Attachment B.xlsx

XLSX spreadsheet 60 KB Posted Nov 20, 2025

Attached to: WORKERS' COMPENSATION MANAGEMENT SYSTEM
Solicitation number: 5400020469
Issued by: Lexington County, Lugoff CDP, South Carolina

About this file

Written by GovTribe AI · Nov 20, 2025

This is a security assessment questionnaire in spreadsheet format for a state and local contract opportunity related to South Carolina's Workers' Compensation Management System. The document functions as a comprehensive vendor security compliance evaluation tool rather than a traditional procurement document. It contains approximately 200+ detailed security control questions organized across multiple domains including access control, authentication, audit and accountability, risk assessment, physical security, personnel security, media protection, asset management, third-party management, contingency planning, vulnerability management, incident response, data protection, and system development lifecycle. The questionnaire requires vendors to provide detailed responses and explanations demonstrating compliance with industry standards including NIST frameworks, HIPAA requirements, and state-specific security standards (DIS IDs). Each question references corresponding NIST control identifiers and HIPAA compliance citations, establishing baseline security requirements for the system.

The security questionnaire serves as a pre-award evaluation mechanism to verify that vendors possess adequate information security and privacy controls to protect workers' compensation data and systems. Rather than establishing traditional pricing or contract terms, this assessment establishes mandatory security postures across areas such as role-based access controls, encryption protocols, disaster recovery planning with defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), annual vulnerability assessments and penetration testing, incident response capabilities, business continuity planning, and formal audit procedures. Vendors must demonstrate compliance with password policies requiring changes every 60-180 days depending on account type, two-factor authentication for remote access, physical facility controls, personnel background verification, annual security training, third-party risk assessments, and documented procedures for data backup and recovery. The comprehensive nature of this questionnaire indicates that South Carolina is implementing rigorous security due diligence for its workers' compensation management system to protect sensitive employee and employer records.

View the file

Other files

File	Type	Posted
Amendment 4.docx	DOCX document	Nov 20, 2025
Notice of Award Posting.docx	DOCX document	Nov 20, 2025
Notice of Award Extension.doc	DOC document	Nov 20, 2025
Attachment A.xlsx	XLSX spreadsheet	Nov 20, 2025
Amendment 3.docx	DOCX document	Nov 20, 2025
Amendment 1.docx	DOCX document	Nov 20, 2025
Amendment 2.docx	DOCX document	Nov 20, 2025
Solicitation.docx	DOCX document	Nov 20, 2025
Amended Attachment A.xlsx	XLSX spreadsheet	Nov 20, 2025

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Sheet1

Does the vendor provide role-based security training?
DIS ID	1.204
NIST ID	AT-3
HIPAA ID	164.312(b)
Vendor Response and Explanation

Does the vendor information security and privacy policies, standards, guidelines, and procedures contain the following information, as appropriate: version, issued date, effective date, owner of document (identified by office or role), purpose, definitions, scope, directives, guidance, and revision history?
DIS ID	1.305
NIST ID	PL-1
HIPAA ID	164.316(a)
Vendor Response and Explanation

Has the vendor developed and implemented a communication plan to disseminate new procedures or changes to existing procedures?
DIS ID	1.308
NIST ID	PL-1
HIPAA ID	164.316(a)
Vendor Response and Explanation

Has the vendor established a procedure governance committee for the purpose of review and approval of procedures?
DIS ID	1.309
NIST ID	PL-1
HIPAA ID	164.316(a)
Vendor Response and Explanation

Has the vendor implemented mechanisms to help ensure that information security procedures will be available to personnel on a continuous basis and whenever required?
DIS ID	1.31
NIST ID	PL-1
HIPAA ID	164.316(a)
Vendor Response and Explanation

Does the vendor require employees to review and acknowledge understanding of information security procedures prior to allowing access to sensitive data or information systems?
DIS ID	1.311
NIST ID	PL-4
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor adopted a risk-based approach to prioritize deployment of controls?
DIS ID	1.401
NIST ID	CA-2
HIPAA ID	164.308(a)(8)
Vendor Response and Explanation

Has the vendor developed and implemented a communication plan to disseminate new controls or changes to existing controls?
DIS ID	1.406
NIST ID	PL-1
HIPAA ID	164.316(a)
Vendor Response and Explanation

Does the vendor periodically review information security controls, staging each full review cycle across no more than a 3-year period?
DIS ID	1.407
NIST ID	PL-1
HIPAA ID	164.316(a)
Vendor Response and Explanation

Does the vendor establish or update formal, documented procedures for secure and compliant management of information systems, user accounts, and networks?
DIS ID	2.101
NIST ID	AC-1
HIPAA ID	164.308(a)(3)(i); 164.308(a)(3)(ii)(A); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C ); 164.312(a)(1)
Vendor Response and Explanation

