Cyber Security Vendor Risk Assessment - Support Services.docx
DOCX document 91 KB Posted
- Solicitation number
- 145277
- Issued by
- San Diego County, California
About this file
This is a Vendor Risk Assessment (VRA) Questionnaire document issued by the City of Chula Vista, California, for vendors seeking to provide information technology services including VPN access, remote support, or remote access to City resources. The questionnaire is designed to evaluate vendor compliance with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and applicable federal, state, and local data privacy regulations, including the California Consumer Privacy Act (CCPA). The assessment covers nine primary categories: business process and data exchange requirements, access controls, regulatory compliance, infrastructure and application security, and cybersecurity insurance. Vendors are required to provide detailed responses addressing their security programs, information security policies, incident response procedures, data handling practices, security breach history, employee training protocols, and third-party audit records. The City's Cybersecurity Division will evaluate responses using a three-tier scoring methodology (A = Meets completely, B = Partially meets, C = Doesn't meet), with vendors having the option to request exceptions and propose alternative countermeasures for approval by the City's IT Director.
The questionnaire requires vendors to demonstrate implementation of multi-factor authentication, privileged account protection, configuration management tools, patch management programs, intrusion detection systems, and regular vulnerability scanning procedures. Vendors must disclose their geographic support locations, employee cybersecurity training frequency, third-party penetration testing practices, regulatory compliance obligations (such as PCI DSS, HIPAA, SOC2, GDPR, or ISO 27001/2022), and current cybersecurity insurance coverage protecting the City against breach response costs, business interruption, ransomware, data theft, and related liabilities. Vendors are prohibited from sharing or selling personal information, personally identifiable information, or sensitive information collected during service delivery without explicit justification and City approval. Supporting documentation, including certificates of insurance, audit reports, and breach records, must be provided for City review and inspection.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| Attachment B FINAL Fee Schedule RFP P09-2027.xlsx | XLSX spreadsheet | |
| BYRD ANTI-LOBBYING ACKNOWLEDGEMENT.pdf | ||
| GENERAL CONDITIONS.pdf | ||
| Solicitation Document.pdf | ||
| Attachment A Current Service Area.pdf | ||
| General Provisions RFP.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Vendor Risk Assessment (VRA) Questionnaire Information Technology Services “Empowering diversity, embracing equity, fostering inclusion & justice through innovative technology.”
The City of Chula Vista follows the National Institute of Standard and Technology (NIST) Cybersecurity Framework as a practice to secure information resources and meet regulatory requirements.
Vendor Information:
Purpose: This Vendor Risk Assessment (VRA) Questionnaire requests information concerning services provided by (the Vendor), that intends to provide to the City of Chula Vista (the City) through any or all of the following services: VPN access, remote support, or remote access to City resources.
Note/Instructions:
· This Questionnaire is for the sole use of the intended Vendor and may contain confidential information of individuals and businesses collected, stored, and used by the City. Any unauthorized collection, storage, use, review, or distribution may be prohibited by California and/or Federal laws including the California Consumer Privacy Act (CCPA). If you are not the intended recipient of this Questionnaire, please contact the sender by e-mail and destroy all copies of the Questionnaire.
· The Vendor shall provide answers to the questions or information to the requests provided below.
· If the Vendor determines that it cannot meet the City’s security and or privacy requirements, the Vendor may submit a request for an exception to the City’s requirements and propose alternative countermeasures to address the risks addressed in this Questionnaire. The City’s IT Director may approve or reject the exception request, depending on the risks associated with the exception request.
· Upon receipt of the Vendor’s response, the Cybersecurity Division will conduct a security risk assessment, using the following scoring methodology:
A = Meets completely.
B = Partially meets. The Vendor may be required to provide additional requested information.
C = Doesn’t meet. The Vendor may be required to provide missing/additional details.
Vendor Name
Address
Completed by
Phone
Date Completed
Updated
BUSINESS PROCESS AND DATA EXCHANGE REQUIREMENTS
| # |
| Question |
| Response |
| 1 |
| Does the Vendor have a developed security program in place? A cyber security team and/or a chief information security officer? |
| 2 |
| Has the Vendor adopted and implemented information security and privacy policies that are documented, are accessible to the City, and conform to NIST CSF, NIST 800-53, ISO 27001/2022, or CIS Controls standards? |
| 3 |
| Does the Vendor maintain formal security procedures to comply with applicable statutory or industry practice requirements/standards? Does it include an Incident Response procedure? Are records maintained to demonstrate compliance or certification? Does the Vendor allow client audit of these records? |
NOTE: PLEASE PROVIDE SUPPORTING DOCUMENTS
| 4 |
| What data exchange will occur between the City and the Vendor? What data will be stored at the Vendor’s or other third party’s data storage location? (Provide data attributes with examples) |
Example: (Payment Card Information, Social Security Number, Driving License # Patrons Name, Address, telephone, etc.), which are examples of personal information.
| 5 |
| If the Vendor is required to store Private Information (PI), Personally Identifiable Information (PII), or Sensitive Information (SI) about individuals in the service provider’s business systems, how does the Vendor maintain the confidentiality of the Information per applicable federal, state and local data and information privacy laws, rules and regulations including the California Consumer Privacy Act? |
| 6 |
| If the Vendor is required to collect and/or store Private Information (PI), Personally Identifiable Information (PII), or Sensitive Information (SI) about individuals in the service provider’s business systems, how does the Vendor intend to use or share data and/or individual’s Information resulting from the business system? Does the Vendor intend to share or sell data and/or individual Information resulting from the business system to third parties? |
If Yes, why is data sharing necessary?
| 7 |
| Has the Vendor ever been subjected to either an electronic or physical security breach? Please describe the event(s) and the steps taken to mitigate the breach(es). What damages or exposure resulted? Are records of breaches and issues maintained and will these records be available for inspection by the City? |
| 8 |
| In what geographic location(s) will the Vendor’s technical staff be providing support? Will they need VPN access? |
| 9 |
| Do the Vendor employees complete cyber security awareness training regularly? If so, how often and what is covered in each training module? |
| 10 |
| Has the Vendor incorporated third-party penetration testing? |
ACCESS CONTROLS
| # |
| Question |
| Response |
| 11 |
| Do you have multi-factor authentication (MFA) implemented? |
| 12 |
| Do you have a methodology in place for protecting privileged user accounts? |
| 13 |
| Does the Vendor allow the use of personal device for work? |
| 14 |
| What controls does the Vendor exercise over the qualification and performance of its team? Of their subcontractor/third party’s team(s)? |
(For example, criminal background verification before employment, providing security training after employment, and managing Role Based Access Control (RBAC) during employment and network and application access termination upon employment termination.
REGULATORY COMPLIANCE
| # |
| Question |
| Response |
| 15 |
| List all the regulations your organization is bound to: |
Example of complaint regulations:
PCI DSS, HIPAA, SOC2, GDPR, NIST, CCPA, etc.
| 16 |
| Is the Vendor audited or assessed by a third party? If yes, specify the security framework. |
Example of security frameworks:
NIST, ISO27001/2, CIS, PCI DSS, SOC2, COBIT, etc.
| 17 |
| Explain how the Vendor performs an information security risk assessment. What is the frequency? |
| 18 |
| Explain how the Vendor manages their information security risk assessment program. |
| 19 |
| Do you have a process in place for tracking emerging cybersecurity regulatory requirements? |
INFRASTRUCTURE, SERVER, AND APPLICATION SECURITY
| # |
| Question |
| Response |
| 20 |
| Do you have configuration management tools enabling secure configuration settings? |
| 21 |
| Do you facilitate remote access to your infrastructure? do these remote access mechanisms undergo security testing to uncover potentially exploitable vulnerabilities? |
| 22 |
| Do you have a patch management program for keeping your applications and devices secured with the latest patches? |
| 23 |
| Describe the security controls you have in place for defending against email-based attacks. |
| 24 |
| Specify the network security tools used to monitor data flow into the vendor’s network for malware or cyber-attacks. |
| 25 |
| What tools and procedures does the Vendor utilize for intrusion detection and at what frequency? How is this capability tested for functionality at the hardware, network, and database levels? |
| 26 |
| Specify the tools used to perform vulnerability scans and the frequency. What is the timeframe to re-mediate high and critical findings? |
| 27 |
| Specify the frequency of third-party penetration tests to assess infrastructure security. Include the type of third-party report received. |
CYBERSECURITY INSURANCE
| # |
| Question |
| Response |
| 28 |
| Does the vendor have cyber liability insurance? If so, please indicate if it protects city / third parties for loss including but not limited to breach response, business interruption security breaches, ransomware, cyber extortion loss, malware, data recovery, regulatory defense penalties and required notifications, data theft, and inadvertent loss of personal information, arising from vendor’s scope of work. Please provide a copy of the Certificate of Insurance and a description of services covered by the insurance. |
image1.png image2.png
File details come from the government source that posted it. Updated .