Attachment 2.pdf

Service Provider Security Assessment Questionnaire

SCPEBA 102025 │ 1

Service Provider Security Assessment Questionnaire Instructions Attach additional pages or documents as appropriate and make sure answers cross reference to the questions below. As used in this questionnaire, the phrase “government information” shall have the meaning defined in the clause titled Information Security. This questionnaire must be read in conjunction with both of the following two clauses:

• Service Provider Security Assessment Questionnaire – Required; and

• Service Provider Security Representation.

Highlight any updates or changes to answers that have occurred in the last year unless otherwise specified.

Access control

1. Is access to government information limited only to those employees and contractors who require access to perform work on behalf of PEBA?

If yes, provide the policies and procedures that demonstrate this.

If no, provide more detail.

☐ Yes ☐ No

2. What security controls do you have in place for incoming email? Choose all that apply.

☐ Detonation and evaluation of attachments in a sandbox ☐ Screening for malicious attachments ☐ Domain Based Message Authentication, Reporting and

Conformance ☐ Screening for malicious links

☐ DomainKeys Identified Mail ☐ Sender Policy Framework strictly enforced ☐ Quarantine service ☐ Tagging external emails

3. Do you enforce multi-factor authentication for all user accounts (other than domain administrator accounts) when accessing your network remotely?

☐ Yes ☐ No

4. Do you enforce MFA for all domain administrator accounts? ☐ Yes ☐ No

5. Do you permit ordinary users’ local administrator rights to their devices? ☐ Yes ☐ No

6. What security solutions do you use to prevent or detect malicious activity on your network?

Security solution Vendor Endpoint Protection Platform ________________________________________________________ Endpoint Detection and Response ________________________________________________________ Managed Detection and Response ________________________________________________________ Network Detection and Response ________________________________________________________ Security Information and Event Management ________________________________________________________ Application Isolation and Containment ________________________________________________________

7. Do you have a Security Operations Center?

If yes, is your SOC internal or managed by a third party? ☐ Internal ☐ Third party ☐ Both If yes, is your SOC staffed 24 hours? ☐ Yes ☐ No

☐ Yes ☐ No

8. Do you use a protective DNS service (e.g., Cisco Umbrella)? ☐ Yes ☐ No

9. Are host-based and network firewalls configured to disallow inbound connections by default? ☐ Yes ☐ No

10. Are network firewalls configured to disallow outbound connections by default? ☐ Yes ☐ No

Service Provider Security Assessment Questionnaire │ 2

11. Do you use a hardened baseline configuration across all (or substantially all) of your devices? ☐ Yes ☐ No

12. Do you screen your employees and contractors who will have access to government information?

If yes, provide details.

☐ Yes ☐ No

13. Do you have a key escrow solution?

If yes, provide details.

☐ Yes ☐ No

Data protection and disposal

14. Do you have documented policies and procedures for managing information assets?

If yes, provide those policies and procedures.

☐ Yes ☐ No

15. Will government information be stored on:

a) Portable media? ☐ Yes ☐ No

i. Is it encrypted? ☐ Yes ☐ No

b) Laptops? ☐ Yes ☐ No

i. Is it encrypted? ☐ Yes ☐ No

c) Backup media? ☐ Yes ☐ No

i. Is it encrypted? ☐ Yes ☐ No

d) Mobile devices? ☐ Yes ☐ No

i. Is it encrypted? ☐ Yes ☐ No

e) Databases? ☐ Yes ☐ No

i. Is it encrypted? ☐ Yes ☐ No

f) Cloud or third-party sites (e.g., Dropbox)? ☐ Yes ☐ No

i. If yes, provide locations.

ii. Are they all encrypted? ☐ Yes ☐ No

16. Will government information be encrypted when transmitted? ☐ Yes ☐ No

17. Will government information be encrypted during data backups and on backup media? ☐ Yes ☐ No

18. Will government information be deleted or destroyed in accordance with NIST Special Publication 800-88 at the termination of the contract?

Provide additional details.

Data protection and recovery

19. Does your Business Continuity Plan contain recovery time objectives for the amount of time within which business processes and continuity must be restored?

If yes, what are the current stated and tested recovery time objectives?

☐ Yes ☐ No

20. What is the process for backing up data? Check all that apply.

☐ Full back-up ☐ Incremental ☐ Differential ☐ Mirror ☐ Other: ______________________________ How often is data backed up?

21. Where are data backups stored? Check all that apply.

☐ Secure offsite ☐ Secondary data center ☐ Other: ______________________________

22. If necessary, how quickly can backed up data be accessed and restored?

23. When was the last time you successfully tested your Business Continuity Plan?

When tested, did you meet all objectives?

24. When was the last time you successfully tested your Disaster Recovery Plan?

When tested, did you meet all stated restore time objectives?

25. Do you have an Incident Response Plan that addresses cybersecurity events?

If yes, when was the last time it was tested?

If yes, does it address ransomware events?

Service Provider Security Assessment Questionnaire │ 3

26. Do you have immutable backups to protect against ransomware?

If no, describe how PEBA’s data and operations would be protected against ransomware events.

Third party management

27. Identify any third party that will host or have access to government information. Provide a description of the services that are or will be provided related to the contract with PEBA.

28. Describe and explain your security policies and procedures as they relate to your use of contractors and next-tier sub-contractors.

Human resources

29. Do you conduct employee security and awareness training at least annually?

If yes, provide the last three annual dates of completion, who is included and the outline for the training.

