Cloud_Vendor_Questionnaire.xlsx
XLSX spreadsheet 23 KB Posted
- Attached to
- RFP Fleet GPS
- Solicitation number
- GEN 0027-24
- Issued by
- Lee County, Fruitville CDP, Florida
About this file
The document is a Cloud Vendor Security Questionnaire from an unspecified government entity, designed to comprehensively assess a potential cloud vendor's information security practices across 17 distinct domains. The questionnaire appears to be specifically related to a GPS fleet vehicle services procurement by the City of Fort Myers, Florida, and is structured to evaluate a vendor's cybersecurity posture through a series of yes/no questions addressing risk levels ranging from low to high. The questionnaire covers critical areas such as document security, asset management, governance, supply chain risk management, identity and access control, human resource security, data protection, system development, physical security, incident management, privacy, disaster recovery, and vulnerability management.
The security assessment is particularly rigorous, with each section containing multiple detailed questions that probe the vendor's capabilities in protecting organizational data, managing access controls, responding to security incidents, and maintaining robust technological safeguards. While no specific pricing details are provided, the questionnaire implies that vendors must demonstrate comprehensive security protocols across technological, procedural, and personnel domains to be considered for the fleet GPS service contract. The document suggests a high-stakes evaluation process where vendors must provide detailed evidence of their security practices, with particular emphasis on protecting sensitive information, managing system vulnerabilities, and maintaining continuous security monitoring and incident response capabilities.
View the file
Other files
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Cloud Vendor Security Questionnaire | ||||
| When considering any IT hardware/software solution, must ensure that due diligence is taken to ensure section and then respond to all questions and provide supporting documentation as requested. Some r attach the document directly into the Vendor Comments cell. | ||||
| # | Question | Risk Baseline | Vendor Comments | Vendor Response |
| 1 | Document Requests and Information Security Policies | LOW, MEDIUM, HIGH | ||
| 1.1 | Please attach a copy of your current Cyber liability insurance and Professional Liability insurance policies | HIGH | Yes or No | |
| 1.2 | Please attacha copy of any information security policy or privacy certifications (e.g. ISO 27001, PCI DSS, GDPR) | LOW, MEDIUM, HIGH | Yes or No | |
| 1.2a | Does the vendor have an Information Security Code of Conduct or Charter? | LOW, MEDIUM, HIGH | Yes or No | |
| 1.2b | Does the vendor have individual(s) that are responsible for their IT Security Program? | LOW, MEDIUM, HIGH | Yes or No | |
| 1.2c | Does the vendor have a Risk Management Program that includes IT related risks? | MEDIUM, HIGH | Yes or No | |
| 1.3 | Please attach a copy of any relevant audit reports that cover information security controls (e.g. SOC II Type II, ISO 27005. | HIGH | Yes or No | |
| 1.3a | Does the vendor have a SOC3 audit report covering application controls? | HIGH | Yes or No | |
| 1.4 | Please attach a copy of your latest penetration test and /or vuknerability assessment report. | HIGH | Yes or No | |
| 1.4a | Does the vendor regularly engage thrd parties to perform security evaluations of their system? | MEDIUM, HIGH | Yes or No | |
| 1.5 | Does the type of information processed or stored by the solution include confidential information (e.g. CJI, PII, PFI, CHD, research and development data)? | HIGH | Yes or No | |
| 1.5a | Does the solution involve a vendor or other third party transmitting, processing or storing protected criminal justice information (CJI)? Has an FDLE Cloud Implementation Plan been approved? | HIGH | Yes or No | |
| 1.5b | Does the solution omvolve a vendor or third party transmitting, processing or storing protected health information (PHI)? Has a Business Associate Agreement been signed? | HIGH | Yes or No | |
| 1.6 | Is the solution designed to comply with PCI, HIPPA, CJIS and other requirements? | HIGH | Yes or No | |
| 1.7 | Does the vendor outsource management or support of the solution? | HIGH | Yes or No | |
| 1.8 | Does the vendor have processes to monitor changes to regulations, and to Implement applicable changes in a timely manner? | HIGH | Yes or No | |
| 1.9 | Is the solution hosted vendor-hosted or SaaS, IaaS, or PaaS based? | MEDIUM, HIGH | ||
| 1.9a | If yes to 1.9, does the security design of the solutions infrastructure allow for segregation of each customer's application environment and data? | MEDIUM, HIGH | Yes or No | |
| 2 | Asset Management | LOW, MEDIUM, HIGH | ||
| 2.1 | Do you maintain an inventory of all hardware and software assets, including ownership? | LOW, MEDIUM, HIGH | Yes or No | |
| 2.2 | Do you have information classification scheme and process designed to ensure that information is protected according to its confidentiality requirements? | MEDIUM, HIGH | Yes or No | |
| 2.3 | Do you maintain an inventory or map of data flows between both internal and external information systems? | HIGH | Yes or No | |
| 3 | Governance | LOW, MEDIUM, HIGH | ||
| 3.1 | Do you have an information security policy that has been approved by management and communicated to all applicable parties? | LOW, MEDIUM, HIGH | Yes or No | |
| 3.2 | Do you have an information security policy exception process that includes formal acceptance or risk by the risk owner? | MEDIUM, HIGH | Yes or No | |
| 3.3 | Do you have a process for reviewing you information security policy at least biennially? | HIGH | Yes or No | |
| 3.4 | Do you regularly perform security threat and risk assessments on critical information systems using an industry-standard risk assessment methodology? | HIGH | Yes or No | |
| 3.5 | Have you designated an individual, who is at least at a manager level, who is responsible for information security activities? | LOW, MEDIUM, HIGH | Yes or No | |
| 3.6 | Do you have a process designed to monitor changes to regulations and ensure compliance with relevant security requirements? | HIGH | Yes or No | |
| 4 | Supply Chain Risk Management | LOW, MEDIUM, HIGH | ||
| 4.1 | Do you perform security assessments on potential suppliers prior to entering into agreements with them? | LOW, MEDIUM, HIGH | Yes or No | |
| 4.2 | Do your agreements with suppliers include appropriate measures designed to meet security requirements? | MEDIUM, HIGH | Yes or No | |
| 4.3 | Do you regularly evaluate with suppliers to ensure tha they are meeting their security requirements? | HIGH | Yes or No | |
| 5 | Identity Management, Authenrication, and Access Control | LOW, MEDIUM, HIGH | ||
| 5.1 | Is all access to information systems formally approved by the appropriate asset owner? | LOW, MEDIUM, HIGH | Yes or No | |
| 5.2 | Call all access to information systems be traced to unique individuals? | MEDIUM, HIGH | Yes or No | |
| 5.3 | Are all access rights to information systems regularly reviewed for appropriateness by the asset owners? | LOW, MEDIUM, HIGH | Yes or No | |
| 5.4 | Are all access rights to information systems immediately revoked upon emoloyee/contractor termination or change of role? | HIGH | Yes or No | |
| 5.5 | Do you restrict and control the use of privileged accounts through the use of a Privileged Account Management system or equivalent controls? | HIGH | Yes or No | |
| 5.6 | Do you manage access permissions and authorizations, incorporating the principles of least privilege (or "need to know") and separation of duties? | MEDIUM, HIGH | Yes or No | |
| 5.6a | Does the solution operate on the premise that "access that is not explicitly authorized is forbidden"? | LOW, MEDIUM, HIGH | Yes or No | |
| 5.7 | Do you require the use of multi-factor authentication for all remote access to organizational data, including email? | MEDIUM, HIGH | Yes or No | |
| 5.8 | Do you require the use of multi-factor authentication for all administrative access to clode-based information systems? | HIGH | Yes or No | |
| 5.9 | Does the solution allow the use of generic ID's & logins for access? | MEDIUM, HIGH | Yes or No | |
| 5.9a | Does the solution support role base access control? | MEDIUM, HIGH | Yes or No | |
| 5.9b | Does the solution have a configurable, automatic logoff feature after a period of inactivity? | MEDIUM, HIGH | Yes or No | |
| 5.9c | Does the solution require secre methods of access (SSH, etc.) for technical support or third-party access? | MEDIUM, HIGH | Yes or No | |
| 5.9d | Does the solution have functionality to identify inactive accounts? | MEDIUM, HIGH | Yes or No | |
| 5.9e | Does the solution integrate with Active Directory (Azure) AD for user authentication? | MEDIUM, HIGH | Yes or No | |
| 5.9f | Does the solution support the use of mobile devices? | MEDIUM, HIGH | Yes or No | |
| 5.9g | Does the solution provide carious levels of security based on the classification of data? | HIGH | Yes or No | |
| 5.9h | Does the solution allow for restriction off access based on source IP address? | MEDIUM, HIGH | Yes or No | |
| 5.9i | Does the solution require unique user IDs for each user? | MEDIUM, HIGH | Yes or No | |
| 5.9j | Does the solution require both a unique user ID & password for authentication? | MEDIUM, HIGH | Yes or No | |
| 5.9k | Does the solution support the use of complex passwords? | MEDIUM, HIGH | Yes or No | |
| 5.9l | Does the solution avoid the use of "default" passwords? | HIGH | Yes or No | |
| 5.9m | Does the solution have configurable settings for password history & change requirements? | MEDIUM, HIGH | Yes or No | |
| 5.9n | Does the solution include configurable account lockout settings? | MEDIUM, HIGH | Yes or No | |
| 5.9o | Are the Passwords unreadable during login? | HIGH | Yes or No | |
| 5.9p | Are the Passwords always encrypted in storage? | HIGH | Yes or No | |
| 5.9q | Are all "default" passwords changed during system installation? | HIGH | Yes or No | |
| 6 | Human Resource Security & Unauthorized Access to Data | LOW, MEDIUM, HIGH | ||
| 6.1 | Do you have an information security awareness program designed to ensure that all employees and contractors receive security education as relevant to their job fuction? | LOW, MEDIUM, HIGH | Yes or No | |
| 6.2 | Do you conduct regular phishing simulation tests of your employees? | HIGH | Yes or No | |
| 6.3 | Do you conduct appropriate background checks on all new employees based on the sensitivity of the role that they are being hired for? | MEDIUM, HIGH | Yes or No | |
| 6.4 | Do you require all new employees and contractors to sign confidentiality agreements? | MEDIUM, HIGH | Yes or No | |
| 6.5 | Does the vendor's workforce understand their responsibilities regarding the copying and disclosing of sensitive information? | MEDIUM, HIGH | Yes or No | |
| 7 | Data Security | LOW, MEDIUM, HIGH | ||
| 7.1 | Do you require that all removable media, which may contain organizational data, is encrypted? | LOW, MEDIUM, HIGH | Yes or No | |
| 7.2 | Do you require that all media, including hardcopies, containing organizational data is disosed of securely when no longer required? | LOW, MEDIUM, HIGH | Yes or No | |
| 7.3 | Have you implemented data loss prevention tools? | HIGH | Yes or No | |
| 7.4 | Do you employ full disk encryption on all laptops? | MEDIUM, HIGH | Yes or No | |
| 7.5 | Do you encrypt databases? | HIGH | Yes or No | |
| 7.6 | Does the vendor have methods to identify data leaving the organization in an unauthorized manner? | MEDIUM, HIGH | Yes or No | |
| 8 | System & Software Acquisition, Development, & Change Control | LOW, MEDIUM, HIGH | ||
| 8.1 | Are information security requirements defined for all new information systems, whether acquired or developed? | LOW, MEDIUM, HIGH | Yes or No | |
| 8.2 | Are development and testing environments separate from the production environment? | MEDIUM, HIGH | Yes or No | |
| 8.3 | Is data used for development and testing protected through anonymization? | LOW, MEDIUM, HIGH | Yes or No | |
| 8.4 | Are information security requirements tested to ensure that they function as designed? | MEDIUM, HIGH | Yes or No | |
| 8.5 | Are your applications developed with secure coding practices, including the OWASP Top 10 Most Critical Web Application Security Risk? | MEDIUM, HIGH | Yes or No | |
| 8.6 | Are your web applications protected by an application layer firewall? | HIGH | Yes or No | |
| 8.7 | Do you incorporate threat modeling into application design? | HIGH | Yes or No | |
| 8.8 | Is application source code tested for vulnerabilities using source code reviews or static application security testing? | MEDIUM, HIGH | Yes or No | |
| 8.9 | Are new information systems scanned for vulnerabilities prior to deployment? | MEDIUM, HIGH | Yes or No | |
| 8.10 | Do you monitor and restrict the installation of unauthorized software? | HIGH | Yes or No | |
| 8.11 | Does the vendor closely manage outsourced software development processes? | MEDIUM, HIGH | Yes or No | |
| 8.12 | Does the vendor have separate development, test & production environments for programming? | MEDIUM, HIGH | Yes or No | |
| 8.13 | Is a detailed security testing of application, including peer review, part of the software development process? | MEDIUM, HIGH | Yes or No | |
| 8.14 | Do change management procedures include testing & approval of code changes prior to implementation? | MEDIUM, HIGH | Yes or No | |
| 8.15 | Does the vendor conduct continuous testing to ensure that code changes to the application do not introduce vulnerabilities? | MEDIUM, HIGH | Yes or No | |
| 8.16 | Does the vendor provide information regarding 3rd party applications that solution utilizes? | MEDIUM, HIGH | Yes or No | |
| 8.17 | Does the vendor use the minimum information or data necessary for solution setup and ongoing processing? | MEDIUM, HIGH | Yes or No | |
| 8.18 | Does the vendor solution include de-identifying confidential date (if applicable) used for testing? attacks? | MEDIUM, HIGH | Yes or No | |
| 8.19 | Does the vendor environment utilize methods to detect & bloack application level software sattacks? | MEDIUM, HIGH | Yes or No | |
| 9 | Physical and Environmental Security | LOW, MEDIUM, HIGH | ||
| 9.1 | Are physical security perimeter controls implemented around sensitive locations such as data centers? | LOW, MEDIUM, HIGH | Yes or No | |
| 9.2 | Are all visitors appropriately identified, logged, and escorted while in sensitive locations? | MEDIUM, HIGH | Yes or No | |
| 9.3 | Has an ISO, SSAE16 or SOC II audit of data center controls been performed? | MEDIUM, HIGH | Yes or No | |
| 9.4 | As per question 1.3, is a current SOCII Type II or other like kind report available for review? | MEDIUM, HIGH | Yes or No | |
| 9.5 | Does the physical controls for the data center facilities, include controls such as locks, keys, video survelliance and related physical security access controls? | MEDIUM, HIGH | Yes or No | |
| 9.6 | Does the physical controls for the data facilities, include controls such as backup power supplies, generators, etc.? | MEDIUM, HIGH | Yes or No | |
| 9.7 | Does the vendor have policies & processes in place for the secure disposal and reuse of IT equipment? | MEDIUM, HIGH | Yes or No | |
| 10 | Information Protection Processes and Procedures | LOW, MEDIUM, HIGH | ||
| 10.1 | Are security configuration baselines defined and implemented for all endpoints and net work devises? | MEDIUM, HIGH | Yes or No | |
| 10.2 | Do you use automated tools to verify that endpoints and network devices comply with their baselines? | HIGH | Yes or No | |
| 10.3 | Do you segregate your network into zones based on trust levels, and control the flow of traffic between zones? | MEDIUM, HIGH | Yes or No | |
| 10.4 | Do you control the transfer of information to external parties through authentication and encryption? | LOW, MEDIUM, HIGH | Yes or No | |
| 10.5 | Are all changes to information systems recorded, planned, and tested? | MEDIUM, HIGH | Yes or No | |
| 10.6 | Are all information systems that are susceptible to malware protected by up-to-date anti-mallware software? | LOW, MEDIUM, HIGH | Yes or No | |
| 10.7 | Do you have backup and recovery process designed to ensure that data can be recovered in the event of unexpected loss? | LOW, MEDIUM, HIGH | Yes or No | |
| 10.8 | Do you segretate wireless network access for BYOD and guest access from your production network? | MEDIUM, HIGH | Yes or No | |
