Attachment H 21-0011-TDP.xlsx
XLSX spreadsheet 2 MB Posted
- Solicitation number
- LB-21-2778
- Issued by
- Wisconsin
About this file
This file is a Higher Education Community Vendor Assessment Toolkit (HECVAT) - Full assessment document designed for vendor evaluation by the University of Wisconsin System in connection with a Request for Proposal (RFP) for a Survey Tool to be deployed across UW System campuses and UW Madison. The toolkit serves as a comprehensive security and compliance questionnaire that vendors must complete to demonstrate their product's ability to protect institutional data, personally identifiable information (PII), and sensitive information across multiple security and regulatory frameworks. The assessment is structured in multiple sections including general information, qualifiers, documentation, company overview, third-party management, application security, authentication and authorization, business continuity, disaster recovery, data protection, mobile applications, physical security, policies and procedures, and compliance areas including HIPAA, PCI DSS, and others. The vendor is required to populate sections GNRL-01 through GNRL-10 with product specifics and contact information, complete the Qualifiers section to determine which additional sections are mandatory, and provide detailed responses addressing security safeguards, architecture, encryption protocols, access controls, and incident response capabilities. The assessment includes a Standards Crosswalk tab that maps HECVAT questions to multiple security frameworks including CIS Critical Security Controls v6.1, HIPAA, ISO 27002:2013, NIST Cybersecurity Framework, NIST SP 800-171r1, NIST SP 800-53r4, and PCI DSS.
The toolkit includes an Analyst Report function allowing institutional security analysts to evaluate vendor responses against selected security standards and generate compliance metrics through a Summary Report. Institution security analysts are responsible for reviewing raw vendor answers, selecting the appropriate security framework for their institution in the analysis phase, converting qualitative responses into quantitative values, and determining compliance status for subjective questions. The document emphasizes that UW must evaluate software qualitatively rather than strictly on price alone to ensure that the widely varying needs across multiple campuses are covered by at least one awarded vendor. Vendors may be required to clarify responses with institutional security staff, and completed assessments can be incorporated into institutional reporting documents. The toolkit is licensed under Creative Commons Attribution-Noncommercial-ShareAlike 4.0 International License and was developed collaboratively by EDUCAUSE, Internet2, and the Research and Education Networking Information Sharing and Analysis Center (REN-ISAC).
View the file
Other files
| File | Type | Posted |
|---|---|---|
| _DLE Interoperability Addendum-v7 (2).pdf | ||
| RFP Template Draft 6-24 Final.pdf | ||
| RFP Template Draft 6-24 Finallb.docx | DOCX document | |
| Questions and Answers for RFP LB 21-2778.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Introduction
Proceed to the next tab, Instructions.
Shared Assessments Introduction
Campus IT environments are rapidly changing and the speed of cloud service adoption is increasing. Institutions looking for ways to do more with less see cloud services as a good way to save resources. As campuses deploy or identify cloud services, they must ensure the cloud services are appropriately assessed for managing the risks to the confidentiality, integrity and availability of sensitive institutional information and the PII of constituents. Many campuses have established a cloud security assessment methodology and resources to review cloud services for privacy and security controls. Other campuses don’t have sufficient resources to assess their cloud services in this manner. On the vendor side, many cloud services providers spend significant time responding to the individualized security assessment requests made by campus customers, often answering similar questions repeatedly. Both the provider and consumer of cloud services are wasting precious time creating, responding, and reviewing such assessments.
The Higher Education Community Vendor Assessment Toolkit (HECVAT) attempts to generalize higher education information security and data protections and issues for consistency and ease of use. Some institutions may have specific issues that must be addressed in addition to the general questions sets provided in the toolkit. It is anticipated that the HECVAT will be revised over time to account for changes in services provisioning and the information security and data protection needs of higher education institutions.
The Higher Education Community Vendor Assessment Toolkit:
● Helps higher education institutions ensure that vendor services are appropriately assessed for security and privacy needs, including some that are unique to higher education
● Allows a consistent, easily-adopted methodology for campuses wishing to reduce costs through vendor services without increasing risks
● Reduces the burden that service providers face in responding to requests for security assessments from higher education institutions
The Higher Education Community Vendor Assessment Toolkit is a suite of tools built around the original HECVAT (known now as HECVAT - Full) to allow institutions to adopt, implement, and maintain a consistent risk/security assessment program. Tools include:
● HECVAT - Triage: Used to initiate risk/security assessment requests - review to determine assessment requirements
● HECVAT - Full: Robust questionnaire used to assess the most critical data sharing engagements
● HECVAT - Lite: A lightweight questionnaire used to expedite process
● HECVAT - On-Premise: Unique questionnaire used to evaluate on-premise appliances and software
The HECVAT (and Toolkit) was created by the Higher Education Information Security Council Shared Assessments Working Group. Its purpose is to provide a starting point for the assessment of vendor provided services and resources. Over time, the Shared Assessments Working Group hopes to create a framework that will establish a community resource where institutions and cloud services providers will share completed Higher Education Cloud Vendor Assessment Tool assessments.
https://www.educause.edu/hecvat https://www.ren-isac.net/hecvat
(C) EDUCAUSE 2019
This work is licensed under a Creative Commons Attribution-Noncommercial-ShareAlike 4.0 International License (CC BY-NC-SA 4.0).
This Higher Education Cloud Vendor Assessment Toolkit is brought to you by the Higher Education Information Security Council, and members from EDUCAUSE, Internet2, and the Research and Education Networking Information Sharing and Analysis Center (REN-ISAC).
Instructions Higher Education Community Vendor Assessment Tool - Full - Instructions
| Target Audience |
| These instructions are for vendors interested in providing the institution with a software and/or a service. |
This worksheet should not be completed by an institution entity. The purpose of this worksheet is for the vendor to submit robust security safeguard information in regards to the product (software/service) being assessed in the institution's assessment process.
| Document Layout |
| There are five main sections of the Higher Education Community Vendor Assessment Tool - Full, all listed below and outlined in more detail. This document is designed to have the first two sections populated first; after the Qualifiers section is completed it can be populated in any order. Within each section, answer each question top-to-bottom. Some questions are nested and may be blocked out via formatting based on previous answers. Populating this document in the correct order improves efficiency. |
Do not overwrite selection values (data validation) in column C of the HECVAT - Full tab.
| General Information | This section is self-explanatory; product specifics and contact information. GNRL-01 through GNRL-10 should be populated by the Vendor. GNRL-11 and GNRL-12 are for institution use only. |
| Qualifiers | Populate this section completely before continuing. Answers in this section can determine which sections will be required for this assessment. By answering "No" to Qualifiers, their matched sections become optional and are highlighted in orange. |
| Documentation | Focused on external documentation, the institution is interested in the frameworks that guide your security strategy and what has been done to certify these implementations. |
| Company Overview | This section is focused on company background, size, and business area experience. |
| Safeguards | The remainder of the document consists of various safeguards, grouped generally by section. |
| In sections where vendor input is required there are only one or two columns that need modification, Vendor Answers and Additional Information, columns C and D respectively (see Figure 1 below). You will see that sometimes C and D are separate and other times are merged. If they are separate, C will be a selectable, drop-down box and any supporting information should be added to column D. If C and D are merged, the question is looking for the answer to be in narrative form. At the far right is a column titled “Guidance”. After answering questions, check this column to ensure you have submitted information/documentation to sufficiently answer the question. Use the “Additional Information” column to provide any requested details. | |
| Figure 1: | |
| Optional Safeguards Based on Qualifiers | |
| Not all questions are relevant to all vendors. Qualifiers are used to make whole sections optional to vendors depending on the scope of product usage and the data involved in the engagement being assessed. Sections that become optional have the section titles and questions highlighted in orange (see Figure 2). | |
| Figure 2: | |
| Definitions and Data Zones | |
| Institution | Any school, college, or university using the Higher Education Community Vendor Assessment Tool - Full. |
| Institution Data Zone | The country/region in which an institution is located, including all laws and regulations in-scope within that country/region. |
| Vendor Data Zone | The country/region in which a vendor is headquartered and/or serves its products/services, including all laws and regulations in-scope within that country/region. |
| Customers from different regions may expect vary protections of data (e.g. GDPR), this is the institution Data Zone. Vendors may handle data differently depending on the country or region where data is stored, this is the Vendor Data Zone. |
As a vendor, if your security practices vary based on your region of operation, you may want to populate a HECVAT in the context for each security zone (strategy). That said, institutions from different data zones may still use vendor responses from other state Data Zones. If your security practices are the same across all regions of operations, indicate "All" in your Vendor Data Zone.
Example A: If vendor ABC is headquartered and stores data in Canada, and provides services to only customers in Canada, ABC should state "Canada" in both Data Zone fields.
Example B: If vendor ABC is headquartered and stores data in Canada, and additionally provides services to customers in the United Kingdom, ABC may want to assure customers in the United Kingdom that their data is handled properly for their region. In that case, ABC should state "Canada" in the Vendor Data Zone and "United Kingdom" in the institution Data Zone.
Example C: If your security strategy is broad and doesn't fit this statement model, provide a brief summary in each field and the institution's Security Analyst can assess your response.
| Data Reporting |
| To update data in the Report tabs, click Refresh All in the Menu tab. Input provided in the HECVAT tab is assessed a preliminary score pending institution's Security Analyst review. |
| Proceed to the next tab, HECVAT - Full. |
| For Institution's Security Analysts |
| 1. Raw vendor answers can be viewed on the HECVAT - Full tab. |
2. To begin your assessment, review the Analyst Report tab, ensuring that you select the appropriate security standard used in your institution (cell B7) before you begin.
3. Review the Analyst Reference tab for guidance and question/response interpretation.
4. Select compliance states for the outstanding non-compliant or short-answer questions in column G. Once all subjective questions are evaluated and compliance indicated, move to the Summary Report tab.
5. To update the report's data, select Refresh All in the Data menu. Review details in the Summary Report and based on your assessment, follow-up with vendor for clarification(s) or add the Summary Report output to your Institution's reporting documents.
HECVAT - Full
| Higher Education Community Vendor Assessment Tool (HECVAT) - Full | Version 2.11 | |||
| HEISC Shared Assessments Working Group | ||||
| DATE-01 | Date | mm/dd/yyyy | ||
| General Information | ||||
| In order to protect the Institution and its systems, vendors whose products and/or services will access and/or host institutional data must complete the Higher Education Community Vendor Assessment Toolkit (HECVAT). Throughout this tool, anywhere where the term data is used, this is an all-encompassing term including at least data and metadata. Answers will be reviewed by Institution security analysts upon submittal. This process will assist the institution in preventing breaches of protected information and comply with Institution policy, state, and federal law. This is intended for use by vendors participating in a Third Party Security Assessment and should be completed by a vendor. Review the Instructions tab for further guidance. | ||||
| GNRL-01 through GNRL-08; populated by the Vendor | ||||
| GNRL-01 | Vendor Name | Vendor Name | ||
| GNRL-02 | Product Name | Product Name and Version Information | ||
| GNRL-03 | Product Description | Brief Description of the Product | ||
| GNRL-04 | Web Link to Product Privacy Notice | http://www.vendor.domain/privacynotice | ||
| GNRL-05 | Vendor Contact Name | Vendor Contact Name | ||
| GNRL-06 | Vendor Contact Title | Vendor Contact Title | ||
| GNRL-07 | Vendor Contact Email | Vendor Contact E-mail Address | ||
| GNRL-08 | Vendor Contact Phone Number | 555-555-5555 | ||
| GNRL-09 | Vendor Data Zone | See Instructions tab for guidance | ||
| GNRL-10 | Institution Data Zone | See Instructions tab for guidance | ||
| GNRL-11 and GNRL-12; populated by the Institution's Security Office | ||||
| GNRL-11 | Institution's Security Analyst/Engineer | Institution's Security Analyst/Engineer Name | ||
| GNRL-12 | Assessment Contact | ticket#@yourdomain.edu | ||
| Instructions | ||||
| Step 1: Complete the Qualifiers section first. Step 2: Complete each section answering each set of questions in order from top to bottom; the built-in formatting logic relies on this order. Step 3: Submit the completed Higher Education Community Vendor Assessment Toolkit (HECVAT) to the Institution according to institutional procedures. | ||||
| Qualifiers | Vendor Answers | Additional Information | Guidance | |
| The institution conducts Third Party Security Assessments on a variety of third parties. As such, not all assessment questions are relevant to each party. To alleviate complexity, a "qualifier" strategy is implemented and allows for various parties to utilize this common documentation instrument. Responses to the following questions will determine the need to answer additional questions below. | ||||
| QUAL-01 | Does your product process protected health information (PHI) or any data covered by the Health Insurance Portability and Accountability Act? | |||
| QUAL-02 | Does the vended product host/support a mobile application? (e.g. app) | |||
| QUAL-03 | Will institution data be shared with or hosted by any third parties? (e.g. any entity not wholly-owned by your company is considered a third-party) |
Charles Escue: The Institution views hosted solutions such as AWS, Rackspace, Azure, and other PaaS/SaaS offerings as third parties. If services such as these are used in your environment, respond "Yes".
| QUAL-04 | Do you have a Business Continuity Plan (BCP)? | |||
| QUAL-05 | Do you have a Disaster Recovery Plan (DRP)? | |||
| QUAL-06 | Will data regulated by PCI DSS reside in the vended product? | |||
| QUAL-07 | Is your company a consulting firm providing only consultation to the Institution? | |||
| Documentation | Vendor Answers | Additional Information | Guidance | |
| DOCU-01 | Have you undergone a SSAE 18 audit? |
: In 2011, Statement on Standards for Attestation Engagements (SSAE) No. 16 took effect and replaced SAS 70 as the authoritative guidance for performing a service auditor's examination. SSAE 16 established a new attestation standard (AT 801) to contain the professional guidance.
You can learn more about SSAE 16 at www.ssae16.com.
DOCU-02 Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ?
: CSA STAR Self Assessment is free and open to all cloud providers and allows them to submit self assessment reports that document compliance to CSA-published best practices.
Website: https://cloudsecurityalliance.org/star/self-assessment/ DOCU-03 Have you received the Cloud Security Alliance STAR certification?
: The CSA STAR Certification is a rigorous third party independent assessment of the security of a cloud service provider. The technology-neutral certification leverages the requirements of the ISO/IEC 27001 management system standard together with the CSA Cloud Controls Matrix, a specified set of criteria that measures the capability levels of the cloud service.
Website: https://cloudsecurityalliance.org/star/certification/
| DOCU-04 | Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.) |
| DOCU-05 | Are you compliant with FISMA standards? |
: The Federal Information Security Management Act (FISMA) is United States legislation that defines a comprehensive framework to protect government information, operations and assets against natural or man-made threats.
Website: http://www.dhs.gov/FISMA slight wording change -Josh Callahan Charles Escue: The Institution views hosted solutions such as AWS, Rackspace, Azure, and other PaaS/SaaS offerings as third parties. If services such as these are used in your environment, respond "Yes".
| DOCU-06 | Does your organization have a data privacy policy? | |||
| Company Overview | Vendor Answers | Additional Information | Guidance | |
| COMP-01 | Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships. | Include circumstances that may involve off-shoring or multi-national agreements. | ||
| COMP-02 | Describe how long your organization has conducted business in this product area. | Include the number of years and in what capacity. | ||
| COMP-03 | Do you have existing higher education customers? | |||
| COMP-04 | Have you had a significant breach in the last 5 years? | |||
| COMP-05 | Do you have a dedicated Information Security staff or office? | |||
| COMP-06 | Do you have a dedicated Software and System Development team(s)? (e.g. Customer Support, Implementation, Product Management, etc.) | |||
| COMP-07 | Use this area to share information about your environment that will assist those who are assessing your company data security program. | Share any details that would help information security analysts assess your product. | ||
| Third Parties | Vendor Answers | Additional Information | Guidance | |
| THRD-01 | Describe how you perform security assessments of third party companies with which you share data (i.e. hosting providers, cloud services, PaaS, IaaS, SaaS, etc.). Provide a summary of your practices that assures that the third party will be subject to the appropriate standards regarding security, service recoverability, and confidentiality. | Ensure that all elements of THRD-01 are clearly stated in your response. | ||
| THRD-02 | Provide a brief description for why each of these third parties will have access to institution data. | If more space is needed to sufficiently answer this question, provide reference to the document or add it as an appendix. | ||
| THRD-03 | What legal agreements (i.e. contracts) do you have in place with these third parties that address liability in the event of a data breach? | Provide sufficient detail for each legal agreement in place. | ||
| THRD-04 | Describe or provide references to your third party management strategy or provide additional information that may help analysts better understand your environment and how it relates to third-party solutions. | Robust answers from the vendor improve the quality and efficiency of the security assessment process. | ||
| Consulting | Vendor Answers | Additional Information | Guidance | |
| CONS-01 | Will the consulting take place on-premises? | |||
| CONS-02 | Will the consultant require access to Institution's network resources? | |||
| CONS-03 | Will the consultant require access to hardware in the Institution's data centers? | |||
| CONS-04 | Will the consultant require an account within the Institution's domain (@*.edu)? | |||
| CONS-05 | Has the consultant received training on [sensitive, HIPAA, PCI, etc.] data handling? | |||
| CONS-06 | Will any data be transferred to the consultant's possession? | |||
| CONS-07 | Is it encrypted (at rest) while in the consultant's possession? | |||
| CONS-08 | Will the consultant need remote access to the Institution's network or systems? | |||
| CONS-09 | Can we restrict that access based on source IP address? | |||
| Application/Service Security | Vendor Answers | Additional Information | Guidance | |
| APPL-01 | Do you support role-based access control (RBAC) for end-users? | |||
| APPL-02 | Do you support role-based access control (RBAC) for system administrators? | |||
| APPL-03 | Can employees access customer data remotely? | |||
| APPL-04 | Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system? | |||
| APPL-05 | Does the system provide data input validation and error messages? | |||
| APPL-06 | Do you employ a single-tenant environment? | |||
| APPL-07 | What operating system(s) is/are leveraged by the system(s)/application(s) that will have access to institution's data? | List all operating systems and the roles that are fulfilled by each. | ||
| APPL-08 | Have you or any third party you contract with that may have access or allow access to the institution's data experienced a breach? | |||
| APPL-09 | Describe or provide a reference to additional software/products necessary to implement a functional system on either the backend or user-interface side of the system. | Describe the products and how they will be implemented. | ||
| APPL-10 | Describe or provide a reference to the overall system and/or application architecture(s), including appropriate diagrams. Include a full description of the data communications architecture for all components of the system. | Ensure that all parts of APPL-10 are clearly stated in your response. Submit architecture diagrams along with this fully-populated HECVAT. | ||
| APPL-11 | Are databases used in the system segregated from front-end systems? (e.g. web and application servers) | |||
| APPL-12 | Describe or provide a reference to all web-enabled features and functionality of the system (i.e. accessed via a web-based interface). | Include both end-user and administrative features and functions. | ||
| APPL-13 | Are there any OS and/or web-browser combinations that are not currently supported? | |||
| APPL-14 | Can your system take advantage of mobile and/or GPS enabled mobile devices? | |||
| APPL-15 | Describe or provide a reference to the facilities available in the system to provide separation of duties between security administration and system administration functions. | Include a detailed description of how security administration and system administration authority is separated, controls are verified, and logs are reviewed regularly to ensure appropriate use. | ||
| APPL-16 | Describe or provide a reference that details how administrator access is handled (e.g. provisioning, principle of least privilege, deprovisioning, etc.) | Ensure that all parts of APPL-16 are clearly stated in your response. | ||
| APPL-17 | Describe or provide references explaining how tertiary services are redundant (i.e. DNS, ISP, etc.). | Ensure that all parts of APPL-18 are clearly stated in your response. The examples given are not exhaustive - elaborate as necessary. | ||
| Authentication, Authorization, and Accounting | Vendor Answers | Additional Information | Guidance | |
| AAAI-01 | Can you enforce password/passphrase aging requirements? | |||
| AAAI-02 | Can you enforce password/passphrase complexity requirements [provided by the institution]? | |||
| AAAI-03 | Does the system have password complexity or length limitations and/or restrictions? | |||
| AAAI-04 | Do you have documented password/passphrase reset procedures that are currently implemented in the system and/or customer support? | |||
| AAAI-05 | Does your web-based interface support authentication, including standards-based single-sign-on? (e.g. InCommon) | |||
| AAAI-06 | Are there any passwords/passphrases hard coded into your systems or products? | |||
| AAAI-07 | Are user account passwords/passphrases visible in administration modules? | |||
| AAAI-08 | Are user account passwords/passphrases stored encrypted? | |||
| AAAI-09 | Does your application and/or user-frontend/portal support multi-factor authentication? (e.g. Duo, Google Authenticator, OTP, etc.) | |||
| AAAI-10 | Does your application support integration with other authentication and authorization systems? List which ones (such as Active Directory, Kerberos and what version) in Additional Info? | |||
| AAAI-11 | Will any external authentication or authorization system be utilized by an application with access to the institution's data? | |||
| AAAI-12 | Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication? | |||
| AAAI-13 | Does the system operate in a mixed authentication mode (i.e. external and local authentication)? | |||
| AAAI-14 | Will any external authentication or authorization system be utilized by a system with access to institution data? | |||
| AAAI-15 | Are audit logs available that include AT LEAST all of the following; login, logout, actions performed, and source IP address? | |||
| AAAI-16 | Describe or provide a reference to the a) system capability to log security/authorization changes as well as user and administrator security events (i.e. physical or electronic)(e.g. login failures, access denied, changes accepted), and b) all requirements necessary to implement logging and monitoring on the system. Include c) information about SIEM/log collector usage. | Ensure that all elements of AAAI-16 are clearly stated in your response. | ||
| AAAI-17 | Describe or provide a reference to the retention period for those logs, how logs are protected, and whether they are accessible to the customer (and if so, how). | Ensure that all elements of AAAI-17 are clearly stated in your response. | ||
| Business Continuity Plan | Vendor Answers | Additional Information | Guidance | |
| BCPL-01 | Describe or provide a reference to your Business Continuity Plan (BCP). | Provide a valid URL to your current BCP or submit it along with this fully-populated HECVAT. | ||
| BCPL-02 | May the Institution review your BCP and supporting documentation? | |||
| BCPL-03 | Is an owner assigned who is responsible for the maintenance and review of the Business Continuity Plan? | |||
| BCPL-04 | Is there a defined problem/issue escalation plan in your BCP for impacted clients? | |||
| BCPL-05 | Is there a documented communication plan in your BCP for impacted clients? | |||
| BCPL-06 | Are all components of the BCP reviewed at least annually and updated as needed to reflect change? | |||
| BCPL-07 | Has your BCP been tested in the last year? | |||
| BCPL-08 | Does your organization conduct training and awareness activities to validate its employees understanding of their roles and responsibilities during a crisis? | |||
| BCPL-09 | Are specific crisis management roles and responsibilities defined and documented? | |||
| BCPL-10 | Does your organization have an alternative business site or a contracted Business Recovery provider? | |||
| BCPL-11 | Does your organization conduct an annual test of relocating to an alternate site for business recovery purposes? | |||
| BCPL-12 | Is this product a core service of your organization, and as such, the top priority during business continuity planning? | |||
| Change Management | Vendor Answers | Additional Information | Guidance | |
| CHNG-01 | Do you have a documented and currently followed change management process (CMP)? | |||
| CHNG-02 | Indicate all procedures that are implemented in your CMP. a.) An impact analysis of the upgrade is performed. b.) The change is appropriately authorized. c.) Changes are made first in a test environment. d.) The ability to implement the upgrades/changes in the production environment is limited to appropriate IT personnel. | Ensure that all parts of CHNG-02 are clearly stated in your response. | ||
| CHNG-03 | Will the Institution be notified of major changes to your environment that could impact the Institution's security posture? | |||
| CHNG-04 | Do clients have the option to not participate in or postpone an upgrade to a new release? | |||
| CHNG-05 | Describe or provide a reference to your solution support strategy in relation to maintaining software currency. (i.e. how many concurrent versions are you willing to run and support?) | Ensure that all relevant details pertaining to CHNG-05 are clearly stated in your response. | ||
| CHNG-06 | Identify the most current version of the software. Detail the percentage of live customers that are utilizing the proposed version of the software as well as each version of the software currently in use. | Ensure that all parts of CHNG-06 are clearly stated in your response. | ||
| CHNG-07 | Does the system support client customizations from one release to another? | |||
| CHNG-08 | Does your organization ensure through policy and procedure (that is currently implemented) that only application software verifiable as authorized, tested, and approved for production, and having met all other requirements and reviews necessary for commissioning, is placed into production? | |||
| CHNG-09 | Do you have a release schedule for product updates? | |||
| CHNG-10 | Do you have a technology roadmap, for the next 2 years, for enhancements and bug fixes for the product/service being assessed? | |||
| CHNG-11 | Is Institution involvement (i.e. technically or organizationally) required during product updates? | |||
| CHNG-12 | Do you have policy and procedure, currently implemented, managing how critical patches are applied to all systems and applications? | |||
| CHNG-13 | Do you have policy and procedure, currently implemented, guiding how security risks are mitigated until patches can be applied? | |||
| CHNG-14 | Are upgrades or system changes installed during off-peak hours or in a manner that does not impact the customer? | |||
| CHNG-15 | Do procedures exist to provide that emergency changes are documented and authorized (including after the fact approval)? | |||
| Data | Vendor Answers | Additional Information | Guidance | |
| DATA-01 | Do you physically and logically separate Institution's data from that of other customers? | |||
| DATA-02 | Will Institution's data be stored on any devices (database servers, file servers, SAN, NAS, …) configured with non-RFC 1918/4193 (i.e. publicly routable) IP addresses? | |||
| DATA-03 | Is sensitive data encrypted in transport? (e.g. system-to-client) | |||
| DATA-04 | Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)? | |||
| DATA-05 | Do you employ or allow any cryptographic modules that do not conform to the Federal Information Processing Standards (FIPS PUB 140-2)? | |||
| DATA-06 | Does your system employ encryption technologies when transmitting sensitive information over TCP/IP networks (e.g., SSH, SSL/TLS, VPN)? (e.g. system-to-system and system-to-client) | |||
| DATA-07 | List all locations (i.e. city + datacenter name) where the institution's data will be stored? | Ensure that all parts of DATA-07 are clearly stated in your response. | ||
| DATA-08 | At the completion of this contract, will data be returned to the institution? | |||
| DATA-09 | Will the institution's data be available within the system for a period of time at the completion of this contract? | |||
| DATA-10 | Can the institution extract a full backup of data? | |||
| DATA-11 | Are ownership rights to all data, inputs, outputs, and metadata retained by the institution? | |||
| DATA-12 | Are these rights retained even through a provider acquisition or bankruptcy event? | |||
| DATA-13 | In the event of imminent bankruptcy, closing of business, or retirement of service, will you provide 90 days for customers to get their data out of the system and migrate applications? | |||
| DATA-14 | Describe or provide a reference to the backup processes for the servers on which the service and/or data resides. | If your strategy uses different processes for services and data, ensure that all strategies are clearly stated and supported. | ||
| DATA-15 | Are backup copies made according to pre-defined schedules and securely stored and protected? | |||
| DATA-16 | How long are data backups stored? | If your backup strategy uses varying periods, ensure that each strategy is clearly stated and supported. | ||
| DATA-17 | Are data backups encrypted? | |||
| DATA-18 | Do you have a cryptographic key management process (generation, exchange, storage, safeguards, use, vetting, and replacement), that is documented and currently implemented, for all system components? (e.g. database, system, web, etc.) | |||
| DATA-19 | Do current backups include all operating system software, utilities, security software, application software, and data files necessary for recovery? | |||
| DATA-20 | Are you performing off site backups? (i.e. digitally moved off site) | |||
| DATA-21 | Are physical backups taken off site? (i.e. physically moved off site) | |||
| DATA-22 | Do backups containing the institution's data ever leave the Institution's Data Zone either physically or via network routing? | |||
| DATA-23 | Do you have a media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures? | |||
| DATA-24 | Does the process described in DATA-23 adhere to DoD 5220.22-M and/or NIST SP 800-88 standards? | |||
| DATA-25 | Do procedures exist to ensure that retention and destruction of data meets established business and regulatory requirements? | |||
| DATA-26 | Is media used for long-term retention of business data and archival purposes stored in a secure, environmentally protected area? | |||
| DATA-27 | Will you handle data in a FERPA compliant manner? | |||
| DATA-28 | Is any institution data visible in system administration modules/tools? | |||
| Database | Vendor Answers | Additional Information | Guidance | |
| DBAS-01 | Does the database support encryption of specified data elements in storage? | |||
| DBAS-02 | Do you currently use encryption in your database(s)? | |||
| Datacenter | Vendor Answers | Additional Information | Guidance | |
| DCTR-01 | Does your company own the physical data center where the Institution's data will reside? | |||
| DCTR-02 | Does the hosting provider have a SOC 2 Type 2 report available? | |||
| DCTR-03 | Are the data centers staffed 24 hours a day, seven days a week (i.e., 24x7x365)? | |||
| DCTR-04 | Do any of your servers reside in a co-located data center? | |||
| DCTR-05 | Are your servers separated from other companies via a physical barrier, such as a cage or hardened walls? | |||
| DCTR-06 | Does a physical barrier fully enclose the physical space preventing unauthorized physical contact with any of your devices? | |||
| DCTR-07 | Select the option that best describes the network segment that servers are connected to. | Provide a general summary of the implemented networking strategy. | ||
| DCTR-08 | Does this data center operate outside of the Institution's Data Zone? | |||
| DCTR-09 | Will any institution data leave the Institution's Data Zone? | |||
| DCTR-10 | List all datacenters and the cities, states (provinces), and countries where the Institution's data will be stored (including within the Institution's Data Zone). | Ensure that all parts of DCTR-10 are clearly stated in your response. | ||
| DCTR-11 | Are your primary and secondary data centers geographically diverse? | |||
| DCTR-12 | If outsourced or co-located, is there a contract in place to prevent data from leaving the Institution's Data Zone? | |||
| DCTR-13 | What Tier Level is your data center (per levels defined by the Uptime Institute)? |
Charles Escue: https://uptimeinstitute.com/tiers
| Review the Uptime Institute's level/tier direction provided on their website if you need addition information to answer DCTR-13. | ||||
| DCTR-14 | Is the service hosted in a high availability environment? | |||
| DCTR-15 | Is redundant power available for all datacenters where institution data will reside? | |||
| DCTR-16 | Are redundant power strategies tested? | |||
| DCTR-17 | Describe or provide a reference to the availability of cooling and fire suppression systems in all datacenters where institution data will reside. | Ensure that all parts of DCTR-17 are clearly stated in your response. | ||
| DCTR-18 | State how many Internet Service Providers (ISPs) provide connectivity to each datacenter where the institution's data will reside. | State the ISP provider(s) in addition to the number of ISPs that provide connectivity. | ||
| DCTR-19 | Does every datacenter where the Institution's data will reside have multiple telephone company or network provider entrances to the facility? | |||
| Disaster Recovery Plan | Vendor Answers | Additional Information | Guidance | |
| DRPL-01 | Describe or provide a reference to your Disaster Recovery Plan (DRP). | Provide a valid URL to your current DRP or submit it along with this fully-populated HECVAT. | ||
| DRPL-02 | Is an owner assigned who is responsible for the maintenance and review of the DRP? | |||
| DRPL-03 | Can the Institution review your DRP and supporting documentation? | |||
| DRPL-04 | Are any disaster recovery locations outside the Institution's Data Zone? | |||
| DRPL-05 | Does your organization have a disaster recovery site or a contracted Disaster Recovery provider? | |||
| DRPL-06 | Does your organization conduct an annual test of relocating to this site for disaster recovery purposes? | |||
| DRPL-07 | Is there a defined problem/issue escalation plan in your DRP for impacted clients? | |||
| DRPL-08 | Is there a documented communication plan in your DRP for impacted clients? | |||
| DRPL-09 | Describe or provide a reference to how your disaster recovery plan is tested? (i.e. scope of DR tests, end-to-end testing, etc.) | Ensure that all elements of DRPL-09 are clearly stated in your response. | ||
| DRPL-10 | Has the Disaster Recovery Plan been tested in the last year? Please provide a summary of the results in Additional Information (including actual recovery time). | |||
| DRPL-11 | Do the documented test results identify your organizations actual recovery time capabilities for technology and facilities? | |||
| DRPL-12 | Are all components of the DRP reviewed at least annually and updated as needed to reflect change? | |||
