Attachment_J_-_VISA_Questionnaire_v2.77.pdf

City of Palo Alto Information Security

Document Version: v2.7 Form: InfoSec 100

Vendor Information Security Assessment (VISA) Questionnaire Purpose: This Vendor Information Security Assessment (VISA) Questionnaire requests information concerning a Cloud Service Provider (the Vendor), which intends to provide to the City of Palo Alto (the City) any or all of the following services: Software as a Service (SaaS);

Platform as a Service (PaaS); and Infrastructure as a Service (IaaS).

Note/Instructions:

• SaaS, PaaS and IaaS are each a ‘cloud’ servicing model, in which software and database applications, computer network infrastructure and/or computer hardware/software platforms is/are hosted by the Vendor and made available to customers interconnected in a network, typically the Internet.

• This Questionnaire is for the sole use of the intended Vendor and may contain confidential information of individuals and businesses collected, stored, and used the City. Any unauthorized collection, storage, use, review or distribution may be prohibited by California and/or Federal laws. If you are not the intended recipient of this Questionnaire, please contact the sender by e-mail and destroy all copies of the Questionnaire.

• The Vendor shall provide answers to the questions or information to the requests provided below.

• In the event that the Vendor determines that it cannot meet the City’s security and or privacy requirements, the Vendor may submit a request for an exception to the City’s requirements and propose alternative countermeasures to address the risks addressed in this Questionnaire. The City’s Information Security Manager (ISM) may approve or reject the exception request, depending on the risks associated with the exception request.

• Security Exception Request shall be submitted if you cannot comply with this policy/requirements

• Upon receipt of the Vendor’s response, the Information Security Manager will conduct a security risk assessment, using the scoring methodology listed below:

A = Meets completely.

B = Partially meets. The Vendor may be required to provide additional requested information.

C = Doesn’t meet. The Vendor may be required to provide missing/additional detail.

VISA Questionnaire Page10 of 10 9/27/2021

Document Version: v2.7 Form: InfoSec 100

# Response from the Vendor Score Additional Information/Clarification Required from the Vendor

1.1

1.2

1.3

1.4

1.5

1.6

1.7

What functionality will be provided to the City's employees or the City's customers or other City services recipients through the application?

VENDOR INFORMATION

Vendor Organization Name:

Vendor Address:

Information Security Contact Person Name:

Email:

Phone:

Questionnaire Completion Date:

1.0 BUSINESS PROCESS AND DATA EXCHANGE REQUIREMENTS

Question Please provide a detailed description of the Vendor’s business process that will be offered to the City related to the proposed requirements of the City’s RFP or other business requirements.

What is the name of the application(s) that the Vendor will be hosting and offering to the City in order to provide services to the City? (List all)

If the Vendor required to store Private Information (PI), Personally Identifiable Information (PII), Sensitive Information (SI), the City’s Confidential & Protected Information (CPI), City’s Critical Infrastructure Information (CII) at the Vendor’s IT environment, how does the Vendor maintain the confidentiality of the information in accordance with applicable federal, state and local data and information privacy laws, rules and regulations?

What mechanism and what types of tool(s) and technologies will be used to exchange data between the City and The Vendor? Example: (VPN, Data Link, Frame Relay, HTTP, HTTPS, FTP, FTPS, etc.)

If required, can the Vendor offer/support a site-to-site VPN solution between the City of Palo Alto and the Vendor's environment.

What data exchange will occur between the City and the Vendor? What data required to be stored at the Vendor’s or other third party’s data storage location? (Provide data attributes with examples of the data to be stored) Example: Payment Card Information, Social Security Number, Driving License number, Patrons Name, Address, Telephone, etc.), which are examples of personal information, the privacy of which is protected by California constitutional and statutory law.

VISA Questionnaire Page1 of 10

Document Version: v2.7 Form: InfoSec 100

# Response from the Vendor Score Additional Information/Clarification Required from the Vendor

2.1

2.2

2.3

2.4

2.5

2.6

What are the internet and the browser security configurations and policy for the cloud application?

