8-IEHP Security Risk Assessment Template V1.xlsx
XLSX spreadsheet 191 KB Posted
- Attached to
- Consent and Preference Management Software
- Solicitation number
- 25-06921
- Issued by
- San Bernardino County, California
About this file
This is a Security Risk Assessment Template document associated with a Consent and Preference Management Software procurement in California. The template appears to be designed for the Inland Empire Health Plan (IEHP) to evaluate security risks related to potential software vendors or system implementations. The document serves as a structured assessment tool to identify, document, and evaluate security vulnerabilities and risk factors that may impact the organization's information systems and data protection requirements.
The template provides a standardized framework for conducting security risk assessments, likely intended to be completed by bidders or used by the procurement team to evaluate vendor security postures and system implementations. This assessment tool would be a critical component of the evaluation process for consent and preference management software, ensuring that selected solutions meet the state and local government's security and compliance standards. The specific assessment criteria, risk categories, and evaluation metrics contained within the template would guide comprehensive security due diligence prior to contract award and system implementation.
View the file
Other files
Show all 12
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
SaaS or Off Customer Prem
| This tab is for any offering of the proposed solution residing outside of IEHP's premises. |
| Instructions: Review all 12 columns below & scroll all the way to the right to ensure all columns are reviewed. |
Respond with "Yes/ No" for each individual control / function (& for each & all sections below each control/ function) in use by the bidder organization for applicable services as defined by information provided in the cells of each column.
Please provide supporting documentation where it is requested.
Failure to provide requested supporting documentation will disqualify 'yes' response to applicable control during IEHP's review.
Please respond "No" in columns that have technologies that will not store IEHP's senitive information.
| DO NOT SKIP THIS SECTION | Skip if sensitive information is not shared with Business Associates \ 3rd Parties | Skip if sensitive information will not be stored in any off-premises databases | Skip if sensitive information will not be stored in any off-premises applications | Skip if sensitive information will not be stored in any SaaS environments | Skip if sensitive information will not be stored on off-premises servers | DO NOT SKIP THIS SECTION | Skip if sensitive information will not be stored in bidder organization desktop PCs | Skip if sensitive information will not be stored in off-premises laptop PCs | Skip if sensitive information will not be accessible or transmitted over WiFi networks | Skip if sensitive information will not be stored on removable storage devices | Skip if sensitive information will not be stored on mobile devices | END OF REVIEW |
| Security and Governance | Business Associates \ 3rd Parties | Databases | Applications | SaaS | Servers | Network | Desktops | Laptops | WiFi Network | Removable Storage | Mobile Devices | |
| Business Impact Analysis | Business associate contracts in place | Access Logging | Access Logging | Acceptable Use Policy | Access Logging | Access Logging | Acceptable Use Policy | Acceptable Use Policy | Access Logging | Computer Hardware Inventory | Anti-Malware Software | |
| Change Control Processes | Security oversight of Business Associates \ 3rd parties (Provide supporting documentation) | Accounts Lock After Too Many Failed Logins | Accounts Lock After Too Many Failed Logins | Access Logging | Accounts Lock After Too Many Failed Logins | Accounts Lock After Too Many Failed Logins | Access Logging | Access Logging | Accounts Lock After Too Many Failed Logins | Controlled Access to Areas with Mobile Devices | Applicable Controls for the Threat/Vulnerability for the Component(s) Listed Above | |
| Computer Hardware Inventory | Sensitive information stays within the United States at all times | Activity Logging | Activity Logging | Accounts Lock After Too Many Failed Logins | Anti-Malware Software | Audit Log Protection | Accounts Lock After Too Many Failed Logins | Accounts Lock After Too Many Failed Logins | Application, Network, or System Penetration Testing | Data Backup | Auto Logoff or Auto Screen Locking | |
| Computer Software Inventory | Sensitive information is only accessed by persons or systems physically located United States at all times | Application Code Review | Application Code Review | Activity Logging | Application Blacklisting | Authoritative Time Source | Anti-Malware Software | Anti-Malware Software | Application, Network, or System Vulnerability Testing | Domain/Device Authentication | Central Monitoring of Anti-Malware Software | |
