BEN-25-048 Appendix D COV Ramp Assessment.xlsx
XLSX spreadsheet 236 KB Posted
- Attached to
- BEN-25-048 SNAP/50
- Solicitation number
- RFP-125291
- Issued by
- Virginia
About this file
This is a Commonwealth of Virginia Information Technology Assessment document, specifically a COV Ramp Assessment Questionnaire (Appendix D) designed to evaluate cloud service providers' security compliance for the SNAP Employment and Training (SNAP E&T) program procurement (BEN-25-048). The assessment is based on Standard Form 1-003 and mapped to the SEC 530 security control group. The document functions as a comprehensive security evaluation tool requiring vendors to provide detailed responses, supporting documentation, and evidence that their proposed cloud solutions—whether Software as a Service, Platform as a Service, or Infrastructure as a Service—meet the Commonwealth's information security standards and requirements. Responses must address specific control areas rather than simple yes/no answers, and vendors may invoke proprietary protections under Virginia Code 2.2-4342(F) for trade secrets or sensitive information contained in their submissions.
The assessment covers twenty-one primary security and governance domains, including access control policies and account management; audit and accountability procedures; configuration management; contingency planning and data backup; identification and authentication mechanisms; incident response capabilities; system maintenance and personnel authorization; media protection and data sanitization; physical and environmental security; vulnerability and patch management; malware protection; system communications and encryption protocols; cryptographic key management; data security and lifecycle management; interoperability and portability standards; and organizational security frameworks. Vendors must demonstrate compliance with Commonwealth security standards located at the Virginia Information Technology Agency (VITA) library and provide evidence of annual audits, penetration testing, third-party certifications (such as SOC 2 or ISO 27001), and tenant-accessible documentation. Critical requirements include data residency within the continental United States, support for multi-factor authentication, encryption at rest and in transit using validated algorithms, automatic account lockout provisions, segregation of duties, 24-hour incident notification procedures, and the ability to provide data in industry-standard formats for portability.
View the file
Other files
Show all 24
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Assessment Guidance
| Appendix A for Standard Form 1-003: COV Ramp Assessment | |||
| Work Request # | RITMxxxxxxx | Date | |
| Notes & Comments | |||
| Please ensure every section in this document is fully completed and you do not simply reply with Yes, No, or Not Applicable (NA) response. It is expected that there will be enough information provided to ensure that VITA is able to determine how the security objective is being met. This will help assist with streamlining the process. | |||
| Please complete the below fields for agency name, supplier name and requested Cloud service/product name. | |||
| Requesting Agency | Supplier Name | Supplier Product/Service Name | Approved PGR# |
Note:
1. An answer of 'Yes' to all questions or answering 'No' to any of the questions in the assessment does not automatically constitute an approval, nor will the latter constitute automatic disqualification. Each response will be assessed and reviewed.
2. This assessment does not address all of the requirements outlined in the "Hosted Environment Information Security Standard", as the security standard contains both agency and supplier requirements. This assessment addresses supplier specific requirements that typically raise concerns from the Vendor and/or VITA.
3. As this is just an assessment, all Vendors still need to comply with all applicable Commonwealth Security Standards located at http://www.vita.virginia.gov/library/default.aspx?id=537
4. Supplier: When responding to questions contained within this questionnaire you must submit copies of the supporting policies or procedures or screen grabs of the applicable section of the supporting policies and procedures to support your responses where applicable.
Agency & Supplier: Please acknowledge by entering the authorized name(s) below and current date that you have read and understand the above 'Note' and all of the applicable security standards.
Agency Authorized Contact: Date
| Supplier Authorized POC: | Date | |
| Confidential/Proprietary Information | By placing a "X" in the "yellow highlighted" box to the right of this statment, the Supplier is stating there is data or other materials contained in this COV Ramp Assessment Questionnaire that is a trade secret or proprietary and thus invokes the protection of this data pursuant to the Code of VA §2.2-4342 (F). | |
| Identify the data or other materials to be protected and state the reasons why protection is necessary below: __________________________________________________________________________________________ |
NOTE: FAILURE TO INVOKE THE PROTECTIONS OF §2.2-4342 (F) WILL RESULT IN THIS COV Ramp ASSESSMENT QUESTIONNAIRE BEING SUBJECT TO RELEASE TO OTHER OFFERORS AND THE PUBLIC IN ACCORDANCE WITH THE VIRGINIA PUBLIC PROCUREMENT ACT (VPPA) AND THE VIRGINIA FREEDOM OF INFORMATION ACT (FOIA).
