Attachment 3 - Security Program Questionnaire (20250602).pdf

Attachment 3

FA2385-25-S-9761

3 June 2025

SECURITY PROGRAM QUESTIONNAIRE

Objective: This questionnaire is used to review the security program and practices of the institutions receiving research funding.

Intended Audience/User: Completed by collaborators; reviewed by S&T Protection Lead.

Date Submitted:

Applicant Name:

CAGE Code/SCL and level (if applicable):

Completed by Name:

Position/Title:

General Security Posture & Governance

1. Do you have a dedicated Information Security Officer (ISO) or a security team?

2. Do you have an established risk management program?

3. What information security assessment methodology(ies) are you using to identify, analyze, and mitigate cybersecurity risks for this project, and within your organization as a whole? What is your overall information security governance framework? (e.g., based on NIST CSF, ISO 27001)?

4. How often do you review and update your security policies and procedures?

Compliance

5. How do you ensure compliance with relevant government regulations and contractual security requirements?

6. What security certifications and standards do you adhere to? (e.g., ISO 27001, SOC 2 Type II, FedRAMP authorization level, NIST 800-53, NIST 800-171, PCI DSS, HIPAA, GDPR)

7. Has your organization completed an internal assessment of you information security practices, and IT infrastructure?

8. Has your organization completed a 3rd party assessment of you information security practices, and IT infrastructure?

9. Can you provide copies of recent audit reports, attestations, or authorization letters?

10. How do you ensure security awareness and training for your employees, especially those with access to our data or systems? What is the frequency and content of this training?

11. Are you willing to provide AFRL S&T Protection training to all personnel with access annually?

Data Loss Prevention, Access Control & Authentication

12. Do you implement data loss prevention (DLP) measures? If so, describe them.

13. What types of government data will you collect, store, process, or transmit? (e.g., PII, CUI, classified information)?

14. Where will information for this effort be stored? Where will government data be stored

(geographic location and cloud vs. on-premise)?

15. What policies and procedures are in place for monitoring/tracking the reproduction of information for this effort?

16. Are personal devices allowed to access government data or systems? If so, what security controls are in place?

17. How do you manage privileged access (e.g., system administrators)? Do you utilize multi-factor authentication (MFA) for all administrative and privileged access to systems handling our data?

Physical Security and Data Segregation

18. What physical security controls are in place at your data centers or facilities where government data or systems are housed? (e.g., access controls, surveillance, environmental controls).

19. How do you ensure data segregation and logical separation of government data from other client data in a multi-tenant environment?

20. What policies and procedures are in place for secure storage of sensitive information?

21. What policies and procedures are in place for secure transmission/transportation of information for this effort?

22. What is the plan for safeguarding GFE/GFI? How will government data be encrypted both in transit and at rest?

23. What policies and procedures are in place for disposal and destruction of information for this effort? What are your data retention and deletion policies? How is data securely disposed of when no longer needed?

24. What procedures are in place for cybersecurity or network protection?

25. How do you monitor your network for suspicious activity, intrusions, and malware?

26. Do you perform regular vulnerability scanning and penetration testing of your systems and applications?

Supply Chain & Third-Party Risk

27. How do you assess and manage the security risks posed by your own third-party vendors and subcontractors?

28. Do you require your subcontractors to meet similar security standards as you do for our program?

29. How do you manage the security of your software supply chain? (e.g., code scanning, open-source component analysis).

30. What policies and procedures are in place for identifying and tracking personnel who can access information for this effort?

31. What processes are in place to deter, detect, and mitigate actions of insider threat?

32. What operational security processes are in place to prevent adversaries from accessing information for this effort or actions that would compromise your projects?

Incident Response

33. What procedures are in place to handle if information for this effort is compromised?

34. How will you notify our program in the event of a security incident or data breach involving our data or systems?

35. Do you have a formal Incident Response Plan and Procedures in place?

36. Do you regularly test your incident response plan (e.g., tabletop exercises)?

Additional comments: