CloudVendorAssessment(Appendix B).xlsx

XLSX spreadsheet 744 KB Posted Aug 31, 2018

Attached to: RFP, FRCC-19-01-W, Campus Store Point of Sale System
Solicitation number: RFP GJEA 2019000019 2
Issued by: Boulder County, Weston CDP, Colorado

About this file

Written by GovTribe AI · Mar 13, 2026

This is a cloud vendor assessment tool created by the Higher Education Information Security Council Shared Assessments Working Group, representing a collaborative effort among EDUCAUSE, Internet2, and the Research and Education Networking Information Sharing and Analysis Center (REN-ISAC). The tool is designed for higher education institutions to systematically evaluate third-party cloud service providers and vendors for security and privacy compliance. The assessment is being administered by Front Range Community College (Budgets and Auxiliary Services department, Westminster, Colorado campus), with Tristy Hillestad serving as the institutional contact and David Johnson as the security analyst. The tool is version 1.05 and was finalized for distribution in October 2016, with the most recent update in April 2017. The assessment encompasses comprehensive evaluation categories including general information, documentation review, company overview, third-party management, application and service security, authentication and authorization, business continuity planning, disaster recovery planning, data handling practices, physical security, and compliance with standards such as HIPAA, PCI DSS, and FISMA.

The assessment tool functions as a standardized questionnaire rather than a solicitation with specific pricing or contract terms. Vendors are required to complete the assessment to demonstrate their security posture and compliance capabilities across multiple domains, with responses subject to review by institutional security analysts. The tool employs a qualifier system that makes certain sections optional based on vendor responses regarding data types, mobile applications, third-party hosting arrangements, and regulatory requirements. Upon completion, vendors acknowledge that their assessments may be shared among higher education institutions, with sharing permissions determined by vendor preference. The assessment tool is designed to reduce redundancy in vendor security evaluation processes by creating a common framework, allowing both higher education institutions and cloud service providers to streamline security assessment procedures without the need for individualized questionnaires. No specific contract award date, term length, or renewal options are identified within this assessment framework document.

View the file

Other files

File	Type	Posted
PricingSheet(AppendixA).xlsx	XLSX spreadsheet	Aug 31, 2018
RFP FRCC-19-01-W.doc	DOC document	Aug 31, 2018
Vendor Written Inquiry RFP FRCC-19-01-W.docx	DOCX document	Aug 31, 2018
Reference - College Response to Vendor Written Inquiry RFP FRCC-18-40-W.docx	DOCX document	Aug 31, 2018

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Introduction

Shared Assessments Introduction

Campus IT environments are rapidly changing and the speed of cloud service adoption is increasing. Institutions looking for ways to do more with less see cloud services as a good way to save resources. As campuses deploy or identify cloud services, they must ensure the cloud services are appropriately assessed for managing the risks to the confidentiality, integrity and availability of sensitive institutional information and the PII of constituents. Many campuses have established a cloud security assessment methodology and resources to review cloud services for privacy and security controls. Other campuses don’t have sufficient resources to assess their cloud services in this manner. On the vendor side, many cloud services providers spend significant time responding to the individualized security assessment requests made by campus customers, often answering similar questions repeatedly. Both the provider and consumer of cloud services are wasting precious time creating, responding, and reviewing such assessments.

The Higher Education Cloud Vendor Assessment Tool attempts to generalize higher education information security and data protection questions and issues for consistency and ease of use. Some institutions may have specific issues that must be addressed in addition to the general questions provided in this assessment. It is anticipated that this Higher Education Cloud Vendor Assessment Tool will be revised over time to account for changes in cloud services provisioning and the information security and data protection needs of higher education institutions.

The Higher Education Cloud Vendor Assessment Tool:

●Helps higher education institutions ensure that cloud services are appropriately assessed for security and privacy needs, including some that are unique to higher education ●Allows a consistent, easily-adopted methodology for campuses wishing to reduce costs through cloud services without increasing risks ●Reduces the burden that cloud service providers face in responding to requests for security assessments from higher education institutions

This Higher Education Cloud Vendor Assessment Tool was created by the Higher Education Information Security Council Shared Assessments Working Group. Its purpose is to provide a starting point for the assessment of third-party provided cloud services and resources. Over time, the Shared Assessments Working Group hopes to create a framework that will establish a community resource where institutions and cloud services providers will share completed Higher Education Cloud Vendor Assessment Tool assessments.

This work is licensed under a Creative Commons Attribution-Noncommercial-ShareAlike 4.0 International License (CC BY-NC-SA 4.0).

This Higher Education Cloud Vendor Assessment Tool is brought to you by the Higher Education Information Security Council, and members from EDUCAUSE, Internet2, and the Research and Education Networking Information Sharing and Analysis Center (REN-ISAC).

Sharing Read Me

Item	Default Sharing Permission	Default Sharing Audience
Assessment template and discussion regarding the assessment process	OK to share	Public
List of service providers assessed and contact information of service providers	OK to share	Higher education institutions only
Completed assessment (vendor answers intact)	None, Opt-in by service provider only	None, unless opt-in. If a service provider opts-in, the sharing is within higher education institutions only
Security report created by this Higher Education institution	None, Opt-in by service provider only	None, unless opt-in. If a service provider opts-in, the sharing is within higher education institutions only

By completing the Higher Education Cloud Vendor Assessment Tool, cloud service providers understand that the completed assessment may be shared among higher education institutions. Anticipated sharing uses, permissions, and audiences are defined in the table below.

Instructions Higher Education Cloud Vendor Assessment Tool Instructions

Target Audience
These instructions are for vendors interested in providing the Institution with a software and/or a service. This worksheet should not be completed by a Institution entity. The purpose of this worksheet is for the vendor to submit robust security safeguard information in regards to the product (software/service) being assessed in the Institution's assessment process.
Document Layout
There are five main sections of the Higher Education Cloud Vendor Assessment Tool, all listed below and outlined in more detail. This document is designed to have the first two sections populated first; after the Qualifiers section is completed it can be populated in any order. Within each section, answer each question top-to-bottom. Some questions are nested and may be blocked out via formatting based on previous answers. Populating this document in the correct order will ensure that questions are not answered unnecessarily.
General Information	This section is self-explanatory; product specifics and contact information. GNRL-01 through GNRL-06 should be populated by an institution entity. GNRL-07 through GNRL-14 should be populated by the Vendor. GNRL-15 and GNRL-16 are for Institution use only.
Higher Education Shared Assessments Confirmation	Answers to the statements in this section will determine how this assessment may be shared within the Higher Education community. Refer to the Sharing Read Me tab for further details.
Qualifiers	Populate this section completely before continuing. Answers in this section can determine which sections will be required for this assessment. By answering "No" to Qualifiers, their matched sections become optional and are highlighted in orange.
Documentation	Focused on external documentation, the Institution is interested in the frameworks that lead your security strategy and what has been done to certify these implementations.
Company Overview	This section is focused on company background, size, and business area experience.
Safeguards	The remainder of the document consists of various safeguards grouped generally by section.
In sections where vendor input is required there are only one or two columns that need modification, Vendor Answers and Additional Information, columns C and D respectively (see Figure 1 below). You will see that sometimes C and D are separate and other times are merged. If they are separate, C will be a selectable, drop-down box and any supporting information should be added to column D. If C and D are merged, the question is looking for the answer to be in narrative form. At the far right is a column titled “Guidance”. After answering questions, check this column to ensure you have submitted information/documentation to sufficiently answer the question. Use the “Additional Information” column to provide any requested details.
Figure 1:
Optional Safeguards Based on Qualifiers
Not all questions are relevant to all vendors. Qualifiers are used to make whole sections optional to vendors depending on the scope of product usage and the data involved in the engagement being assessed. Sections that become optional have the section titles and questions highlighted in orange (see Figure 2).
Figure 2:
Proceed to the next tab, Cloud Vendor Assessment Tool, to begin.

Cloud Vendor Assessment Tool

Higher Education Cloud Vendor Assessment Tool				Version 1.05
HEISC Shared Assessments Working Group
DATE-01	Date
General Information
In order to protect the Institution and its systems, vendors whose products and/or services will access and/or host institutional data must complete the Higher Education Cloud Vendor Assessment Tool. Throughout this tool, anywhere where the term data is used, this is an all-encompassing term including at least data and metadata. Answers will be reviewed by institution security analysts upon submittal. This process will assist the institution in preventing breaches of protected information and comply with Institution policy, state, and federal law. This is intended for use by vendors participating in a Third Party Security Assessment and should be completed by a vendor. Review the Instructions tab for further guidance.
GNRL-01	Institution Department	Budgets and Auxiliary Services
GNRL-02	Institution Department Primary Campus	Westminster, Colorado
GNRL-03	Institution Department Code	N/A
GNRL-04	Institution Department Contact Name	Tristy Hillestad
GNRL-05	Institution Department Contact Email	tristy.hillestad@frontrange.edu
GNRL-06	Institution Department Contact Phone Number	303-404-5024
GNRL-07	Vendor Name	Vendor Name
GNRL-08	Product Name	Product Name and Version Information
GNRL-09	Product Description	Please include a brief description of the product
GNRL-10	Web Link to Product Privacy Notice	http://www.vendor.domain/privacynotice
GNRL-11	Vendor Contact Name	Vendor Contact Name
GNRL-12	Vendor Contact Title	Vendor Contact Title
GNRL-13	Vendor Contact Email	Vendor Contact E-mail Address
GNRL-14	Vendor Contact Phone Number	555-555-5555
GNRL-15	Institution Security Analyst/Engineer	David Johnson
GNRL-16	Assessment Contact	david.johnson@frontrange.edu
Higher Education Shared Assessments Confirmation		Vendor Answers	Additional Information	Guidance
By completing the Higher Education Cloud Vendor Assessment Tool, cloud service providers understand that the completed assessment may be shared among higher education institutions. Answers to the following statements will determine how this assessment may be shared within the Higher Education community. Shared assessment sharing details can be found on the "Sharing Read Me" tab.
HESA-01	I understand the goal of Higher Education Shared Assessments and that the completed Higher Education Cloud Vendor Assessment Tool may be shared with other higher education institutions, based on the following selections.
HESA-02	Add this completed assessment to a list of Higher Education assessed service providers, with contact information for service providers. No answers are shared; it is a list stating vendor, product, version, and service provider contact information.	Yes; OK to List	Scope: Higher Education Institutions Only
HESA-03	This completed assessment (with vendor answers intact) can be shared within Higher Education institutions.	No; Sharing Disallowed	Scope: Higher Education Institutions Only
HESA-04	The security report created by this Higher Education institution, after evaluating this assessment, can be shared within Higher Education institutions.	No; Sharing Disallowed	Scope: Higher Education Institutions Only
Instructions
Step 1: Complete the Qualifiers section first. Step 2: Complete each section answering each set of questions in order from top to bottom; the built-in formatting logic relies on this order. Step 3: Submit the completed Higher Education Cloud Vendor Assessment Tool (HECVAT) to the Institution according to institutional procedures.
Qualifiers		Vendor Answers	Additional Information	Guidance
The Institution conducts Third Party Security Assessments on a variety of third parties. As such, not all assessment questions are relevant to each party. To alleviate complexity, a "qualifier" strategy is implemented and allows for various parties to utilize this common documentation instrument. Responses to the following questions will determine the need to answer additional questions below.
QUAL-01	Does your product process protected health information (PHI) or any data covered by the Health Insurance Portability and Accountability Act?
QUAL-02	Does the vended product host/support a mobile application? (i.e. app)
QUAL-03	Will institution data be shared with or hosted by any third parties? (e.g. any entity not wholly-owned by your company is considered a third-party)

Charles Escue: The Institution views hosted solutions such as AWS, Rackspace, Azure, and other PaaS/SaaS offerings as third parties. If services such as these are used in your environment, respond "Yes".

QUAL-04	Do you have a Business Continuity Plan (BCP)?
QUAL-05	Do you have a Disaster Recovery Plan (DRP)?
QUAL-06	Will data regulated by PCI DSS reside in the vended product?
QUAL-07	Is your company a consulting firm providing only consultation to the Institution?
Documentation		Vendor Answers	Additional Information	Guidance
DOCU-01	Have you undergone a SSAE 16 audit?

Microsoft Office User: In 2011, Statement on Standards for Attestation Engagements (SSAE) No. 16 took effect and replaced SAS 70 as the authoritative guidance for performing a service auditor's examination. SSAE 16 established a new attestation standard (AT 801) to contain the professional guidance.

You can learn more about SSAE 16 at www.ssae16.com.

DOCU-02 Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ?

Microsoft Office User: CSA STAR Self Assessment is free and open to all cloud providers and allows them to submit self assessment reports that document compliance to CSA-published best practices.

Website: https://cloudsecurityalliance.org/star/self-assessment/ DOCU-03 Have you received the Cloud Security Alliance STAR certification?

Microsoft Office User: The CSA STAR Certification is a rigorous third party independent assessment of the security of a cloud service provider. The technology-neutral certification leverages the requirements of the ISO/IEC 27001 management system standard together with the CSA Cloud Controls Matrix, a specified set of criteria that measures the capability levels of the cloud service.

Website: https://cloudsecurityalliance.org/star/certification/

DOCU-04	Do you conform with a specific industry standard security framework? (e.g. NIST Special Publication 800-53, ISO 27001, etc.)
DOCU-05	Are you compliant with FISMA standards (indicate at what level)?

Microsoft Office User: The Federal Information Security Management Act (FISMA) is United States legislation that defines a comprehensive framework to protect government information, operations and assets against natural or man-made threats.