Does the vendor identify account types (e.g., individual, group, system, application, guest/anonymous, and temporary) and establish conditions for group membership?
DIS ID	2.102
NIST ID	AC-2
HIPAA ID	164.308(a)(3)(ii)(B); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(5)(ii)(C ); 164.312(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Does the vendor identify authorized users of information systems and specify access rights?
DIS ID	2.103
NIST ID	AC-2
HIPAA ID	164.308(a)(3)(ii)(B); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(5)(ii)(C ); 164.312(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Does the vendor identify authorized users of information systems and specify access rights?
DIS ID	2.103
NIST ID	AC-2
HIPAA ID	164.308(a)(3)(ii)(B); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(5)(ii)(C ); 164.312(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Has the vendor established a process to enforce access requests to be approved by a business or data owner (or delegate) prior to provisioning user accounts.
DIS ID	2.104
NIST ID	AC-2
HIPAA ID	164.308(a)(3)(ii)(B); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(5)(ii)(C ); 164.312(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Does the vendor authorize and monitor the use of guest/anonymous and temporary accounts, and notify relevant personnel (e.g., account managers) when temporary accounts are no longer required?
DIS ID	2.105
NIST ID	AC-2
HIPAA ID	164.308(a)(3)(ii)(B); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(5)(ii)(C ); 164.312(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Has the vendor established a process to notify relevant personnel (e.g., account managers, system administrators) to remove or deactivate access rights when users are terminated, transferred, or access rights requirements change?
DIS ID	2.106
NIST ID	AC-2
HIPAA ID	164.308(a)(3)(ii)(B); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(5)(ii)(C ); 164.312(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Does the vendor remove, disable, or rename default user accounts? When not possible, does the vendor increase the required length or complexity of password or use additional factors for authentication?
DIS ID	2.107
NIST ID	AC-2
HIPAA ID	164.308(a)(3)(ii)(B); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(5)(ii)(C ); 164.312(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Does the vendor ensure that rights granted to accounts must be based on the principles of need-to-know, least-privilege, and separation of duties? Access not explicitly permitted denied by default?
DIS ID	2.108
NIST ID	AC-5; AC-6
HIPAA ID	164.308(a)(3)(i); 164.308(a)(4)(i); 164.308(a)(4)(ii)(A); 164.312(a)(1); 164.308(a)(3)(ii)(B); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(5)(ii)(C ); 164.312(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Does the vendor ensure that privileged accounts (e.g., system / network administrators having root level access, database administrators) are only provisioned after approval by an information security officer and/or similarly designated role? Is the approval granted to a limited number of individuals with the requisite skill, experience, business need, and documented reason based on role requirements?
DIS ID	2.11
NIST ID	AC-2; AC-6
HIPAA ID	164.308(a)(3)(ii)(B); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(5)(ii)(C ); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(3)(i); 164.308(a)(4)(i); 164.308(a)(4)(ii)(A); 164.312(a)(1)
Vendor Response and Explanation

Does the vendor ensure that privileged accounts are controlled, monitored, and can be reported on a periodic basis?
DIS ID	2.111
NIST ID	AC-2
HIPAA ID	164.308(a)(3)(ii)(B); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(5)(ii)(C ); 164.312(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Does the vendor implement processes to enforce periodic user access reviews to be performed by information / data owners or their assigned delegates to ensure the following: current access rights are consistent with current access provisioning criteria, and there are unnecessary duplicate user identifiers? Are privileged accounts reviewed at least semiannually? Are standard accounts reviewed at least as often as annually?
DIS ID	2.112
NIST ID	AC-2
HIPAA ID	164.308(a)(3)(ii)(B); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(5)(ii)(C ); 164.312(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Does the vendor regulate information system access and define security requirements for contractors, vendors, and other service providers?
DIS ID	2.113
NIST ID	AC-2
HIPAA ID	164.308(a)(3)(ii)(B); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(5)(ii)(C ); 164.312(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Has the vendor established procedures to administer privileged user accounts in accordance with a role-based access model?
DIS ID	2.114
NIST ID	AC-6(5)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor enforce approved authorizations for logical (e.g. cyber or electronic) access to information systems?
DIS ID	2.115
NIST ID	AC-3
HIPAA ID	164.308(a)(3)(ii)(A); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C ); 164.310(a)(2)(iii); 164.310(b); 164.312(a)(1); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.312(a)(2)(iv)
Vendor Response and Explanation

Does the vendor implement encryption of data in motion to protect remote connections?
DIS ID	2.116
NIST ID	AC-17(2)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor enforce information flow controls for its systems, to allow large Restricted data flows to transfer only to approved destinations?
DIS ID	2.117
NIST ID	AC-4
HIPAA ID	164.308(a)(3)(ii)(A); 164.308(a)(4)(ii)(B); 164.310(b)
Vendor Response and Explanation

Has the vendor implemented controls in information systems to enforce separation of duties through assigned access authorizations, such as separation of security administration duties from security audit duties, administration duties for critical business systems separated among personnel, separation of information system testing and production duties?
DIS ID	2.118
NIST ID	AC-5
HIPAA ID	164.308(a)(3)(i); 164.308(a)(4)(i); 164.308(a)(4)(ii)(A); 164.312(a)(1)
Vendor Response and Explanation

Does the vendor document and implement separation of duties through assigned information system access authorizations?
DIS ID	2.119
NIST ID	AC-5
HIPAA ID	164.308(a)(3)(i); 164.308(a)(4)(i); 164.308(a)(4)(ii)(A); 164.312(a)(1)
Vendor Response and Explanation

Does the vendor ensure that only authorized individuals have access to non-public data, and that such access is controlled and audited in accordance with the concepts of need-to-know, least-privilege, and separation of duties?
DIS ID	2.12
NIST ID	AC-6
HIPAA ID	164.308(a)(3)(i); 164.308(a)(4)(i); 164.308(a)(4)(ii)(A); 164.312(a)(1)
Vendor Response and Explanation

Has the vendor implement processes or mechanisms to disable file system access not required for duties, restrict database management to authorized database administrators, and restrict access to removable device/media boot functions to system administrators?
DIS ID	2.121
NIST ID	AC-6; AC-6(1); AC-6(2)
HIPAA ID	164.308(a)(3)(i); 164.308(a)(4)(i); 164.308(a)(4)(ii)(A); 164.312(a)(1)
Vendor Response and Explanation

Does the vendor ensure that its information systems enforce a limit of unsuccessful logon attempts during a defined period?

Is the number of log-on attempts commensurate with the classification of data hosted, processed or transferred by the information system?
DIS ID	2.122
NIST ID	AC-7
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor automatically lock user accounts after maximum logon attempts is reached and established an account lock time period commensurate with the classification of data hosted, processed or transferred by the information system?
DIS ID	2.123
NIST ID	AC-7
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor’s systems interface intended for non-public usage display a warning before granting system access, addressing issues such as intended use of the system, applicable privacy disclosures, and other warnings as required for applicable regulatory or contractual obligations?
DIS ID	2.124
NIST ID	AC-8
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor’s systems disconnect sessions or require reauthentication after (30) minutes of inactivity?
DIS ID	2.125
NIST ID	AC-11
HIPAA ID	164.310(b); 164.312(a)(2)(iii)
Vendor Response and Explanation

Does the vendor document allow remote access to the network and information systems?
DIS ID	2.201
NIST ID	AC-17
HIPAA ID	164.310(b)
Vendor Response and Explanation

