City of Portland - City Operations - Bureau of Technology Services

Hosted System Questionnaire Date:

Contractor name:

Product web site:

Product name and version:

Primary Contractor contact person and information:

Product Description:

End Point Requirements

1. List or include a link to a list of all environments the System is certified and supported in.

2. Does the System require client software to be installed locally? ☐ Yes ☐ No

3. Except for initial installation, does the System require elevated or administrative access/permissions to function? ☐ Yes ☐ No (If No, please explain.)

4. List all browsers the System runs in. Include details about what cookies, pop-ups, or other extras are needed for the System to function in those browsers.

5. Does the System require technology such as ActiveX controls, .NET framework or other similar technologies? ☒ No ☐ Yes (If Yes, please explain)

6. Does the System require Java (not javascript)? ☐ No ☐ Yes (version _____________)

a. Can OpenJDK be used instead?

System Security Requirements

1. Are login and sign-up portions of a hosted, web-based System running over a secured communications channel?

a. TLS 1.2 ☐ Yes ☐ No

b. TLS 1.3 ☐ Yes ☐ No

c. TLS Certs managed by: ☐ Contractor ☐ City

Bureau of Technology Services Page 2 V3.0 – 8/1/2024 Vendor Hosted Solution Questionnaire

2. Are end users authenticated through SSO with Entra ID? ☐ Yes ☐ No (If No, please explain, including MFA details and authentication requirements.)

3. What type of data does the system store?

4. Will the System utilize or store any of the following protected data types?

(check all that apply, follow links for more information) ☐ Payment Card Industry (PCI-DSS) ☐ NACHA ACH Rules (NACHA Enforcement Rules) ☐ Criminal Justice Information (CJI) ☐ Sarbanes-Oxley (SOX) ☐ Protected Health Information (HIPAA) ☐ Utility account data ("Red Flag" Rules) ☐ IRS Publication 1075 (Publication 1075) ☐ Data in combinations that are covered by the Oregon Identity Theft Protection Act.

See also Oregon Law regarding breach or compromise of information subject to the Act.

☐ Other sensitive data for which there are no established data handling policies or best practices. (Please explain)

5. Does the data center that hosts the System and data meet the following minimum security certifications? (check all that apply and attach certification reports) ☐ FedRAMP ☐ SOC2 Type 2 ☐ Other – Please list:

☐ N/A - Please explain:

6. Is City data stored within United States borders. ☐ Yes ☐ No (If No, please explain.)

7. Will the City retain ownership of its data? ☐ Yes ☐ No (If No, please explain.)

8. What access will the Contractor have to the City’s data?

9. Will the Contractor assuming or seeking any right to use or to resell the City’s data or metadata? ☐ No ☐ Yes (If Yes, please explain)

10. Is the City’s data comingled with other customer data in a common database?

https://www.pcisecuritystandards.org/documents/PCI%20SSC%20Quick%20Reference%20Guide.pdf https://www.nacha.org/content/rules-enforcement https://www.fbi.gov/services/cjis/cjis-security-policy-resource-center http://www.sox-online.com/sarbanes-oxley-act-the-basics/ https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html https://www.ftc.gov/tips-advice/business-center/guidance/fighting-identity-theft-red-flags-rule-how-guide-business https://www.irs.gov/pub/irs-pdf/p1075.pdf http://dfr.oregon.gov/business/Documents/4117.pdf https://www.oregonlaws.org/ors/646A.604

Bureau of Technology Services Page 3 V3.0 – 8/1/2024 Vendor Hosted Solution Questionnaire

☐ No ☐ Yes (If Yes, please explain)

Product and Environment Requirements

1. What is the country of origin for this software?

2. Describe how the product is licensed and new versions received?

3. How does the product receive patches and updates? (include notification process, frequency, and customer controls)

4. What is the Contractor’s response plan for addressing known major software bugs?

5. Data backup responsibility belongs to: ☐ City ☐ Contractor (If Contractor, provide details, including how data recovery is handled)

6. Are customizations or integrations planned? ☐ No ☐ Yes (If Yes, please provide details)

7. How are service outages and return to service managed and communicated?

8. Does the hosted System automatically fail over to a secondary site if the primary site has a failure? ☐ No ☐ Yes (If Yes, please provide details)

9. Describe the Vendor Support Model: