CSM_VISA_Questionnaire.pdf

Information Services Department 1685 Main Street, Room 105 Santa Monica, CA 90401 Tel: 310.458.8381 www.smgov.net

Information Security Document Version: 2.0

Vendor Information Security Assessment (VISA) Questionnaire Purpose: This Vendor Information Security Assessment (VISA) Questionnaire requests information concerning a Cloud Service Provider (the Vendor), which intends to provide to the City of Santa Monica (The City) any or all of the following services: Software as a Service (SaaS); Platform as a Service (PaaS); and Infrastructure as a Service (IaaS).

Note/Instructions:

• SaaS, PaaS and IaaS are each a ‘cloud’ servicing model, in which software and database applications, computer network infrastructure and/or computer hardware/software platforms is/are hosted by the Vendor and made available to customers interconnected to a network, typically to the Internet.

• This Questionnaire is for the sole use of the intended Vendor and may contain confidential information of individuals and businesses collected, stored, and used by The City. Any unauthorized collection, storage, use, review or distribution may be prohibited by California and/or Federal laws. If you are not the intended recipient of this Questionnaire, please contact the sender by e-mail and destroy all copies of the Questionnaire.

• The Vendor shall provide answers to the questions or information to the requests provided below.

• The Vendor shall also provide the latest System & Organization Controls (SOC) Type 2 Audit Report or Third Party Cybersecurity Assessment Report & Privacy Policy.

• In the event that the Vendor determines that it cannot meet the City’s security and or privacy requirements, the Vendor may submit a request for an exception to the City’s requirements and propose alternative countermeasures to address the risks addressed in this Questionnaire. The City’s Information Security Officer (ISO) may approve or reject the exception request, depending on the risks associated with the exception request.

• Upon receipt of the Vendor’s response, the Information Services Department Information Security will conduct a security risk assessment, using the following scoring methodology:

A = Meets completely.

B = Partially meets. The Vendor may be required to provide additional requested information.

C = Doesn’t meet. The Vendor may be required to provide missing/additional detail.

Vendor Information:

Vendor Organization Name Address Information Security Contact Person Name Email Phone Date this Questionnaire Completed

City of Santa Monica VISA Form Page 2 11/30/2021 3:10 PM

1.0 BUSINESS PROCESS AND DATA EXCHANGE REQUIREMENTS

# Question Response from the Vendor Score Additional

Information/Clarification Required from the Vendor

1.1 Please provide a detailed description of the

business process that will be supported by the Vendor, as it relates to the proposed requirements of the City’s RFP or other Business Requirements Document (BRD)

1.2 Has the Vendor adopted and implemented

information security and privacy policies that are documented, are accessible to the City, and conform to ISO 27001/2 – Information Security Management Systems (ISMS) Standards?

1.3 What data exchange will occur between the City

and the Vendor? What data will be stored at the Vendor’s or other third party’s data storage location? (Provide data attributes with examples)

Example: (Payment Card Information, Social Security Number, Driving License # Patrons Name, Address, telephone etc.), which are examples of personal information, the privacy of which must be protected as stated by the California constitutional and statutory law.

1.4 In the event that the Vendor is required to store

Private Information (PI), Personally Identifiable Information (PII), or Sensitive Information (SI) (collectively, the Information) about individuals in the service provider’s business systems, how does the Vendor maintain the confidentiality of the Information in accordance with applicable federal, state and local data and information privacy laws, rules and regulations?

1.5 What mechanism and/or types of tool(s) will be

used to exchange data between The City and the Vendor? Example: (VPN, Data Link, Frame Relay, HTTP, HTTPS, FTP, FTPS, etc.)

City of Santa Monica VISA Form Page 3 11/30/2021 3:10 PM

Score Additional

Information/Clarification Required from the Vendor

1.6 What types of data storage (work in progress

storage and backup storage) are present or will be required at the Vendor’s site? Example: (PCI Credit Card Info, SSN, DLN, Patrons Name, Address, telephone, medical records, etc.)

1.7 Is e-mail integration required between The City and

the Vendor?

Example: The provision of services may require the City to provide the Vendor with an e-mail account on the City’s e–mail server.