| DRPL-13 | Do you carry cyber-risk insurance to protect against unforeseen service outages, data that is lost or stolen, and security incidents? | |||
| Firewalls, IDS, IPS, and Networking | Vendor Answers | Additional Information | Guidance | |
| FIDP-01 | Are you utilizing a web application firewall (WAF)? | |||
| FIDP-02 | Are you utilizing a stateful packet inspection (SPI) firewall? | |||
| FIDP-03 | State and describe who has the authority to change firewall rules? | Ensure that all parts of FIDP-03 are clearly stated in your response. | ||
| FIDP-04 | Do you have a documented policy for firewall change requests? | |||
| FIDP-05 | Have you implemented an Intrusion Detection System (network-based)? | |||
| FIDP-06 | Have you implemented an Intrusion Prevention System (network-based)? | |||
| FIDP-07 | Do you employ host-based intrusion detection? | |||
| FIDP-08 | Do you employ host-based intrusion prevention? | |||
| FIDP-09 | Are you employing any next-generation persistent threat (NGPT) monitoring? | |||
| FIDP-10 | Do you monitor for intrusions on a 24x7x365 basis? | |||
| FIDP-11 | Is intrusion monitoring performed internally or by a third-party service? | In addition to stating your intrusion monitoring strategy, provide a brief summary of its implementation. | ||
| FIDP-12 | Are audit logs available for all changes to the network, firewall, IDS, and IPS systems? | |||
| Mobile Applications | Vendor Answers | Additional Information | Guidance | |
| MAPP-01 | On which mobile operating systems is your software or service supported? | Ensure that all supported operating systems are listed - be sure to provide version number, where relevant. | ||
| MAPP-02 | Describe or provide a reference to the application's architecture and functionality. | Ensure that all elements of MAPP-02 are clearly stated in your response. (i.e. (architecture AND functionality are defined) | ||
| MAPP-03 | Is the application available from a trusted source (e.g., iTunes App Store, Android Market, BB World)? | |||
| MAPP-04 | Does the application store, process, or transmit critical data? | |||
| MAPP-05 | Is Institution's data encrypted in transport? | |||
| MAPP-06 | Is Institution's data encrypted in storage? (e.g. disk encryption, at-rest) | |||
| MAPP-07 | Does the mobile application support Kerberos, CAS, or Active Directory authentication? | |||
| MAPP-08 | Will any of these systems be implemented on systems hosting the Institution's data? | |||
| MAPP-09 | Does the application adhere to secure coding practices (e.g. OWASP, etc.)? | |||
| MAPP-10 | Has the application been tested for vulnerabilities by a third party? | |||
| MAPP-11 | State the party that performed the vulnerability test and the date it was conducted? | Ensure that all elements of MAPP-11 are clearly stated in your response. | ||
| Physical Security | Vendor Answers | Additional Information | Guidance | |
| PHYS-01 | Does your organization have physical security controls and policies in place? | |||
| PHYS-02 | Are employees allowed to take home Institution's data in any form? | |||
| PHYS-03 | Are video monitoring feeds retained? | |||
| PHYS-04 | Are video feeds monitored by datacenter staff? | |||
| PHYS-05 | Are individuals required to sign in/out for installation and removal of equipment? | |||
| Policies, Procedures, and Processes | Vendor Answers | Additional Information | Guidance | |
| PPPR-01 | Can you share the organization chart, mission statement, and policies for your information security unit? | |||
| PPPR-02 | Do you have a documented patch management process? | |||
| PPPR-03 | Can you accommodate encryption requirements using open standards? | |||
| PPPR-04 | Have your developers been trained in secure coding techniques? | |||
| PPPR-05 | Was your application developed using secure coding techniques? | |||
| PPPR-06 | Do you subject your code to static code analysis and/or static application security testing prior to release? | |||
| PPPR-07 | Do you have software testing processes (dynamic or static) that are established and followed? | |||
| PPPR-08 | Are information security principles designed into the product lifecycle? | |||
| PPPR-09 | Do you have a documented systems development life cycle (SDLC)? | |||
| PPPR-10 | Do you have a formal incident response plan? | |||
| PPPR-11 | Will you comply with applicable breach notification laws? | |||
| PPPR-12 | Will you comply with the Institution's IT policies with regards to user privacy and data protection? | |||
| PPPR-13 | Is your company subject to Institution's Data Zone laws and regulations? | |||
| PPPR-14 | Do you perform background screenings or multi-state background checks on all employees prior to their first day of work? | |||
| PPPR-15 | Do you require new employees to fill out agreements and review policies? | |||
| PPPR-16 | Do you have documented information security policy? | |||
| PPPR-17 | Do you have an information security awareness program? | |||
| PPPR-18 | Is security awareness training mandatory for all employees? | |||
| PPPR-19 | Do you have process and procedure(s) documented, and currently followed, that require a review and update of the access-list(s) for privileged accounts? | |||
| PPPR-20 | Do you have documented, and currently implemented, internal audit processes and procedures? | |||
| Product Evaluation | Vendor Answers | Additional Information | Guidance | |
| PROD-01 | Do you incorporate customer feedback into security feature requests? | |||
| PROD-02 | Can you provide an evaluation site to the institution for testing? | |||
| Quality Assurance | Vendor Answers | Additional Information | Guidance | |
| QLAS-01 | Provide a general summary of your Quality Assurance program. | Provide a valid URL to your Quality Assurance program or submit it along with this fully-populated HECVAT. | ||
| QLAS-02 | Do you comply with ISO 9001? | |||
| QLAS-03 | Will your company provide quality and performance metrics in relation to the scope of services and performance expectations for the services you are offering? | |||
| QLAS-04 | Have you supplied products and/or services to the Institution (or its Campuses) in the last five years? | |||
| QLAS-05 | Do you have a program to keep your customers abreast of higher education and/or industry issues? | |||
| Systems Management & Configuration | Vendor Answers | Additional Information | Guidance | |
| SYST-01 | Are systems that support this service managed via a separate management network? | |||
| SYST-02 | Do you have an implemented system configuration management process? (e.g. secure "gold" images, etc.) | |||
| SYST-03 | Are employee mobile devices managed by your company's Mobile Device Management (MDM) platform? | |||
| SYST-04 | Do you have a systems management and configuration strategy that encompasses servers, appliances, and mobile devices (company and employee owned)? | |||
| Vulnerability Scanning | Vendor Answers | Additional Information | Guidance | |
| VULN-01 | Are your applications scanned externally for vulnerabilities? | |||
