Cyber Risk

Document Version: 12.4

Vendor Information Security Assessment (VISA) Questionnaire Purpose: This Vendor Information Security Assessment (VISA) Questionnaire requests information concerning a Cloud Service Provider (the Vendor), which intends to provide to the City of Long Beach (The City) any or all of the following services: Software as a Service (SaaS); Platform as a Service (PaaS); and Infrastructure as a Service (IaaS).

Note/Instructions:

• SaaS, PaaS and IaaS are each a ‘cloud’ servicing model, in which software and database applications, computer network infrastructure and/or computer hardware/software platforms is/are hosted by the Vendor and made available to customers interconnected to a network, typically to the Internet.

• This Questionnaire is for the sole use of the intended Vendor and may contain confidential information of individuals and businesses collected, stored, and used by

The City. Any unauthorized collection, storage, use, review or distribution may be prohibited by California and/or Federal laws including the California Consumer Privacy Act (CCPA). If you are not the intended recipient of this Questionnaire, please contact the sender by e-mail and destroy all copies of the Questionnaire.

• The Vendor shall provide answers to the questions or information to the requests provided below.

• In the event that the Vendor determines that it cannot meet the City’s security and or privacy requirements, the Vendor may submit a request for an exception to the City’s requirements and propose alternative countermeasures to address the risks addressed in this Questionnaire. The City’s Cyber Risk Officer (CRO) may approve or reject the exception request, depending on the risks associated with the exception request.

• Upon receipt of the Vendor’s response, the Technology & Innovation will conduct a security risk assessment, using the following scoring methodology:

A = Meets completely.

B = Partially meets. The Vendor may be required to provide additional requested information.

C = Doesn’t meet. The Vendor may be required to provide missing/additional detail.

Vendor Information:

Vendor Organization Name

Address

Information Security Contact Person Name

Email

Phone

Date this Questionnaire Completed

1.0 BUSINESS PROCESS AND DATA EXCHANGE REQUIREMENTS

# Question Response from the Vendor Score Additional

Information/Clarification Required from the Vendor

1.1 Please provide a detailed description of the

business process that will be supported by the Vendor, as it relates to the proposed requirements of the City’s RFP or other Business Requirements Document (BRD)

1.2 Has the Vendor adopted and implemented

information security and privacy policies that are documented, are accessible to the City, and conform to ISO 27001/2 – Information Security Management Systems (ISMS) Standards?

1.3 What data exchange will occur between the

City and the Vendor? What data will be stored at the Vendor’s or other third party’s data storage location? (Provide data attributes with examples)

Example: (Payment Card Information, Social Security Number, Driving License # Patrons Name, Address, telephone etc.), which are examples of personal information, the privacy of which must be protected as stated by the California constitutional and statutory law.

1.4 In the event that the Vendor is required to

store Private Information (PI), Personally Identifiable Information (PII), or Sensitive Information (SI) (collectively, the Information) about individuals in the service provider’s business systems, how does the Vendor maintain the confidentiality of the Information in accordance with applicable federal, state and local data and information privacy laws, # Question Response from the Vendor Score Additional

Information/Clarification Required from the Vendor rules and regulations including the California Consumer Privacy Act?

1.5 In the event that the Vendor is required to

collect and/or store Private Information (PI), Personally Identifiable Information (PII), or Sensitive Information (SI) about individuals in the service provider’s business systems, what is the Vendors approach for deidentification, anonymization, and/or aggregation of this data?

1.6 In the event that the Vendor is required to

collect and/or store Private Information (PI), Personally Identifiable Information (PII), or Sensitive Information (SI) about individuals in the service provider’s business systems, how does the Vendor intend to use or share data and/or individual’s Information resulting from the business system? Does the Vendor intend to share or sell data and/or individual’s Information resulting from the business system to third parties?

If Yes, why is data sharing necessary?

1.7 What mechanism and/or types of tool(s) will

be used to exchange data between The City and the Vendor? Example: (VPN, Data Link, Frame Relay, HTTP, HTTPS, FTP, FTPS, etc.)