Does the vendor utilize automated mechanisms to enable management to monitor and control remote connections into networks and information systems?
DIS ID	2.202
NIST ID	AC-17(1)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor require Virtual Private Network (VPN) or equivalent encryption technology establish remote connections into the private networks?
DIS ID	2.203
NIST ID	AC-17(2)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor restrict remote access to its private networks and systems to the approved mechanisms and protocols?
DIS ID	2.204
NIST ID	AC-17(3)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor require two-factor authentication for remote connections by Virtual Private Network (VPN) or other such tunneling technologies?
DIS ID	2.205
NIST ID	IA-2
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor develop formal procedures for authorized individuals to access its information systems from external systems, such as access allowed from an alternate work site (if required)?
DIS ID	2.206
NIST ID	AC-17
HIPAA ID	164.310(b)
Vendor Response and Explanation

Has the vendor established usage restrictions, configuration and connection requirements, and implementation guidance for wireless access?
DIS ID	2.207
NIST ID	AC-18
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor only use wireless networking technology that enforces user authentication for access to non-public networks?
DIS ID	2.208
NIST ID	AC-18(1)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor authorize wireless access to information systems prior to allowing use of wireless networks for access to non-public networks?
DIS ID	2.209
NIST ID	AC-18
HIPAA ID	164.308(a)(5)(ii)(D); 164.312(a)(2)(i); 164.312(d)
Vendor Response and Explanation

Does the vendor require that before non-public data is processed or stored on a third-party system, the system must be approved for such use by data owners, considering such issues as the classifications of data which may be used with the system, the permitted methods of connection to the system, and compliance of the system with policy?
DIS ID	2.211
NIST ID	AC-20; AC-20(1)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor segregate systems intended for internal use from systems intended for public use by means of separate physical or logical networks?
DIS ID	2.212
NIST ID	SC-7
HIPAA ID	N/A
Vendor Response and Explanation

Is the vendor’s networks and information systems inaccessible from pubic networks (e.g., Internet) except under secured and managed interfaces employing boundary protection devices?
DIS ID	2.213
NIST ID	SC-7
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor limit network access points to a minimum to enable effective monitoring of inbound and outbound communications and network traffic?
DIS ID	2.214
NIST ID	SC-7(3)
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor established processes to enforce the use of unique identifiers assigned to personnel (User IDs), including system users, technical support personnel, system operators, network administrators, system programmers, and database administrators?
DIS ID	2.301
NIST ID	IA-2
HIPAA ID	164.308(a)(6)(i)
Vendor Response and Explanation

Does the vendor prevent reuse of a user ID until all logs, documents, or other records referencing the user ID have reached the end of their retention periods?
DIS ID	2.302
NIST ID	IA-4
HIPAA ID	164.308(a)(6)(ii)
Vendor Response and Explanation

Does the vendor allow the use of group IDs only where these are necessary for business or operational reasons; group IDs must be formally approved and documented?
DIS ID	2.303
NIST ID	AC-2
HIPAA ID	164.308(a)(3)(ii)(B); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(5)(ii)(C ); 164.312(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Does the vendor require users to be authenticated with a user ID prior to, or simultaneous with, using the group ID?
DIS ID	2.304
NIST ID	IA-2(5)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor perform identification and authentication of any user accessing any system intended for internal-only use, and record logs sufficient to identify each user's network address?
DIS ID	2.306
NIST ID	IA-8
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor implement mechanisms to record successful and failed authentication attempts?
DIS ID	2.402
NIST ID	AC-7
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor established processes and procedures for users to obtain access to required information systems on an emergency basis?
DIS ID	2.501
NIST ID	AC-2
HIPAA ID	164.308(a)(3)(ii)(B); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(5)(ii)(C ); 164.312(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Does the vendor’s emergency procedure must ensure that only identified and authorized personnel are allowed emergency access; all emergency actions are documented in detail; emergency accounts are removed, disabled, or re-secured promptly upon conclusion of the emergency conditions; and emergency actions are reported to management?
DIS ID	2.502
NIST ID	AC-2; AC-2(2)
HIPAA ID	164.308(a)(3)(ii)(B); 164.308(a)(4)(i); 164.308(a)(4)(ii)(B); 164.308(a)(4)(ii)(C); 164.312(a)(2)(i); 164.312(a)(2)(ii); 164.308(a)(5)(ii)(C ); 164.312(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Does the vendor enforce a password criteria policy that meets or exceeds?
• Users must change personal user account passwords at least as frequently as every 180 days.
• Privileged user account passwords must be changed at least as frequently as every 60 days.
• System account passwords must be changed at least as frequently as every 180 days.
• Each password must be at least 8 characters in length, and be composed of at least one uppercase letter, at least one lowercase letter, and at least one digit or punctuation character.
• Passwords must be encrypted when stored or transmitted.
DIS ID	2.601
NIST ID	IA-5; IA-5(1)
HIPAA ID	164.308(a)(5)(ii)(D)
Vendor Response and Explanation

Does the vendor prohibit users from sharing their personal account passwords with others?
DIS ID	2.602
NIST ID	IA-5
HIPAA ID	164.308(a)(5)(ii)(D)
Vendor Response and Explanation

Does the vendor ensure that shared account passwords are changed immediately upon termination, resignation, or reassignment of any person with knowledge of the password?
DIS ID	2.603
NIST ID	IA-5
HIPAA ID	164.308(a)(5)(ii)(D)
Vendor Response and Explanation

Does the vendor prohibit its users from using common words or personal information as passwords (e.g., username, social security number, children’s names, pets’ names, hobbies, anniversary dates, etc.)?
DIS ID	2.604
NIST ID	IA-5
HIPAA ID	164.308(a)(5)(ii)(D)
Vendor Response and Explanation

Does the vendor suspend user accounts after a specified number of days of inactivity?
DIS ID	2.605
NIST ID	AC-2(3)
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor implemented a process to change passwords immediately if there is reason to believe a password has been compromised or disclosed to someone other than an authorized user?
DIS ID	2.606
NIST ID	IA-5
HIPAA ID	164.308(a)(5)(ii)(D)
Vendor Response and Explanation

