Attachment_D_-_Vendor_IT_Security_Questionnaire.xlsx

This is an IT Security Questionnaire document associated with an Electric Vehicle Supply Equipment (EVSE) Maintenance Services contract opportunity in Florida. The questionnaire is designed to assess the security posture of a third-party software application that will serve as the comprehensive platform for the EVSE maintenance services pilot program. The selected vendor must demonstrate compliance across seven major security domains: application security practices (including secure software development lifecycle, vulnerability management, and authentication/authorization controls), data security and privacy measures, application infrastructure and hosting security, incident management and monitoring capabilities, compliance with regulatory standards, and risk assessment procedures with continuous improvement protocols.

The questionnaire requires vendors to detail their development lifecycle practices, including whether security requirements are incorporated during design phases and if static and dynamic application security testing is performed. Vendors must also address their vulnerability management programs, patch application frequencies, penetration testing practices, and cybersecurity due diligence for third-party dependencies. Critical sections address data encryption standards (such as AES-256 and TLS 1.2+), multi-factor authentication support, role-based access controls, data retention and disposal policies, logging and monitoring capabilities with minimum 90-day retention periods, and compliance certifications such as ISO 27001, SOC 2, NIST, and PCI DSS. Additionally, vendors must disclose any known security issues, describe their formal incident response plans with breach notification timelines, confirm regular security training for employees and contractors, and provide documentation of formal risk assessments and penetration testing frequencies for their software platform.