Attachment I - DHHA_Cybersecurity_Risk Assessment-Official.xlsx
XLSX spreadsheet 29 KB Posted
- Attached to
- Sleep Apnea Testing Solution
- Solicitation number
- 1183
- Issued by
- Denver County, Denver City, Colorado
About this file
This document is an External Third-Party Cybersecurity Risk Assessment Questionnaire for Denver Health, specifically focused on evaluating cybersecurity practices and capabilities of potential technology partners or service providers. The comprehensive assessment covers multiple domains of cybersecurity including security governance, organizational security, operational security management, access control, mobile device management, application security, and cloud services. The questionnaire is structured with detailed sections that address critical aspects such as information security policies, background screening, security awareness training, change management, data encryption, vulnerability assessments, access controls, multi-factor authentication, and compliance with various international security standards like ISO.
The questionnaire appears designed to thoroughly vet potential technology vendors and service providers by examining their security posture across multiple dimensions, with specific attention to how they might interact with Denver Health's systems and data. Key areas of focus include data transmission locations, hosting environments, network segmentation, federated identity capabilities, data classification, and potential third-party access. While no specific contract value or procurement timeline is explicitly stated, the document suggests a rigorous process for evaluating cybersecurity risks before engaging with external technology partners, with particular emphasis on protecting sensitive healthcare-related information and ensuring comprehensive security controls are in place.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Attachment D - Blank w-9 form.pdf | ||
| Attachment F - DHHA IT Security Risk Stratification Questionnaire.xlsx | XLSX spreadsheet | |
| Denver Health - RFP Template - Oct 2023.docx | DOCX document | |
| Attachment A - Statement of Work - Denver Health Sleep Studies.docx | DOCX document | |
| Attachment E - Voluntary Self-Certification Forms.pdf | ||
| Attachment G - Simplified Cost Breakdown.docx | DOCX document | |
| Attachment H - Evaluation Matrix (EXAMPLE).xlsx | XLSX spreadsheet | |
| Attachment B - Questions and Clarifications Form.doc | DOC document | |
| Attachment C - Service Agreement.doc | DOC document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
External ThirdParty
| Cybersecurity Risk Assessment Questionnaire - External/Third-Party | ||||||
| A. Security Governance | ERROR:#REF! | |||||
| Ref | Question | Response | Additional Information | AUP Reference | ISO Ref Num | ISO Ref Text |
| A.1 | Is there an information security policy that has been approved by management, communicated to employees and stakeholders? | 5.1.1 | Information Security Policy Document | |||
| A.2 | Have the information security policies been reviewed in the last 12 months? | B.2 Information Security Policy Maintenance | 5.1.2 | Review of Information Security Policy | ||
| A.3 | Is there an information security function responsible for security initiatives within the organization? | 6.1.1 | Management commitment to information security | |||
| A.4 | Is a background screening performed for employees? | |||||
| A.5 | Is there a security awareness training program? | |||||
| B. Organizational Security | ERROR:#REF! | |||||
| Ref | Question | Response | Additional Information | AUP Reference | ISO Ref Num | ISO Ref Text |
| B.1 | Will third parties have access to Denver Health systems and data? | 6.2 | External parties | |||
| B.2 | Will Denver Health data be retransmitted outside of the United States? | |||||
| B.3 | Will you use an external facility to host Denver Health data (e.g. Rack Space, AWS, etc.)? | |||||
| B.4 | Is an IT security risk assessment performed on third parties that have access to Denver Health systems and data? | N/A | ||||
| B.5 | Do you perform ongoing security monitoring (e.g. perimeter, netflow, web servers, etc.)? | |||||
| B.6 | Do you have an SOC2 or SSAE16 report that you can provide? If not, please provide a description of your physical security program. | |||||
| C. Operational Security Management | ERROR:#REF! | |||||
| Ref | Question | Response | Additional Information | AUP Reference | ISO Ref Num | ISO Ref Text |
| C.1 | Is there a documented change management policy or program? | G.21 Change Control | 10.1.2 | Change Management | ||
| C.2 | Is there an anti-virus / malware policy or program for your infrastructure? | 10.4.1.e | Controls Against Malicious Code | |||
| C.3 | Are backups performed of Denver Health data? | 10.5.1 | Information Back-Up | |||
| C.3.a | If so are backups encrypted? | |||||
| C.4 | Are firewalls in use and properly configured for both internal and external connections? | G.17 Network Security – Firewall(s) | 11.4.5 | Segregation in networks | ||
| C.5 | Are internal and external vulnerability assessments and scans performed on your company's infrastructure on a regular basis (weekly/monthly/quarterly)? | L.2 Technical Compliance Checking – Vulnerability Testing and Remediation | 12.6.1 | Control of technical vulnerabilities | ||