| VULN-02 | Have your applications had an external vulnerability assessment in the last year? | |||
| VULN-03 | Are your applications scanned for vulnerabilities prior to new releases? | |||
| VULN-04 | Are your systems scanned externally for vulnerabilities? | |||
| VULN-05 | Have your systems had an external vulnerability assessment in the last year? | |||
| VULN-06 | Describe or provide a reference to the tool(s) used to scan for vulnerabilities in your applications and systems. | Ensure that all elements of VULN-06 are clearly stated in your response. | ||
| VULN-07 | Will you provide results of security scans to the Institution? | |||
| VULN-08 | Describe or provide a reference to how you monitor for and protect against common web application security vulnerabilities (e.g. SQL injection, XSS, XSRF, etc.). | Ensure that all elements of VULN-08 are clearly stated in your response. | ||
| VULN-09 | Will you allow the institution to perform its own security testing of your systems and/or application provided that testing is performed at a mutually agreed upon time and date? | |||
| HIPAA | Vendor Answers | Additional Information | Guidance | |
| HIPA-01 | Do your workforce members receive regular training related to the HIPAA Privacy and Security Rules and the HITECH Act? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-02 | Do you monitor or receive information regarding changes in HIPAA regulations? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-03 | Has your organization designated HIPAA Privacy and Security officers as required by the Rules? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-04 | Do you comply with the requirements of the Health Information Technology for Economic and Clinical Health Act (HITECH)? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-05 | Do you have an incident response process and reporting in place to investigate any potential incidents and report actual incidents? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-06 | Do you have a plan to comply with the Breach Notification requirements if there is a breach of data? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-07 | Have you conducted a risk analysis as required under the Security Rule? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-08 | Have you identified areas of risks? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-09 | Have you taken actions to mitigate the identified risks? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-10 | Does your application require user and system administrator password changes at a frequency no greater than 90 days? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-11 | Does your application require a user to set their own password after an administrator reset or on first use of the account? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-12 | Does your application lock-out an account after a number of failed login attempts? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-13 | Does your application automatically lock or log-out an account after a period of inactivity? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-14 | Are passwords visible in plain text, whether when stored or entered, including service level accounts (i.e. database accounts, etc.)? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-15 | If the application is institution-hosted, can all service level and administrative account passwords be changed by the institution? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-16 | Does your application provide the ability to define user access levels? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-17 | Does your application support varying levels of access to administrative tasks defined individually per user? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-18 | Does your application support varying levels of access to records based on user ID? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-19 | Is there a limit to the number of groups a user can be assigned? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-20 | Do accounts used for vendor supplied remote support abide by the same authentication policies and access logging as the rest of the system? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-21 | Does the application log record access including specific user, date/time of access, and originating IP or device? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-22 | Does the application log administrative activity, such user account access changes and password changes, including specific user, date/time of changes, and originating IP or device? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-23 | How long does the application keep access/change logs? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-24 | Can the application logs be archived? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-25 | Can the application logs be saved externally? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-26 | Does your data backup and retention policies and practices meet HIPAA requirements? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-27 | Do you have a disaster recovery plan and emergency mode operation plan? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-28 | Have the policies/plans mentioned above been tested? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-29 | Can you provide a HIPAA compliance attestation document? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-30 | Are you willing to enter into a Business Associate Agreement (BAA)? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-31 | Have you entered into a BAA with all subcontractors who may have access to protected health information (PHI)? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| PCI DSS | Vendor Answers | Additional Information | Guidance | |
| PCID-01 | Do your systems or products store, process, or transmit cardholder (payment/credit/debt card) data? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-02 | Are you compliant with the Payment Card Industry Data Security Standard (PCI DSS)? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-03 | Do you have a current, executed within the past year, Attestation of Compliance (AoC) or Report on Compliance (RoC)? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-04 | Are you classified as a service provider? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-05 | Are you on the list of VISA approved service providers? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-06 | Are you classified as a merchant? If so, what level (1, 2, 3, 4)? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-07 | Describe the architecture employed by the system to verify and authorize credit card transactions. | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-08 | What payment processors/gateways does the system support? | Refer to PCI DSS Security Standards for supplemental guidance in this section |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .