7-VendorSecurityOutsourcingQuestionare.xlsx
XLSX spreadsheet 28 KB Posted
- Solicitation number
- RFP-26-00025
- Issued by
- Hillsborough County, Florida
About this file
The document is a Vendor Security and Compliance Questionnaire for Hillsborough County, specifically targeting a potential vendor for the Water Resources Department's Customer Billing, Payment and Engagement Solution. The project seeks a comprehensive electronic payment receipt system with capabilities including online credit card payments, e-Checks, mobile payments, digital wallet and retail payment solutions, bill printing and mailing services, bill redesign, customer portal development, Live Chat, Chatbot, bill comparison features, and communication management. The contract is estimated at $22,000,000 for a five-year term, focusing on providing advanced payment and customer engagement technologies for the county's water resources billing system.
The questionnaire extensively covers security requirements aligned with national standards like NIST SP 800-53, CJIS, and other federal compliance frameworks. Key security expectations include data storage exclusively within the continental United States, integration with Hillsborough County's Identity Management system, encryption of sensitive data, background screenings for personnel, annual third-party security assessments, vulnerability testing, and compliance with various federal and state regulations including HIPAA, FERPA, and FBI/CJIS standards. The vendor must demonstrate robust information security policies, comprehensive threat protection mechanisms, incident response capabilities, and willingness to allow county audits of their security infrastructure and processes.
View the file
Other files
Show all 11
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Syst. & Serv. Acquisition P&P VENDOR SECURITY & COMPLIANCE QUESTIONNAIRE - Outsource
Name: Email: Phone: Date:
Company Name: Company Website:
| Company Address: | ||||
| PLEASE PLACE AN "X" IN EITHER YES, NO, OR N/A AND PLEASE PROVIDE COMMENTS AS YOU DEEM APPROPRIATE | YES | NO | N/A | Comments |
| General Questions | ||||
| G1. Do you have staff dedicated to physical and/or information technology security? Please explain. | ||||
| G2. What type of interfaces do you support? Do you have documentation? | ||||
| G3. What is the reliability/uptime of your environment (do you meet the 5 9's)? (Please add comments) | ||||
| G4. Is there regularly scheduled downtime for maintenance? If so, what is that timeframe? | ||||
| G5. Can you share your backup and recovery procedures? | ||||
| G6. Can you share your disaster plan with us and is it tested? | ||||
| G7. What is your privacy policy? (Please add comments) | ||||
| G8. Can you provide your physical security policies? | ||||
| G9. Please describe the layers of security to the physical access to the servers that Hillsborough County data would reside on. | ||||
| G10. Is Hillsborough County allowed to do periodic site visits to see the physical structure? | ||||
| G11. Do the servers reside, that are hosting and backing up the software, on shore? | ||||
| G12. Is there a government certified cloud? | ||||
| G13. What is your policy for background check for your employees? Who has access to sensitive information? | ||||
| G14. How do you enforce security processes for integrations with third parties? | ||||
| G15. Is there a certification process to ensure that third party applications are secure and won't allow intruders to get into your environment through one of these partners? | ||||
| G16. How do you protect sensitive data in storage infrastructure? | ||||
| G17. What audit logs are available? | ||||
| G18. How is the data encrypted? Is it encrypted at rest, in transition, and for disposition? | ||||
| G19. What type of encryption do you use for the transfer of information (via emails, etc.) | ||||
| G20. What are your layers of security (including network, application, etc.)? | ||||
| G21. What devices are you using to stop intruders from getting in through your perimeter? | ||||
| G22. Do you have strong network firewalls? How are they kept updated? | ||||
| G23. How do you monitor events | ||||
| G24. Do you have a SIEM or Log Management software in place? | ||||
| G25. What security process do you have for your virtualization environment | ||||
| G26. How are you testing for vulnerabilities and fixing them? | ||||
| G27. What type of standards are you following for Access control? | ||||
| G28. How is the provisioning of users done? | ||||
| G29. Who manages the credential management process? | ||||
| G30. How control will Hillsborough County have? | ||||
| G31. How is the secure login handled? Is there a dedicated VPN? | ||||