Security & Governance
| Confidential/Proprietary Information | WR Number | RITMxxxxxxx | |||||||
| SEC 530 Mapping Document for SaaS Control Group | CGID | 530 CID | 530 Mapping | Control Specification | Assessment Question | Assessment Response | |||
| Yes | No | N/A | Explanation of response | ||||||
| Cloud Classification & Configuration | CCC-1 | CCC-1.0 | EC -1 | Ensures appropriate information security guards are established. | Is the cloud solution you are proposing a Software as a Service, Platform as a Service, or Infrastructure as a Service Delivery Model | ||||
| Cloud Classification & Configuration | CCC-2 | CCC-2 | EC - 2 | Establishing, monitoring, and operating IT systems in a manner consistent with COV Information Security policies and standards | Are you offering Public, Private or government cloud? Please describe the solution support model. | ||||
| Access Control: Policies & Procedures | ACP-1 | ACP-1.1 | AC-1 | Develops, documents, and disseminates to all organization personnel, contractors, and service providers with a responsibility to implement access controls: | Does the provider have access control policies and procedures that are reviewed and/or updated at least annually or required due to environmental changes? |
(Please provide supporting artifact)
| Access Control - Account Management | ACP-2 | ACP-2.1 | AC-2 | User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest. | Does the solution have the capability to identify and select the following types of accounts: Individual, group, System, Service, Application, Guest/anonymous and temporary? |
| ACP-2.2 | Does the provider have the capability to segment and identify administrative accounts by tenant? | ||||
| ACP-2.3 | Are controls in place to prevent unauthorized access to your application, program or object source code, and assure it is restricted to authorized personnel only? | ||||
| ACP-2.4 | Does provider document how access to tenant data is granted and approved? | ||||
| ACP-2.5 | Is timely deprovisioning, revocation or modification of user access to the organizations systems, information assets and data implemented upon any change in status of employees, contractors, customers, business partners or involved third parties? | ||||
| ACP-2.6 | Do you provide tenants with documentation on how segregation of duties within proposed cloud service offering are maintained? Please provide copy of procedure(s) | ||||
| ACP-2.7 | Control Enhancements for Sensitive Systems Removal of Temporary/Emergency Accounts. | Does the provider or solution automatically terminate temporary and emergency accounts after a predetermined period which is not to exceed 30-days in accordance with sensitivity and risk? Please provide copy of procedure(s) | |||
| Do you provide open encryption methodologies (3.4ES, AES, etc.) to tenants in order for them to protect their data if it is required to move through public networks (e.g., the Internet)? | |||||
| Do you require at least annual certification of entitlements for all system users and administrators (exclusive of users maintained by your tenants)? | |||||
| If users are found to have inappropriate entitlements, are all remediation and certification actions recorded/documented? |
If different actions are taken for Admin and User Accounts, please provide information on both.
| ACP-2.8 | Disable Inactive Accounts | Does the provider or solution automatically disable inactive accounts after 90 consecutive days of non-use? | |||
| ACP-2.9 | Inactivity logout | Does the solution logout users automatically when the session inactivity time has exceeded 30 minutes? | |||
| Access Control - Access Enforcement | ACP-3 | ACP-3.1 | AC-3 | The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies. | Are policies and procedures established for labeling, handling and the security of data and objects that contain data? |
| Access Control - Separation of Duties | ACP-4 | ACP-4.1 | AC-5 | User access policies and procedures shall be established, and supporting business processes and technical measures implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest. | Are controls in place to prevent unauthorized access to your application, program or object source code, and assure it is restricted to authorized personnel only? Provide documentation on controls in place to prevent unauthorized access. |
| Are controls in place to prevent unauthorized access to tenant application, program or object source code, and assure it is restricted to authorized personnel only? Provide documentation on controls in place to prevent unauthorized access. | |||||
| Access Control - Least Privilege | ACP-5 | ACP-5.1 | AC-6 | The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions. | Do you document how you grant and approve access to tenant data? Please procedure for doing this. |
| ACP-5.2 | Do you have a method of aligning provider and tenant data classification methodologies for access control purposes? | ||||
| ACP-5.3 | Will you share user entitlement remediation and certification reports with your tenants, if inappropriate access may have been allowed to tenant data? | ||||
| Access Control - Unsuccessful Logon Attempts | ACP-6 | ACP-6.1 | AC-7 | Enforces a limit of 5 consecutive invalid logon attempts by a user during a 15 minute period; | Do you allow tenants/customers to define password and account lockout policies for their accounts? Provide system password requirements and policies. |
| ACP-6.2 | Automatically locks the account/node for a minimum of a 30 minute period when the maximum number of unsuccessful attempts is exceeded. | Do you support password (minimum length, age, history, complexity) and account lockout (lockout threshold, lockout duration) policy enforcement? Please provide policies for both standard and admin accounts. | |||
| ACP-6.3 | Password Policy must meet or exceed current password policy defined in SEC 501. | Do you support tenant defined password complexity policies? Specify your password length and complexity requirements in the notes field | |||
| Awareness and Training - Policy and Procedures | ATP-1 | ATP-1.1 | AT-1 |
AT-2
AT-2-COV
AT-3
AT-4 Employment agreements shall incorporate provisions and/or terms for adherence to established information governance and security policies and must be signed by newly hired or on-boarded workforce personnel (e.g., full or part-time employee or contingent staff) prior to granting workforce personnel user access to corporate facilities, resources, and assets. Do you specifically train your employees regarding their specific role and the information security controls they must fulfill?
(Please provide supporting artifact)
| ATP-1.2 | Do you document employee acknowledgment of training they have completed? | ||||
| ATP-1.3 | Are all personnel required to sign NDA or Confidentiality Agreements as a condition of employment to protect customer/tenant information? | ||||
| ATP-1.4 | Is successful and timely completion of the training program considered a prerequisite for acquiring and maintaining access to sensitive systems? | ||||
| ATP-1.5 | Are personnel trained and provided with customer defined awareness programs at least once a year? | ||||
| Audit and Control -Audit and Accountability | AUC-1 | AUC-1.1 | AU-1 | Audit plans shall be developed and maintained to address business process disruptions. Auditing plans shall focus on reviewing the effectiveness of the implementation of security operations. All audit activities must be agreed upon prior to executing any audits. | Do you produce audit assertions using a structured, industry accepted format (e.g., Cloud Audit/A6 URI Ontology, Cloud Trust, SCAP/CYBEX, GRC XML, ISACA's Cloud Computing Management Audit/Assurance Program, etc.)? |
(Please provide supporting artifact)
| AUC-1.2 | Are your audits performed at least annually? if no, please describe in the comments section. | |||||
| AUC-1.3 | Independent reviews and assessments shall be performed at least annually to ensure that the organization addresses nonconformities of established policies, standards, procedures, and compliance obligations. | Do you allow tenants to view your SOC2/ISO 27001 or similar third-party audit or certification reports? | ||||
| AUC-1.4 | Do you conduct network penetration tests of your cloud service infrastructure regularly as prescribed by industry best practices and guidance? | |||||
| AUC-1.5 | Do you conduct application penetration tests of your cloud infrastructure regularly as prescribed by industry best practices and guidance? | |||||