Website: http://www.dhs.gov/FISMA

DOCU-06	Does your organization have a data privacy policy?
Company Overview		Vendor Answers	Additional Information	Guidance
COMP-01	Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships.
COMP-02	Describe how long your organization has conducted business in this product area.
COMP-03	How many higher education, commercial customers and government customers do you serve in North America? Please provide a higher education customer reference if available.
COMP-04	Please explain in detail any involvement in business-related litigation in the last five years by your organization, its management, or the staff that will be providing the administrative services.
COMP-05	Describe the structure and size of your Security Office and overall information security staff.
COMP-06	Describe the structure and size of your Software and System Development teams.
COMP-07	Use this area to share information about your environment that will assist those who are evaluating you company data security safeguards.
Third Parties		Vendor Answers	Additional Information	Guidance
THRD-01	Describe how you perform security assessments of third party companies with which you share data (i.e. hosting providers, cloud services, PaaS, IaaS, SaaS, etc.). Provide a summary of your practices that assures that the third party will be subject to the appropriate standards regarding security, service recoverability, and confidentiality.
THRD-02	Provide a brief description for why each of these third parties will have access to institution data.
THRD-03	What legal agreements (i.e. contracts) do you have in place with these third parties that address liability in the event of a data breach?
THRD-04	Describe or provide references to your third party management strategy or provide additional information that may help analysts better understand your environment and how it relates to third-party solutions.
Consulting		Vendor Answers	Additional Information	Guidance
CONS-01	Will the consulting take place on-premises or remotely?
CONS-02	Will the consultant require access to institution network resources?
CONS-03	Will the consultant require access to hardware in the university data centers?
CONS-04	Will the consultant require an account within the institution's domain (@*.edu)?
CONS-05	Has the consultant received training on [sensitive, HIPAA, PCI, etc.] data handling?
CONS-06	Will any data be transferred to the consultant's possession?
CONS-07	How long will it remain in their possession?
CONS-08	Is it encrypted (at rest) while in the consultant's possession?
CONS-09	Will the consultant need remote access to the institution's network or systems?
CONS-10	What software will be used to facilitate that access?
CONS-11	Can we restrict that access based on source IP address?
Application/Service Security		Vendor Answers	Additional Information	Guidance
APPL-01	Does the application/service support being virtualized?
APPL-02	Are the servers hosting institution data currently deployed in a virtualized environment?
APPL-04	Can user access be customized to allow read-only access, update access, or no-access to specific types of records, record attributes, components, or functions?
APPL-05	Describe or provide a reference to how user security administration is performed?
APPL-06	Define the access control roles of employees that will have access to the data and in what capacity.
APPL-07	Do you allow employees to remotely access data (aka work from home)?
APPL-08	Define what controls are in place to secure their remote environment and connection to the institution's data.
APPL-09	What operating system(s) is/are leveraged by the system(s)/application(s) that will have access to university data?
APPL-10	Have you or any third party you contract with that may have access or allow access to the institution's data experienced a breach?
APPL-11	Describe or provide a reference to additional software/products necessary to implement a functional system on either the backend or user-interface side of the system.
APPL-12	Describe or provide a reference to the overall system and/or application architecture(s), including appropriate diagrams. Include a full description of the data communications architecture for all components of the system.
APPL-13	Are databases used in the system segregated from front-end systems? (e.g. web and application servers)
APPL-14	Describe or provide a reference to all web-enabled features and functionality of the system (i.e. accessed via a web-based interface).
APPL-16	Describe or provide a reference to any OS and/or web-browser combinations that are not currently supported.
APPL-17	Can your system take advantage of mobile and/or GPS enabled mobile devices?
APPL-18	Describe or provide a reference to the facilities available in the system to provide separation of duties between security administration and system administration functions.
APPL-19	Describe or provide a reference that details how administrator access is handled (e.g. provisioning, principle of least privilege, deprovisioning, etc.)
APPL-20	Does the system provide data input validation and error messages?
APPL-21	Do you employ a single-tenant or multi-tenant environment?
APPL-22	Describe or provide references explaining how tertiary services are redundant (i.e. DNS, ISP, etc…).
Authentication, Authorization, and Accounting		Vendor Answers	Additional Information	Guidance
AAAI-01	Can you enforce password/passphrase aging requirements?
AAAI-02	Can you enforce password/passphrase complexity requirements [provided by the institution]?
AAAI-03	What are the minimum and maximum password lengths supported, and what types of characters are supported?
AAAI-04	Describe the current/default/supported password/passphrase reset procedures?
AAAI-05	Describe or provide a reference to the types of authentication, including standards-based single-sign-on (SSO, InCommon), that are supported by the web-based interface?
AAAI-06	Are there any passwords/passphrases "hard coded" into your systems or products?
AAAI-07	Are user account passwords/passphrases visible in administration modules?
AAAI-08	Are user account passwords/passphrases stored encrypted?
AAAI-09	Describe or provide a reference to the algorithm/strategy that is used to encrypt stored passwords/passphrases?
AAAI-10	Does your application and/or user-frontend/portal support multi-factor authentication? (e.g. Duo, Google Authenticator, OTP, etc.)
AAAI-11	List all supported multi-factor authentication methods, technologies, and/or products and provide a brief summary of each.
AAAI-12	Does your application support integration with other authentication and authorization systems such as Active Directory, Kerberos (what version) or another institution centralized authorization service?
AAAI-13	Will any external authentication or authorization system be utilized by an application with access to the institution's data?
AAAI-14	Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication?
AAAI-15	Does the system operate in a mixed authentication mode (i.e. external and local authentication)?
AAAI-16	Will any external authentication or authorization system be utilized by a system with access to institution data?
AAAI-17	Are audit logs available that include ALL of the following; login, logout, actions performed, and source IP address?
AAAI-18	Describe or provide a reference to the system capability to log security/authorization changes as well as user and administrator security (physical or electronic) events (e.g., login failures, access denied, changes accepted), and all requirements necessary to implement logging and monitoring on the system. Include information about SIEM/log collector usage.
AAAI-19	Describe or provide a reference to the retention period for those logs, how logs are protected, and whether they are accessible to the customer (and if so, how).
Business Continuity Plan		Vendor Answers	Additional Information	Guidance
BCPL-01	Describe or provide a reference to your Business Continuity Plan.
BCPL-02	Is an owner assigned who is responsible for the maintenance and review of the Business Continuity Plan?
BCPL-03	If possible, can the institution review your Business Continuity Plan and supporting documentation?