| Contingency Plan Testing | Application Load Testing | Application Load Testing | Authentication of Network Sessions (as Distinct From Users) | Application Whitelisting | Automatic Alerting for Adverse Events | Application Blacklisting | Application Blacklisting | Audit Log Protection | Encryption of Device | Centralized Patch Management | ||
| Contingency Plans | Application or Data Partitioning | Application or Data Partitioning | Auto Logoff or Auto Screen Locking | Application, Network, or System Penetration Testing (Provide supporting documentation) | Capacity Planning | Application Whitelisting | Application Whitelisting | Authoritative Time Source | Media/Device Reuse and Disposal Policy and Procedures | Computer Hardware Inventory | ||
| Cryptographic Key Management | Application Patching | Application Patching | Contingency Plan Testing | Application, Network, or System Vulnerability Testing (Provide supporting documentation) | Contingency Plan Testing | Application, Network, or System Vulnerability Testing (Provide supporting documentation) | Application, Network, or System Vulnerability Testing (Provide supporting documentation) | Automatic Alerting for Adverse Events | Mobile Device Usage Policy and Procedures | Computer Software Inventory | ||
| Distributed Processing or Storage | Application, Network, or System Penetration Testing | Application, Network, or System Penetration Testing (Provide supporting documentation) | Contingency Plans | Audit Log Protection | Contingency Plans | Audit Log Protection | Audit Log Protection | Capacity Planning | Physically Securing Devices or Systems When Not in Use | Data Backup | ||
| Incident Response Planning (Provide supporting documentation) | Application, Network, or System Vulnerability Testing | Application, Network, or System Vulnerability Testing (Provide supporting documentation) | Contractual Agreements | Authoritative Time Source | Domain/Device Authentication | Authoritative Time Source | Authoritative Time Source | Contingency Plan Testing | Redundant or Spare Equipment | Domain/Device Authentication | ||
| Incident Response Testing | Audit Log Protection | Audit Log Protection | Data Backup | Automatic Alerting for Adverse Events | Event Correlation | Auto Logoff or Auto Screen Locking | Auto Logoff or Auto Screen Locking | Contingency Plans | Remote Wipe/Remote Lock | Email Spam Filtering | ||
| Information Systems Security Governance (Provide supporting documentation) | Authoritative Time Source | Authoritative Time Source | Data Input Validation | Backup Media Testing and Validation Policy and Procedures | Identification and Authentication Policy and Procedures | Backup Media Testing and Validation Policy and Procedures | Backup Media Testing and Validation Policy and Procedures | Event Correlation | Sanitize Device/Disks/Media | Encryption of Device | ||
| Information Systems Security Management (Provide supporting documentation) | Automatic Alerting for Adverse Events | Auto Logoff or Auto Screen Locking | Event Correlation | Capacity Planning | Information Systems Monitoring | Central Monitoring of Anti-Malware Software | Central Monitoring of Anti-Malware Software | Identification and Authentication Policy and Procedures | Tracking of Device | Firmware Patching | ||
| Information Systems Security Policies and Procedures (Provide supporting documentation) | Backup Media Testing and Validation Policy and Procedures | Automatic Alerting for Adverse Events | Identification and Authentication Policy and Procedures | Central Monitoring of Anti-Malware Software | Limited Access to Network Cabling and Devices | Centralized Patch Management | Centralized Patch Management | Information Systems Monitoring | Media/Device Reuse and Disposal Policy and Procedures | |||
| Internal IT Audit Program | Capacity Planning | Backup Media Testing and Validation Policy and Procedures | Information Access Control Policy and Procedures | Centralized Patch Management | Limited User Accessibility (By Time of Day, By Location, etc.) | Content (URL) Filtering | Change Control Processes | Limited Access to Network Cabling and Devices | Mobile Device Management | |||
| Periodic Risk Analyses | Centralized Patch Management | Capacity Planning | Information Disclosure Procedures | Contingency Plan Testing | Log Aggregation and Analysis | Contingency Plan Testing | Computer Hardware Inventory | Limited User Accessibility (By Time of Day, By Location, etc.) | Mobile Device Usage Policy and Procedures | |||
| Policy and Procedure Communication | Change Control Processes | Centralized Patch Management | Limited User Accessibility (By Time of Day, By Location, etc.) | Contingency Plans | Network Access Control | Contingency Plans | Computer Software Inventory | Log Aggregation and Analysis | Operating System Patching | |||