| AUC-1.6 | Are the results of the penetration tests available to tenants at their request? | |||||
| AUC-1.7 | Are the results of internal and external audits available to tenants at their request? | |||||
| Audit and Control: | ||||||
| Audit Events | AUC-2 | AUC-2.1 | AU-2 | An event is any observable occurrence in an organizational information system. Organizations identify audit events as those events which are significant and relevant to the security of information systems and the environments in which those systems operate in order to meet specific and ongoing audit needs. | Is the solution capable of auditing the following events? Successful and unsuccessful account logon events, account management events, object access, policy change, privilege functions, process tracking, and system events. | |
| AUC-2.2 | Audit events on Web Applications | Is the solution capable of auditing the following events, for Web applications? All administrator activity, authentication checks, authorization checks, data deletions, data access, data changes, and permission changes. | ||||
| Audit and Control: | ||||||
| Audit Review, Analysis, and Reporting | AUC-3 | AUC-3.1 | AU-6 | Audit Review, Analysis, and Reporting | Is the solution capable of automated mechanisms to centrally review, analyze and correlate audit and log records from multiple components of the solution to support organizational processes for investigation, alerting and response to suspicious activities? is the information available to your tenants? | |
| Audit and Control: | ||||||
| AUC-4 | AUC-4.1 | AU-11 | Is the solution capable of maintaining all audit records in accordance with commonwealth record retention policies found at the following URL? http://www.lva.virginia.gov/agencies/records/ | |||
| Control Assessment and Authorization | CAA-1 | CAA-1.1 | CA-1 |
CA-3
CA-7 Risk assessments associated with data governance requirements shall be conducted at planned intervals and shall consider the following:
• Awareness of where sensitive data is stored and transmitted across applications, databases, servers, and network infrastructure
• Compliance with defined retention periods and end-of-life disposal requirements
• Data classification and protection from unauthorized use, access, loss, destruction, and falsification Do you provide security control health data in order to allow tenants to implement industry standard Continuous Monitoring (which allows continual tenant validation of your physical and logical control status)?
: Is the second sentence too harsh?
| -Michael Atkinson | CAA-1.2 | Do you conduct risk assessments associated with data governance requirements at least once a year? | |||
| Configuration Management - Policy and Procedures | CMP-1 | CMP-1.1 | CM-1 | Organization shall follow a defined quality change control and testing process (e.g., ITIL Service Management) with established baselines, testing, and release standards which focus on system availability, confidentiality, and integrity of systems and services | Do you provide your tenants with documentation that describes your quality assurance process? |
(Please provide supporting artifact)
| CMP-1.2 | Is documentation describing known issues with certain products/services available? | ||
| CMP-1.3 | Are there policies and procedures in place to triage and remedy reported bugs and security vulnerabilities for product and service offerings? Are tenants provided with documentation on remedied issues? | ||
| CMP-1.4 | Are mechanisms in place to ensure that all debugging and test code elements are removed from released software versions? Are there technical controls in place to prevent? | ||
| CMP-2 | CMP-1.1 | CM-2 |
CM-2-COV
CM-3
CM-3-COV
| CM-7 | The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system. | Do you have a capability to continuously monitor and report the compliance of your infrastructure against your information security baselines? | |||
| CMP-1.2 | Do you have controls in place to restrict and monitor the installation of unauthorized software onto your systems? | ||||
| CMP-1.3 | Can you provide evidence that the proposed solution adheres to a security baseline, which is based on least functionality? | ||||
| CMP-1.4 | Are all changes to proposed solution authorized according to change management policies? | ||||
| Contingency Planning - Information System backup | CP-1 | CP-1.1 | CP-2 |
CP4
CP-6
CP-7
CP-9
CP-9-COV
CP-10
SA-9-COV A consistent unified framework for business continuity planning and plan development shall be established, documented, and adopted to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements. Requirements for business continuity plans include the following:
• Defined purpose and scope, aligned with relevant dependencies
• Accessible to and understood by those who will use them
• Owned by a named person(s) who is responsible for their review, update, and approval
• Defined lines of communication, roles, and responsibilities
• Detailed recovery procedures, manual work-around, and reference information
• Method for plan invocation Do you provide tenants with geographically resilient hosting options?