How does the Vendor ensure that their employees and service providers adhere to your information security and privacy policies?

Does the Vendor maintain formal security policies, privacy policy to comply with applicable statutory or industry practice requirements/standards?

What security standards and requirements do the Vendor maintain to ensure application security at the user interface? (A set of detailed documentation should be provided to support the compliance).

Are records maintained to demonstrate compliance or certification? Does the Vendor allow client audit of these records? If yes, please submit supporting documentation.

Has the Vendor adopted and implemented information security and privacy policies/standards that are documented and conform to ISO 27001/2 – Information Security Management Systems (ISMS) Standards or NIST 800-53 (National Institute of Standards – NIST Special Publication (SP) 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations)

2.0 SECURITY POLICIES AND STANDARDS

Question

VISA Questionnaire Page2 of 10

Document Version: v2.7 Form: InfoSec 100

# Response from the Vendor Score Additional Information/Clarification Required from the Vendor

3.1

3.2

3.3

3.4

3.5

3.6

How does the Vendor assess applications (which will be offered to the City) for security vulnerabilities and address any issues before deployment to production and after deployment?

What is the Vendor's application(s) hosting hardware and software platform?

Example: Windows or Unix Operating System (OS) and other detail.

If required, can the Vendor offer the Network Layer IP filtering solution to allow access only from the City of Palo Alto's IP address to the Vendor environment (primarily hosted for the City of Palo Alto)? In addition, can the Vendor offer IP filtering for all the applications and database access to the Vendor's environment and the hosting (e.g., AWS) environment? If, not what alternative solution can the Vendor offer?

Will the Vendor use a subcontractor and a third-party service provider? (List all). If yes, what data privacy and information security agreements are in place between the Vendor and any subcontractor/third party to ensure appropriate and accountable treatment of information? Note the City requires that the Vendor and each subcontractor and third-party formally acknowledge that will comply with the City's Information Privacy Policy and SaaS Security and Privacy Terms and Conditions

How do the Vendor’s application and database architecture support segregation of the City's data (related to its function as a local government agency) from the data of individuals providing services to or receiving services from the City?

Please provide a detailed proposed solution developed as a part of the Vendor's implementation to support this project. (For example, intricate solution architecture, secured data flow to support business processes, etc.).

3.0 APPLICATION/SOLUTION CONFIGURATION

Question

VISA Questionnaire Page3 of 10

Document Version: v2.7 Form: InfoSec 100

# Response from the Vendor Score Additional Information/Clarification Required from the Vendor

4.1

4.2

4.3

4.4

4.5

4.6

4.7

4.8

4.9

4.10

4.11

Has the Vendor ever been subjected to either an electronic or physical security breach? Please describe the event(s) and the steps taken to mitigate the breach(es). What damages or exposure resulted? Are records of violations and issues maintained, and will these records be available for inspection by the City?

What anti-malware programs the Vendor had deployed that support or connect to the Vendor’s cloud service offerings installed on all of your systems?

4.0 RISK & VULNERABITY MANAGEMENT

Question What solution does the Vendor use to conduct network-layer vulnerability scans regularly? And what is the frequency of the network-layer vulnerability scans performed? If required can the Vendor submit the scan results to the City’s Information security officer?

What solution does the Vendor use to conduct local operating system-layer vulnerability scans regularly? And what is the frequency of the local operating system-layer vulnerability scans performed?

If required can the Vendor submit the scan results to the City’s Information security officer?

What is the Vendor policy for rapid patch management? If required, can the Vendor submit the patch management policy to the City’s Information security officer?

What is the Vendor’s mobile code authorization policy? Does mobile code authorized before its installation and use, and how the code configuration checked to ensure that the authorized mobile code operates according to a clearly defined security policy?

Does the Vendor use a certified external third-party service provider to conduct vulnerability scans and periodic penetration tests on the Vendor applications and networks? If yes, how frequently the vulnerability scans and routine penetration tests are performed? If required can the Vendor submit the scan results to the City’s Information security officer?