BCPL-04	Is there a defined problem/issue escalation plan in your BCP for impacted clients?
BCPL-05	Is there a documented communication plan in your BCP for impacted clients?
BCPL-06	Are all components of the Business Continuity Plan reviewed at least annually and updated as needed to reflect change?
BCPL-07	Indicate the last time that the Business Continuity Plan was tested and provide a summary of the results.
BCPL-08	Does your organization conduct training and awareness activities to validate its employees understanding of their roles and responsibilities during a crisis?
BCPL-09	Are specific crisis management roles and responsibilities defined and documented?
BCPL-10	Does your organization have an alternative business site or a contracted Business Recovery provider?
BCPL-11	Does your organization conduct an annual test of relocating to this alternate site for business recovery purposes?
BCPL-12	Indicates the priority of service restoration for services utilized by the Institution compared to other applications/services the vendor provides.
Change Management		Vendor Answers	Additional Information	Guidance
CHNG-01	Do you have a documented and currently followed change management process (CMP)?
CHNG-02	Indicate all procedures that are implemented in your CMP. a.) An impact analysis of the upgrade is performed. b.) The change is appropriately authorized. c.) Changes are made first in a test environment. d.) The ability to implement the upgrades/changes in the production environment is limited to appropriate IT personnel.
CHNG-03	How and when will the institution be notified of major changes to your environment that could impact our security posture?
CHNG-04	Do clients have the option to not participate in or postpone an upgrade to a new release?
CHNG-05	Describe or provide a reference to your solution support strategy in relation to maintaining software currency. (i.e. how many concurrent versions are you willing to run and support?)
CHNG-06	Identify the most current version of the software. Detail the percentage of live customers that are utilizing the proposed version of the software as well as each version of the software currently in use.
CHNG-07	Describe, if applicable, your support for client customizations from one release to another.
CHNG-08	How does your organization ensure that only application software verifiable as authorized, tested, and approved for production, and having met all other requirements and reviews necessary for commissioning, is placed into production?
CHNG-09	Describe or provide a reference to your release schedule for product updates.
CHNG-10	Describe or provide a reference to your technology roadmap, for the next 2 years, for enhancements and bug fixes for the product/service being assessed.
CHNG-11	Describe or provide a reference to your expectation of client involvement with product updates?
CHNG-12	Provide a brief summary of how critical patches are applied to all systems and applications.
CHNG-13	Describe or provide a reference to how security risks are mitigated until patches can be applied.
CHNG-14	Are upgrades or system changes installed during off-peak hours or in a manner that does not impact the customer?
CHNG-15	Do procedures exist to provide that emergency changes are documented and authorized (including after the fact approval)?
Data		Vendor Answers	Additional Information	Guidance
DATA-01	Describe the highest level of data classification that will be managed within your system(s) and/or application(s).
DATA-02	Describe or provide a reference to how institution data is physically and logically separated from that of other customers.
DATA-03	Will university data be stored on any devices (database servers, file servers, SAN, NAS, …) configured with non-RFC 1918/4193 (i.e. publicly routable) IP addresses?
DATA-04	Is sensitive data encrypted in transport?
DATA-05	Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)?
DATA-06	Do you employ or allow any cryptographic modules that do not conform to the Federal Information Processing Standards (FIPS PUB 140-2)?
DATA-07	Describe or provide a reference to the encryption technology and strategy you employ for transmitting sensitive information over TCP/IP networks (e.g., SSH, SSL/TLS, VPN).
DATA-08	List all locations (i.e. city + datacenter name) where the institution's data will be stored?
DATA-09	At the completion of this contract, will data be returned to the institution?
DATA-10	How will data be returned to the institution and in what format?
DATA-11	How long will the institution's data be available within the system at the completion of this contract?
DATA-12	Can the institution extract a full backup of data?
DATA-13	Are ownership rights to all data, inputs, outputs, and metadata retained by the institution?
DATA-14	Are these rights retained even through a provider acquisition or bankruptcy event?
DATA-15	In the event of imminent bankruptcy, closing of business, or retirement of service, will you provide 90 days for customers to get their data out of the system and migrate applications?
DATA-16	Describe or provide a reference to the backup processes for the servers on which the service and/or data resides.
DATA-17	Are backup copies made according to pre-defined schedules and securely stored and protected?
DATA-18	How long are data backups stored?
DATA-19	Are you encrypting your backups?
DATA-20	Summarize the encryption algorithm/strategy you are using to secure the backups.
DATA-21	Describe or provide a reference to your cryptographic key management process (generation, exchange, storage, safeguards, use, vetting, and replacement) of all system components (e.g. database, system, web, etc.).
DATA-22	Do current backups include all operating system software, utilities, security software, application software and data files necessary for recovery?
DATA-23	Are you performing offsite backups? (i.e. digitally moved off site)
DATA-24	Are backups taken off site? (i.e. physically moved off site)
DATA-25	Do backups containing the institution's data ever leave the United States of America either physically or via network routing?
DATA-26	Describe or provide a reference to your media handing process, including end-of-life, repurposing, and data sanitization, that is documented and currently implemented.
DATA-27	Does this process adhere to DoD 5220.22-M and/or NIST SP 800-88 standards?
DATA-28	Do procedures exist to ensure that retention and destruction of data meets established business and regulatory requirements?
DATA-29	Is media used for long-term retention of business data and archival purposes stored in a secure, environmentally protected area?
DATA-30	Will you handle data in a FERPA compliant manner?
DATA-31	Is any institution data visible in system administration modules/tools?
Database		Vendor Answers	Additional Information	Guidance
DBAS-01	Does the database support encryption of specified data elements in storage?
DBAS-02	Do you currently use encryption in your database?
Datacenter		Vendor Answers	Additional Information	Guidance
DCTR-01	Does your company own the physical data center where the institution's data will reside?
DCTR-02	Does the hosting provider have a SOC 2 Type 2 report available?
DCTR-03	Are the data centers staffed 24 hours a day, seven days a week (24x7)?
DCTR-04	Do any of your servers reside in a co-located data center?
DCTR-05	Are your servers separated from other companies via a physical barrier, such as a cage or hardened walls?
DCTR-06	Does the physical barrier fully enclose the physical space preventing unauthorized physical contact with any of your devices?
DCTR-07	Select the option that best describes the network segment that servers are connected to.
DCTR-08	Does this data center operate outside of the United States?
DCTR-09	Will any institution data leave the United States?
DCTR-10	List all datacenters and their cities, states (provinces), and countries where the institution's data will be stored (including within the United States).
DCTR-11	Are your primary and secondary data centers geographically diverse?
DCTR-12	If outsourced or co-located, is there a contract in place to prevent data from leaving the United States?
DCTR-13	What Tier Level is your data center (per levels defined by the Uptime Institute)?

