Attachment F Security Questionnaire.docx

Attachment F 6.208b Security Assessment Questionnaire for External Vendors Processing, Storing or Transmitting FHFA CUI

Insert Vendor Name Instructions:

If policies, procedures, reports or other documents address any of the following questions, please provide the documents as attachments and reference the document name in your written response.

Section 1: Organizational Controls

1.1 Describe how FHFA information will be used throughout the engagement. Will FHFA information be shared with any external parties? If so, what information and for what purpose?

1.2 Describe any recurring information security audits or independent assessments conducted on your organization or information systems controlled by your organization that may process, store or transmit FHFA information.

1.3 Describe how IT and IT Security services are managed within your organization (i.e. are there dedicated organizational staff, contractors, specialized contracted services, etc.?).

1.4 Is background screening performed for all organization employees? Describe the screening process.

1.5 Describe the security awareness and/or privacy training requirements for organization users.

1.6 Is there a security incident response plan or procedure? If yes, please provide it as an attachment.

1.7 Is there a formally documented privacy policy that describe how Personally Identifiable Information (PII) is handled internally? If yes, please provide the policy as an attachment.

1.8 Provide an overview of the organization’s IT network, to include datacenter location(s) / hosting providers, operating systems, end-user computing devices (i.e. laptops, tablets, mobile devices).

1.9 Describe how end-user computing devices (i.e. laptops, tablets, mobile devices) are protected, to include: operating system version and hardening, hardware encryption, port protection, VPN technology (addressing split-tunneling), authentication and malware protection.

1.10 Describe network boundary protection mechanisms (e.g. Firewall, Intrusion Detection System (IDS), etc.).

1.11 Describe vulnerability scanning technology in use, and the frequency and scope of scans.

Section 2: Control Scoping

2.1 Describe the system(s) and operating environment(s) in which FHFA information may be processed, stored or transmitted throughout the engagement (i.e. file servers, email system, document management system, databases, laptops, etc.).

2.2 Can FHFA information be accessed from a personal device? If yes, please explain how.

Please answer questions 2.3 – 2.8 uniquely for each system or operating environment listed in question 2.1. This includes external cloud-based systems (e.g., cloud-based email, file storage, document management solution, etc.).

2.3 Describe who from your organization will access FHFA information, what level of access they will have, who approves access and how FHFA information will be protected from users without a business need to access the data.

2.4 Describe access controls associated with the system(s) to include: authentication requirements, password expiration, account lockout policies, session timeout policies, etc.

2.5 Is FHFA information in the system(s) backed up, and if so, how and where?

2.6 Describe the encryption technologies used to protect data in transit and data at rest.

2.7 Describe how access to FHFA Information is audited and reviewed, and if any data loss prevention solutions would prevent or detect the unauthorized transfer of FHFA information to a non-organizational system.

2.8 Describe the procedures for sanitizing FHFA information when no longer needed.