| G32. Is there a federated identity process and how is that managed? Hillsborough County would be looking for single sign-on with active directory accounts. | ||||
| G33. Can open ID's be used for registration and authentication? | ||||
| G34. Does security ownership transfer to the infrastructure provider? How do you ensure protection against key vulnerabilities like XSS, SQL injection, CSRF, Session Management, etc.? | ||||
| G35. What happens in case of a breach? Who's responsible? | ||||
| G36. Do you use vulnerability scanning tools and services to find vulnerabilities with the infrastructure environment? | ||||
| G37. What is the process of remediating or blocking those vulnerabilities? | ||||
| G38. Will you allow Hillsborough County to run our own vulnerability assessment tools? We currently have Homeland Security running weekly vulnerability tests on our IP addresses. | ||||
| G39. What type of encryption is applied to related mobile apps (if any)? | ||||
| G40. Can you provide three customer IT department references that we can contact? | ||||
| Security Requirements - Where applicable national standard references are included | ||||
| 1. An information security policy based on industry acceptable standards and frameworks, is in place, has been approved by management and has been communication to employees, contractors, and individuals on behalf of the organization. (NIST SP 800-53 Access Control) | ||||
| 2. Security roles and responsibilities of employees, contractors, and individuals working on behalf of the organization are defined and documented in accordance with the organizations information security policy. (NIST SP 800-53 Access Control) | ||||
| 3. An information security awareness and training program has been established and routinely provides general awareness and role specific (e.g., secure coding, CJIS, etc.) security training to all employees. (NIST SP 800-53 Awareness and Training) | ||||
| 4. Background screenings of employees, contractors and individuals working on behalf of the organization are performed to include criminal, credit, professional / academic, references and drug screenings. (NIST SP 800-53 Personnel Security) | ||||
| 5. The organization will (1) locate all production and disaster recovery data centers that store, process, or transmit Hillsborough County data only in the continental United States, (2) store, process and transmit Hillsborough County data only in the continental United States, and (3) locate all monitoring and support of all the cloud computing or hosting services only in the continental U.S. (CJIS and Hillsborough County Policy) | ||||
| 6. The system/solution/service provides password protection and security controls to prevent unauthorized access to or use of the system, data, and images. Proposed system solutions will ensure Industry best practices for security architecture & design. (NIS SP 800-53 Configuration Management) | ||||
| 7. The system/solution/service has capability to integrate with the Hillsborough County’s Identity Management (IAM) system. (ADFS) |
(NIST SP 800-53 Identification and Authentication)
8. No data of any kind shall be transmitted, exchanged or otherwise passed to or accessed by other vendors or interested parties except on a case-by-case basis as specifically agreed to in writing by the Hillsborough County.
(NIST SP 800-53 System and Communications Protection)
9. The system/solution/service will encrypt sensitive data in transit and at rest using industry standard encryption protocols.
(NIST SP 800-53 System and Communications Protection)
10. All data will be stored, processed, and maintained solely on designated servers and that no data at any time will be processed on or transferred to any portable or laptop computing device or any portable storage medium, unless that storage medium is in use as part of the organization’s designated backup and recovery processes.
(NIST SP 800-53 Media Protection)
11. All Information systems will be configured to industry security best practices (e.g., CIS, NIST, etc.).
(NIST SP 800-53 Configuration Management)
12. Anti-Malware and anti-virus software will be installed, running and maintained on all systems. Which ones do you use?
(NIST SP 800-53 System and Information Integrity)
13. All physical access to information systems will be controlled and restricted to only those with a need to physically access these systems.
(NIST SP 800-53 Maintenance)
14. The system/solution/service will be developed according to secure software development best practices (e.g., OWASP, etc.).
(NIST SP 800-53 System and Services Acquisition)
15. Automated and manual software assurance assessment, testing and remediation processes are in place to detect security flaws in the underlying application code that could pose security risks. Can you provide your risk assessment methodology?
