Attachment_D_Technology_Security_Assessment.pdf

County of San Mateo Information Services Department Technology Security Assessment

This document is to be completed for new or upgraded technology acquisitions, contracts, and projects. Please submit with all other proposals and agreement terms for review by the County Information Security Officer according to directives in Administrative Memorandum B-1. All questions must be answered fully.

Submitting Department_______________________________________________ Submitter’s Name________________________________________________ Phone_________________________________________

Section 1: Vendor Information Name:

Address:

Corporate Phone #:

City: State: ZIP:

Technical Support Contact Methods:

(Select all that apply)

Phone:

Email:

IM/Chat

Web Portal

Technical Support Coverage Hours: 24x7x365 Business Hours M-F 8-5 Pacific

Does the vendor provide a dedicated account manager or representative for escalating problems or incidents?

If yes, please provide name.

Yes No

Does the vendor maintain any formal security policies & procedures to comply with industry requirements?

How often is the vendor’s security posture reviewed?

Yes No

Will the vendor provide a copy of their last security audit? Yes No

Does the vendor have any third-party certifications or attestations, such as FedRamp, FIPS 140 -2, FISMA and DIACAP, HIPAA, ISO 27001, PCI DSS, TRUSTe or SOC 1/SOC 2/ SSAE 16/ISAE 3402? If yes, provide certification or attestations.

Section 2: Product Information

Yes No

Product Name: No. of Users:

This is an upgrade or renewal for existing technology currently in use in the County

Does the product have technical constraints to the number of concurrent users it can support?

Yes No

Location: On-Premise Hosted (Cloud/Off-site) Hybrid (On-Premise/Cloud)

Product Description and Purpose: Please include information that will identify the function, business process, and the departments/divisions who will use it.

Integration: Does the product integrate or interface with any other existing or planned products or services used either at the County, or with another third-party County vendor? This would include requirements for integration or use of the County’s email System, ServiceNow, or other systems.

Has the application been subjected to any breaches? If yes, include separately, enacted steps to mitigate including response and escalation processes.

Known Vulnerabilities?

Yes No

Yes No

Yes No

Other

Data Sensitivity: Public Internal Confidential Restricted

Data Criticality: Useful Important Essential

For details on Data Sensitivity and Data Criticality, please see the References section of this document

Section 3: Administrative Controls Configuration and System Hardening: Does the product offer a baseline configuration or system hardening tool that can protect the product against confidential data disclosure or service disruption? **Please provide system Yes No configuration diagram

Backup and Restore: Does the product offer features to backup and restore user data, configurations, and application code?

Does the product integrate with CommVault Storage Services and API (the County’s backup platform)?

If there is a backup process performed by Vendor: Yes No

How often:

Retention period

Data at Termination of Agreement: Will the data be returned?

What assurance is provided for complete removal?

Section 4: Security Controls Monitoring and Event Management: Describe how the product can be monitored for performance, reliability, and security. Include how the product reacts to events that are raised during normal operations.

Can the product forward events to a central log repository or System Event and Incident Management (SEIM) platform

Patching: Describe how the product is patched and updated. Include how frequently the vendor provides security fixes and updates.

If the hardware is onsite, can County engineers apply patches

If hosted, please provide version, service pack, patches, and how will the server be maintained to the lasted patch level?

Malware Protection: Will the product be affected by servers or endpoints that run anti-virus/anti-malware protection? If yes, provide details on what exclusions are required for the product to work effectively.

Employees: Have employees undergone a background check process?

Will the provider use a subcontractor or 3rd party service provider?

If yes, please attach and provide for each subcontractor, the security and privacy agreement.

SaaS: Is the product 100% web-based?

What are the browser security configuration requirements?

Is the portal ADA compliant with Section 508 of the Rehabilitation Act and follows the principles of responsive web design?

Disaster Recovery: Is the location of the server, if hosted, in an area prone to natural disaster?

Is there a disaster recovery plan in place?

Yes No

Yes No

Encrypted? Yes No

Where stored?

Yes No

Yes No

Yes No

Yes No

Yes No

Yes No

Yes No

Yes No

Y Yes No

Identity and Authentication Management:

Does the product provide for, or support identity and authentication integration with via other credentialing systems or protocols?