1.8 What types of data storage (work in progress

storage and backup storage) are present or will be required at the Vendor’s site? Example:

(PCI Credit Card Info, SSN, DLN, Patrons Name, Address, telephone, medical records, etc.)

# Question Response from the Vendor Score Additional

Information/Clarification Required from the Vendor

1.9 Is e-mail integration required between The City

and the Vendor?

Example: The provision of services may require the City to provide the Vendor with an e-mail account on the City’s e–mail server.

1.10 Has the Vendor ever been subjected to either

an electronic or physical security breach?

Please describe the event(s) and the steps taken to mitigate the breach(es). What damages or exposure resulted? Are records of breaches and issues maintained and will these records be available for inspection by the City?

1.11 Does the Vendor maintain formal security

policies and procedures to comply with applicable statutory or industry practice requirements/standards? Does it include an Incident Response procedures? Are records maintained to demonstrate compliance or certification? Does the Vendor allow client audit of these records?

NOTE: PLEASE PROVIDE SUPPORTING

DOCUMENTATION.

2.0 APPLICATION/SOLUTION CONFIGURATION

# Question Response from The Vendor Score Additional

Information/Clarification Required from The Vendor

2.1 What are the Internet and the browser

security configurations for the application?

What security standards and requirements does the Vendor maintain to ensure application security at the user interface? (A

# Question Response from The Vendor Score Additional

Information/Clarification Required from The Vendor set of detailed documentation should be provided to support the compliance.)

2.2 What is the name of the application(s) that the

Vendor will host in order to provide services to the City? (List all).

What is the proposed url / web address that will be used by the city to access the application?

2.3 What functionality will be provided to the

City’s employees or the City’s customers or other recipient of City services through the application?

2.4 Will the Vendor use a subcontractor and/or a

third-party service provider? (List all). If yes, then what data privacy and information security agreements are in place between the Vendor and any subcontractor/third party to ensure appropriate and accountable treatment of information? Note the City requires each subcontractor and/or third party to complete this Questionnaire.

2.5 What is the Vendor's application(s) hosting

hardware and software platform? Provide a detailed description, including Service Packs and a patch or security applications in use.

Example: Windows or Unix Operating System (OS) and other detail.

2.6 How does the Vendor’s application and

database architecture manage or promote segregation of the City's data (related to its

# Question Response from The Vendor Score Additional

Information/Clarification Required from The Vendor function as a local government agency) from its other customers?

2.7 Describe the Vendor’s server and network

infrastructure. Please provide server and network infrastructure deployment topology, diagram, including data flow architecture including but not limited to security management applications (i.e. firewalls, etc.)

2.8 Please provide a detail proposed solution that

will be developed as a part of the Vendor’s implementation to support this project. (For example, detailed solution architecture and diagram, secured data flow to support business processes, etc.).

2.9 Does the Vendor’s proposed solution utilize

machine learning and/or artificial intelligence?

If so, please provide a high-level description of these components and demonstrate how human review is included in the design of decision-making schemas and algorithm/AI training input. Describe any identifiable data or algorithmic bias implemented/embedded/ included in the application.

Does the application have any third-party audits on the machine learning/artificial intelligence algorithms? If so, please provide a copy.

3.0 DATA PROTECTION

# Question Response from the Vendor Score Additional

Information/Clarification Required from the Vendor

3.1 What will be the medium of data exchange

between the City and Vendor?

3.2

How will the data be kept secure during the data exchange process? Example: (VPN, Data Link, Frame Relay, HTTP, HTTPS, FTP, FTPS, etc.)

3.3 How will the City’s data be kept physically and

logically secure at the Vendor’s preferred storage location? Example: Digitally, Encrypted etc.

3.4 What application level protections are in place

to prevent the Vendor’s or a subcontractor/third party’s staff member from viewing unauthorized confidential information?

For example, encryption, masking, etc.

3.5 What controls does the Vendor exercise over

the qualification and performance of its team?

Of their subcontractor/third party’s team(s)?

(For example, criminal background verification prior to employment, providing security training after employment and managing Role Based Access Control (RBAC) during employment and network and application access termination upon employment termination.