Does the vendor require users of non-public systems to sign an acknowledgement of their understanding of authentication policies prior to allowing access to non-public networks or systems, including policies on password selection and confidentiality?
DIS ID	2.701
NIST ID	PS-6
HIPAA ID	164.308(a)(3)(ii)(A); 164.308(a)(3)(ii)(B); 164.308(a)(4)(ii)(B); 164.310(b); 164.310(d)(2)(iii); 164.314(a)(1); 164.314(a)(2)(i); 164.314(a)(2)(ii)
Vendor Response and Explanation

Has the vendor established a process to verify the identity of a user prior to providing a new, replacement, or temporary password?
DIS ID	2.702
NIST ID	IA-5
HIPAA ID	164.308(a)(5)(ii)(D)
Vendor Response and Explanation

Has the vendor established a process to uniquely identify and authenticate external users of internal-use systems?
DIS ID	2.703
NIST ID	IA-8
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor established procedures to manage new or removed privileged account passwords?
DIS ID	2.704
NIST ID	IA-5; IA-5(1)
HIPAA ID	164.308(a)(5)(ii)(D)
Vendor Response and Explanation

Does the vendor require passwords administratively set on behalf of a user (e.g. new password, password reset) be set to a unique value per user and changed by the user at first use?
DIS ID	2.705
NIST ID	IA-5(1)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor communicate temporary passwords to users in a secure manner?
DIS ID	2.706
NIST ID	IA-5; IA-5(1)
HIPAA ID	164.308(a)(5)(ii)(D)
Vendor Response and Explanation

Does the vendor obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals?
DIS ID	2.707
NIST ID	IA-6
HIPAA ID	164.308(a)(5)(ii)(D)
Vendor Response and Explanation

Does the vendor periodically review or audit its users' and systems' compliance with security policies, standards, and procedures, and initiates corrective actions where necessary?
DIS ID	3.102
NIST ID	AU-2
HIPAA ID	164.308(a)(5)(ii)(C); 164.312(b)
Vendor Response and Explanation

Does the vendor document and report findings from compliance reviews or audits?
DIS ID	3.103
NIST ID	AU-6
HIPAA ID	164.308(a)(1)(ii)(D); 164.308(a)(5)(ii)(C ); 164.312(b)
Vendor Response and Explanation

Has the vendor established formal, documented audit and accountability procedures?
DIS ID	3.104
NIST ID	AU-1
HIPAA ID	164.312(b)
Vendor Response and Explanation

Has the vendor implemented a process to periodically review and update the audit and accountability procedures?
DIS ID	3.105
NIST ID	AU-1
HIPAA ID	164.312(b)
Vendor Response and Explanation

Does the vendor conduct audit procedures in a way that minimizes the risk of disruption of operational systems and business processes?
DIS ID	3.201
NIST ID	AU-2
HIPAA ID	164.308(a)(5)(ii)(C ); 164.312(b)
Vendor Response and Explanation

Has the vendor implemented security controls to help prevent unauthorized access and/or access abuse of audit tools?
DIS ID	3.202
NIST ID	AU-9
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor determined the types of events that are to be audited within information systems, such as authentication success, authentication failure, user connections, system connections, system updates, privileged user actions, record accesses, record updates, system errors, application starts, application stops, system debugging operations?
DIS ID	3.203
NIST ID	AU-2
HIPAA ID	164.308(a)(5)(ii)(C ); 164.312(b)
Vendor Response and Explanation

Does the vendor review and update the list of audited events annually?
DIS ID	3.204
NIST ID	AU-2
HIPAA ID	164.308(a)(5)(ii)(C ); 164.312(b)
Vendor Response and Explanation

Does the vendor ensure that leadership coordinates the audit functions, information security functions, and business functions to facilitate the identification of auditable events?
DIS ID	3.205
NIST ID	AU-2
HIPAA ID	164.308(a)(5)(ii)(C ); 164.312(b)
Vendor Response and Explanation

Does the vendor ensure its information systems are enabled to generate audit records containing details to help establish what type of event occurred, when and where the event occurred, the source and outcome of the event, and the identity of any individuals or subjects associated with the event?
DIS ID	3.206
NIST ID	AU-3
HIPAA ID	164.312(b)
Vendor Response and Explanation

Does the vendor analyze information system audit records periodically?
DIS ID	3.207
NIST ID	AU-6
HIPAA ID	164.308(a)(1)(ii)(D); 164.308(a)(5)(ii)(C ); 164.312(b)
Vendor Response and Explanation

Does the vendor report findings of audit record reviews to information security personnel and leadership?
DIS ID	3.208
NIST ID	AU-6
HIPAA ID	164.308(a)(1)(ii)(D); 164.308(a)(5)(ii)(C ); 164.312(b)
Vendor Response and Explanation

Does the vendor perform correlation and analysis of information generated by security assessments and monitoring?
DIS ID	3.209
NIST ID	AU-6
HIPAA ID	164.308(a)(1)(ii)(D); 164.308(a)(5)(ii)(C ); 164.312(b)
Vendor Response and Explanation

Does the vendor allocate sufficient audit storage capacity to ensure compliance with audit log retention requirements?
DIS ID	3.21
NIST ID	AU-4
HIPAA ID	164.312(b)
Vendor Response and Explanation

Has the vendor implemented provisions for information systems to off-load audit records at regular intervals onto a different system or media than the system being audited?
DIS ID	3.211
NIST ID	AU-4
HIPAA ID	164.312(b)
Vendor Response and Explanation

Does the vendor ensure security controls are monitored on an ongoing basis?
DIS ID	3.301
NIST ID	CA-2
HIPAA ID	164.308(a)(8)
Vendor Response and Explanation