(Please provide locations)
| CP-1.2 | Do you provide tenants with infrastructure service failover capability to other providers? | ||||
| CP-1.3 | Are business continuity plans subject to test at planned intervals or upon significant organizational or environmental changes to ensure continuing effectiveness? | ||||
| CP-1.4 | Can the solution provide and maintain a backup of commonwealth data that can be recovered in an orderly and timely manner within a predefined frequency consistent with recovery time and recovery point objectives? | ||||
| CP-1.5 | Can the solution store a backup of commonwealth data, at least daily, in an off-site “hardened” facility, located within the continental United States, maintaining the security of commonwealth data? | ||||
| CP-1.6 | Can the solution partition, in aggregate for this proposal, all commonwealth data submitted into the solution by the data owner in such a manner that it will not be impacted or forfeited due to E-discovery, search and seizure or other actions by third parties obtaining or attempting to obtain records, information or commonwealth data for reasons or activities that are not directly related to the business of the data owner? | ||||
| Identification and Authentication; Organizational Users | IDA-1 | IDA-1.1 | IA-1 | Vendor should have An identification and authentication policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance | Does your management provision the authorization and restrictions for user access (e.g., employees, contractors, customers (tenants), business partners and/or suppliers) prior to their access to data and any owned or managed (physical and virtual) applications, infrastructure systems and network components? |
(Please provide supporting artifact)
| IDA-1.2 | |||||
| IDA-1.3 | Procedures to facilitate the implementation of the identification and authentication policy and associated identification and authentication controls | Do you require at least annual updates and reviews of your access policies for all system users and administrators (exclusive of users maintained by your tenants)? | |||
| Identification and Authentication; Authenticator Management | IDA-2 | IDA-1.1 | IA-2 |
IA-5
Internal agency or customer (tenant) user account credentials shall be restricted as per the following, ensuring appropriate identity, entitlement, and access management and in accordance with established policies and procedures:
• Identity trust verification and service-to-service application (API) and information processing interoperability (e.g., SSO and Federation)
• Account credential lifecycle management from instantiation through revocation
• Account credential and/or identity store minimization or re-use when feasible
| • Adherence to industry acceptable and/or regulatory compliant authentication, authorization, and accounting (AAA) rules (e.g., strong/multi-factor, expireable, non-shared authentication secrets) | Do you support use of, or integration with, existing customer-based Single Sign On (SSO) solutions to your service? | ||||
| IDA-1.2 | Do you support identity federation standards (SAML, SPML, WS-Federation, etc.) as a means of authenticating/authorizing users? | ||||
| IDA-1.3 | Do you have an identity management system (enabling classification of data for a tenant) in place to enable both role-based and context-based entitlement to data? | ||||
| IDA-1.4 | Do you provide tenants with strong (multifactor) authentication options (digital certs, tokens, biometrics, etc.) for user access? | ||||
| IDA-1.5 | Do you allow tenants to use third-party identity assurance services? | ||||
| IDA-1.6 | Do you support password (minimum length, age, history, complexity) and account lockout (lockout threshold, lockout duration) policy enforcement? | ||||
| IDA-1.7 | Do you support the ability to force password changes upon first logon? | ||||
| IDA-1.8 | Do you have mechanisms in place for unlocking accounts that have been locked out (e.g., self-service via email, defined challenge questions, manual unlock)? | ||||
| Incident Response | IR-1 | IR-1.1 | IR-4 |
IR-5
IR-6
Identify immediate mitigation procedures, including specific instructions, based on information security incident categorization level, on whether or not to shut down or disconnect affected IT systems. Establish procedures for information security incident investigation, preservation of evidence, and forensic analysis. Do you have a documented security incident response plan?
