and unsuccessful logon attempt for unique identifiers? | ||||
| 42. Is the product capable of restricting the number of sessions that are allowed to itself as defined by the Hillsborough County? | ||||
| 43. Is the product capable of locking a session automatically after a preset period of time as defined by the Hillsborough County? | ||||
| 44. Is the product capable of requiring all transactions to have an associated unique user identifier or system account prior to transaction initiation? | ||||
| 45. Is the product capable of tagging information with access permission rights, so that the information can only be viewed with proper credentials regardless of where it is stored? | ||||
| 46. Is the product capable of restricting remote access except through approved Hillsborough County mediums such as the Virtual Private Network (VPN) Infrastructure? | ||||
| 47. Is the product capable of restricting wireless access except through approved Hillsborough County wireless solutions? (See the Hillsborough County Information Security Policy on Wireless). | ||||
| 48. Is the product capable of restricting unique user identifiers' access to other unique user identifiers' information, directory structure, etc. unless otherwise permitted by a user with super user/administrative access? | ||||
| 49. Is the product capable of logging and recording all unique user identifier activity and system account activity? | ||||
| 50. Is the product capable of logging and recording all changes which occur on the asset including applications, databases, network or system operating systems? | ||||
| 51. Is the product capable of logging system and activity transactions including date, time and whether the event was successful? | ||||
| 52. Is the product capable of storing log data on a predefined amount of storage as defined by the Hillsborough County? | ||||
| 53. Is the product capable of alerting via email if log data is not successfully recorded? | ||||
| 54. Is the product capable of recording software/hardware errors and when storage capacity has been reached? | ||||
| 55. Is the product capable of logging messages using the "syslog" or "syslog-ng" protocol in compliance with RFC 5424 (replacing 3164) | ||||
| 56. Does the product support filtering capabilities for all specified log types that are captured by the asset (e.g., application, database, network or system operating systems)? | ||||
| 57. Does the product support time stamps of transactions and events for purposes of logging? | ||||
| 58. Does the product support data storage using encryption algorithms that exceed the strength of 128-bit advanced encryption? | ||||
| 59. Does the product support utilization of hashing and/or generally accepted digital signature based technology to provide non-repudiation of logs stored or transmitted from the asset including applications, database, network or system operating systems? | ||||
| 60. Does the product support the retention of log data for a preset period of time (in storage) as defined by the Hillsborough County? | ||||
| NIST SP 800-53 Identification and Authorization | ||||
| 61. Does the product require unique user identification before access is granted to an asset including applications, databases, network or system operating platforms? | ||||
| 62. Does the product require unique system identification before system-to-system access is allowed? | ||||
| 63. Is the product capable of establishing user accounts based on unique attributes such as last names, initials, etc. at the discretion of the Hillsborough County? | ||||
| 64. Is the product capable of restricting the permanent use of a unique user identifier that has already been used? | ||||
| 65. Does the product require the authentication of a unique identifier prior to permitting access to the requested source? | ||||
| 66. Is the product capable of supporting password strings of at least 15 characters during password authentication? | ||||
| 67. Is the product capable of enforcing password complexity, which requires the use of at least 1 uppercase, 1 lowercase, 1 special character, and 1 number? | ||||
| 68. Is the product capable of enforcing that new passwords for unique user identifiers cannot use previous password sequences where at least 6 characters are being reused? | ||||
| 69. Does the product support password storage using at least 128-bit advanced encryption standard? | ||||
| 70. Is the product capable of expiring passwords and requiring unique user identifiers to change their password after a preset period of time not to exceed 365 days and at the discretion of the Hillsborough County? | ||||
| 71. Does the product support the use of PKI-based authentication solutions? | ||||
| 72. Does the product support the use of PKI including validation of certificates through the construction of certification paths with status information to an accepted trust anchor? | ||||
| 73. Does the product support the use of PKI including enforcement of authorized access to the corresponding private keys? | ||||
| 74. Does the product support the use of PKI maps authenticated identities to unique user identifiers? | ||||
| 75. Is the product capable of masking passwords during system entry? (i.e., shows passwords as *******) | ||||
| 76. Does the product support cryptographic authentication schemes, which are at a minimum in compliance with FIPS 140-2 (i.e., 128-bit AES for example is acceptable)? | ||||
| NIST SP 800-53 System and Communications Protections | ||||
| 77. Is the product capable of separating the administration of the asset from the use of the asset (i.e., Application Partitioning) including applications, databases, network or system operating platforms? | ||||
| 78. Is the product capable of requiring unique user identification and authentication to shared resources, and all activity and use of the resource is logged, recorded, and reported? | ||||
| 79. Is the product capable of restricting access from the specific sources using specific protocols? | ||||
| 80. Is the product capable of prioritizing services as determined by the Hillsborough County to enhance performance (generally only applied to operating platforms? | ||||
| 81. Is this product capable of preventing access via internet Protocol, Service, and Port? | ||||
| 82. Does this product support checksums and hash values to maintain the integrity of information? | ||||
| 83. Is this product capable of encrypting data in transit to protect it from unauthorized disclosure? | ||||
| 84. Is this product capable of terminating communications when sessions are completed? | ||||
| 85. Can the product be configured to communicate only with specific assets? | ||||
| 86. Is the product capable of utilizing PKI infrastructures? | ||||
| 87. Is the product capable of utilizing only FIPS 140-2 compliant encryption algorithms (e.g., 128-bit AES)? | ||||
| 88. Does the product support the ability to use acceptable mobile code such as Java, JavaScript, ActiveX, PDF, Postscript, Shockwave movies, Flash animations, and VBScript? | ||||
| 89. Does the product support session authenticity during initialization of sessions (e.g., SSL)? | ||||
| 90. Do have the application firewalls in place for this system? | ||||
| NIST SP 800-53 System and Information Integrity | ||||
| 91. Does the product support the ability to have vendor's correct flaws (e.g., security vulnerabilities), including applications, databases network and system operating platforms? | ||||
| 92. Is the product capable of being scanned using well-known antivirus systems for malicious code? | ||||
| 93. Is the product capable of restricting personnel from entering data in the asset based on access control (e.g., role-based access)? | ||||
| 94. Does the product have the ability to determine whether or not inputs are valid? | ||||
| 95. Do you permit Hillsborough County the right to audit this information as well as other related security information? |
Sheet1
Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No No Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A No No Yes Yes N/A N/A N/A N/A N/A N/A No Yes N/A N/A N/A No Yes N/A N/A N/A No Yes N/A N/A N/A No Yes N/A N/A N/A No Yes N/A N/A N/A No Yes N/A N/A N/A No Yes N/A N/A N/A No Yes N/A N/A N/A No Yes N/A N/A N/A No Yes N/A N/A N/A No Yes N/A N/A N/A No Yes N/A No N/A N/A N/A No N/A N/A N/A No N/A N/A N/A No N/A N/A N/A
File details come from the government source that posted it. Updated .