| Policy and Procedure Review Process | Data Backup | Change Control Processes | Locally-stored Backups of Third-party Hosted Data | Cross-functional Training | Network Segmentation | Cross-functional Training | Content (URL) Filtering | Network Access Control | Physically Securing Devices or Systems When Not in Use | |||
| Redundant Network Communications Providers | Data Cleansing | Data Backup | Log Aggregation and Analysis | Data Backup | Password Change Required on 1st Login | Data Backup | Contingency Plan Testing | Network Segmentation | Prevention of User Storing Data Locally (Terminals, VDI, etc.) | |||
| Redundant or Spare Equipment | Data Integrity Management | Data Input Validation | Multi-factor Authentication | Data Loss Prevention Tools | Password Strength Requirements | Data Loss Prevention Tools | Contingency Plans | Password Change Required on 1st Login | Redundant or Spare Equipment | |||
| Redundant Service Providers | Data Retention Policy and Procedures | Data Loss Prevention Tools | Password Change Required on 1st Login | Data Retention Policy and Procedures | Password/Token Management Policy and Procedures | Data Retention Policy and Procedures | Cross-functional Training | Password Strength Requirements | Remote Wipe/Remote Lock | |||
| Resilient Network Topography | Distributed Processing or Storage | Distributed Processing or Storage | Password Strength Requirements | Device Hardening | Physical Access Control | Device Hardening | Data Backup | Password/Token Management Policy and Procedures | Restrictions on the Use of Internet File Storage | |||
| Risk Management Process (Provide supporting documentation) | Event Correlation | Error Message Sanitization | Password/Token Management Policy and Procedures | Distributed Processing or Storage | Physical Access Monitoring | Domain/Device Authentication | Data Loss Prevention Tools | Physical Access Control | Sanitize Device/Disks/Media | |||
| Security Budget Process | Identification and Authentication Policy and Procedures | Event Correlation | Prevention of Simultaneous User Logins | Encryption of Disks (Full Disk, File Based, etc.) (Provide supporting documentation) | Physically Secured Demarcation Points | Email Spam Filtering | Device Hardening | Physical Access Monitoring | Security/Privacy Awareness and Training | |||
| Security During Systems Acquisition | Information Disclosure Procedures | Information Disclosure Procedures | Principle of Least Privilege | Event Correlation | Privileged Account Management | Encryption of Disks (Full Disk, File Based, etc.) | Domain/Device Authentication | Physically Secured Demarcation Points | Social Engineering Testing | |||
| Security/Privacy Awareness and Training (Provide supporting documentation) | Information Systems Monitoring | Information Systems Monitoring | Privileged Account Management | Firmware Patching | Prompt Account Termination | Event Correlation | Email Spam Filtering | Privileged Account Management | System and Lifecycle Maintenance | |||
| Threat/Vulnerability Intelligence Services | Limitations on the Use of Live Data | Limitations on the Use of Live Data | Prompt Account Termination | Host-based Firewalls Enabled | Redundant Network Communications Providers | Firmware Patching | Encryption of Disks (Full Disk, File Based, etc.) | Prompt Account Termination | Tracking of Device | |||
| Training for the Security Workforce | Log Aggregation and Analysis | Log Aggregation and Analysis | Redundant Service Providers | Identification and Authentication Policy and Procedures | Resilient Network Topography | Host-based Firewalls Enabled | Event Correlation | Redundant Network Communications Providers | ||||
| Disaster Recovery Plan and Testing (Provide supporting documentation) | On-call Technical Resources | Multi-factor Authentication | Restrictions on the Use of Non-Organizational Devices | Incident Response Planning | Secure Name/Address Resolution Service | Identification and Authentication Policy and Procedures | Firmware Patching | Redundant or Spare Equipment | ||||
| HIPAA Compliant Data Center (Provide supporting documentation) | Password Strength Requirements | On-call Technical Resources | Review of Service Providers | Incident Response Testing | Split Tunneling Prevention | Information Access Control Policy and Procedures | Host-based Firewalls Enabled | Resilient Network Topography | ||||
| SOC II Type 2 Certified Data Center (Provide supporting documentation) | Password/Token Management Policy and Procedures | Password Change Required on 1st Login | Role-based Access Control | Information Access Control Policy and Procedures | Tamper-proof Mechanisms | Information Disclosure Procedures | Information Access Control Policy and Procedures | Service-level Agreements | ||||