1.8 Has the Vendor ever been subjected to either an

electronic or physical security breach? Please describe the event(s) and the steps taken to mitigate the breach(es). What damages or exposure resulted? Are records of breaches and issues maintained and will these records be available for inspection by the City?

1.9 Does the Vendor maintain formal security policies

and procedures to comply with applicable statutory or industry practice requirements/standards? Does it include an Incident Response procedures and Business Continuity Plan? Are records maintained to demonstrate compliance or certification? Does the Vendor allow client audit of these records?

NOTE: PLEASE PROVIDE SUPPORTING

DOCUMENTATION.

City of Santa Monica VISA Form Page 4 11/30/2021 3:10 PM

2.0 APPLICATION/SOLUTION CONFIGURATION

# Question Response from The Vendor Score Additional

Information/Clarification Required from The Vendor

2.1 What are the Internet and the browser security

configurations for the application? What security standards and requirements does the Vendor maintain to ensure application security at the user interface? (A set of detailed documentation should be provided to support the compliance.)

2.2 What is the name of the application(s) that the

Vendor will host in order to provide services to the City? (List all)

2.3 What functionality will be provided to the City’s

employees or the City’s customers or other recipient of City services through the application?

2.4 Will the Vendor use a subcontractor and/or a third

party service provider? (List all). If yes, what data privacy and information security agreements are in place between the Vendor and any subcontractor/third party to ensure appropriate and accountable treatment of information? Note the City requires each subcontractor and/or third party to complete this Questionnaire.

2.5 What is the Vendor's application(s) hosting

hardware and software platform? Provide a detailed description, including Service Packs and a patch or security applications in use.

Example: Windows or Unix Operating System (OS) and other detail.

2.6 How does the Vendor’s application and database

architecture manage or promote segregation of the City's data (related to its function as a local government agency) from its other customers?

City of Santa Monica VISA Form Page 5 11/30/2021 3:10 PM

# Question Response from The Vendor Score Additional

Information/Clarification Required from The Vendor

2.7 Describe the Vendor’s server and network

infrastructure. Please provide server and network infrastructure deployment topology, including data flow architecture including but not limited to security management applications (i.e. firewalls, IDs, IPS, etc.)

2.8 Please provide a detail proposed solution that will

be developed as a part of the Vendor’s implementation to support this project. (For example detailed solution architecture, secured data flow to support business processes, etc.).

2.9 Please describe the process system

administrators/engineers follow to remotely access applications.

2.10 Please describe the Inbound access of VNC,FTP, RDP

ports.

2.11 Please describe antivirus solution used.

City of Santa Monica VISA Form Page 6 11/30/2021 3:10 PM

3.0 DATA PROTECTION

Score Additional

Information/Clarification Required from the Vendor

3.1 What will be the medium of data exchange between

the City and Vendor?

3.2

How will the data be kept secure during the data exchange process? Example: (VPN, Data Link, Frame Relay, HTTP, HTTPS, FTP, FTPS, etc.)

3.3 How will the City’s data be kept physically and

logically secure at the Vendor’s preferred storage location? Example: Locked storage, Digitally, Encrypted etc.

3.4 What application level protections are in place to

prevent the Vendor’s or a subcontractor/third party’s staff member from viewing unauthorized confidential information? For example, encryption, masking, etc.

3.5 What controls does the Vendor exercise over the

qualification and performance of its team? Of their subcontractor/third party’s team(s)? (For example criminal background verification prior to employment, providing security training after employment and managing Role Based Access Control (RBAC) during employment and network and application access termination upon employment termination.

3.6 Please describe the continuous vulnerability

assessment and remediation process.

City of Santa Monica VISA Form Page 7 11/30/2021 3:10 PM

4.0 DATA BACK-UP

# Question Response Score Additional Information/Clarification

Required from the Vendor

4.1 What are the Vendor’s method(s) used to keep data

secured during the data backup process?

4.2

Is the Vendor’s encryption technology used to encrypt whole or selective data?

4.3 What types of storage media will the Vendor use for

data backup purposes? For example, Tape, Hard Disk Drive or any other devices.

4.4 Are the Vendor’s backup storage devices encrypted?

If ‘yes,’ please provide encryption specification, with type of encryption algorithm and detail process of encryption handling. If ‘no,’ provide a detailed description (with process, tools and technology) to keep data secured during the back-up process.

