Attachment_G_-_Vendor_Questionnaire_for_Hosted_Vendor_Solutions_2.pdf
PDF 581 KB Posted
- Attached to
- Emergency Communications Satellite Phones
- Solicitation number
- PR8471
- Issued by
- Florida
About this file
This document is a Security Questionnaire for Hosted Vendor Solutions developed by the Orlando Utilities Commission (OUC) IT Security department on December 19, 2012. The comprehensive questionnaire is designed to evaluate potential vendors providing hosted technology solutions, covering multiple aspects of data security, storage, transmission, access, and management. The document consists of 51 detailed questions across several key sections including solution type and description, data storage and encryption, data transmission and access methods, standards and regulatory compliance, host facility protections, host physical and logical access controls, host process controls, timeliness and service availability, liability and security incident management, and service termination and data disposal.
The questionnaire aims to thoroughly assess vendor capabilities and security practices by requiring detailed responses about data handling, encryption protocols, physical and digital access controls, compliance certifications, backup and recovery processes, incident response procedures, and data disposal methods. Critical areas of inquiry include the location and processing of OUC data, encryption standards, access permissions, network protections, patch management, disaster recovery plans, support levels, and strategies for managing potential security breaches or service interruptions. The document also includes a contract checklist highlighting key contractual considerations such as data ownership, liability for unauthorized access, service level agreements, support agreements, exit strategies, and data and hardware disposal methods.
View the file
Other files
Show all 16
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Orlando Utilities Commission 5 12/19/2012
Attachment G
Security Questionnaire for Hosted Vendor Solutions OUC IT Security
12/19/2012
Vendor questions
A hosted solution can involve multiple vendors. Below, the term vendor(s) applies to all vendors involved in the solution, although applicability of a particular item may depend on the component the vendor is providing.
The vendor must answer the following questions.
Solution type & description
Q1 Describe the solution type — for example, is it a web-based externally hosted cloud solution, software as a service (SaaS), platform as a service (PaaS), or infrastructure as a service (IaaS)?
type answer here
Data storage & encryption
Q2 Where is OUC’s data stored and processed? On OUC’s network, in your environment, or in a third-party environment?
type answer here
Q3 At what physical vendor location(s) (cities) is OUC information stored and processed?
type answer here
Q4 Can OUC limit the physical vendor locations where OUC information is stored and processed?
type answer here
Q5 If stored in your environment, is OUC data stored in an encrypted state?
type answer here
Orlando Utilities Commission 6 12/19/2012
Data transmission & access methods
Q6 List all the methods that will be used to transmit OUC data and for OUC to access it.
(for example, HTTP, HTTPS, FTP, sFTP, physical media, VPN, web services or other) type answer here
Q7 What protocols do you use to access the OUC environment?
(for example, HTTP, HTTPS, FTP, sFTP, physical media, VPN, web services, or other) type answer here
Q8 Is there a client application that OUC would use to access its data?
(for example, an Internet browser) type answer here
Q9 If an Internet browser, what browsers and versions are supported?
type answer here
Q10 If an Internet browser, are there any required configuration settings?
type answer here
Q11 Can services, ports, and incoming IP addresses on and into your environment (needed for OUC access) be limited by OUC?
type answer here
Q12 Can services, ports, and incoming IP addresses on and into the OUC environment (needed for your access) be determined by OUC?
type answer here
Q13 Is OUC data encrypted during transmission from OUC to your environment?
type answer here
Q14 Is OUC data encrypted during transmission from your environment to OUC?