Charles Escue: https://uptimeinstitute.com/tiers

DCTR-14	Is the service hosted in a high availability environment?
DCTR-15	Is redundant power available for all datacenters where institution data will reside?
DCTR-16	How often are redundant power strategies tested?
DCTR-17	Describe or provide a reference to the availability of cooling and fire suppression systems in all datacenters where institution data will reside.
DCTR-18	State how many Internet service providers (ISPs) provide connectivity to each datacenter where the institution's data will reside.
DCTR-19	Does every datacenter where the institution's data will reside have multiple telephone company or network provider entrances to the facility?
Disaster Recovery Plan		Vendor Answers	Additional Information	Guidance
DRPL-01	Describe or provide a reference to your Disaster Recovery Plan.
DRPL-02	Is an owner assigned who is responsible for the maintenance and review of the Disaster Recovery Plan?
DRPL-03	If possible, can the institution review your Disaster Recovery Plan(s) and supporting documentation?
DRPL-04	Are any disaster recovery locations outside the United States?
DRPL-05	Does your organization have a Disaster Recovery site or a contracted Disaster Recovery provider?
DRPL-06	What type of availability does your Disaster Recovery site provide?
DRPL-07	Does your organization conduct an annual test of relocating to this site for disaster recovery purposes?
DRPL-08	Is there a defined problem/issue escalation plan in your DRP for impacted clients?
DRPL-09	Is there a documented communication plan in your DRP for impacted clients?
DRPL-10	Describe or provide a reference to how your disaster recovery plan is tested? (i.e. scope of DR tests, end-to-end testing, etc.)
DRPL-11	Indicate the last time that the Disaster Recovery Plan was tested and provide a summary of the results (including actual recovery time).
DRPL-12	Do the documented test results identify your organizations actual recovery time capabilities for technology and facilities?
DRPL-13	Are all components of the Disaster Recovery Plan reviewed at least annually and updated as needed to reflect change?
DRPL-14	Do you carry cyber-risk insurance to protect against unforeseen service outages, data that is lost or stolen, and security incidents?
Firewalls, IDS, IPS, and Networking		Vendor Answers	Additional Information	Guidance
FIDP-01	Are you utilizing a web application firewall (WAF)?
FIDP-02	Are you utilizing a stateful packet inspection (SPI) firewall?
FIDP-03	State and describe who has the authority to change firewall rules?
FIDP-04	Do you have a documented policy for firewall change requests?
FIDP-05	Have you implemented an Intrusion Detection System (network-based)?
FIDP-06	Have you implemented an Intrusion Prevention System (network-based)?
FIDP-07	Do you employ host-based intrusion detection?
FIDP-08	Do you employ host-based intrusion prevention?
FIDP-09	Describe or provide a reference to any other safeguards used to monitor for attacks?
FIDP-10	Do you monitor for intrusions on a 24x7x365 basis?
FIDP-11	Is intrusion monitoring performed internally or by a third-party service?
FIDP-12	Are audit logs available for all changes to the network, firewall, IDS, and/or IPS?
Mobile Applications		Vendor Answers	Additional Information	Guidance
MAPP-01	On which mobile operating systems is your software or service supported?
MAPP-02	Describe or provide a reference to the application's architecture and functionality.
MAPP-03	Is the application available from a trusted source (e.g., iTunes App Store, Android Market, BB World)?
MAPP-04	Does the application store, process, or transmit critical data?
MAPP-05	Is institution data encrypted in transport?
MAPP-05	Is institution data encrypted in storage? (e.g. disk encryption, at-rest)
MAPP-06	Does the mobile application support Kerberos, CAS, or Active Directory authentication?
MAPP-07	Will any of these systems be implemented on systems hosting the institution's data?
MAPP-08	Does the application adhere to secure coding practices?
MAPP-09	Has the application been tested for vulnerabilities by a third party?
MAPP-10	State the party that performed the test and the date it was conducted?
Physical Security		Vendor Answers	Additional Information	Guidance
PHYS-01	Describe or provide a reference to physical safeguards that are placed on facilities housing the institution's data (e.g., video monitoring, restricted access areas, man traps, card access controls, etc.)?
PHYS-02	Are employees allowed to take home customer data in any form?
PHYS-03	Are video monitoring feeds retained?
PHYS-04	Is the video feed monitored by data center staff?
PHYS-05	Are individuals required to sign in/out for installation and removal of equipment?
PHYS-06	What are the equipment removal procedures for the clients?
Policies, Procedures, and Processes		Vendor Answers	Additional Information	Guidance
PPPR-01	Briefly describe your security organization. Include the responsible party for your information security program and the size of your security staff?
PPPR-02	Do you have a documented patch management process?
PPPR-03	Can you accommodate encryption requirements using open standards?
PPPR-04	Have your developers been trained in secure coding techniques?
PPPR-05	Was your application developed using secure coding techniques?
PPPR-06	Do you subject your code to Static Code Analysis and/or Static Application Security Testing prior to release? If so, what tool(s) do you use?"
PPPR-07	Describe testing processes that are established and followed (e.g., development of test plans, personnel involved in the testing process, and authorized individual accountable for approval and certification of test results)?
PPPR-08	Are information security principles designed into the product lifecycle?
PPPR-09	Do you have a documented systems development life cycle (SDLC)?
PPPR-10	Describe or provide a reference to your system development life cycle methodology including your environments, version control, and change management (if not already covered in the Change Management section).
PPPR-11	Do you have a formal incident response plan?
PPPR-12	Will you comply with applicable Breach Notification Laws?
PPPR-13	Will you comply with the institution's IT policies with regards to user privacy and data protection?
PPPR-14	Is your company subject to US laws and regulations?
PPPR-15	Do you perform background screenings or multi-state background checks on all employees prior to their first day of work?
PPPR-16	Do you require new employees to fill out agreements and review policies?
PPPR-17	What agreements are required and policies reviewed? (i.e. confidentiality agreement, etc.)
PPPR-18	Do you have a documented information security policy?
PPPR-19	Do you have an information security awareness program?
PPPR-20	Is the security awareness training mandatory for all employees?
PPPR-21	How frequently are employees required to undergo the security awareness training?
PPPR-22	Is a process documented, and currently followed, that requires a review and update of the access-list for privileged accounts?
PPPR-23	Describe or provide a reference to your Internal Audit processes and procedures.
Product Evaluation		Vendor Answers	Additional Information	Guidance
PROD-01	Do you incorporate customer feedback into security feature requests?
PROD-02	Can you provide an evaluation site to the institution for testing?
Quality Assurance		Vendor Answers	Additional Information	Guidance
QLAS-01	Provide a general summary of your Quality Assurance program.
QLAS-02	Do you comply with ISO 9001?
QLAS-03	Will your company provide quality and performance metrics in relation to the scope of services and performance expectations for the services you are offering?
QLAS-04	Have you supplied products and/or services to the Institution (or its Campuses) in the last five years?
QLAS-05	Do you have a program to keep your customers abreast of higher education and/or industry issues?
Systems Management & Configuration		Vendor Answers	Additional Information	Guidance
SYST-01	Are systems that support this service managed via a separate management network?
SYST-02	Do you have an implemented system configuration management process? (i.e. secure "gold" images, etc.)
SYST-03	Are employee mobile devices managed by your company's Mobile Device Management (MDM) platform?
SYST-04	Provide a general summary of your systems management and configuration strategy, including servers, appliances, and mobile devices (company and employee owned).
Vulnerability Scanning		Vendor Answers	Additional Information	Guidance
VULN-01	Are your applications scanned externally for vulnerabilities?
VULN-02	What was the date of your applications last external assessment? (mm/dd/yyyy)
VULN-03	Are your applications scanned for vulnerabilities prior to new releases?
VULN-04	Are your systems scanned externally for vulnerabilities?
VULN-05	What was the date of your systems last external assessment? (mm/dd/yyyy)
VULN-06	Describe or provide a reference to the tool(s) used to scan for vulnerabilities in your applications and systems.
VULN-07	Can we review the results of security scans?
VULN-08	Describe or provide a reference to how you monitor for and protect against common web application security vulnerabilities (e.g. SQL injection, XSS, XSRF, etc.).
VULN-09	Will you allow the institution to perform its own security testing of your systems and/or application provided that testing is performed at a mutually agreed upon time and date?
HIPAA		Vendor Answers	Additional Information	Guidance
HIPA-01	Do your workforce members receive regular training related to the HIPAA Privacy and Security Rules and the HITECH Act?
HIPA-02	Do you monitor or receive information regarding changes in HIPAA regulations?
HIPA-03	Has your organization designated HIPAA Privacy and Security officers as required by the Rules?
HIPA-04	Do you comply with the requirements of the Health Information Technology for Economic and Clinical Health Act (HITECH)?
HIPA-05	Do you have an incident response process and reporting in place to investigate any potential incidents and report actual incidents?
HIPA-06	Do you have a plan to comply with the Breach Notification requirements if there is a breach of data?
HIPA-07	Have you conducted a risk analysis as required under the Security Rule?
HIPA-08	Have you identified areas of risks?
HIPA-09	Have you taken actions to mitigate the identified risks?
HIPA-10	Does your application require user and system administrator password changes at a frequency no greater than 90 days?
HIPA-11	Does your application require a user to set their own password after an administrator reset or on first use of the account?
HIPA-12	Does your application lock-out an account after a number of failed login attempts?
HIPA-13	Does your application automatically lock or log-out an account after a period of inactivity?
HIPA-14	Are passwords visible in plain text, whether when stored or entered, including service level accounts (i.e. database accounts, etc.)?
HIPA-15	If the application is institution-hosted, can all service level and administrative account passwords be changed by the institution?
HIPA-16	Does your application provide the ability to define user access levels?
HIPA-17	Does your application support varying levels of access to administrative tasks defined individually per user?
HIPA-18	Does your application support varying levels of access to records based on user ID?
HIPA-19	Is there a limit to the number of groups a user can be assigned?
HIPA-20	Do accounts used for vendor supplied remote support abide by the same authentication policies and access logging as the rest of the system?
HIPA-21	Does the application log record access including specific user, date/time of access, and originating IP or device?
HIPA-22	Does the application log administrative activity, such user account access changes and password changes, including specific user, date/time of changes, and originating IP or device?
HIPA-23	How long does the application keep access/change logs?
HIPA-24	Can the application logs be archived?
HIPA-25	Can the application logs be saved externally?
HIPA-26	Does your data backup and retention policies and practices meet HIPAA requirements?
HIPA-27	Do you have a disaster recovery plan and emergency mode operation plan?
HIPA-28	Have the policies/plans mentioned above been tested?
HIPA-29	Can the application logs be saved externally?
HIPA-30	Can you provide a HIPAA compliance attestation document?
HIPA-31	Are you willing to enter into a Business Associate Agreement (BAA)?
HIPA-32	Have you entered into a BAA with all subcontractors who may have access to protected health information (PHI)?
PCI DSS		Vendor Answers	Additional Information	Guidance
PCID-01	Does your systems or products store, process, or transmit cardholder (payment/credit/debt card) data?
PCID-02	Are you compliant with the Payment Card Industry Data Security Standard (PCI DSS)?
PCID-03	Do you have a current, executed within the past year, Attestation of Compliance (AoC) or Report on Compliance (RoC)?
PCID-04	Are you classified as a service provider?
PCID-05	Are you on the list of VISA approved service providers?
PCID-06	Are you classified as a merchant? If so, what level (1, 2, 3, 4)?
PCID-07	Describe the architecture employed by the system to verify and authorize credit card transactions.
PCID-08	What payment processors/gateways does the system support?
PCID-09	Can the application be installed in a PCI DSS compliant manner ?
PCID-10	Is the application listed as an approved PA-DSS application?
PCID-11	Does the systems or products use a third party to collect, store, process, or transmit cardholder (payment/credit/debt card) data?
PCID-12	Include documentation describing the systems' abilities to comply with the PCI DSS and any features or capabilities of the system that must be added or changed in order to operate in compliance with the standards.