| HITRUST certification (Provide supporting documentation) | Principle of Least Privilege | Password Strength Requirements | Security During Systems Acquisition | Information Disclosure Procedures | Two Man Rule/Dual Authorization | Limitations on Administrative Rights | Information Disclosure Procedures | Tamper-proof Mechanisms | ||||
| FedRAMP certification (Provide supporting documentation) | Privileged Account Management | Password/Token Management Policy and Procedures | Security/Privacy Awareness and Training | Information Systems Monitoring | Unique User ID | Limited Access to Output Devices (Printers, etc.) | Limitations on Administrative Rights | Two Man Rule/Dual Authorization | ||||
| CSA STAR certification (Provide supporting documentation) | Prompt Account Termination | Prevention of Simultaneous User Logins | Service-level Agreements | Internal IT Audit Program | User Account Management | Limited User Accessibility (By Time of Day, By Location, etc.) | Limited Access to Output Devices (Printers, etc.) | Unique User ID | ||||
| Cyber Insurance certificate (Provide supporting documentation) | Remote Administrative Access | Principle of Least Privilege | Session Auditing | Lights-out/Hands-off Management | User Permissions Reviews | Locked Down External Ports (USB, CD, DVD, Firewire, etc.) | Limited User Accessibility (By Time of Day, By Location, etc.) | User Account Management | ||||
| Restrictions on the Use of Non-Organizational Devices | Privileged Account Management | Single Sign-on | Locked Down External Ports (USB, CD, DVD, Firewire, etc.) | Log Aggregation and Analysis | Locked Down External Ports (USB, CD, DVD, Firewire, etc.) | User Permissions Reviews | ||||||
| Role-based Access Control | Prompt Account Termination | Two Man Rule/Dual Authorization | Log Aggregation and Analysis | Media/Device Reuse and Disposal Policy and Procedures | Log Aggregation and Analysis | Visitor Access Control | ||||||
| Secure Administrative Host | Remote Administrative Access | Unique User ID | Media/Device Reuse and Disposal Policy and Procedures | Multi-factor Authentication | Media/Device Reuse and Disposal Policy and Procedures | Wireless Access Restrictions | ||||||
| Secure Password Storage | Restrictions on the Use of Non-Organizational Devices | User Account Management | Multi-factor Authentication | On-call Technical Resources | Mobile Device Management | Wireless Encryption | ||||||
| Secure Software Development Processes | Role-based Access Control | User Activity Review | On-call Technical Resources | Operating System Patching | Mobile Device Usage Policy and Procedures | Wireless Intrusion Detection | ||||||
| Secure Software Development Training | Secure Administrative Host | User Permissions Reviews | Operating System Patching | Password Change Required on 1st Login | Multi-factor Authentication | Wireless Link Protection | ||||||
| Security During Systems Acquisition | Secure Password Storage | Single Tenency | Password Change Required on 1st Login | Password Strength Requirements | On-call Technical Resources | Wireless Security Policy and Procedures | ||||||
| Segregation of Duties | Secure Software Development Processes | Data at rest encrypted | Password Strength Requirements | Password/Token Management Policy and Procedures | Operating System Patching | |||||||
| Service-level Agreements | Secure Software Development Training | Password/Token Management Policy and Procedures | Prevention of User Storing Data Locally (Terminals, VDI, etc.) | Password Change Required on 1st Login | ||||||||
| Single Sign-on | Security During Systems Acquisition | Principle of Least Privilege | Privileged Account Management | Password Strength Requirements | ||||||||
| Tamper-proof Mechanisms | Segregation of Duties | Privileged Account Management | Process Documentation | Password/Token Management Policy and Procedures | ||||||||
| Two Man Rule/Dual Authorization | Service-level Agreements | Process Documentation | Prompt Account Termination | Prevention of User Storing Data Locally (Terminals, VDI, etc.) | ||||||||
| Unique User ID | Session Auditing | Prompt Account Termination | Redundant or Spare Equipment | Privileged Account Management | ||||||||
| User Account Management | Single Sign-on | Recovery Backup | Remote Administrative Access | Process Documentation | ||||||||
| User Activity Review | Tamper-proof Mechanisms | Redundant or Spare Equipment | Restrictions on Media Use | Prompt Account Termination | ||||||||
| User Permissions Reviews | Two Man Rule/Dual Authorization | Remote Access Controls | Restrictions on the Use of Internet File Storage | Redundant or Spare Equipment | ||||||||
| Data at rest encrypted | Unique User ID | Remote Administrative Access | Sanitize Device/Disks/Media | Remote Administrative Access | ||||||||
| User Account Management | Restrictions on Media Use | Security/Privacy Awareness and Training | Remote Wipe/Remote Lock | |||||||||