| C.6 | Are the findings from vulnerability assessments and scans documented and tracked to remediation? | 12.6.1.e | Control of technical vulnerabilities | |||
| C.7 | Do you have an operational security patching program? | |||||
| C.8 | Is Denver Health data encrypted at rest? | 10.7.1 | Management Of Removable Media | |||
| C.9 | Is Denver Health data encrypted while in transit? | |||||
| C.10 | Do you harden systems that process, transmit and store Denver Health data? | N/A | ||||
| C.11 | Do you have a password policy that enforces the use of unique passwords, complexity, expiration, reuse, etc.? | |||||
| C.12 | Do you log sufficient data for incident response and forensic investigation? Are the logs reviewed on a periodic basis? | 10.10.2 | Monitoring System Use | |||
| D. Access Control | ERROR:#REF! | |||||
| Ref | Question | Response | Additional Information | AUP Reference | ISO Ref Num | ISO Ref Text |
| D.1 | Is there a documented access control policy? | B.1 Information Security Policy Content | 11.1.1 | Access Control Policy | ||
| D.2 | Does this policy ensure least privilege? | 11.1.1.c | Access Control Policy | |||
| D.3 | Is Role Based Access Control (RBAC) enforced? | |||||
| D.4 | Are unique user IDs used for access? | 11.2.1.a | User Registration | |||
| D.5 | Is single-sign-on (SSO) / shared authentication implemented and available (e.g., SAML, OpenID)? | |||||
| D.6 | Is multi-factor authentication deployed? | |||||
| D.6a | For remote users? | |||||
| D.6b | For internal privileged users (i.e. Domain administrators, Database Administrators)? | |||||
| D.7 | Are privileged user access rights reviewed at least quarterly to ensure that process and procedure was followed as per policy? | 11.2.4.c | Review Of User Access Rights | |||
| D.8 | Is there a password policy for systems that transmit, process, or store Denver Health Data? | 11.2.3 | User Password Management | |||
| D.9 | Is there a remote access policy for systems transmitting, processing, and storing Denver Health Data? | 11.7.1 | Mobile Computing And Communications | |||
| D.10 | Is remote connection technology (e.g. Citrix, SSH, RDP, etc.) used to access the network? Does this technology prevent copying of Denver Health data from being copied to remote devices? | 11.7.1 | Mobile Computing And Communications | |||
| E. Mobile | ERROR:#REF! | |||||
| Ref | Question | Response | Additional Information | AUP Reference | ISO Ref Num | ISO Ref Text |
| E.1 | Does your organization have a documented policy for mobile device use? | |||||
| E.2 | Does the security policy include a requirement for mobile device management and mobile application management (MDM and MAM)? | |||||
| E.3 | Does your organization allow Denver Health systems and data to be accessed on mobile devices? Are such devices managed by MDM and MAM? | |||||
| F. Application Security and Development | ERROR:#REF! | |||||
| Ref | Question | Response | Additional Information | AUP Reference | ISO Ref Num | ISO Ref Text |
| F.1 | Is application development performed? | |||||
| F.2 | Does your development team adhere to a formal application security methods (e.g. OWASP, Security Tools .Net)? | |||||
| F.3 | Is code analysis performed? | |||||
| F.3.a | Static code analysis? | |||||
| F.3.b | Dynamic code analysis? | |||||
| F.3.c | Is there a third party attestation of the code analysis? If yes, please provide. | |||||
| F.3.d | Is dynamic security scanning performed on production systems? | |||||
| F.4 | Is the API code security tested against OWASP top 10 security issues? If yes, does this include: | |||||
| F.4.a | Data scoping? | |||||
| F.4.b | Cross Site Scripting (XSS)? | |||||
| F.4.c | SQL injection? | |||||
| F.4.d | Session abuse? | |||||
| F.4.e | Replay attack? | |||||
| F.4.f | Denial-of-Service (DoS)? | |||||
| F.4.g | Data Leakage | |||||
| G. Cloud | ||||||
| Ref | Question | Response | Additional Information | Service Model | Deployment Model | AUP Reference |
| G.1 | Are Cloud Services provided? If yes, what service model is provided (select all that apply): | |||||
| G.1.a | Software as a Service (SaaS)? | |||||
| G.1.b | Platform as a Service (PaaS)? | |||||
| G.1.c | Infrastructure as a Service (IaaS)? | |||||
| G.1.d | What deployment models are provided: | |||||
| G.1.e | Private cloud? | |||||
| G.1.f | Public cloud? | |||||
| G.1.g | Where is the cloud infrastructure hosted: | |||||
| G.1.h | Data center: single tenancy? | |||||
| G.1.i | Co-location: dedicated server? | |||||
| G.1.j | Co-location: shared server? | |||||
| G.1.k | Co-location: dedicated cabinet? | |||||
| G.1.l | Co-location: shared cabinet? | |||||
| G.1.m | Co-location: dedicated cage? | |||||
| G.1.n | Co-location: shared cage? | |||||
| G.1.o | Cloud provider: (e.g., Amazon Web Services, AZURE, Rack Space, etc.)? | |||||
| G.1.p | If cloud provider is used, please provide the most recent SSAE16, SOC2 type II | |||||
| G.2 | In what legal jurisdiction(s) does data reside (select all that apply): | |||||
| G.2.a | USA? | |||||
| G.2.b | Canada? | |||||
| G.2.c | Asia? | |||||
| G.2.d | South America? | |||||