(NIST SP 800-53 System and Information Integrity)
16. An Annual third party physical and environmental security assessment is conducted of computing environment (i.e. data center) including where members of staff will access Hillsborough County information and resources (Can you provide us with the results of any physical security assessments which have been conducted)?
(NIST SP 800-53 Physical and Environmental Protection)
17. The system/solution/service’s storage processes, backup storage processes, and security procedures being implemented ensure that there is no loss of data or unauthorized access to the data.
(NIST SP 800-53 Access Control)
18. Firewalls are in place at the network perimeter and between the internal network segment and any DMZ.
(NIST SP 800-53 System and Communications Protection)
19. Systems and applications are patched in a timely manner to ensure critical security and operational patches and fixes are in place to ensure the confidentiality, integrity and availability of the information system.
(NIST SP 800-53 System and Information Integrity)
20. Vulnerability tests (internal/external) are performed on all applications and platforms.
(NIST SP 800-53 Security Assessment and Authorization)
| 21. Online transactions must conform to reasonable commercial security standards and measures. Temporary files for all secure online transactions must be securely and permanently deleted when said transaction is complete |
| 22. The system/solution/service will comply with the National Institute of Standards and Technology (NIST) Recommended Security Controls for Federal Information Systems and Organizations, Special Publication 800-53 revision 4, for Moderate systems. |
| 23.Independent Security audits of the system/solution/service, processes and data centers used to provide the services/solution are conducted at least annually. Audits are performed in accordance to SSAE16 SOC 2 or equivalent (e.g. FedRAMP) industry security standards. Contracted vendor will provide the most recent independent physical and logical audit results to the Hillsborough County. (appropriate NDA’s will be signed if needed) |
(NIST SP 800-53 Security Assessment and Authorization and Physical and Environmental Protection)
24. The organization will maintain business continuity processes and plans and will provide Hillsborough County with a detailed disaster recovery continuity of operations plan as part of their response.
(NIST SP 800-53 Contingency Planning)
| 25. The proposal must provide a detailed explanation of the security features that are built into the proposed system/solution/service. |
| 26. The vendor and system/solution/product/ service/proposal will comply with the requirements of the Pennsylvania Security Policy ITP-SEC000 and applicable federal laws/regulations |
(e.g., HIPAA, FERPA, IRS Publication 1075, FBI/CJIS, SOX, FISMA)?
| 27. If Federal, state or industry compliance requirements pertain to the data (e.g. CJI, IRS 1075, PHI (HIPAA), SSA, PCI, Etc.) the system/solution/service will comply with the said security policy and industry best practice. |
| 28. If CJI is in scope, organization staff (including employees, contractors and individuals working on behalf of the organization) that come in contact with CJI will pass an FBI fingerprinted background check and sign the FBI/CJIS Security Addendum/ Certification agreement |
(CJIS 5.5 compliance)
| 29. All data received from the Hillsborough County or created, collected or otherwise obtained as part of this agreement will be owned solely by the Hillsborough County and all access, use and disclosure of the data shall be restricted to only that which is required to perform the organization’s duties under this agreement. |
| 30. Processes will be in place to securely destroy or delete Hillsborough County data according to the standards enumerated in D.O.D. 5015.2 from systems or media no longer being used to fulfill the terms of this agreement or upon request from the Hillsborough County. |
| 31. In the event of termination of the agreement, the organization shall implement an orderly return of Hillsborough County assets and the subsequent secure disposal of Hillsborough County assets. |
During any period of suspension, the organization will not take any action to intentionally erase any Hillsborough County Data.
32. An incident response plan is in place which includes notifying the Hillsborough County immediately of a known or suspected security or privacy incident involving Hillsborough County Data.
(NIST SP 800-53 Incident Response)
| 33. Do you possess SSAE Certification? |
| 34. Do you permit Hillsborough County the right to audit this information as well as other related security information? |
&F
File details come from the government source that posted it. Updated .