| User Activity Review | Sanitize Device/Disks/Media | Session Auditing | Restrictions on Media Use | |||||||||
| User Permissions Reviews | Secure Administrative Host | Single Sign-on | Restrictions on the Use of Internet File Storage | |||||||||
| Data at rest encrypted | Security/Privacy Awareness and Training | Social Engineering Testing | Sanitize Device/Disks/Media | |||||||||
| Service-level Agreements | Standardized System Configurations | Security/Privacy Awareness and Training | ||||||||||
| Session Auditing | Surge Protectors | Session Auditing | ||||||||||
| Single Sign-on | System and Lifecycle Maintenance | Single Sign-on | ||||||||||
| Social Engineering Testing | System Configuration Management | Social Engineering Testing | ||||||||||
| Standardized System Configurations | System Isolation | Standardized System Configurations | ||||||||||
| Surge Protectors | Tamper-proof Mechanisms | Surge Protectors | ||||||||||
| System and Lifecycle Maintenance | Threat/Vulnerability Intelligence Services | System and Lifecycle Maintenance | ||||||||||
| System Configuration Management | Training for the Security Workforce | System Configuration Management | ||||||||||
| System Isolation | Two Man Rule/Dual Authorization | System Isolation | ||||||||||
| Tamper-proof Mechanisms | Uninterruptible Power Supply (UPS) | Tamper-proof Mechanisms | ||||||||||
| Threat/Vulnerability Intelligence Services | Unique User ID | Threat/Vulnerability Intelligence Services | ||||||||||
| Two Man Rule/Dual Authorization | User Account Management | Tracking of Device | ||||||||||
| Uninterruptible Power Supply (UPS) | User Activity Review | Two Man Rule/Dual Authorization | ||||||||||
| Unique User ID | User Permissions Reviews | Uninterruptible Power Supply (UPS) | ||||||||||
| User Account Management | Unique User ID | |||||||||||
| User Activity Review | User Account Management | |||||||||||
| User Permissions Reviews | User Activity Review | |||||||||||
| User Permissions Reviews |
On Customer Prem
| This tab is for any offering of the proposed solution that will reside on IEHP's premises. If there is no on premise solutions offered, do not fill this tab out | ||
| Instructions: Review the two columns below and select yes for each control or function in use by the bidder organization. Continue the process for each column where applicable. Please provide supporting documentation where it's requested. Failure to provide requested supporting documentation will disqualify yes response during IEHP's review. Skip colums that have technologies that are not part of the bidder organization's offerings. | ||
| Are the following controls or functions for provided as part of the proposed solution? | Yes | Comments |
| Access Logging | ||
| Accounts Lock After Too Many Failed Logins | ||
| Activity Logging | ||
| Application Code Review | ||
| Application Load Testing | ||
| Application or Data Partitioning | ||
| Application Patching | ||
| Audit Log Protection | ||
| Auto Logoff or Auto Screen Locking | ||
| Automatic Alerting for Adverse Events | ||
| Data Backup | ||
| Data Input Validation | ||
| Data Integrity Management | ||
| Distributed Processing or Storage | ||
| Error Message Sanitization | ||
| Multi-factor Authentication | ||
| On-call Technical Resources | ||
| Password Change Required on 1st Login | ||
| Password Strength Requirements | ||
| Password/Token Management Policy and Procedures | ||
| Prevention of Simultaneous User Logins | ||
| Principle of Least Privilege | ||
| Privileged Account Management | ||
| Role-based Access Control | ||
| Secure Password Storage | ||
| Secure Software Development Processes | ||
| Secure Software Development Training | ||
| Segregation of Duties | ||
| Service-level Agreements | ||
| Session Auditing | ||
| Single Sign-on | ||
| Tamper-proof Mechanisms | ||
| Two Man Rule/Dual Authorization | ||
| Unique User ID |
IT Product Architecture
| # | Architecture | Section | Feature | Response | Details | ||
| 1 | Platform Architecture | Environment Information | Is this a hosted application (Cloud-based/ASP/SaaS Model)? | Yes | Please provide details including SLAs. | ||
| No | |||||||
| Environment Information | Can you provide functional and technical diagrams? | Yes | Please provide as attachments. | ||||
| No | |||||||
| Environment Information | Do you include any 3rd party software as part of your product? | Yes | If Yes, please detail the software, version and function | ||||
| No | |||||||
| Environment Information | Does your product support High Availability Platforms? | Yes | If not, are there plans for HA support? | ||||
| No | |||||||
| Environment Information | How does your product scale for future growth and availability? | Add to existing resources | Please provide details. | ||||
| Add additional hosts | |||||||
| Rebuild with new resources | |||||||