| G.2.e | Australia? | |||||
| G.2.f | Asia-Pacific? | |||||
| G.2.g | Africa? | |||||
| G.2.h | Europe (EU)? | |||||
| G.2.i | Europe (non-EU)? | |||||
| G.2.j | Other (please specify)? | |||||
| G.3 | Can clients define the legal jurisdictions of their data? If yes, can they define where the data is: | |||||
| G.3.a | Stored? | |||||
| G.3.b | Processed? | |||||
| G.3.c | Transmitted? | |||||
| G.3.d | Accessed? | |||||
| G.4 | Are application instances part of the services provided? | |||||
| G.4.a | Are these instances shared with other clients? | |||||
| G.5 | Are database instances part of the services provided? | |||||
| G.5.a | Are these instances shared with other clients? | |||||
| G.6 | Is data segmentation and separation capability between clients provided? If yes, is this implemented via: | |||||
| G.6.a | Physical segmentation (private cloud)? | |||||
| G.6.b | Network segmentation? | |||||
| G.6.c | System segmentation (unique system instances (e.g., virtualization)? | |||||
| G.6.d | Application segmentation (unique application instances)? | |||||
| G.6.e | Application segmentation (e.g., application ID, metadata tagging, )? | |||||
| G.6.f | Other (please specify)? | |||||
| G.7 | Is standards based federated ID capability available to clients (e.g., SAML, OpenID)? | |||||
| G.8 | Are clients provided with the ability to specify where their data will be stored? If yes, what level: | |||||
| G.8.a | Data classification zone: based on security classification level (e.g., production networks, PCI networks) | |||||
| G.8.b | Data center? | |||||
| G.8.c | Country? | |||||
| G.8.d | Location based on legal jurisdiction? |
Internal Built or Hosted
| Cybersecurity Risk Assessment Questionnaire - Internal (Built or Hosted) | ||||
| A. Security Policy | ||||
| Ref | Question | Response | Additional Information | Standards/Docs |
| A.1 | Does the project have security requirements formally documented throughout the project delivery lifecycle (Initiation, Requirements, Design, Build, Test, Implement, Close)? | |||
| A.2 | Is there security training specific to your project? If yes, describe in Additional Information section. | |||
| B. Third Party Provider Security | ||||
| Note: If any of these questions are a yes, please have the vendor fill out the "External ThirdParty" worksheet | ||||
| Ref | Question | Response | Additional Information | |
| B.1 | Will third parties have access to Denver Health systems and data? | |||
| B.2 | Will Denver Health data be retransmitted outside of the United States by the third party/vendor? | |||
| B.3 | Will you use an external facility to host Denver Health data (e.g. Rack Space, AZURE, AWS, etc.)? | |||
| B.4 | Has an IT security risk assessment been performed on third parties that have access to Denver Health systems and data? | |||
| C. Operational Security Management | ||||
| Ref | Question | Response | Additional Information | |
| C.1 | Where will the systems that process, transmit and store Denver Health data be housed (Tacoma, CoLo, etc.)? | |||
| C.2 | Are systems that process, transmit and store Denver Health data hardened? | |||
| C.3 | Do these systems adhere to the Denver Health logging standard? If not, please provide details in Additional Information section. | |||
| C.4 | Do these systems log sufficient data for incident response and forensic investigation? | |||
| D. Access Control | ||||
| Ref | Question | Response | Additional Information | |
| D.1 | Is there a documented access control policy for your project? | |||
| D.2 | Is the project adhering to the Denver Health Role Based Access Control (RBAC) standard? If not, please provide details in Additional Information section. | |||
| D.3 | Is single-sign-on (SSO) / shared authentication implemented and available (e.g., SAML, OpenID) for your project? | |||
| D.4 | Is multi-factor authentication deployed for your project? | |||
| D.5 | Do the systems adhere to the Denver Health password standard? If not, please provide details in Additional Information section. | |||
| D.6 | Do you adhere to the Denver Health remote access standard? If not, please provide details in Additional Information section. | |||
| E. Mobile | ||||
| Ref | Question | Response | Additional Information | |
| E.1 | Is there a mobile component to your project? If yes, please continue to questions below. | |||
| E.2 | Does this project adhere to the Denver Health mobile device management standard? If no, please provide details in Additional Information section. | |||
| E.3 | Are mobile devices Denver Health provided? | |||
| E.4 | Are mobile devices individual owned (BYOD)? | |||
| F. Application Security and Development | ||||
| Ref | Question | Response | Additional Information | |
| F.1 | Is application development performed? If yes, please continue to questions below. | |||
| F.2 | Does your development team adhere to a formal application security methods (e.g. OWASP, Security Tools .Net)? | |||
| F.3 | Is code analysis performed? | |||
| F.3.a | Static code analysis? | |||
| F.3.b | Dynamic code analysis? | |||
| F.3.c | Is dynamic security scanning performed on production systems? |
File details come from the government source that posted it. Updated .