Orlando Utilities Commission 7 12/19/2012
Standards & regulatory compliance
Q15 What password standard does your solution support?
type answer here
Q16 Does the solution’s hardware/software (if installed on OUC’s network) comply with OUC’s hardware and software standards?
type answer here
Q17 Do you maintain an FTC FACTA Identity Theft Deterrence (Red Flags) program?
type answer here
Q18 Are you a PCI, SSAE 16, ISO 27001, or CJIS Certified Service Provider?
type answer here
Host facility protections
Q19 Does your environment include a firewall at both the network border and on host servers?
type answer here
Q20 Is an Intrusion Detection System/Intrusion Protection System installed and monitored on your environment?
type answer here
Q21 Does your solution offer a network penetration testing service?
type answer here
Q22 Will you allow OUC or an OUC-contracted service to perform network penetration testing?
type answer here
Q23 Is anti-malware and whitelisting implemented in your environment?
type answer here
Q24 How soon after a critical patch is released (for example, a Microsoft operating system patch) is the patch installed in your environment?
Orlando Utilities Commission 8 12/19/2012
Host physical & logical access controls
Q25 How many people (and their roles) will have physical access to the data center where OUC data is stored or processed?
type answer here
Q26 How many people (and their roles) will have network or database access to OUC data?
type answer here
Q27 Describe the granularity of your personnel’s administrative and user permissions to OUC data. Be specific.
type answer here
Q28 Describe the granularity of administrative and user permissions available to OUC personnel.
Be specific.
type answer here
Q29 Have background checks (meeting OUC’s requirements) been completed on your personnel who will have physical and logical access to OUC data?
type answer here
Q30 How will changes to access control be communicated to OUC?
type answer here
Q31 Will OUC data be shared with any party other than OUC?
type answer here
Q32 Will hosted OUC data be on its own physical server or will it be located on a virtual/shared system?
type answer here
Q33 If on a virtual/shared system, describe how OUC data is segregated from the data of other tenants (users).
Orlando Utilities Commission 9 12/19/2012
Q34 If on a virtual/shared system, what safeguards are in place to ensure that other tenants (users) will not have access to OUC data?
type answer here
Host process controls
Q35 Is there application/service/network health reporting available to OUC?
type answer here
Q36 Is there logging and auditing available to OUC for troubleshooting and auditing purposes?
type answer here
Q37 Do you have a change/configuration management process?
type answer here
Q38 What is your process for notifying OUC of change/configuration changes?
type answer here
Timeliness, service availability & support
Q39 Is the hosted service or application able to self-recover from a service interruption or outage?
type answer here
Q40 What protective measures are in place to protect against a service interruption?
(for example, high-availability technology, redundancy, UPS, generators) type answer here
Q41 What is your process (including timeliness) for notifying OUC of a service interruption or outage?
type answer here
Q42 What levels of services (SLAs) do you offer?
type answer here
Q43 What levels of support do you offer?
Orlando Utilities Commission 10 12/19/2012
Q44 What is the disaster recovery/business continuity plan for your environment? Will you provide a copy of the plan to OUC for review?
type answer here
Q45 How is OUC data backed up and is there an SLA for restoration?
type answer here
Liability & security incident management
Q46 What is your process (including timeliness) for notifying OUC of a potential or actual OUC data breach, loss, or misuse (intentionally or unintentionally by a vendor employee, vendor partner, or outside party or due to hardware failure or corruption)?
type answer here
Q47 Will you provide OUC with a copy of your security incident response plan for review?
type answer here
Service termination & data disposal
Q48 Do you provide an escrow guarantee for OUC’s data?
type answer here
Q49 In the event of service termination (for example, by vendor or OUC contract cancellation, end of vendor support, or sale or demise of vendor’s solution), how will OUC’s data (including history) be returned to OUC and in what format?
type answer here
Q50 What is the process for OUC data disposal, including disposal of backups?
type answer here
Q51 How do you dispose of equipment that contained OUC data?
Orlando Utilities Commission 12 12/19/2012
Contract checklist
Data ownership
Responsibility and liability for unauthorized access, use, disclosure, modification, or destruction of OUC data, including incident response actions, timeliness of notification to OUC, penalties, and fees
Service level agreements (SLAs)
Support agreement
Exit strategy
Data & hardware disposal methods
File details come from the government source that posted it. Updated .