Suppose the Vendor environment experience any security incident, and the City requires that the Vendor formally advise the City’s information security office within 24 hours. Will the Vendor commits to support this requirement? And will the Vendor make security incident information available to the City?

What solution the Vendor had implemented to conduct a defense-in-depth assessment (e.g., in-depth packet analysis, traffic throttling, and black-holing) for detection and timely response to network-based attacks associated with anomalous ingress or egress traffic patterns (e.g., MAC spoofing and ARP poisoning attacks) and distributed denial-of-service (DDoS) attacks?

What solution does the Vendor deploy for operating systems hardening and provide management access control to the necessary ports, protocols, and services to meet business needs using technical controls (e.g., antivirus, file integrity monitoring, and logging) as part of their baseline build standard or template?

The City requires that the Vendor must provide evidence of a valid cyber liability insurance policy. Such insurance shall include coverage in an amount sufficient to cover the full replacement value of damage to, alteration of, loss of, theft, dissemination or destruction of electronic data and/or use of confidential information, “property” of the City of Palo Alto that will be in the care, custody, or control of vendor information including but not limited to bank and credit card account information or personal information, such as name, address, social security numbers, protected health information or other personal identification information stored or transmitted in electronic form.

Can the Vendor support this requirement? If yes, please submit “the evidence of valid cyber liability insurance policy” along with the response to this questionnaire.

VISA Questionnaire Page4 of 10

Document Version: v2.7 Form: InfoSec 100

# Response from the Vendor Score Additional Information/Clarification Required from the Vendor

5.1

5.2

5.3

5.4

5.5

5.6

5.7

5.8

5.9

Question

What will be the medium of data exchange between the City and Vendor?

How will the data be kept secure during the data exchange process? Example: (VPN, Data Link, Frame Relay, HTTP, HTTPS, FTP, FTPS, etc.)

How will the City's data be kept physically and logically secure at the Vendor's preferred storage location? Example: Locked storage, Digitally, Encrypted, etc.

What encryption methodologies (3.4ES, AES, etc.) the Vendor can offer to the City to protect data if the data required to transfer through public networks/the Internet)?

What application-level protections are in place to prevent the Vendor or a subcontractor/third party's staff member from viewing unauthorized confidential information? For example, encryption, masking, etc.

What data Security Architecture design used to secure the data (e.g., CDSA, MULITSAFE, CSA Trusted Cloud Architectural Standard, FedRAMP, CAESARS)?

Is the Vendor's encryption technology used to encrypt whole or selective data?

If required by the City, can the Vendor support logically segmenting or encrypting customer data, like data may be produced for a designated tenant only, without compromising other tenant's information? If no, then please explain how the Vendor secures protected data within a multi-tenant hosting environment?

What controls does the Vendor exercise over the qualification and performance of its team? Of their subcontractor/third party’s team(s)? (For example, criminal background verification before employment, providing security training after employment, and managing Role-Based Access Control (RBAC) during employment and network and application access termination upon employment termination.

5.0 DATA SECURITY & PROTECTION

VISA Questionnaire Page5 of 10

Document Version: v2.7 Form: InfoSec 100

# Response from the Vendor Score Additional Information/Clarification Required from the Vendor

6.1

6.2

6.3

6.4

6.5

Are the Vendor’s backup storage devices encrypted? If yes,’ please provide encryption specification with the type of encryption algorithm and detailed methodology of encryption handling. If, not please explain what is the Vendor’s method(s) to keep data secured during the data backup process?

Who on the Vendor’s staff or subcontractor/third party’s staff is/are authorized to access backup data storage media? (Provide Name and Role)

Are the data backup storage media stored at the Vendor’s location or other third-party location?

