Attachment_D_-_Vendor_Questionnaire_RFP_25_PR_8968.xlsx
XLSX spreadsheet 19 KB Posted
- Attached to
- Management Services for Temporary Staffing
- Solicitation number
- PR8968
- Issued by
- Florida
About this file
This is an IT Security Questionnaire attachment for a vendor evaluation associated with a Florida state contract opportunity (RFP 25-PR-8968) for management services for temporary staffing. The questionnaire is designed to assess the security posture of third-party application developers and resellers who may provide information technology services, including staff augmentation and IT support. The document functions as a comprehensive due diligence tool rather than a traditional RFP with specific deliverables, quantities, or timelines. It establishes security and compliance requirements that vendors must meet to qualify for consideration.
The questionnaire evaluates vendors across eight primary security domains: application security practices (including secure development lifecycle, vulnerability management, and authentication controls), data security and privacy (encryption standards, data retention policies, and third-party data sharing agreements), application infrastructure and hosting security (environment hardening and disaster recovery), incident management and monitoring (incident response plans and security logging), compliance with regulatory standards (ISO 27001, SOC 2, NIST, PCI DSS, GDPR, CCPA, HIPAA), risk assessment and continuous improvement practices, and hardware security practices including supply chain integrity, hardware security features, manufacturing security, maintenance procedures, and industry certifications. Vendors must respond with Yes, No, or Partial answers and provide explanations for partial responses, with mappings to NIST Cybersecurity Framework 2.0 and C2M2 standards. The questionnaire requires vendor signatures certifying the accuracy of responses and serves as a foundational security assessment mechanism prior to contract award for temporary staffing and IT service provision.
View the file
Other files
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
IT Security Questionnaire
| Application Name: |
| Application Developer / Reseller |
| Aplication version |
| Area | Response Yes/ No /Partial | Partial - Please Explain |
| 1. Application Security Practices |
| 1.1 Development Lifecycle |
| Does the third party follow a secure software development lifecycle (SDLC)? |
| Are security requirements incorporated during the design phase of the SDLC? |
| Are security reviews conducted at each phase of the development process? |
| Is static and dynamic application security testing (SAST/DAST) performed during development? |
| Does the application undergo regular security code reviews? |
| 1.2 Vulnerability Management |
| Does the third party have a vulnerability management program in place? |
| How frequently are security patches and updates applied to the application? |
| What is the process for addressing security vulnerabilities reported by third parties, users, or automated tools? |
| How are software vulnerabilities tracked and remediated (e.g., CVE reporting, timelines)? |
| Is your product penetration tested regularly by internal or third-party professionals? |
| Do you perform cybersecurity due diligence for third-party libraries, APIs, and cloud services used in your software? |
| Are third-party dependencies tracked, evaluated for security risk, and updated regularly? |
| 1.3 Authentication and Authorization |
| Does the application support multi-factor authentication (MFA)? |
| Does the application utilize role-based access control (RBAC) to ensure least-privilege access? |
| Are credentials stored using strong cryptographic algorithms (e.g., salted hashes)? |
| Does the application support Single Sign-On (SSO)? |
| Are password policies enforced (e.g., complexity, expiration)? |
| Is access to the software environment and data governed by role-based access controls and MFA? |
2. Data Security and Privacy
| 2.1 Data Encryption |
| Is sensitive data encrypted at rest and in transit? |
| What encryption standards are used (e.g., AES-256, TLS 1.2+)? |
| Is key management performed according to industry standards (e.g., hardware security modules)? |
| 2.2 Data Retention and Disposal |
| Does the third party have a data retention policy in place? |
| How is sensitive data securely disposed of when no longer required? |
| 2.3 Third-Party Data Sharing |