| 2 | Server, Database & Deployment Architecture | Server | Platform: | MS Windows | If other, please provide details | ||
| IBM AIX | |||||||
| Redhat | |||||||
| Cent OS | |||||||
| Other | |||||||
| Server | Quantity and speed of CPU: | ||||||
| Server | RAM: | ||||||
| Server | Disk storage required for application: | ||||||
| Server | Disk storage required for data: | Please include 3 year growth estimates | |||||
| Server | Does your product support server virtualization? | Yes | |||||
| No | |||||||
| Server | Any special hardware peripherals required? | Yes | If yes, please provide details. | ||||
| No | |||||||
| Server | What server roles are required in your solution? | Web | If other, please provide functional details. Please specify quantities of each role. | ||||
| Application | |||||||
| Database | |||||||
| Other | |||||||
| Server | Is the server-side application compatible with 64-bit operating systems? | Yes | If no, please provide details | ||||
| No | |||||||
| Backup and Recovery | What is the recommended data retention period? | Please provide details. | |||||
| Backup and Recovery | What type of technology does your product use to meet RTO and RPO objectives? | Cold Backup /Recovery | Please provide details. | ||||
| Hot Backup /Recovery | |||||||
| Snapshot | |||||||
| Clone | |||||||
| Shadow | |||||||
| Other | |||||||
| None | |||||||
| Database | Does your product utilize Microsoft SQL or Oracle? | Yes | If yes, what version? | ||||
| No | |||||||
| Database | Does your product provide database reporting tools? | Yes | If 3rd party, please specify all 3rd party tools that can be used for reporting and any support arrangement. | ||||
| No | |||||||
| Can use a 3rd party tool | |||||||
| Database | What is your concurrent user capacity | Limited | If ‘limited’ or ‘other’, please describe your concurrent user policy | ||||
| Unlimited | |||||||
| Other | |||||||
| Database | Does the product provide an archiving tool? | Yes | If yes, please describe. | ||||
| No | |||||||
| Database | Do you provide scripts for database maintenance? | Yes | If yes, do you also support the scripts | ||||
| No | |||||||
| 3 | Application Architecture | Application Information | Does your product require any browser plug-ins or special software? | Yes | If yes, please specify. | ||
| No | |||||||
| Application Information | Is your product compatible with Windows 64-bit client systems? | Yes | If no, please provide details | ||||
| No | |||||||
| Application Information | What is your minimum Internet browser standard? | Please specify browser and version. | |||||
| Application Information | Does your product require a specific version of Java? | Yes | If yes, please specify version. | ||||
| No | |||||||
| Application Information | Does your product use any of the technology listed: | Client JavaScript | If yes, please provide details. | ||||
| Client VBScript | |||||||
| ActiveX | |||||||
| XML | |||||||
| .NET | |||||||
| Security Certificates | |||||||
| None of the above | |||||||
| Platform Administration | Do you provide troubleshooting and debug tools? | Yes | If yes, please explain. | ||||
| No | |||||||
| Platform Administration | Does the product have alert and notification capabilities? | Yes | If yes, please explain. | ||||
| No | |||||||
| Platform Administration | Does your product support operating system patching? What is your patch schedule? | Yes | Please explain for both server and application | ||||
| No | |||||||
| Application Information | Does the product integrate with collaboration systems such as email and content management systems? | Yes | If yes, please specify which software packages. | ||||
| No | |||||||
| Application Information | Does the product require additional software to support web presentation? | Yes | If yes, please provide details. | ||||
| No | |||||||
| 5 | Integration Information | Does your system require any type of interface or data extract? | Yes | If yes, please provide details. | |||
| Integration Architecture | No | ||||||
| Integration Information | Does your product support HL7,834, 837,835? | Yes | If yes, please specify version | ||||
| No | |||||||
| Integration Information | What type of interfaces does your product support? | API | If other, please provide details. | ||||
| Web Services | |||||||
| Flat Files | |||||||
| Other | |||||||
| Integration Information | Does your product maintain real-time or batch transaction processing? | Real-Time | Please provide details. | ||||
| Batch | |||||||
| Both | |||||||
| Integration Information | Does the interface service of your product require an active user login? | Yes | If yes, please provide details. | ||||
| No | |||||||
| 6 | Network & Security Architecture | Network Information | What type of network connection does your system require? | 100Mb | If your system requires an isolated network or a topology other than TCP/IP over Ethernet, please provide details. | ||