Is the vendor’s security control assessment function independent from operational or business functions, or hired third parties?
DIS ID	3.302
NIST ID	CA-2(1)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor develop a plan of action and milestones to document planned remedial actions to correct deficiencies identified as result of risk assessments, security reviews, or audits?
DIS ID	3.303
NIST ID	CA-5
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor update its plan of action and milestones at least on a yearly basis, and also based on the findings from continuous security monitoring activities?
DIS ID	3.304
NIST ID	CA-5
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor review and evaluate risk based on the system categorization level and/or data classification of their systems?
DIS ID	4.102
NIST ID	RA-2
HIPAA ID	164.308(a)(1)(ii)(A); 164.308(a)(1)(ii)(B); 164.308(a)(7)(ii)(E )
Vendor Response and Explanation

Has the vendor established a risk assessment framework based on applicable State and federal laws, regulation, and industry standards (e.g. NIST 800-30). This assessment framework must clearly define accountability, roles and responsibilities?
DIS ID	4.201
NIST ID	RA-3
HIPAA ID	164.308(a)(1)(ii)(A); 164.308(a)(1)(ii)(B); 164.316(a)
Vendor Response and Explanation

Does the vendor periodically conduct a formal assessment of its information security and privacy processes and controls to determine the appropriateness of the design and implementation of controls, and the extent to which the controls are operating as intended and producing the desired outcome (e.g. NIST 800-115, NIST 800-53A)?
DIS ID	4.202
NIST ID	CA-2
HIPAA ID	164.308(a)(8)
Vendor Response and Explanation

Does the vendor ensure that risk assessments identify, quantify, and prioritize risks against criteria for risk acceptance and objectives?
DIS ID	4.203
NIST ID	RA-1; RA-3
HIPAA ID	164.308(a)(1)(i); 164.316(a); 164.308(a)(1)(ii)(A); 164.308(a)(1)(ii)(B);
Vendor Response and Explanation

Has the vendor developed and periodically update a Plan of Action & Milestones (POAM) document that identifies any deficiencies related to internal security controls?
DIS ID	4.204
NIST ID	CA-5
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor established a process and assign a senior-level executive or manager to determine whether or not risks can be accepted, and for each of the risks identified following the risk assessment, the designated personnel must make a decision regarding risk treatment?
DIS ID	4.205
NIST ID	RA-3; CA-6
HIPAA ID	164.308(a)(1)(ii)(A); 164.308(a)(1)(ii)(B); 164.316(a); 164.308(a)(2); 164.308(a)(8)
Vendor Response and Explanation

Has the vendor established and implemented controls to ensure risks are reduced to an acceptable level based on security requirements, once threats have been identified and decisions for the management of risks have been made?
DIS ID	4.301
NIST ID	CA-6
HIPAA ID	164.308(a)(2); 164.308(a)(8)
Vendor Response and Explanation

Does the vendor determine and document the acceptable level for risk for various threats based on the business requirements and the potential impact of the risk?
DIS ID	4.302
NIST ID	CA-6
HIPAA ID	164.308(a)(2); 164.308(a)(8)
Vendor Response and Explanation

Has the vendor established formal, documented procedures to facilitate the implementation of physical and environmental protection controls?
DIS ID	5.101
NIST ID	PE-1
HIPAA ID	164.310(a)(1); 164.310(a)(2)(ii); 164.310(a)(2)(iii)
Vendor Response and Explanation

Has the vendor established procedures to review and maintain current the physical and environmental protection procedures?
DIS ID	5.102
NIST ID	PE-1
HIPAA ID	164.310(a)(1); 164.310(a)(2)(ii); 164.310(a)(2)(iii)
Vendor Response and Explanation

Has the vendor developed, approved, and maintained a list of personnel with authorized access to the facility where information systems are physically located.
DIS ID	5.103
NIST ID	PE-2
HIPAA ID	164.310(a)(1); 164.310(a)(2)(iii)
Vendor Response and Explanation

Has the vendor established a process to review, approve, and issue credentials for facility access?
DIS ID	5.104
NIST ID	PE-2
HIPAA ID	164.310(a)(1); 164.310(a)(2)(iii)
Vendor Response and Explanation

Does the vendor remove individuals from the facility access list when access is no longer required?
DIS ID	5.105
NIST ID	PE-2
HIPAA ID	164.310(a)(1); 164.310(a)(2)(iii)
Vendor Response and Explanation

Does the vendor ensure that facilities housing systems containing sensitive data are protected against unauthorized physical access (e.g. keycards, keys, security guards)?
DIS ID	5.106
NIST ID	PE-3
HIPAA ID	164.310(a)(1); 164.310(a)(2)(iii); 164.310(b); 164.310(c)
Vendor Response and Explanation

Does the vendor maintain physical access audit logs for facilities housing systems containing sensitive data?
DIS ID	5.107
NIST ID	PE-3
HIPAA ID	164.310(a)(1); 164.310(a)(2)(iii); 164.310(b); 164.310(c)
Vendor Response and Explanation

Has the vendor established a process to escort visitors and monitor their activity within facilities housing systems containing sensitive data?
DIS ID	5.11
NIST ID	PE-3
HIPAA ID	164.310(a)(1); 164.310(a)(2)(iii); 164.310(b); 164.310(c)
Vendor Response and Explanation

Does the vendor change combinations and keys at defined intervals, and when keys are lost, combinations are compromised, or individuals are transferred or terminated?
DIS ID	5.111
NIST ID	PE-3
HIPAA ID	164.310(a)(1); 164.310(a)(2)(iii); 164.310(b); 164.310(c)
Vendor Response and Explanation

Does the vendor control physical access to information system distribution and transmission lines within the data center(s) using physical access control devices (e.g., keycard or keys)?
DIS ID	5.112
NIST ID	PE-4
HIPAA ID	164.310(a)(1); 164.310(a)(2)(iii); 164.310(c)
Vendor Response and Explanation

Does the vendor review physical access logs at a defined frequency and upon occurrence of security incidents?
DIS ID	5.114
NIST ID	PE-6
HIPAA ID	164.310(a)(1); 164.310(a)(2)(iii); 164.310(b); 164.310(c)
Vendor Response and Explanation

Does the vendor ensure that visitor access records to facilities housing systems containing sensitive information, are retained for a minimum of 1 year?
DIS ID	5.115
NIST ID	PE-8
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor established processes to authorize, monitor, and control sensitive information systems and media entering and exiting facilities?
DIS ID	5.116
NIST ID	PE-16
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor place power equipment and cabling in safe locations to prevent environmental and/or man-made damage and destruction?
DIS ID	5.201
NIST ID	PE-9
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor have the capability of shutting off power to data system facilities during an incident?
DIS ID	5.202
NIST ID	PE-10
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor place emergency shutoff switches or devices at locations which can be safely and easily accessed by personnel during an incident?
DIS ID	5.203
NIST ID	PE-10
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor implement physical and logical controls to protect emergency power shutoff capability from unauthorized activation?
DIS ID	5.204
NIST ID	PE-10
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor install and maintain fire detection and suppression devices that are supported by an independent power source?
DIS ID	5.206
NIST ID	PE-13
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor employ fire detection devices/ system that activate automatically and notify emergency personnel and defined emergency responder(s) in the event of a fire?
DIS ID	5.207
NIST ID	PE-13(2)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor employ an automatic fire suppression system if the data system facility is not staffed on a continuous basis?
DIS ID	5.208
NIST ID	PE-13(3)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor employ temperature and humidity monitoring that provides an alarm or notification of changes potentially harmful to personnel or equipment?
DIS ID	5.21
NIST ID	PE-14(2)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor protect processing equipment from damage resulting from water leakage?
DIS ID	5.211
NIST ID	PE-15
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor define and implement mechanisms for disposal of digital media and data storage devices?
DIS ID	5.301
NIST ID	MP-6
HIPAA ID	164.310(d)(1); 164.310(d)(2)(i); 164.310(d)(2)(ii)
Vendor Response and Explanation

Does the vendor employ sanitization mechanisms with the strength and integrity commensurate with classification of data to be sanitized?
DIS ID	5.302
NIST ID	MP-6
HIPAA ID	164.310(d)(1); 164.310(d)(2)(i); 164.310(d)(2)(ii)
Vendor Response and Explanation

Has the vendor established processes for cleansing and disposal of computers, hard drives, and fax/printer/scanner devices?
DIS ID	5.303
NIST ID	MP-6
HIPAA ID	164.310(d)(1); 164.310(d)(2)(i); 164.310(d)(2)(ii)
Vendor Response and Explanation

Does the vendor define security roles and responsibilities of employees, contractors, and third-party personnel, and document these in accordance with their information security procedures?
DIS ID	6.101
NIST ID	PS-1
HIPAA ID	164.308(a)(3)(ii)(A); 164.308(a)(3)(ii)(B); 164.308(a)(3)(ii)(C )
Vendor Response and Explanation

Does the vendor ensure background verification checks on candidates for employment, including contractors, and third-party users align with the nature and sensitivity of data and systems the personnel will have access to, and carried out in accordance with applicable laws?
DIS ID	6.102
NIST ID	PS-3
HIPAA ID	164.308(a)(3)(ii)(B)
Vendor Response and Explanation

Does the vendor ensure that upon termination or transfer of employment for employees, termination of engagement for non-employees, personnel must return all physical documents (and all copies thereof) and other property and materials in their possession or control, and must certify the secure erasure or destruction of any electronic information?
DIS ID	6.103
NIST ID	PS-4; PS-5
HIPAA ID	164.308(a)(3)(ii)(C )
Vendor Response and Explanation

Does the vendor ensure that employees, contractors, and third-party users must agree and sign an acceptable use policy, which must state responsibilities for information security?
DIS ID	6.104
NIST ID	PS-6
HIPAA ID	164.308(a)(3)(ii)(A); 164.308(a)(3)(ii)(B); 164.308(a)(4)(ii)(B); 164.310(b); 164.310(d)(2)(iii); 164.314(a)(1); 164.314(a)(2)(i); 164.314(a)(2)(ii)
Vendor Response and Explanation

Does the vendor require employees, contractors, and third-party users to apply security in accordance with established policies and procedures of the organization, where such personnel have responsibilities for non-public information, systems, media, or facilities housing such items?
DIS ID	6.201
NIST ID	PS-1; PS-7
HIPAA ID	164.308(a)(3)(ii)(A); 164.308(a)(3)(ii)(B); 164.308(a)(3)(ii)(C); 164.308(b)(1); 164.314(a)(1); 164.314(a)(2)(i); 164.314(a)(2)(ii)
Vendor Response and Explanation

Does the vendor ensure employees, contractors, and third-party users receive security and privacy awareness training, and regular updates about organizational policies and procedures, as relevant for their job function?
DIS ID	6.202
NIST ID	AT-3
HIPAA ID	164.308(a)(5)(i)
Vendor Response and Explanation

Does the vendor require that each user receives some minimum level of awareness training prior to granting access?
DIS ID	6.204
NIST ID	AT-3
HIPAA ID	164.308(a)(5)(i)
Vendor Response and Explanation

Has the vendor appointed a cyber-security awareness training coordinator to manage training content, schedules, and user training completion status?
DIS ID	6.205
NIST ID	PS-2
HIPAA ID	164.308(a)(3)(ii)(B)
Vendor Response and Explanation

Does the vendor limit portable storage devices to devices assigned and identified to an individual owner?
DIS ID	7.101
NIST ID	MP-7
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor require the use of portable storage devices that allow secure erasure or destruction, for use with non-public data?
DIS ID	7.102
NIST ID	MP-7
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor require handheld computing devices have the ability to be remotely wiped / erased, for use with non-public data?
DIS ID	7.103
NIST ID	MP-7
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor developed usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled handheld computing devices?
DIS ID	7.104
NIST ID	AC-19
HIPAA ID	164.310(b)
Vendor Response and Explanation

Has the vendor developed and applied adequate asset management procedures to all handheld computing devices?
DIS ID	7.106
NIST ID	AC-19
HIPAA ID	164.310(b)
Vendor Response and Explanation

Does the vendor ensure that handheld computing devices used to access non-public data are configured with encryption of data at rest?
DIS ID	7.107
NIST ID	AC-19(5)
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor implemented controls to ensure the installation of standardized operating system, applications, and patches on handheld computing devices?
DIS ID	7.108
NIST ID	AC-19
HIPAA ID	164.310(b)
Vendor Response and Explanation

Does the vendor ensure that non-public information is securely erased from any handheld computing device used to access such data, before the device is disposed or transferred to another person?
DIS ID	7.109
NIST ID	MP-6
HIPAA ID	164.310(d)(1); 164.310(d)(2)(i); 164.310(d)(2)(ii)
Vendor Response and Explanation

Does the vendor ensure for handheld computing devices, where feasible, the testing of vendor recommended patches, hot-fixes, or service packs before such changes are approved for installation; and a process to keep system hardware, operating system, and applications up-to-date with the approved system updates?
DIS ID	7.111
NIST ID	AC-19
HIPAA ID	164.310(b)
Vendor Response and Explanation

Does the vendor ensure that each handheld computing device is configured so that only approved services and software are enabled and/or installed?
DIS ID	7.112
NIST ID	AC-20(2)
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor developed controls for the protection of data storage on handheld computing devices, including their removable media?
DIS ID	7.115
NIST ID	AC-20; AC-20(1)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor ensure that the physical security of each portable storage or handheld computing device is the responsibility of the person to whom the device has been assigned?
DIS ID	7.118
NIST ID	MP-4
HIPAA ID	164.310(c); 164.310(d)(1); 164.310(d)(2)(iv)
Vendor Response and Explanation

Does the vendor protect information system media until the media is destroyed or sanitized using approved processes?
DIS ID	7.201
NIST ID	MP-4
HIPAA ID	164.310(c); 164.310(d)(1); 164.310(d)(2)(iv)
Vendor Response and Explanation

Does the vendor physically control and securely store digital (e.g., CD, flash drives) and non-digital (e.g., paper) media within secured locations, when such media contains non-public information?
DIS ID	7.202
NIST ID	MP-4
HIPAA ID	164.310(c); 164.310(d)(1); 164.310(d)(2)(iv)
Vendor Response and Explanation

Does the vendor employ encryption mechanisms to protect the confidentiality of information stored on digital media during transport outside of controlled areas?
DIS ID	7.203
NIST ID	MP-5(4)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor ensure that removable media is securely erased or destroyed, and that paper media is securely destroyed, prior to disposal, for any such media containing non-public information?
DIS ID	7.205
NIST ID	MP-6
HIPAA ID	164.310(d)(1); 164.310(d)(2)(i); 164.310(d)(2)(ii)
Vendor Response and Explanation

Does the vendor employ encryption at rest to protect the confidentiality of information stored on portable computing devices such as laptops?
DIS ID	7.301
NIST ID	SC-28; SC-28(1)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor ensure that each portable computing device is configured so that only approved services and software are enabled and/or installed?
DIS ID	7.302
NIST ID	CM-7(5)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor ensure that each portable computing device is covered by a configuration management process that includes flaw remediation, such as installing most current stable security patches, critical security updates, and hot fixes?
DIS ID	7.303
NIST ID	CM-2
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor ensure asset tags are placed on portable computing devices?
DIS ID	7.306
NIST ID	CM-8
HIPAA ID	164.310(d)(1); 164.310(d)(2)(iii)
Vendor Response and Explanation

Does the vendor ensure peer-to-peer (ad-hoc) wireless connections on all portable computing devices are disabled?
DIS ID	7.307
NIST ID	CM-7(1)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor document and maintain inventories of the important assets associated with each information system? Do vendor asset inventories include a unique system name, a system/business owner, a data classification, and a description of the location of the asset?
DIS ID	8.101
NIST ID	CM-8
HIPAA ID	164.310(d)(1); 164.310(d)(2)(iii)
Vendor Response and Explanation

Does the vendor require user acknowledgement of all rules and regulations pertinent to an asset, prior to issuing or permitting access to the asset?
DIS ID	8.102
NIST ID	PL-4
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor periodically review asset records to ensure that each is classified appropriately and that the safeguards remain valid and operative?
DIS ID	8.103
NIST ID	CM-8
HIPAA ID	164.310(d)(1); 164.310(d)(2)(iii)
Vendor Response and Explanation

Does the vendor classify assets based on data sensitivity classification types?
DIS ID	8.104
NIST ID	RA-2
HIPAA ID	164.308(a)(1)(ii)(A); 164.308(a)(1)(ii)(B); 164.308(a)(7)(ii)(E )
Vendor Response and Explanation

Does the vendor ensure that each asset is classified based on data classification type and impact level, and the appropriate level of information security safeguards are available and in place?
DIS ID	8.105
NIST ID	RA-2
HIPAA ID	164.308(a)(1)(ii)(A); 164.308(a)(1)(ii)(B); 164.308(a)(7)(ii)(E )
Vendor Response and Explanation

Has the vendor established processes to ensure third parties comply with information security requirements and employ defined security controls in accordance with compliance requirements?
DIS ID	9.201
NIST ID	SA-9
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor implemented processes, methods, and techniques to review compliance by third parties on an ongoing basis?
DIS ID	9.202
NIST ID	SA-9
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor established a process to conduct risk assessments on third party service providers and document the risk assessment results?
DIS ID	9.203
NIST ID	AC-20(1); RA-3; SA-9(1)
HIPAA ID	164.308(a)(1)(ii)(A); 164.308(a)(1)(ii)(B); 164.316(a)
Vendor Response and Explanation

Has the vendor implemented controls to help ensure that risk assessments are updated in case of major changes in scope of services or contractual changes with third parties?
DIS ID	9.204
NIST ID	CA-3; SA-9
HIPAA ID	164.308(b)(1); 164.308(b)(4); 164.314(a)(2)(ii)
Vendor Response and Explanation

Does the vendor authorize connections between information systems and third-party information systems by entering into Interconnection Security Agreements?
DIS ID	9.205
NIST ID	CA-3
HIPAA ID	164.308(b)(1); 164.308(b)(4); 164.314(a)(2)(ii)
Vendor Response and Explanation

Does the vendor ensure that for each third-party system interface with a system, the interface characteristics, security requirements, and the nature of the information communicated are documented?
DIS ID	9.206
NIST ID	CA-3
HIPAA ID	164.308(b)(1); 164.308(b)(4); 164.314(a)(2)(ii)
Vendor Response and Explanation