If the Vendor’s backup storage devices are stored with other third-party location, please provide:

a. Company Name:

b. Address:

c. Contact person detail (Phone and Email):

d. What contractual commitments are in place to guarantee security compliance from these vendors

6.0 DATA BACK-UP

Question What types of storage media will the Vendor use for data backup purposes? Examples: Tape, Hard Disk Drive, or any other devices. What is the media transfer process (I.e., The lockbox process used to send tapes off-site)?

VISA Questionnaire Page6 of 10

Document Version: v2.7 Form: InfoSec 100

# Response from the Vendor Score Additional Information/Clarification Required from the Vendor

7.1

7.2

7.3

7.4

7.5

Please provide details on the Vendor's business continuity plan, including details around how frequently the business continuity plans tested to ensure continuing in the event of a disaster?

The City requires that the Vendor must offer robust disaster recovery and business continuity solutions with maximum 8 (eight) hours RTO (Recovery Time Objective), i.e., in the event of a disaster, the services offered by the Vendor shall not exceed 8 hours downtime, can the Vendor support this requirement? If no then what alternative solution can Vandor offer to satisfy this requirement.

The City requires that as an on-going basis, the Vendor shall offer 99.99% up-time. The Service Level Agreement (SLA) with the Vendor shall ensure the 99.99% up-time requirement; if no, what alternative solution can Vandor offer to satisfy this requirement.

What solution does the Vendor offer for infrastructure service failover recovery?

7.0 BUSINESS CONTINUITY PLANNING (DR-BCP)

Question

Does the Vendor's cloud solution offer independent restore and recovery capabilities? If no, then what alternative solution the Vendor offers?

VISA Questionnaire Page7 of 10

Document Version: v2.7 Form: InfoSec 100

# Response from the Vendor Score Additional Information/Clarification Required from the Vendor

8.1

8.2

8.3

8.4

8.5

The City requires that a minimum of 3 (three) authorized personals from the City of Palo Alto shall have superuser/ super admin access to the Vendor's hosted environment with MFA authentication, can the Vendor support this requirement? If no then what alternative solution can Vandor offer to satisfy this requirement.

8.0 ACCESS CONTROL, ACCOUNT PROVISIONING & DE-PROVISIONING

Question

What is the account provisioning/removal process?

Example: How are user accounts created and managed?)

What is the account de-provisioning/removal process? Example: How are user accounts created and managed?)

How will the City's employees gain access to the application(s) offered by the Vendor?

Does the application(s) have the capability to restrict access only from the City's WAN (Wide Area Network) through 'Ip" filtering? If not, what alternative solution can the Vendor offer?

VISA Questionnaire Page8 of 10

Document Version: v2.7 Form: InfoSec 100

# Response from the Vendor Score Additional Information/Clarification Required from the Vendor

9.1

9.2

9.3

9.4

What will be the policy and procedures for the logging, authentication, authorization, and password management scheme? (Please provide a soft copy of the process)

Where will the login and password credentials be stored?

Are the password credentials stored with encryption? If yes,’ please provide encryption scheme detail.

The Vendor’s application must comply with the following password requirements. Does the Vendor’s application meet these requirements?

1. First-time password must be unique to an individual and require the User to change it upon initial login.

2. If the password is sent via plain text email to the City employee to mitigate security exposure.

3. The City requires a first-time password to have a time-out capability of no more than 7 days.

4. The email notification must not be copied to anyone except the User.

5. The permanent/long term password must be changed frequently (at least TWICE a year)

6. Email notification must be sent to the User whenever the password has been updated.

7. User should not be able to view data or conduct business unless an initial password has been updated with a different password.

8. The Vendor shall inform the City’s users that, when a new password is created, the User shall not use the City’s LDAP (Lightweight Directory Access Control Protocol) password.

9. The password must have 8 or more alphanumeric (/) characters, and it must contain at least one character from each of the bullets noted below (i.e., Each line shall contribute at least one character):

• abcdefghijklmnopqrstuvwxyz

• ABCDEFGHIJKLMNOPQRSTUVWXYZ

• 0123456789

9.0 PASSWORD MANAGEMENT

Question

VISA Questionnaire Page9 of 10

VISA Questionnaire