The file's text, extracted by GovTribe without its formatting.
Business Information
| PERA Vendor Risk Assessment Questionnaire | | | | | Count | Resp |
| Serial No | | 0% | | | | 27 | |
| 4003 | Question/Request | | Vendor Response | Explanation | Reviewer Rating | 0 | |
| 2891 | Vendor Name: | | | | | 0 | 0 |
| 2892 | Vendor Contact Name, Job Title, Email Address: | | | | | 0 | 0 |
| 2893 | Please describe the service and/or product being offered related to this engagement. Eg data flow, data classification, authentication to systems, physical access, web application etc. | | | | | 0 | 0 |
| 3749 | Names and titles/functions of individuals who contributed to this questionnaire: | | | | | 0 | 0 |
| 2894 | Date of Response: | | | | | 0 | 0 |
| Company Profile | | 0 |
| 2896 | Name of the holding or parent company | 0 | 0 |
| In which countries do you operate or store data? | | |
| 2897 | Business service name | 0 | 0 |
| 2898 | Publicly or privately held company | 0 | 0 |
| 2899 | If public, what is the name of the Exchange | 0 | 0 |
| 2900 | How long has the company been in business | 0 | 0 |
| 2901 | Type of legal entity and state of incorporation | 0 | 0 |
| Have you undergone any mergers, acquisitions, or ownership changes in the last 24 months? | | |
| 2903 | Has your company suffered a data loss or security breach within the last 3 years? | 0 | 0 |
| 2904 | If yes, please describe the loss or breach. | 0 | 0 |
| 4000 | Has any of your Third Party Vendors suffered a data loss or security breach within the last 3 years? | 0 | 0 |
| 4001 | If yes, please describe the loss or breach. | 0 | 0 |
| 4003 | | ERROR:#REF! | 0 |
| Information Security | | 0 |
| 2911 | Does your organization have an Information Security Policy & Procedures? | 0 | 0 |
| Does your organization have an incident Response Policy and Procedures? | | |
| Does your organization have an Enterprise/Operational Risk Management Policy & Procedures? | | |
| Does your organization have a Vendor/third party Risk Management Policy & Procedures? | | |
| Does your organization have a Physical Security Policy & Procedures? | | |
| Does your organization have a Change management/SDLS Policy & Procedures? | | |
| Does your organization have a Configuration/Patch Management Policy & Procedures? | | |
| Are security policies (IR, DR, access control, encryption, vendor risk) documented and reviewed annually? | | |
| Who is responsible for cybersecurity governance? | | |
| Do you have a dedicated CISO or equivalent role? | | |
| Data Center Security | | |
| 2912 | Backup site physical address | 0 | 0 |
| 2913 | Any additional locations where Systems and Data is stored | 0 | 0 |
| 2914 | If yes, provide each location (address, city, state, country). | 0 | 0 |
| 2973 | Are the answers to this questionnaire for only one specific type of service? If yes, describe the service. | 0 | 0 |
| What is your data retention schedule/policy and destruction policy? | | |
| Web Application Security | | |
| 3919 | Are software applications provided? | 0 | 0 |
| How do you report application security vulnerabilities? | | |
| Does your web application have a SSL/TLS certificate? | | |
| Does your application offer Multifactor Authenticator (MFA) /Two Factor Authenticator (TFA) or single sign on (SSO) | | |
| Does your organization have encryption at rest and in transmission? How is encryption implemented for: | | |
oData at rest oData in transit oBackups
| Infrastructure Protection |
| Do you have a VPN? |
| What is your process for backing up your data? |
| Do you keep a record of security events? |
| How is privileged access to systems managed and reviewed? |
| How do you protect a company from cyber attacks (malware, ransomware, phishing)? |
| Privacy and Data Handling |
| What types of customer data are collected? (PII, biometric data, logs, metadata) |
| Is sensitive data classified and labeled? |
| How is customer data securely deleted? |
| Is data anonymized or tokenized where possible? |
| Does your organization perform Data Sanitization |
| Compliance and Security Standard |
| Which security and compliance frameworks are you currently certified against? (ISO 27001, SOC 2 Type 2, FedRAMP, HITRUST etc.) |
| Can you provide the latest audit reports or attestations? |
| What privacy regulations do you comply with? (GDPR, CCPA, HIPAA, etc.) |
| When were the last audits completed, and when is the next scheduled audit? |
| Have you had any audit findings or exceptions in the last 12–24 months? If so, how were they remediated? |
| Security Controls and Technology | | |
| How do you monitor data security | | |
| How do you plan for and avert a Cybersecurity Incident? | | |
| In the event of an incident, how do you plan to communicate it to us? | | |
| 3993 | Identify the applications which are covered by the secure software development lifecycle. | 0 | 0 |
| 3994 | What type of software is being provided, select all that apply. (Commercial Off-The-Shelf (COTS), Cloud, Mobile, Open Source Software, other) | | 0 |
| Do you segregate customer data? | | |
| 3995 | Commercial Off-The-Shelf (COTS) | 0 | 0 |
| 3997 | Artificial Intelligence & Security Risk | 0 | 0 |
| What AI tools or platforms are currently being used within your organization, and what business functions do they support? Please identify both internally developed and third-party AI solutions. | | |
| What types of data are processed, stored, or transmitted by these AI tools? Does the data include confidential, proprietary, customer, regulated, or personal information? | | |
| How do you prevent sensitive or regulated data from being entered into public AI platforms? Describe any policies, technical controls, or monitoring mechanisms in place. | | |
| Are AI-generated prompts, inputs, outputs, or training data retained by the AI provider? If yes, how long is the data retained, and can it be used for model training or service improvement? | | |
| What security controls are implemented to protect AI systems and associated data? Examples include encryption, access controls, multifactor authentication, logging, and network segmentation. | | |
| How do you manage user access to AI tools and ensure least-privilege access? Describe role-based access controls, approval processes, and periodic access reviews. | | |
| Do you have an AI governance policy or framework that defines acceptable use, risk management, and oversight responsibilities? Please provide details regarding governance committees or designated AI owners. | | |
| How do you assess and mitigate risks related to AI-generated content, including inaccurate outputs, bias, hallucinations, or unauthorized disclosures? Describe validation, review, and monitoring processes. | | |
| What third-party security and/or compliance certifications apply to the AI platforms you use? Examples include SOC 2, ISO 27001, NIST AI Risk Management Framework alignment, GDPR, HIPAA, or other relevant standards. | | |
| Have you experienced any security incidents, data breaches, or compliance violations involving AI systems within the last three years? If yes, describe the incident, impact, remediation actions, and lessons learned. | | |
| Other | | |
| 3998 | How do you prioritize critical assets for your organization | 0 | 0 |
| When was the last time you had a risk assessment by a third-party? Result? | | |
| How much data do you deal with per month/year? | | |
| 3999 | How frequently are employees trained on policies in your organization? | 0 | 0 |
| Are employees and contractors subject to background checks? | | |
| Do you outsource security functions to third-party providers? | | |
| How are subcontractors vetted? | | |
| Are subcontractors required to meet the same security standards? | | |
| Does your organization host or use a healthcare exchange to share data with other healthcare organizations? | | |
| Do you have a process in place to respond to data subject requests (access requests, right to erasure/ | | |
rectification/processing restriction/objection/automated decision making/etc.) and complaints based on applicable privacy regulations?
| Are production and development environments separated? |
| Are developers trained on secure coding practices? |
| Is code reviewed before deployment? |
| Are SAST/DAST tools used? |
| Are CCTV and environmental protections in place? |
| Are software builds reproducible and signed? |
| Do you maintain a formal business continuity plan? |
| What is your disaster recovery testing frequency? |
| What are your: |
oRTO (Recovery Time Objective) oRPO (Recovery Point Objective)
| Are backups immutable or ransomware-protected? |
| Can operations continue during regional instability or outages? |
| Incident Response POC: |
| Title: |
Shared Assessments Program Standardized Information Gathering (SIG) Questionnaire Version 2017
&A Page &P of Page(s)