| Does the application share data with any external third parties? |
| If yes, is data sharing governed by contracts or data protection agreements (e.g., GDPR, CCPA)? |
| Are sensitive data exchanges encrypted? |
3. Application Infrastructure and Hosting Security
| 3.1 Environment Security |
| Where is the application development hosted (e.g., cloud, on-premise, hybrid)? |
| Is the hosting environment hardened according to industry best practices? |
| Are servers regularly patched and updated? |
| Is the application development hosted in a segregated network or isolated from other systems? |
| 3.2 Backup and Recovery |
| Are regular backups taken of critical application data and configurations? |
| Are backups encrypted and stored in a secure location? |
| Does the application have a documented disaster recovery plan (DRP)? |
| Has the application undergone disaster recovery testing in the last 12 months? |
4. Incident Management and Monitoring
| 4.1 Security Incident Management |
| Does the third party have a formal incident response plan (IRP) in place? |
| Are security incidents regularly reported and tracked? |
| In the event of a security breach, how quickly will the third party notify affected customers? |
| Is there a documented, tested incident response plan specific to the software you deliver? |
| 4.2 Logging and Monitoring |
| Are security logs generated for critical application events (e.g., login attempts, data access)? |
| Are logs monitored and reviewed regularly for suspicious activities? |
| Are logs retained for a minimum of 90 days? |
| Are security logs protected from unauthorized access or modification? |
| Do you monitor your product and infrastructure for anomalous or unauthorized behavior? |
5. Compliance and Regulatory Requirements
| 5.1 Compliance Standards |
| Does the application meet any industry security standards or frameworks? (e.g., ISO 27001, SOC 2, NIST, PCI DSS) |
| Please list the relevant compliance certifications the application holds: |
| 5.2 Data Protection Laws |
| Is the application compliant with data protection regulations such as GDPR, CCPA, HIPAA, etc.? |
| Does the third party provide a data processing agreement (DPA) or similar legal document? |
6. Risk Assessment and Continuous Improvement
| 6.1 Risk Assessment |
| Does the third party conduct regular security risk assessments of the application? |
| Are third-party security assessments, such as penetration testing or external audits, conducted periodically? |
| When were the last third-party security assessments performed? |
| 6.2 Security Training and Awareness |
| Do employees involved in the development and operation of the application receive regular security training? |
| Are third-party developers and contractors required to undergo security awareness training? |
7. Additional Information
| Are there any known security issues, vulnerabilities, or challenges with the application? |
| Are there any additional security measures or protocols that the third party employs? |
| Do you maintain a documented information security program endorsed by executive leadership? |
| How often do you perform formal risk assessments related to your software product and delivery? |
| How often do you perform formal penetration testing to your software product? |
8. Hardware Security Practices
| 8.1 Asset Integrity & Supply Chain |
| Do you maintain a bill of materials (BOM) for all hardware components, including sub-tier suppliers? |
| Do you perform security vetting of your suppliers and subcontractors? |
| Are hardware components inspected for tampering or unauthorized modifications before shipment? |
| Do you provide a chain-of-custody record for critical hardware components? |
| 8.2 Hardware Security Features |
| Do your products support hardware-based security features (e.g., TPM, Secure Boot, UEFI protections)? |
| Are firmware and BIOS updates cryptographically signed and verified before installation? |
| Do your devices support hardware-based encryption (e.g., self-encrypting drives)? |
| 8.3 Secure Manufacturing & Physical Security |
| Are your manufacturing facilities protected by physical access controls and surveillance? |
| Do you conduct background checks on personnel with access to sensitive hardware or manufacturing processes? |
| Is tamper-evident packaging used for shipping hardware? |
| 8.4 Maintenance, Updates & End-of-Life |
| Do you provide secure firmware and hardware update mechanisms post-deployment? |