| 10.9 | Do you enforce containerization on all mobile devices that may contain organizsational data, including email, whether those devices are owned by the organizsation or by employees? | MEDIUM, HIGH | Yes or No | |
| 10.10 | Do you have the capability of deleting all organizational data from mobil devices, whether owned by the organization or by employees, in the event that the device is lost or stolen? | HIGH | Yes or No | |
| 10.11 | Do you monitor external sources, such as vendor bulletins, for newly identified identified vulnerabilities and patches? | MEDIUM, HIGH | Yes or No | |
| 10.12 | Do you evaluate, test, and apply information system patches in a timely fashion according to their risk? | LOW, MEDIUM, HIGH | Yes or No | |
| 11 | Data Protection & Protective Technology | LOW, MEDIUM, HIGH | ||
| 11.1 | Have security event logging requirements been defined, and are all information systems configured to meet logging requirements? | LOW, MEDIUM, HIGH | Yes or No | |
| 11.2 | Are security event logs protected and retained per defined logging requirements? | MEDIUM, HIGH | Yes or No | |
| 11.3 | Have you deployed intrusion detection or prevention systems at the network perimeter? | LOW, MEDIUM, HIGH | Yes or No | |
| 11.4 | Have you deployed tools to limit web browsing activity based on URL categories? | HIGH | Yes or No | |
| 11.5 | Have you deployed controls to detect and mitigate denial of service attacks? | MEDIUM, HIGH | Yes or No | |
| 11.6 | Does the solution provide encryption of data at rest? | HIGH | Yes or No | |
| 11.6a | Is data at rest encrypted using at least a 256 bit encryption key? | HIGH | Yes or No | |
| 11.6b | Does the solution use known secure encryption algorithms with strong keys? | HIGH | Yes or No | |
| 11.6c | Are there management policies & procedures in place to protect the use & storage of cryptographic keys (PKI)? | HIGH | Yes or No | |
| 11.6d | Are data encryption policies enforced for all workstations & laptops that store confidential information? | MEDIUM, HIGH | Yes or No | |
| 11.6e | Is any data housed, stored or located outside of the continental United States? | MEDIUM, HIGH | Yes or No | |
| 11.6f | Does the solution securely transmit data over public networks? | MEDIUM, HIGH | Yes or No | |
| 11.6g | Does the solutions use HTTPS/TLSv1.2 256 bit or better protection for the data in transit? | MEDIUM, HIGH | Yes or No | |
| 11.6h | Does the solution transmit bulk data in flight via secure methods (e.g., secure VPN, SFTP, SCP, FTPS, etc.)? | MEDIUM, HIGH | Yes or No | |
| 11.6i | Does the solution support the use of email encryption if confidential data is emailed (e.g., TLS, PGP, etc.)? | MEDIUM, HIGH | Yes or No | |
| 12 | Security Continuous Monitoring & Login Auditing | LOW, MEDIUM, HIGH | ||
| 12.1 | Have you deployed automated tools to collect, correlate, and analyze security event logs from multiple sources for anomalies? | LOW, MEDIUM, HIGH | Yes or No | |
| 12.2 | Do you monitor privileged user activity to detect potential security events? | MEDIUM, HIGH | Yes or No | |
| 12.3 | Do you monitor user activity to detect potential security events? | HIGH | Yes or No | |
| 12.4 | Are security alerts monitored 24x7? | HIGH | Yes or No | |
| 12.5 | Do you employ automated tools to scan information systems for vulnerabilities on a regular basis? | LOW, MEDIUM, HIGH | Yes or No | |
| 12.6 | Do you perform penetration tests on all web applications and services, in accordance with standard penetration testing methodologies? | HIGH | Yes or No | |
| 12.7 | Does the solution record all exceptions & security relevant events in application & systems logs? | MEDIUM, HIGH | Yes or No | |
| 12.8 | Are all audit logs secure from modifications? | MEDIUM, HIGH | Yes or No | |
| 12.9 | Are the application audit logs recorded? | LOW, MEDIUM, HIGH | Yes or No | |
| 12.9a | Are the logs regularly reviewed to examine user ID's, dates & times of log on & log off, login failure events, etc.? | MEDIUM, HIGH | Yes or No | |
| 12.9b | Are the system logs reviewed at a defined frequency & retained for as long as required? | MEDIUM, HIGH | Yes or No | |