4.0 DATA BACK-UP

# Question Response Score Additional Information/Clarification

Required from the Vendor

4.1 What are the Vendor’s method(s) used to keep

data secured during the data backup process?

4.2

Is the Vendor’s encryption technology used to encrypt whole or selective data?

4.3 What types of storage media will the Vendor

use for data backup purposes?

4.4 Are the Vendor’s backup storage devices

encrypted? If ‘yes,’ please provide encryption specification, with type of encryption algorithm and detail process of encryption handling. If ‘no,’ provide a detailed description (with process, tools and technology) to keep data secured during the back-up process.

5.0 DATA RETENTION

# Question Response from the Vendor Score Additional Information/Clarification

Required from the Vendor

5.1 What is the Vendor’s retention period of the

backed-up data? The data retention process shall comply with the City’s data retention policy.

5.2 Are the data back-up storage media at the

Vendor’s location or other third party location?

# Question Response from the Vendor Score Additional Information/Clarification

Required from the Vendor

5.3 If the Vendor’s backup storage devices are

stored with another company, please provide:

• Company Name:

• Address:

• Contact person detail (Phone & Email):

• What contractual commitments are in place to guarantee security performance from these vendors

5.4 What is the media transfer process (in the

event the contract expires)?

5.5 Who on the Vendor’s staff or

subcontractor/third party’s staff is/are authorized to access backup data? (Provide Name and Role)

6.0 ACCOUNT PROVISIONING AND DE-PROVISIONING (The Vendor must receive formal pre-authorization from the City’s Business Information Systems Bureau Manager and

Cyber Risk Officer prior to provisioning and de-provisioning of application access account).

# Question Response from the Vendor Score

Additional Information/Clarification

Required from the Vendor

6.1 What is the account provisioning/addition

process? (Example: how are users accounts created and managed?)

6.2

What is the account deprovisioning/ removal process? Example: how are users accounts created and managed?)

6.3 How will the City’s employees gain access

to required application(s)?

7.0 PASSWORD MANAGEMENT

# Question Response from the Vendor Score

Additional Information/Clarification

Required from the Vendor

7.1 What will be the policy and/or procedures for

the logging, authentication, authorization and password management scheme? (Please provide a soft copy or diagram of the process, if available)

7.2 Where will the login and password credentials

be stored?

7.3 Are the password credentials stored with

encryption? If ‘yes,’ please provide encryption scheme detail.

7.4 The Vendor’s application must comply with the

following password requirements. Does the Vendor’s application meet these requirements?

First time password must be unique to an individual and require the user to change it upon initial login.

• If the password is sent via plain text e-mail to the City employee to mitigate security exposure.

• The City requires first time password to have a time-out capability of no more than 7 days.

• The e-mail notification must not be copied to anyone except the user.

• Password Expiration- for long term password changed frequently (at least every 90 days)

• E-mail notification must be sent to the user whenever the password has been updated.

# Question Response from the Vendor Score

Additional Information/Clarification

Required from the Vendor

• Password length of at least 12 characters

• Password Complexity - it must contain alphanumeric characters and at least one special character.

8.0 CLOUD SERVICES

# Question Response from the Vendor Score

Additional Information/Clarification

Required from the Vendor

8.1 Are the vendor services housed at their own (a)

data center, (b) the cloud, or (c) deployed-on premise only? How does the vendor ensure any services hosted externally maintain regulatory and best practice security controls?

8.2 Which cloud providers does the vendor use?

9.0 CYBERSECURITY INSURANCE

# Question Response from the Vendor Score

Additional Information/Clarification

Required from the Vendor

9.1 Does the vendor have cybersecurity insurance?

If so, please indicate if it protects against security incidents, such as, but not limited to breach response, business interruption security breaches, ransomware, cyber extortion loss, malware, data recovery, regulatory defense & penalties, , data theft and inadvertent loss personal information. Please provide copy of Certificate of Insurance and description of services covered by the insurance.

Note: If approved, please be prepared to provide a copy of your current Certificate of Insurance for Cyber Security with the ‘City of Long Beach’ listed as an additional insured.

--------------------------------------------------- End of Document --------------------------------------------------