Has the vendor established terms and conditions for trust relationships established with other entities owning, operating, or maintaining external information systems?
DIS ID	9.207
NIST ID	AC-20
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor review and update third party security agreements on an annual basis, or as defined in the contract?
DIS ID	9.208
NIST ID	CA-3
HIPAA ID	164.308(b)(1); 164.308(b)(4); 164.314(a)(2)(ii)
Vendor Response and Explanation

Has the vendor established a formal, documented contingency planning process that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance?
DIS ID	10.101
NIST ID	CP-1
HIPAA ID	164.308(a)(7)(i)
Vendor Response and Explanation

Has the vendor established a formal process for annual contingency planning policy and procedure review and update?
DIS ID	10.102
NIST ID	CP-1
HIPAA ID	164.308(a)(7)(i)
Vendor Response and Explanation

Has the vendor conducted a Business Impact Analysis (BIA) to identify critical functions, processes, and applications and determined a point in time (i.e. recovery time objective (RTO)) when the impact of an interruption or disruption becomes unacceptable?
DIS ID	10.103
NIST ID	CP-2(3)
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor assigned contingency roles and responsibilities to key individuals from all business functions?
DIS ID	10.105
NIST ID	CP-2
HIPAA ID	164.308(a)(7)(ii)(B) ; 164.308(a)(7)(ii)(C); 164.308(a)(7)(ii)(E ); 164.310(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Has the vendor documented a Business Continuity Plan (BCP) that addresses recovery strategies designed to enable response to potential disruptions and recover its critical business functions within a predetermined RTO following a disruption?
DIS ID	10.107
NIST ID	CP-2
HIPAA ID	164.308(a)(7)(ii)(B) ; 164.308(a)(7)(ii)(C); 164.308(a)(7)(ii)(E ); 164.310(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Has the vendor established a process to ensure that the BCP is reviewed and approved by senior management?
DIS ID	10.108
NIST ID	CP-2
HIPAA ID	164.308(a)(7)(ii)(B) ; 164.308(a)(7)(ii)(C); 164.308(a)(7)(ii)(E ); 164.310(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Has the vendor distributed copies of the BCP to key personnel responsible for the recovery of the critical business functions and other relevant personnel and partners with contingency roles?
DIS ID	10.109
NIST ID	CP-2
HIPAA ID	164.308(a)(7)(ii)(B) ; 164.308(a)(7)(ii)(C); 164.308(a)(7)(ii)(E ); 164.310(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Has the vendor established and implement procedures to review the BCP at planned intervals and at least on an annual basis?
DIS ID	10.11
NIST ID	CP-2
HIPAA ID	164.308(a)(7)(ii)(B) ; 164.308(a)(7)(ii)(C); 164.308(a)(7)(ii)(E ); 164.310(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Has the vendor established a process to update the contingency plan, including BIA, when changes to the organization, information system, or environment of operation occurred?
DIS ID	10.111
NIST ID	CP-2
HIPAA ID	164.308(a)(7)(ii)(B) ; 164.308(a)(7)(ii)(C); 164.308(a)(7)(ii)(E ); 164.310(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Does the vendor provide training to personnel with assigned BCP roles and responsibilities?
DIS ID	10.112
NIST ID	CP-3
HIPAA ID	164.308(a)(7)(ii)(D)
Vendor Response and Explanation

Has the vendor established a process for evaluating the effectiveness of its BCP training?
DIS ID	10.113
NIST ID	CP-3
HIPAA ID	164.308(a)(7)(ii)(D)
Vendor Response and Explanation

Does the vendor incorporate simulated events and lessons learned into contingency training to facilitate effective response by personnel with contingency roles when responding to a disruption?
DIS ID	10.114
NIST ID	CP-3(1)
HIPAA ID	N/A
Vendor Response and Explanation

Does the vendor test the BCP at least annually to determine the effectiveness of the plan and the readiness to execute the plan?
DIS ID	10.115
NIST ID	CP-4
HIPAA ID	164.308(a)(7)(ii)(D)
Vendor Response and Explanation

Does the vendor review the BCP test results, record lessons learned and perform corrective actions as needed?
DIS ID	10.116
NIST ID	CP-4
HIPAA ID	164.308(a)(7)(ii)(D)
Vendor Response and Explanation

Does the vendor employ standard testing methods, ranging from walk-through and tabletop exercises to more elaborate parallel/full interrupt simulations, to determine the effectiveness of the plan and to identify potential weaknesses in the plans?
DIS ID	10.117
NIST ID	CP-4
HIPAA ID	164.308(a)(7)(ii)(D)
Vendor Response and Explanation

Has the vendor developed a Disaster Recovery Plan (DRP) that addresses scope, roles, responsibilities, and coordination among organizational entities for reallocating information systems operations to an alternate location?
DIS ID	10.201
NIST ID	CP-2; CP-2(1)
HIPAA ID	164.308(a)(7)(ii)(B) ; 164.308(a)(7)(ii)(C); 164.308(a)(7)(ii)(E ); 164.310(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Has the vendor established recovery time objectives for the BIA identified critical information systems?
DIS ID	10.202
NIST ID	CP-2(3)
HIPAA ID	N/A
Vendor Response and Explanation

Has the vendor established and documented procedures to fully restore critical information systems, after an incident, minimizing deterioration of the security safeguards originally planned and implemented?
DIS ID	10.203
NIST ID	CP-2
HIPAA ID	164.308(a)(7)(ii)(B) ; 164.308(a)(7)(ii)(C); 164.308(a)(7)(ii)(E ); 164.310(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

Has the vendor assigned disaster recovery roles and responsibilities to key individuals?
DIS ID	10.204
NIST ID	CP-2; CP-2(1)
HIPAA ID	164.308(a)(7)(ii)(B); 164.308(a)(7)(ii)(C); 164.308(a)(7)(ii)(E ); 164.310(a)(2)(i); 164.312(a)(2)(ii)
Vendor Response and Explanation

This is the start of the file's text. The full file is on GovTribe.

File details come from the government source that posted it. Updated Nov 20, 2025.