| Do you have a documented process for secure decommissioning and disposal of hardware? |
| Do you notify customers of known hardware vulnerabilities and provide mitigation guidance? |
| 8.5 Compliance & Certifications |
| Are your hardware products certified under any security standards (e.g., FIPS 140-3, Common Criteria, TAA compliance)? |
| Do you conduct third-party security audits or assessments of your hardware security practices? |
| Signature: |
| By completing this questionnaire, you acknowledge that the information provided is accurate to the best of your knowledge and will be used to assess the security posture of the third-party application. |
| Name: |
| Position: |
| Date: |
Sheet2
| Section | Question | Response Options | NIST CSF 2.0 Mapping | C2M2 Mapping | Associated Risk if Not Met |
| Asset Integrity & Supply Chain | Do you maintain a bill of materials (BOM) for all hardware components, including sub-tier suppliers? | Yes / No / Partial | ID.SC-01, ID.SC-04 | RM MIL2+ | Lack of BOM increases risk of counterfeit or malicious components entering the supply chain. |
| Asset Integrity & Supply Chain | Do you perform security vetting of your suppliers and subcontractors? | Yes / No / Partial | ID.SC-02 | RM-2a, RM-2b | Unvetted suppliers may introduce vulnerabilities or compromise product integrity. |
| Asset Integrity & Supply Chain | Are hardware components inspected for tampering or unauthorized modifications before shipment? | Yes / No / Partial | ID.SC-04 | TVM | Tampered hardware can lead to embedded malware or backdoors. |
| Asset Integrity & Supply Chain | Do you provide a chain-of-custody record for critical hardware components? | Yes / No / Partial | ID.SC-05 | RM-3a | Lack of traceability increases risk of undetected tampering during transit. |
| Hardware Security Features | Do your products support hardware-based security features (e.g., TPM, Secure Boot, UEFI protections)? | Yes / No / Partial | PR.PT-01, PR.PT-03 | CM | Absence of hardware protections weakens device integrity and trust. |
| Hardware Security Features | Are firmware and BIOS updates cryptographically signed and verified before installation? | Yes / No / Partial | PR.IP-12 | CM-2b | Unsigned updates can be exploited to install malicious firmware. |
| Hardware Security Features | Do your devices support hardware-based encryption (e.g., self-encrypting drives)? | Yes / No / Partial | PR.DS-01 | DP | Data at rest may be exposed if devices are lost or stolen. |
| Secure Manufacturing & Physical Security | Are your manufacturing facilities protected by physical access controls and surveillance? | Yes / No / Partial | PR.PH-01 to PR.PH-05 | SA | Unauthorized access to manufacturing can lead to hardware tampering. |
| Secure Manufacturing & Physical Security | Do you conduct background checks on personnel with access to sensitive hardware or manufacturing processes? | Yes / No / Partial | PR.AT-01 | WM | Insider threats may go undetected, increasing risk of sabotage. |
| Secure Manufacturing & Physical Security | Is tamper-evident packaging used for shipping hardware? | Yes / No / Partial | PR.PH-03 | RM-2a | Tampering during transit may go unnoticed, compromising device integrity. |
| Maintenance, Updates & End-of-Life | Do you provide secure firmware and hardware update mechanisms post-deployment? | Yes / No / Partial | PR.IP-12 | CM-2a | Insecure update channels can be hijacked to deliver malicious code. |
| Maintenance, Updates & End-of-Life | Do you have a documented process for secure decommissioning and disposal of hardware? | Yes / No / Partial | PR.IP-06 | DP-3a | Improper disposal may lead to data leakage or hardware reuse by adversaries. |
| Maintenance, Updates & End-of-Life | Do you notify customers of known hardware vulnerabilities and provide mitigation guidance? | Yes / No / Partial | DE.CM-08, RS.AN-01 | IR-2a | Delayed disclosure can leave customers exposed to known threats. |
| Compliance & Certifications | Are your hardware products certified under any security standards (e.g., FIPS 140-3, Common Criteria, TAA compliance)? | Yes / No / Partial | ID.GV-03 | RM | Lack of certification may indicate non-compliance with industry best practices. |
| Compliance & Certifications | Do you conduct third-party security audits or assessments of your hardware security practices? | Yes / No / Partial | ID.RA-03 | RM-3b | Absence of independent validation reduces confidence in vendor security claims. |
File details come from the government source that posted it. Updated .