Attachment D - VISA Questionnaire.docx

City of Palo Alto

Information Technology

Information Security Services

Cyber Risk Document Version: 12.4

Vendor Information Security Assessment (VISA) Questionnaire Purpose: This Vendor Information Security Assessment (VISA) Questionnaire requests information concerning a Cloud Service Provider (the Vendor), which intends to provide to the City of Long Beach (The City) any or all of the following services: Software as a Service (SaaS); Platform as a Service (PaaS); and Infrastructure as a Service (IaaS).

Note/Instructions:

· SaaS, PaaS and IaaS are each a ‘cloud’ servicing model, in which software and database applications, computer network infrastructure and/or computer hardware/software platforms is/are hosted by the Vendor and made available to customers interconnected to a network, typically to the Internet.

· This Questionnaire is for the sole use of the intended Vendor and may contain confidential information of individuals and businesses collected, stored, and used by The City. Any unauthorized collection, storage, use, review or distribution may be prohibited by California and/or Federal laws including the California Consumer Privacy Act (CCPA). If you are not the intended recipient of this Questionnaire, please contact the sender by e-mail and destroy all copies of the Questionnaire.

· The Vendor shall provide answers to the questions or information to the requests provided below.

· In the event that the Vendor determines that it cannot meet the City’s security and or privacy requirements, the Vendor may submit a request for an exception to the City’s requirements and propose alternative countermeasures to address the risks addressed in this Questionnaire. The City’s Cyber Risk Officer (CRO) may approve or reject the exception request, depending on the risks associated with the exception request.

· Upon receipt of the Vendor’s response, the Technology & Innovation will conduct a security risk assessment, using the following scoring methodology:

A = Meets completely.

B = Partially meets. The Vendor may be required to provide additional requested information.

C = Doesn’t meet. The Vendor may be required to provide missing/additional detail.

Vendor Information:

Vendor Organization Name

Address

Information Security Contact Person Name

Email

Phone

Date this Questionnaire Completed

1.0 BUSINESS PROCESS AND DATA EXCHANGE REQUIREMENTS

Information/Clarification Required from the Vendor

Example: (Payment Card Information, Social Security Number, Driving License # Patrons Name, Address, telephone etc.), which are examples of personal information, the privacy of which must be protected as stated by the California constitutional and statutory law.

If Yes, why is data sharing necessary?

Address, telephone, medical records, etc.)

Example: The provision of services may require the City to provide the Vendor with an e-mail account on the City’s e–mail server.

the Vendor allow client audit of these records? NOTE: PLEASE PROVIDE SUPPORTING DOCUMENTATION.

2.0 APPLICATION/SOLUTION CONFIGURATION

Information/Clarification Required from The Vendor

What is the proposed url / web address that will be used by the city to access the application?

Example: Windows or Unix Operating System (OS) and other detail.

If so, please provide a high-level description of these components and demonstrate how human review is included in the design of decision-making schemas and algorithm/AI training input. Describe any identifiable data or algorithmic bias implemented/embedded/ included in the application.

Does the application have any third-party audits on the machine learning/artificial intelligence algorithms? If so, please provide a copy.

3.0 DATA PROTECTION

Required from the Vendor

3.2

How will the data be kept secure during the data exchange process? Example: (VPN, Data Link, Frame Relay, HTTP, HTTPS, FTP, FTPS, etc.)

providing security training after employment and managing Role Based Access Control (RBAC) during employment and network and application access termination upon employment termination.

4.0 DATA BACK-UP

Required from the Vendor

4.2

Is the Vendor’s encryption technology used to encrypt whole or selective data?

5.0 DATA RETENTION

· Company Name:

· Address:

· Contact person detail (Phone & Email):

· What contractual commitments are in place to guarantee security performance from these vendors

Information/Clarification Required from the Vendor

6.2

What is the account deprovisioning/ removal process? Example: how are users accounts created and managed?)

7.0 PASSWORD MANAGEMENT

Information/Clarification Required from the Vendor

First time password must be unique to an individual and require the user to change it upon initial login.

· If the password is sent via plain text e-mail to the City employee to mitigate security exposure.

· The City requires first time password to have a time-out capability of no more than 7 days.

· The e-mail notification must not be copied to anyone except the user.

· Password Expiration- for long term password changed frequently (at least every 90 days)

· E-mail notification must be sent to the user whenever the password has been updated.

· Password length of at least 12 characters

· Password Complexity - it must contain alphanumeric characters and at least one special character.

8.0 CLOUD SERVICES

Information/Clarification Required from the Vendor

9.0 CYBERSECURITY INSURANCE

Information/Clarification Required from the Vendor

Note: If approved, please be prepared to provide a copy of your current Certificate of Insurance for Cyber Security with the ‘City of Long Beach’ listed as an additional insured.

--------------------------------------------------- End of Document --------------------------------------------------

Information Privacy Policy Page 4 of 8 Version 2.2 31 January, 2013 image1.png image2.png image3.jpeg