Attachment_C-Collin_County_IT_SaaS_Questionnaire_11-6.pdf

Attachment C- Collin County IT Sass Questionnaire C O L L I N C O U N T Y

Information Technology

2300 Bloomdale Road

Suite 3198

McKinney, Texas 75071 www.col l incountytx.gov

1 | P a g e

Company Name:______________________________________

In the event of a cybersecurity incident, who should we contact?

Governance & Security Controls

Do you offer the capability to export your logs to the county's on-premise SEIM? If yes, select all that apply.

Yes No

Authentication Logs Changelogs Traffic logs

For other logs, please specify.

How do you secure logins to the cloud application?

Username/Password MFA SSO Source IP Restriction

Other methods, please specify.

Do you integrate with Okta for single sign-on (SSO)? Yes No

Do you support Cisco Duo 2FA to secure access? Yes No

Do you provide the capability to geoblock access to the cloud application? Yes No

Does your solution support role-based access? Yes No

Does your solution store any personally identifiable information, personal health data, payment card information (PII, PHI, or PCI data), or secure/confidential information?

Yes No

PII PHI PCI Secure/Confidential

Who owns the county’s data in your cloud solution? _________________________________________________

Do you encrypt the data stored at rest? Yes No

Do you encrypt the data in transit? Yes No

Does your solution comply with the FedRAMP requirements? Yes No

Do you have traffic analysis tools for your solution? Yes No

Can the county's data in your cloud solution be stored in another country besides the United States?

Yes No

If yes, what other countries may store the county's data?

If yes, can Collin County restrict data storage to US locations only?

Is your solution behind a firewall? Yes No

C O L L I N C O U N T Y

Information Technology

2300 Bloomdale Road

Suite 3198

McKinney, Texas 75071 www.col l incountytx.gov

2 | P a g e

Backups

How do you back up the county's data, and how long do you keep the backups?

Can you export the backup to the county’s data center? Yes No

If yes, what data format will be used to transfer the data to the county?

Policies & Procedures

What is your record retention policy for the county's data?

What is your data retention policy after the end of service?

• For example, do you securely remove all of our data at the end of service, and how long will you keep it?

What is your application patch policy?

• For example, how long does it take you to patch a critical vulnerability once notified?

Do you run a bug bounty program to identify vulnerabilities in your application? Yes No

What is your breach notification policy for your customers if you suffer a cybersecurity breach?

If you determine an outsider has breached the county's data, what is your notification policy to the county?

Explain your notification policy if a misconfiguration is identified that may have put your customer at risk (for example, exposing RDP to the internet).

What is your notification policy if you determine the county has misconfigured your cloud solution and put itself at risk?

C O L L I N C O U N T Y

Information Technology

2300 Bloomdale Road

Suite 3198

McKinney, Texas 75071 www.col l incountytx.gov

3 | P a g e

Who is responsible for providing notifications regarding system outages, and what is your expected timeframe for delivering these notifications?

Additional Comments

Submitter’s Information

Printed Name:______________________________ Signature:___________________________________

Position:___________________________________ E-Mail Address:_______________________________

Date:___________________