(Please provide supporting artifact)
| IR-1.2 | Do you integrate customized tenant requirements into your security incident response plans? | |||||
| IR-1.3 | Do you publish a roles and responsibilities document specifying what you vs. your tenants are responsible for during security incidents? | |||||
| IR-1.4 | Have you tested your security incident response plans in the last year? | |||||
| IR-1.5 | The organization tracks and documents information system security incidents. | Do you monitor and quantify the types, volumes and impacts on all information security incidents? | ||||
| IR-1.6 | Will you share statistical information for security incident data with your tenants upon request? | |||||
| IR-1.7 | Requires personnel to report suspected security incidents to the organizational incident response capability within 24 hours from when the agency discovered or should have discovered their occurrence; and Reports security incident information to designated authorities. | Do you have a defined and documented incident notification process for reporting suspected security incidents within 24 hours? | ||||
| IR-1.8 | Does your security information and event management (SIEM) system merge data sources (app logs, firewall logs, IDS logs, physical access logs, etc.) for granular analysis and alerting? | |||||
| IR-1.9 | Do you maintain liaisons and points of contact with local authorities in accordance with contracts and appropriate regulations? | |||||
| IR-1.10 | Do you enforce and attest to tenant data separation when producing data in response to legal subpoenas? | |||||
| System Maintenance Policy and Procedures | MA-5 | MA-5.1 | MA-5 | |||
| MA-5-COV | Establishes a process for maintenance personnel authorization and maintains a list of authorized maintenance organizations or personnel. | Do you have a documented process for maintenance personnel? | ||||
| The organization shall develop and publish a maintenance personnel policy that requires all system/service maintenance and support be performed by United States citizens or individuals with a valid H1B visa. | Can you attest to the fact that system/service maintenance and support will be performed by United States citizens or individuals with a valid H1B visa? | |||||
| Media Protection Policy and Procedures: | ||||||
| Media Sanitization | MPP-1 | MPP-1.1 | MP-6 | |||
| MP-6-COV | Policies and procedures shall be established with supporting business processes and technical measures implemented for the secure disposal and complete removal of data from all storage media, ensuring data is not recoverable by any computer forensic means. | Do you support secure deletion (e.g., degaussing/cryptographic wiping) of archived and backed-up data as determined by the tenant? | ||||
| MPP-1.2 | Does supplier meet all data disposal requirements as outlined in the current Removal of Commonwealth Data from Electronic Media Standard (SEC514-04)? | |||||
| Physical and Environmental Protection: Physical Access Authorizations | PEP-1 | PEP-1.1 | PE-2(1) | |||
| PE-2(3) | The organization authorizes physical access to the facility where the information system resides based on position or role. | Can you provide a published procedure for exiting the service arrangement, including assurance to sanitize all computing resources of tenant data once a customer has exited your environment or has vacated a resource? | ||||
| Physical and Environmental Protection: | ||||||
| Physical Access Control | PEP-2 | PEP-2.1 | PE-3 | Ingress and egress points such as service areas and other points where unauthorized personnel may enter the premises shall be monitored, controlled and, if possible, isolated from data storage and processing facilities to prevent unauthorized data corruption, compromise, and loss. | Do you restrict physical access to information assets and functions by users and support personnel? | |
| PEP-2.2 | Are ingress and egress points, such as service areas and other points where unauthorized personnel may enter the premises, monitored, controlled and isolated from data storage and process? | |||||
| Physical and Environmental Protection: | ||||||
| Physical Location | PEP-3 | PEP-3.1 | PE-18-COV | |||
| SA-9-COV-1 | All information system components and services remain within the continental United States. |
All physical components associated with an information system or service classified as sensitive with respect to confidentiality or integrity must be housed within the same storage location dedicated for the exclusive use of the organization and are clearly marked.
| Each hypervisor can only host one tier of the application architecture and no hypervisor may host the application interface and the data storage component for any information system, even if the components in question do not interact within the same information system. | Do you allow tenants to define acceptable geographical locations for data routing or resource instantiation? | |||
| Can you attest to the fact that commonwealth data will remain within the continental United States? | ||||
| PEP-3.2 | Can you provide the physical geographical location of the storage in advance for a tenants data? | |||
| PEP-3.3 | Can you provide the physical geographical location of a tenants data upon request? | |||
| PEP-3.4 | Can you ensure that data does not migrate beyond a defined geographical residency? | |||
| PEP-3.5 | Do you have the capability to restrict the storage of customer data to specific countries or geographic locations? | |||
| PEP-3.6 | Does the solution have the capability to set affinity on tiered systems, no one hypervisor can host the application and the data storage? | |||
| System and Information Integrity: | ||||
| Vulnerability / Patch Management (Flaw Remediation) | SII-1 | SII-1.1 | RA-5 |
SI-2
SI-2-COV
Policies and procedures shall be established, and supporting processes and technical measures implemented, for timely detection of vulnerabilities within organizationally-owned or managed applications, infrastructure network and system components (e.g., network vulnerability assessment, penetration testing) to ensure the efficiency of implemented security controls. A risk-based model for prioritizing remediation of identified vulnerabilities shall be used. Changes shall be managed through a change management process for all vendor-supplied patches, configuration changes, or changes to the organization's internally developed software. Upon request, the provider informs customer (tenant) of policies and procedures and identified weaknesses especially if customer (tenant) data is used as part the service and/or customer (tenant) has some shared responsibility over implementation of control. Do you conduct network-layer vulnerability scans regularly as prescribed by industry best practices?