| 1Gb | |||||||
| 10Gb | |||||||
| Copper | |||||||
| Fiber | |||||||
| Network Information | Does your product require access to systems outside of IEHP? | Yes | If so do you require VPN access or PORTS to be open to support your product? If PORTS, please specify the PORTS required. | ||||
| No | |||||||
| Security | How does your product or service support HIPAA compliancy? | Yes | Please provide details. | ||||
| No | |||||||
| Security | Does your product support data encryption? Does your application support data at rest encryption? (i.e. Database) | Yes | Please provide details. | ||||
| No | |||||||
| Security | Does your product support authentication to Active Directory? | Yes | If yes, please provide details. | ||||
| No | |||||||
| Security | Does your product support support a “locking mechanism” for unsuccessful logon attempts/unauthorized updates? | Yes | If yes, please provide details. | ||||
| No | |||||||
| Security | Does your product provide security audit logs? | Yes | Please provide details concerning the function, information retained and purge strategy. | ||||
| No | |||||||
| Security | Does the system automatically log-off an inactive user after a specified amount of idle time? | Yes | If yes, can this time period be user or group specified? | ||||
| No | |||||||
| Security | Does your product have any issues with Sophos Protection (Antivirus/Malware solution)? | Yes | If issues are identified, please provide details. Also provide any required excludes specific your product (i.e. files, file extensions, etc.). | ||||
| No | |||||||
| Security | Does your application access or modify the registry during runtime? | Yes | If yes, please provide details. | ||||
| No | |||||||
| Security | Does your application require remote access for support purposes? | Yes | Explain what type of remote access is required. | ||||
| No | |||||||
| Security | Is your application cloud based or off-premise access? | Yes | If this is a cloud based service all data must reside within the continental US. Who is the cloud service provider and where are the Data Centers located? | ||||
| No | |||||||
| Security | Does your application store any data on the local workstation? | Yes | Explain if local data is stored | ||||
| No | |||||||
| Security | Does your application perform an adequate level of data integrity checks in data validation? | Yes | Describe the types of data validation | ||||
| No | |||||||
| Security | Does your application support all the current level of operating system patches and/or updates? | Yes | Please describe any current patch level support issues | ||||
| No | |||||||
| Security | Does your application have DevSecOps reports (i.e., SCA,SAST,DAST, IAST)? | Yes | If yes, please provide | ||||
| No | |||||||
| Security | Does your application has AppScan | ||||||
| Penetration testing reports | Yes | If yes, please provide | |||||
| No | |||||||
| Security | Can you provide proof of a HIPAA Security Audit within the past 12 months? | Yes | If yes, please attach; if no, please explain | ||||
| No | |||||||
| Security | Do you require your own BAA be signed by IEHP? | Yes | If yes, please provide | ||||
| No | |||||||
| Security | Do you do 24x7 security monitoring and incident response for this application? | Yes | If yes, please provide documentation | ||||
| No |
AI Governance
| # | Section | Feature | Details |
| 1 | Data Privacy and Storage | Where is the data stored? | Please provide details including SLAs. |
Data Privacy and Storage What privacy laws govern the stored data? Please provide as attachments.
Data Privacy and Storage Does the AI provider comply with GDPR, CCPA, and other relevant data protection regulations? Please provide details.
Data Privacy and Storage What controls are in place to ensure data is not used beyond its original purpose? Please provide details.
Data Privacy and Storage How long is the data retained and how is it securely disposed of when no longer needed? Please provide details.
2 Data Access Who has access to the data and under what conditions? Please provide details.
| Data Access | Are there strong access controls and authentication processes in place? | Please provide details. | |
| Data Access | How does the provider ensure that data isn't misused by those who have access? | Please provide details. | |
| 3 | Data Transmission | How is data protected during transmission? | Please provide details. |
Data Transmission Does the provider use encryption protocols like Transport Layer Security (TLS)to protect data in transit? If yes, what version? Please provide details.
4 Training Data What data was used to train the AI? Please provide details.
Training Data How was the data anonymized and is there any risk of de-anonymization? Please provide details.
Training Data How is the proprietary data protected during AI model training? Please provide details.