5.0 DATA RETENTION

# Question Response from the Vendor Score Additional Information/Clarification

Required from the Vendor

5.1 What is the Vendor’s retention period of the backed

up data? The data retention process shall comply with the City’s data retention policy.

5.2 Are the data back-up storage media at the Vendor’s

location or other third party location?

5.3 If the Vendor’s backup storage devices are

stored with another company, please provide:

Company Name:

Address:

Contact person detail (Phone & Email):

What contractual commitments are in place to guarantee security performance from these vendors

City of Santa Monica VISA Form Page 8 11/30/2021 3:10 PM

# Question Response from the Vendor Score Additional Information/Clarification

Required from the Vendor

5.4 What is the media transfer process (I.e. The lock

box process used to send tapes off-site)?

5.5 Who has access to the data storage media

lockbox(es)? (Provide Name and Role)

5.6 Who on the Vendor’s staff or

subcontractor/third party’s staff is/are authorized to access backup data storage media? (Provide Name and Role)

5.7 What is the backup data storage media receipt

and release authorization process(es)? (Please submit a soft copy of the process)

City of Santa Monica VISA Form Page 9 11/30/2021 3:10 PM

6.0 ACCOUNT PROVISIONING AND DE-PROVISIONING (The Vendor must receive formal pre-authorization from the City’s ISD designated Manager prior to provisioning and de-provisioning of application access account).

# Question Response from the Vendor Score

Additional Information/Clarification

Required from the Vendor

6.1 What is the account provisioning/removal

process? (Example: how are users accounts created and managed?)

6.2

What is the account deprovisioning/ removal process? Example: how are users accounts created and managed?)

6.3 How will the City’s employees gain access to

required application(s)?

6.4 Does the application(s) have the capability to

restrict access only from the City’s WAN (Wide Area Network)?

City of Santa Monica VISA Form Page 10 11/30/2021 3:10 PM

7.0 PASSWORD MANAGEMENT

# Question Response from the Vendor Score

Additional Information/Clarification

Required from the Vendor

7.1 What will be the policy and/or procedures for the

logging, authentication, authorization and password management scheme? (Please provide a soft copy of the process)

7.2 Where will the login and password credentials be

stored?

7.3 Are the password credentials stored with encryption?

If ‘yes,’ please provide encryption scheme detail.

7.4 Please describe system administrator’s authentication

process, are they using multifactor authentication (if so, please explain/detail)?

7.5 The Vendor’s application must comply with the

following password requirements. Does the Vendor’s application meet these requirements?

Multifactor Authentication First time password must be unique to an individual and require the user to change it upon initial login.

If the password is sent via plain text e-mail to the

City employee to mitigate security exposure.

The City requires first time password to have a time-out capability of no more than 7 days.

The e-mail notification must not be copied to anyone except the user.

The permanent/long term password must be changed frequently (at least every 90 days) E-mail notification must be sent to the user whenever the password has been updated.

City of Santa Monica VISA Form Page 11 11/30/2021 3:10 PM

Additional Information/Clarification

Required from the Vendor

User should not be able to view data or conduct business unless an initial password has been updated with a different password.

The Vendor shall inform the City’s users, when a new password is created, the user shall not use their City’s password.

The password must have 12 or more alphanumeric characters and it must contain at least one character from each of the bullets noted below (i.e. each line shall contribute at least one character):

Abcdefghijklmnopqrstuvwxyz

ABCDEFGHIJKLMNOPQRSTUVWXYZ

0123456789

City of Santa Monica VISA Form Page 12 11/30/2021 3:10 PM

8.0 CLOUD SERVICES

Additional Information/Clarification

Required from the Vendor

8.1 Are the vendor services housed at their own (a) data

center, (b) the cloud, or (c) deployed-on premise only?

How does the vendor ensure any services hosted externally maintain regulatory and best practice security controls?

8.2 Which cloud provider(s) does the vendor use?

9.0 CYBERSECURITY INSURANCE

Additional Information/Clarification

Required from the Vendor

9.1 Does the vendor have cybersecurity insurance? If so, please indicate if it protects against security incidents, including hacking, viruses, data theft and inadvertent loss personal information.

Information Security Officer Comments:

--------------------------------------------------- End of Document --------------------------------------------------