Attachement C- Technology and Infroamtion Services Hosted Solution Questionaire.pdf

North Clackamas School District Technology and Information Services

Hosted Solution Questionnaire

Company name:

Company or product website:

Product name and version:

Primary contact person and information:

Description of product:

End Point Requirements

1. Does the application run on the following browsers? (Check all that apply)

☐ Chrome

☐ Edge

☐ Firefox

☐ Safari

2. Does the application require client software to be installed?

a. If so, which platforms are supported (check all that apply)?

☐ Microsoft Windows 11 or above

☐ MacOS 15 or above

☐ ChromeOS 138 or above

System Security

1. For any facility(s) that will be storing NCSD data:

a. Security Certification of facility(s):

☐ SSAE 18

☐ SOC 2

☐ N/A - Please explain:

b. Will data be stored within the United States? If not, where will data be located?

2. Do you enforce Multi-Factor Authentication (MFA) for all employees, contractors, and partners on the following? If yes, please select all that apply:

☐ Email

☐ Cloud Deployments

☐ Mission Critical Systems

☐ Remote Access

☐ Other (please specify):

3. Does your platform allow for Multi-Factor Authentication for accounts created for our users?

4. Does your organization have an incident response plan - tested and in-effect - setting forth specific action items and responsibilities for relevant parties in the event of a cyber incident or data breach matter?

5. The following is a list of known and credible cybersecurity frameworks which can protect digital learning ecosystems. These specific frameworks were chosen based on a set of guiding cybersecurity principles provided by the US Cybersecurity and Infrastructure Security Agency (CISA) in cooperation with the Australian Signals Directorate: https://www.cisa.gov/resources-tools/resources/choosing-secure-and-verifiable-technologies

Please select all Frameworks in use by your organization:

MAINTAINING ORGANIZATION/GROUP FRAMEWORK(S)

☐ National Institute of Standards and Technology

NIST Cybersecurity Framework Version 1.1

☐ National Institute of Standards and Technology

NIST SP 800-53, Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity (CSF), Special Publication 800-171

☐ International Standards Organization Information technology — Security techniques — Information security management systems (ISO 27000 series)

☐ Secure Controls Framework Council, LLC Security Controls Framework (SCF)

☐ Center for Internet Security CIS Critical Security Controls (CSC, CIS Top 20)

☐ Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S))

Cybersecurity Maturity Model Certification (CMMC, ~FAR/DFAR)

6. NCSD retains exclusive rights to all data uploaded, stored, and processed. Given these data ownership terms:

a. Data Access: What access will the Company have to NCSD’s data?

b. Data Rights: Is the company assuming or seeking any right to in any way use or to resell

NCSD’s data?

7. Does your software platform involve credit card payment processing?

☐ No, our software does not process payments

☐ Yes, and we have a current PCI DSS certification

☐ Yes, and we do not have a current PCI DSS certification (please explain):

User Access Flexibility

How are end users authenticated? (Check all that apply)

☐ Local platform account only

☐ Google

☐ Active Directory

☐ OAuth

☐ SAML

Account Rostering

1. NCSD utilizes the OneRoster standard to roster applications. Does your platform support syncing user data via the OneRoster standard?

2. NCSD uses Classlink RosterServer to transmit roster data. Does your platform support syncing roster data from Classlink RosterServer via either of these methods? (Check all that apply):

☐ REST API

☐ SFTP Upload

☐ N/A

3. If OneRoster is not supported, are any other account creation or identity management solutions supported by your platform (check all that apply)?

☐ Google Workspace

☐ Active Directory

☐ LDAP

4. Does your platform allow for manual account creation in addition to automated rostering?

5. Can manual accounts be created or edited in such a way that overrides data included via OneRoster (i.e. OneRoster data lists a user as a teacher but manually adjusting their account within the platform to allow for Principal level access)?

6. Will your platform access or store student data? If yes, we will require a signed data privacy agreement. Our preference would be to use the Student Data Privacy Consortium Agreement (https://privacy.a4l.org/)

☐ We will not store any student data

☐ We will store student data and will sign the Student Data Privacy Consortium Agreement or an equivalent agreement

By filling in the fields below I indicate that the information provided in this form is accurate and complete to the best of my knowledge.

Information provided by:

Name:

Title:

Date:

https://privacy.a4l.org/