(Provide the frequency) SII-1.2 Do you conduct application-layer vulnerability scans regularly as prescribed by industry best practices?
(Provide the frequency) SII-1.3 Do you conduct local operating system-layer vulnerability scans regularly as prescribed by industry best practices?
(Provide the frequency)
| SII-1.4 | Will you make the results of vulnerability scans available to tenants at their request? | |||||
| SII-1.5 | Do you have a capability to rapidly patch vulnerabilities across all of your computing devices, applications and systems? | |||||
| SII-1.6 | Will you provide your risk-based systems patching time frames to your tenants upon request? | |||||
| System and Information Integrity: | ||||||
| Malicious Code protection | SII-2 | SII-2.1 | SI-3 | |||
| SI-3-COV | Policies and procedures shall be established, and supporting business processes and technical measures implemented, to prevent the execution of malware on organizationally-owned or managed user end-point devices (i.e., issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components. | Does the provider ensure that they will utilize industry standard malware protection, incorporating both signature and non-signature-based detection mechanisms, on all systems with access to commonwealth data? | ||||
| SII-2.1 | Does the provider ensure that malware protection will be centrally managed and receive regular automatic updates to malicious code protection mechanisms and data files from the software vendor? | |||||
| System and Communications Protection: | ||||||
| Boundary Protection | SCP-1 | SCP-01.1 | SC-7 | Policies and procedures shall be established, and supporting business processes and technical measures implemented, for the use of encryption protocols for protection of sensitive data in storage (e.g., databases) and data in transmission (e.g., system interfaces, over public networks, and electronic messaging) as per applicable legal, statutory, and regulatory compliance obligations. | Does the provider ensure that the solution will utilize industry standard firewalls regulating all data entering the internal data network from any external source which will enforce secure connections between internal and external systems and will permit only authorized data to pass through? | |
| SCP-01.2 | Does the offeror ensure that external connections incorporated into the solution have appropriate security controls including industry standard intrusion detection and countermeasures that will detect and terminate any unauthorized activity prior to entering the firewall maintained by offeror? | |||||
| System and Communications Protection; | ||||||
| Encryption | SCP-2 | SCP-02.1 | SC-1 |
SC-8
SC-8-COV
SC-23
| SC-28 | Do you encrypt tenant data at rest (on disk/storage) within your environment? | |||
| SCP-02.2 | Do you use encryption for storing and transmitting email attachments? | |||
| SCP-02.3 | Do you leverage encryption to protect data and virtual machine images during transport across and between networks and hypervisor instances? | |||
| SCP-02.4 | Do you support tenant-generated encryption keys or permit tenants to encrypt data to an identity without access to a public key certificate (e.g., identity-based encryption)? | |||
| SCP-02.5 | Do you have documentation establishing and defining your encryption management policies, procedures and guidelines? | |||
| Systems and Communication Protection; Cryptographic Key Establishment and Management | ||||
| SCP-3 | SCP-3.1 | SC-12 |
SC-12-COV
SC-13
| SC-13-COV | The organization establishes and manages cryptographic keys for required cryptography employed within the information system in accordance with the organization-defined requirements for key generation, distribution, storage, access, and destruction. Platform and data appropriate encryption (e.g., AES-256) in open/validated formats and standard algorithms shall be required. Keys shall not be stored in the cloud (i.e. at the cloud provider in question), but maintained by the cloud consumer or trusted key management provider. Key management and key usage shall be separated duties. | Do you have platform and data appropriate encryption that uses open/validated formats and standard algorithms? | ||||
| SCP-3.2 | Do you support encryption keys being solely maintained by the cloud consumer or a trusted key management provider? | |||||
| SCP-3.3 | Do you store encryption keys in the cloud? | |||||
| SCP-3.4 | Do you have separate key management and key usage duties? | |||||
| Data Security & Information Lifecycle Management | ||||||
| Nonproduction Data | DS-01 | DS-01.1 | SA-11 | Production data shall not be replicated or used in non-production environments. Any use of customer data in non-production environments requires explicit, documented approval from all customers whose data is affected, and must comply with all legal and regulatory requirements for scrubbing of sensitive data elements. | Do you have procedures in place to ensure production data shall not be replicated or used in non-production environments? | |
| VITA Governance - Portability Requirements | ||||||
| Interoperability & Portability | ||||||
| APIs | IPY-01 | IPY-01 | COV Ramp -1 | The provider shall use open and published APIs to ensure support for interoperability between components and to facilitate migrating applications. | Do you publish a list of all APIs available in the service and indicate which are standard and which are customized? | |
| Interoperability & Portability | ||||||
| Data Request | IPY-02 | IPY-02 | COV Ramp -2 | All structured and unstructured data shall be available to the customer and provided to them upon request in an industry-standard format (e.g., .doc, .xls, .pdf, logs, and flat files). | Is customer data (Structured & Unstructured) available on request in an industry-standard format (e.g., .doc, .xls, or .pdf)? | |
| Interoperability & Portability | ||||||
| Policy & Legal | IPY-03 | IPY-03.1 | COV Ramp -3 | Policies, procedures, and mutually-agreed upon provisions and/or terms shall be established to satisfy customer (tenant) requirements for service-to-service application (API) and information processing interoperability, and portability for application development and information exchange, usage, and integrity persistence. | Do you provide policies and procedures (i.e. service level agreements) governing the use of APIs for interoperability between your service and third-party applications? | |
| IPY-03.2 | COV Ramp -4 | Do you provide policies and procedures (i.e. service level agreements) governing the migration of application data to and from your service? | ||||
| Interoperability & Portability | ||||||
| Standardized Network Protocols | IPY-04 | IPY-04.1 | COV Ramp - 5 | The provider shall use secure (e.g., non-clear text and authenticated) standardized network protocols for the import and export of data and to manage the service, and shall make available a document to consumers (tenants) detailing the relevant interoperability and portability standards that are involved. | Can data import, data export and service management be conducted over secure (e.g., non-clear text and authenticated), industry accepted standardized network protocols? | |
| IPY-04.2 | COV Ramp - 6 | Do you provide consumers (tenants) with documentation detailing the relevant interoperability and portability network protocol standards that are involved? | ||||
| Interoperability & Portability | ||||||
| Virtualization | IPY-05 | IPY-05.1 | COV Ramp - 7 | The provider shall use an industry-recognized virtualization platform and standard virtualization formats (e.g., OVF) to help ensure interoperability, and shall have documented custom changes made to any hypervisor in use, and all solution-specific virtualization hooks, available for customer review. | Do you use an industry-recognized virtualization platform and standard virtualization formats (e.g.., OVF) to help ensure interoperability? | |
| IPY-05.2 | COV Ramp - 8 | Do you have documented custom changes made to any hypervisor in use, and all solution-specific virtualization hooks available for customer review? | ||||
| Security Framework - Organizational Security Framework | SF -01 | SF-01.1 | COV Ramp - 9 | Design, acquisition, implementation, configuration, modification, and management of infrastructure and software are consistent with defined processing integrity and related security policies. | What Security Framework do you follow (.i.e. NIST, , ISO/IEC 27001, etc…,)? | |
| Artificial Intelligence | AI -01 | AI-01.1 | COV Ramp - 10 | VITA and agencies are charged to ensure the responsible, ethical and transparent use of artificial intelligence technology by state government in order to protect the rights of Virginians, while delivering innovation and vetting uses for this emerging technology to help deliver a best-in-class state govenrment. | Does the solution utilize the use of AI technology? If yes, please provide the name of the AI technology in use and how that technology is being used within the solution and how it is monitored. |
image1.png image2.png
File details come from the government source that posted it. Updated .