5 AI Ethics and Bias How does the provider handle ethical issues like AI bias? Please provide details.
AI Ethics and Bias What measures are in place to ensure the AI’s outputs are fair and unbiased? Please provide details.
6 Predictability and Transparency How transparent is the AI system's decision-making process? Please provide details.
| Predictability and Transparency | Is there a possibility of the AI making uncontrolled, unsupervised decisions that could impact security? | Please provide details. | |
| 7 | Future-Proof Security | How does the provider plan to keep up with evolving security threats and trends? | Please provide details. |
Future-Proof Security How is the system designed to handle emerging security issues in the AI landscape? Please provide details.
MLOps Security
| 1 | Data-centeric management | Details |
| 1.1 | Data repository | |
| 1.2 | Diverse data source integration | |
| 1.3 | Data schema validation | |
| 1.4 | Data Versioning and Lineage | |
| 1.5 | Labeling workflow | |
| 1.6 | Online and offline feature storage | |
| 2 | Experimentation | Details |
| 2.1 | Integrated development environments | |
| 2.2 | Code version control | |
| 2.3 | Tracking | |
| 2.4 | Cross-platform integration | |
| 2.5 | Debugging: accuracy and system performance | |
| 3 | Observability and model management | Details |
| 3.1 | Versioned model registry | |
| 3.2 | Bias, fairness, and explainability | |
| 3.3 | Lineage tracking: data inputs and outputs | |
| 3.4 | Lineage tracking: environment information | |
| 3.5 | Lineage tracking: model | |
| 3.6 | Integration with deployment and monitoring | |
| 3.7 | Pipeline Parameter Configurations | |
| 3.8 | Issues are traceable, debuggable, and reproducible. | |
| 3.9 | Performance visualization | |
| 4 | Robust pipelines and promotion | Details |
| 4.1 | Large-scale and distributed training | |
| 4.2 | Support for multiple frameworks | |
| 4.3 | Hyperparameter tuning | |
| 4.4 | AutoML option | |
| 4.5 | Inference support: real time | |
| 4.6 | Inference support: streaming | |
| 4.7 | Inference support: batch | |
| 4.8 | Preprocessing and post-processing routines | |
| 4.9 | Ability to invoke hierarchical or simultaneous models | |
| 4.10 | Horizontal and vertical scaling strategies | |
| 4.11 | End-to-end logging | |
| 5 | Continuous integration (CI) | Details |
| 5.1 | Local code checks | |
| 5.2 | Static code analysis | |
| 5.3 | Data quality tests | |
| 5.4 | Feature tests | |
| 5.5 | Unit tests | |
| 5.6 | Integration tests | |
| 5.7 | Smoke tests | |
| 5.8 | Load testing | |
| 5.9 | Model functional tests | |
| 5.11 | Model inference tests with extreme cases | |
| 6 | Continuous monitoring | Details |
| 6.1 | Model monitoring: data quality detection | |
| 6.2 | Model monitoring: distribution shift | |
| 6.3 | Model monitoring: model concept drift | |
| 6.4 | Model monitoring: model evaluation check | |
| 6.5 | System captures: input schemas | |
| 6.6 | System captures: evaluation results and statistics | |
| 6.7 | System captures: anomalies | |
| 6.8 | Logging: saturation and resources | |
| 6.9 | Logging: latency | |
| 6.1 | Logging: traffic | |
| 6.11 | Logging: errors | |
| 6.12 | Notifications and alerting | |
| 7 | Continuous deployment (CD) | Details |
| 7.1 | Model switching | |
| 7.2 | Model promotion processes | |
| 7.3 | Rollback strategies | |
| 7.4 | Canary deployment | |
| 7.5 | Model shadow deployment | |
| 7.6 | Blue/green deployment | |
| 7.7 | Support for A/B testing or more | |
| 8 | Continuous training | Details |
| 8.1 | Checks: model input validation | |
| 8.2 | Retrain triggering: scheduled jobs | |
| 8.3 | Retrain triggering: new training data | |
| 8.4 | Retrain triggering: model performance degradation | |
| 8.5 | Retrain triggering: data distribution shift | |
| 9 | Governance | Details |
| 9.1 | Data quality and compliance | |
| 9.2 | Audit and documentation | |
| 9.3 | Reproducibility and traceability | |
| 9.4 | Human-in-the-loop sign-off | |
| 9.5 | Bias and adversarial attacks testing |
File details come from the government source that posted it. Updated .