&"Helvetica,Regular"&12&K000000 &P mailto:tristy.hillestad@frontrange.edumailto:david.johnson@frontrange.edu Certification

Certification
I certify that the information set forth in or attached to this Vendor Disclosure Form is true to the best of my knowledge. I further understand that the making of any false statements in the form or any attachments may negatively impact our company from being awarded pursuant to the procurement process.
Signature	Name	Date

Review and Approval – For College Use

Reviewer Comments

Approved?

Acknowledgments

The Higher Education Information Security Council Shared Assessments Working Group contributed their vision and significant talents to the conception, creation, and completion of this resource. Members that contributed to this effort are:

• Jon Allen, Baylor University

• John Bruggeman, Hebrew Union College, Jewish Institute of Religion

• Charles Escue, Indiana University

• Joanna Grama, EDUCAUSE

• Karl Hassler, University of Delaware

• Todd Herring, REN-ISAC

• Nick Lewis, Internet2

• Kim Milford, REN-ISAC

• Craig Munson, Minnesota State Colleges & Universities

• Mitch Parks, University of Idaho

• Laura Raderman, Carnegie Mellon University

• Valerie Vogel, EDUCAUSE

ChangeLog

Version	Date	Description of Change
v0.6	8/4/16	Merged initial comments and suggestions of sub-group members.
v0.7	8/14/16	Completed base formulas for all Guidance fields. Changed Qualifer formatting to make questions readable (and optional).
v0.8	8/15/16	Added SOC2T2 question to datacenter section.
v0.9	8/16/16	Added Systems and Configuration Management section, added MDM, sep. management networks, system configuration images, Internal audit processes and procedures.
v0.91	8/24/16	Added input from WG meeting on 8/22, removed RiskMgmt section, added question ID's, and removed dup network question.
v0.92	8/25/16	Added Introduction, Sharing Read Me, and Acknowledgements tabs and content. Also updated report specifics in Documentation.
v0.93	8/26/16	Integrated grammatical corrections set by Karl, fixed a minor formula error in a guidance cell.
v0.94	8/26/16	Added Instructions tab, adjusted question ID background color, updated DRP/BCP copy error.
v0.95	9/21/16	Changed document title to HECVAT. Integrated KDH input.
v0.96	9/23/16	Added input from NL, 36 modifications across all sections.
v0.97	9/26/16	Updated Sharing Read Me tab with final language and options table.
v0.98	10/6/16	Sharing Confirmation section added, updated instructions, updated Sharing Read Me tab, fixed a ton of conditional formatting issues.
v1.00	10/17/16	Finalized for distribution.
v1.01	11/16/16	Corrections for grammar, conditional formatting, and question clarification.
v1.02	11/21/16	Added tertiary services narrative question (DNS, ISP, etc…).
v1.03	11/23/16	Grammar and spelling cleanup.
v1.04	4/22/17	Minor layout change in preparation for HECVAT-Lite split
v1.05	4/28/17	Changed University mentions to Institution; final version before SPC 2017

Values

Campus

Answers

Yes

N/A

DRPTestingSchedule

Quarterly

Semi-annually

Annually

Other

NetworkTypes

Exclusive VLAN

Shared VLAN

Physically Separate

Flat Shared Network

Other

Consulting

On-premises

Remotely

DR Types

Cold

Hot

Tenants

Single-tenant

Multiple-tenant

SharedAssessmentsConfirmation

Yes; OK to Share

No; Sharing Disallowed

SharedAssessmentListingConfirmation

Yes; OK to List

No; Listing Disallowed

UptimeTiers

Tier I

Tier II

Tier III

Tier IV

N/A

image2.png image3.png image4.tiff image5.tiff

File details come from the government source that posted it. Updated Mar 12, 2026.