Note: SAML 2.0 and OAuth 2.0 are the preferred choice for integration with San Mateo County systems (older versions are not compatible).

*If OKTA integration is selected for application integration, answering the Password Management section below will not be required.

Password Management:

How are accounts provisioned and managed (include deprovisioning and removal)?

Does the product provide for password management that meets the County password policy for complexity, expiration, reuse, and lockout? See References section for more information about San Mateo County’s Password Policy

1. All users have a single account with unique account ID?

2. First time password must be unique and changed upon initial login?

3. Password must be changed every 60 days?

4. Password must have at least 8 characters and 1 each of:

lowercase, uppercase, number, and special character?

Does the product provide for password self-reset capability?

How are passwords stored? Encrypted?

Access Management: Does the product allow for privileges to be assigned to both individuals and ‘groups’ of individuals in order to support the use of ‘Roles’ for access permissions? Please describe method used.

Yes No If yes, please specify

Yes No

Yes No

Yes No

Yes No

Yes No

Yes No

Yes No

Yes No

Encryption: Identify and describe whether the product encrypts data during different states – i.e., at rest, in use, and in transit. Also include credentials (usernames, passwords, etc).

Auditing: Does the product provide a mechanism for auditing system activity and/or reporting of that activity? Examples of auditing include user login/logoff, user actions, data export, and permission changes.

Data-in-transit

Data-in-use Data-at-rest Credentials

Yes No

Section 5: Cloud/Hosted Services Data Sovereignty: Does the vendor keep all the data within the United States? Please provide location(s) where San Mateo County’s data will be stored.

Tenancy: Describe how San Mateo County data resides with other customer data in the hosted environment-- i.e., is the data co-mingled in a single database, or are there separate customer databases?

Hosted Platform: Please describe the vendor’s technology platform in the hosted environment-- both application, database, and/or other layers (e.g., Ruby on Rails, Redis Cache, MongoDB)

Third Party Services: Does the vendor use any third-party services (e.g., for development, QA, helpdesk, integration services, offsite backup locations, etc.) where the third party vendors have access to San Mateo County data?

Network Defenses: Please describe how the vendor's network perimeter is protected, including whether an IPS/IDS and anti-virus system is activated, and whether there is a central logging facility for perimeter events

Service Levels and Incident Response:

What is the service level for this hosted product, and how does the vendor guarantee that level for its customers? Include how the vendor notifies customers of incidents that do not meet service levels.

Data Loss Events: Has the vendor experienced any data loss incidents which required reporting to regulatory authorities in the past 24 months?

SAML

OAuth

MFA

Active Directory

LDAP

Other

No Yes

No Yes

Forensic Analysis: Who would perform a forensic analysis of a breach if one were to occur at the vendor site?

IP Restrictions: Does the vendor’s hosted site have the capability to restrict access to San Mateo County’s public IP address space?

Section 6: References

Password Policy

The County of San Mateo’s Information Security Policy requires new technology implementations that use passwords to adhere to the following password requirements:

County of San Mateo Password Requirements

1. All users must have unique account IDs that identifies a single account owner

2. First time password must be unique to an individual, and require change upon initial login

3. The permanent / long term password requires an enforceable change every 60 days

4. The password must enforce a minimum of at least 8 characters, and contain at least one character from three of the following:

a. Lower Case

b. Upper Case

c. Numbers

d. Special Characters

Data Classification Standards In order to apply the proper security safeguards to digital assets, the County of San Mateo classifies new technology both to a Sensitivity and Criticality class. The following information defines those classification standards, and is added as a resource to answering the questions in Section 3, ‘Product Information’.

Section 7: Non-Compliance

Please explain area(s) of non-compliance. Provide information as to the services or systems that would be impacted as well as the proposed remediation, if any.

NOTE: All Non-Compliance must file an Information Security Risk Acceptance Form

Section 8: Other Documents

Please include any pertinent documents, diagrams of network, and/or data flow architecture

Documents included? Yes No

This assessment was prepared by (Print Name) ____________________________________________________

Signature _________________________________________

Date

Phone _________________________________________

San Mateo County Information Services Department Technology Security Assessment Version 0.6 20180601