| 13 | Information Security Incident Management & Disclosure of Security Breaches | LOW, MEDIUM, HIGH | ||
| 13.1 | Do you have a formal, documented security incident response plan? | LOW, MEDIUM, HIGH | Yes or No | |
| 13.2 | Do you conduct regular tests of your security incident response plan? | LOW, MEDIUM, HIGH | Yes or No | |
| 13.3 | Are all security incidents recorded, classified, and tracked? | MEDIUM, HIGH | Yes or No | |
| 13.4 | Are forensic investigations conducted as part of incident response? | MEDIUM, HIGH | Yes or No | |
| 13.5 | Does the vendor have procedures to notify the City of Port Saint Lucie following the discovery of a breach without reasonable delay? | HIGH | Yes or No | |
| 13.6 | Does the disclosure notification include the identification of data & each individual whose private data has been, or is reasonably believed to have been accessed, acquired, or disclosed during the breach? | HIGH | Yes or No | |
| 13.7 | When a breach is discovered, does the vendor assign ownership of a breach for reporting purposes? | HIGH | Yes or No | |
| 14 | Privacy | LOW, MEDIUM, HIGH | ||
| 14.1 | Do you have a data retention policy and process that is designed to meet relevant privacy regulations? | MEDIUM, HIGH | Yes or No | |
| 14.2 | Do you maintain an inventory and mapping of where all personal data is stored that includes cross-border data flows? | LOW, MEDIUM, HIGH | Yes or No | |
| 15 | Disaster Recovery, Business Continuity & System Availability | LOW, MEDIUM, HIGH | ||
| 15.1 | Does the vendor have a developed & documented Disaster Recovery and Business Continuity Plans? | MEDIUM, HIGH | Yes or No | |
| 15.2 | Has the Disaster Recovery Plan been tested within the last year? If not, when? | MEDIUM, HIGH | Yes or No | |
| 15.3 | Does the solution have a disaster recovery plan and procedures? | MEDIUM, HIGH | Yes or No | |
| 15.4 | Are the backups encrypted using 256 bit AES encryption or better? | MEDIUM, HIGH | Yes or No | |
| 15.5 | Does the vendor have measures in place to assure system availability (Either Cloud-based &/or on premise including data mirroring, redundant systems,etc.) | MEDIUM, HIGH | Yes or No | |
| 15.6 | Does the system availability solution meet the business owner's system availability requirements? | LOW, MEDIUM, HIGH | Yes or No | |
| 15.7 | Does the system availability solution support the use of third-party backups? | MEDIUM, HIGH | Yes or No | |
| 15.8 | Does the vendor actively manage services that are contracted/outsourced to third parites (such as in the Cloud - SaaS, IaaS or PaaS), that can impact availability? | MEDIUM, HIGH | Yes or No | |
| 16 | Anti-malware and Vulnerability Management | LOW, MEDIUM, HIGH | ||
| 16.1 | Does the solution support the use of anti-malware protection? | MEDIUM, HIGH | Yes or No | |
| 16.2 | Does the vendor have processes to monitor & manage system vulnerabilities to mitigate malware? | MEDIUM, HIGH | Yes or No | |
| 16.3 | Does the vendor have a comprehensive patch & vulnerability management program to include internal systems as well as external services, software & products along with reliable customer notifications? | MEDIUM, HIGH | Yes or No | |
| 16.4 | Does the vendor scan for system vulnerabilities on a continuous or regular basis? | HIGH | Yes or No | |
| 16.5 | Does the vendor have procedures in place to determine if assets have been compromised? | HIGH | Yes or No | |
| 16.6 | Does the vendor have a patch management program that includes testing patches prior to implementation? | HIGH | Yes or No | |
| 16.7 | Does the vendor have a configuration management program? | HIGH | Yes or No | |
| 17 | Data Life Cycle Controls | LOW, MEDIUM, HIGH | ||
| 17.1 | Does the vendor agree to end of contract separation provisions related to data? | HIGH | Yes or No | |
| 17.2 | Does the vendor have a defined process for secure disposal of customer's data? | HIGH | Yes or No |
| Vendor Name: |
| Vendor Contact: |
| Vendor Phone: |
| Vendor Email: |
| Project Name: |
| Date Completed: |
File details come from the government source that posted it. Updated .