Attachment F - PPS Security Questionnaire.docx

Portland Public Schools School District 1J Multnomah County, Oregon Request for Proposal RFP No. 2026-037

ATTACHMENT F.

SOLUTION PROVIDER SECURITY ASSESSMENT QUESTIONNAIRE

Vendor: ______________________________

Instructions:

(1) Attach additional pages or documents as appropriate and make sure answers cross reference to the questions below.

(2) As used in this Questionnaire, the phrase “Government Information” shall be defined as any fact or concept, regardless of its physical form or characteristics, that is owned by, produced by or for, or otherwise controlled by Portland Public Schools (PPS), including such facts or concepts that are provided by PPS to any person, including persons who are not employees of PPS.

ATTACHMENT F

SOLUTION PROVIDER SECURITY ASSESSMENT QUESTIONNAIRE

Questions:

1. Describe safeguards the Vendor has in place to prevent unauthorized use, reuse, distribution, transmission, manipulation, copying, modification, access or disclosure of Government Information.

2. Describe Vendor’s policies and procedures that ensure access to Government Information is limited to only those employees/subcontractors who require access to perform Vendor’s proposed services.

3. Describe Vendor’s disaster recovery and business continuity plans, and the processes in place to maintain, test and update these plans.

4. What safeguards and practices are employed by the Vendor to vet employees who have access to Government Information?

5. Describe and explain Vendor’s security policies and procedures related to the vetting and use of subcontractors.

6. Identify all subcontractors or other third parties which will host or have access to Government Information.

7. What safeguards does the Vendor have in place to segregate Government Information from Vendor data and from other customers' data, to prevent accidental or unauthorized access to Government Information?

8. Describe how the Vendor’s software quality assurance practices ensure that software used to process Government Information is free of common vulnerabilities and describe how penetration testing is used as an assurance practice.

9. Describe the policies, procedures, and other controls in place to provide for the physical security of Vendor’s data centers and other sites where Government Information will be processed, archived, accessed or maintained.

10.Describe how Government Information will be encrypted at rest and during transmission. Describe how data backups of Government Information will be encrypted.

11.Describe how the proposed solution will enable single sign-on services and integration with multi-factor authentication. Describe how an adaptive approach to multi-factor authentication can be implemented with the proposed service.

12.Describe how the permissions for authenticated users can be provisioned and managed, including capabilities for implementing role-based access control. Describe how integration with identity governance and administration systems can be supported. Describe capabilities for adaptive access control, within and/or integrated with the service.

13.Describe capabilities for managing privileged access, and for logging, auditing, reporting, and alerting on activities of administrators and other privileged users.

14.How are entities required to authenticate when integrating with the service through API’s that can provide access to Government Information?

15.What controls are in place to detect security anomalies and potential indicators of compromise or misuse? Describe how system transactions and network activity are logged, and how user actions can be audited and analyzed. How long are user activity logs and security event logs retained?

16.Describe capabilities provided to manage detection and response security service with 24/7 thread monitoring, ERP web page access auditing / logging, SAML, MFA, and allowed source IP access range control.

18.Describe data security capabilities including data in transit, at rest, compliance (e.g., FERPA, COPPA, PCI, HIPPA, etc.), and APIs security, etc.

19.What controls are in place for vendor staff access management (e.g., vendor staff, 3rd parties and external)? Describe how the system will use the principle of least privilege (PoLP) and segregation of duties (SoD).

20.Describe the Vendor’s capabilities for addressing the scenario of the multiple users of Webclock accessing the ERP from the same PPS workstation to punch in / out.

21.What controls are in place to enable the proposed service to withstand a Denial-of Service attack?

22.Describe the Vendor’s Security Operations Center and the personnel, procedures and tools used to perform continuous security monitoring. Describe how the hosts and networks that process, store, and transmit Government Information will be monitored to detect security incidents and ensure timely resolution.

23.Describe the Vendor’s incident response policies and practices.

24.What procedures and safeguards does the Vendor have in place for sanitizing and disposing of Government Information according to prescribed retention schedules, and following contract termination, to render it unrecoverable and prevent accidental or unauthorized access to Government Information?

25.Does the Vendor have an Information Security Plan in place, supported by security policies and procedures, to ensure the protection of information and information resources, including Government Information? Describe the outline of the Plan, and how often it is updated. Describe the Vendor’s processes for performing on-going information security risk assessments.

26. What standards are used to address Information Security compliance issues?

SIGNATURE OF PERSON AUTHORIZED TO REPRESENT THE ACCURACY OF THIS INFORMATION ON BEHALF OF VENDOR:

By:

(authorized signature)

(printed name of person signing above)

(title of person signing above)

Date:

image1.png