Audit and compliance

30. Which current reports or certifications do you have that demonstrate that adequate security controls and assurance requirements are in place to protect PEBA’s data? If you answer yes to any of the following, provide a copy.

a. SOC 1

b. SOC 2

If yes, Type I / Type II

c. SOC 3

d. ISO/IEC27001 certificate

e. HITRUST

f. Other: ______________________________

☐ I ☐ II

☐ Yes ☐ No ☐ Yes ☐ No ☐ Yes ☐ No

31. Are you required to be PCI compliant in relation to the business you do with PEBA?

a. If yes, are you compliant with PCI standards?

b. If yes, is payment card data encrypted at the point of sale through transmission to the payment processor?

c. If you are not compliant with PCI standards, describe the status of any compliance work and the estimated date of completion.

☐ Yes ☐ No

HIPAA compliance

32. Are you or would you be required to be HIPAA compliant in relation to the business you do with PEBA?

If yes, continue to complete this section.

☐ Yes ☐ No

33. When was the last HIPAA risk assessment completed?

34. Does your company have a comprehensive HIPAA policy?

If yes, what was the last date it was updated?

☐ Yes ☐ No

35. Do you conduct employee HIPAA training at least annually?

If yes, provide the last three annual dates of completion, who is included and the outline for the training.

☐ Yes ☐ No

36. Describe the training.

37. Have executive officers been trained on HIPAA? ☐ Yes ☐ No

38. Do you have a dedicated HIPAA Compliance Officer and/or department?

If yes, describe the department and provide the contact information for that person or department.

☐ Yes ☐ No

39. Do you have a dedicated Chief Privacy Officer?

If yes, describe who they report to and provide basic information about their job responsibilities and roles.

40. To the best of your knowledge, is your company/entity HIPAA compliant? ☐ Yes ☐ No

Service Provider Security Assessment Questionnaire │ 4

If no, explain why your company/entity is not HIPAA compliant.

Artificial intelligence

41. Is AI developed in-house or supplied by a third party?

Provide details.

☐ In-house ☐ Third party ☐ N/A

42. Do you perform independent audits of AI model outputs? ☐ Yes ☐ No

43. Is customer data used to train or fine-tune models? ☐ Yes ☐ No

44. Will AI be used to handle or store sensitive data? ☐ Yes ☐ No

45. Will personally identifiable information be anonymized? ☐ Yes ☐ No

46. Will the system continue to function if the AI service is not available? ☐ Yes ☐ No

Physical security

47. List the geographical locations of your data centers that could contain PEBA’s data.

48. Do your secondary/failover sites have commensurate security with your primary site? ☐ Yes ☐ No

49. Is your data center hosted by a third party?

If yes, provide details.

☐ Yes ☐ No

50. Describe the policies, procedures and practices you have in place to provide for the physical security of your data centers and other sites where government information will be hosted, accessed or maintained.

Detection and prevention

51. What controls are in place to detect security breaches?

52. What system and network activity do you log?

53. How long do you maintain these audit logs?

54. Describe who monitors the logs (e.g., internal SOC, third-party SOC, etc.) and how they are monitored.

55. Do you have network intrusion detection systems that provide actionable alerts if an unauthorized computer system intrusion occurs?

If yes, provide details.

☐ Yes ☐ No

56. How often do you perform internal vulnerability scanning?

☐ Continuous ☐ Monthly ☐ Quarterly

57. How often do you perform external vulnerability scanning against internet-facing IP addresses?

☐ Continuous ☐ Monthly ☐ Quarterly

58. Is penetration testing performed by an external vendor?

If yes, how often is it performed? ☐ Continuous ☐ Monthly ☐ Quarterly

☐ Yes ☐ No

59. Is there any other penetration testing performed?

If yes, who performs it?

If yes, how often is it performed?

☐ Continuous ☐ Monthly ☐ Quarterly ☐ Semi-annually ☐ Other: ______________________________

☐ Yes ☐ No

60. Provide the last three dates of testing and indicate if it was conducted by an external vendor or internally.

61. Is there a process for the timely installation of software updates/patches?

If yes, are critical updates/patches installed within 30 days of release?

Service Provider Security Assessment Questionnaire │ 5

Incident response

62. Describe your incident response policies and practices.

63. Have you had any non-HIPAA breaches in the last three years?

If yes, provide details.

☐ Yes ☐ No

64. Have you or your third-party vendors had any breaches in the last three years, as defined by HIPAA, that involved more than 500 records?

If yes, provide details.

☐ Yes ☐ No

65. Have you or your third-party vendors paid any HIPAA related fines in the last three years?

Security requirements and general information

66. Are there any planned system upgrades, conversions or other system changes that might affect PEBA in the next year?

If yes, provide details.

☐ Yes ☐ No

67. Have there been or are there any planned changes in leadership or key staff that might affect your relationship with PEBA?

If yes, provide details.

☐ Yes ☐ No

68. Are there any other material items/changes you believe PEBA should be made aware?

The Offeror’s response to this questionnaire includes any other information submitted with its Offer regarding information or data security.

SIGNATURE OF PERSON AUTHORIZED TO REPRESENT THE ACCURACY OF THIS INFORMATION ON BEHALF OF

CONTRACTOR:

By: _______________________________________

(Authorized signature)

(Printed name)

Its: _______________________________________

(Title)

Date: _______________________________________