DO_NOT_USE_Attachment_B_Collin_County_SaaS_Questionnaire_08_09_2024_(OLD_VERSION).docx
DOCX document 30 KB Posted
- Attached to
- Electronic Health Records
- Solicitation number
- 2024-280
- Issued by
- Collin County, Texas
About this file
This document is a SaaS Questionnaire from Collin County Information Technology, designed to evaluate cloud-based software solutions for the county's technology infrastructure, specifically targeting an Electronic Health Records (EHR) system for Collin County Health Care Services (CCHCS). The questionnaire comprehensively assesses potential cloud service providers' cybersecurity capabilities, governance controls, authentication methods, data management practices, and overall security posture, with specific focus on areas such as log exportation, multi-factor authentication, single sign-on integration, data encryption, backup procedures, and breach notification protocols.
The questionnaire seeks detailed information about vendors' capabilities to protect sensitive county data, including personally identifiable information (PII), personal health data (PHI), and payment card information (PCI). Key areas of inquiry include data ownership, storage location restrictions, firewall protection, backup mechanisms, record retention policies, application patch management, vulnerability identification processes, and specific notification procedures for potential security incidents. The document is structured to help Collin County thoroughly evaluate potential cloud service providers' technical capabilities, security standards, and commitment to protecting government data, with particular emphasis on ensuring comprehensive cybersecurity measures for a cloud-based electronic health records system.
View the file
Other files
Show all 32
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
COLLIN COUNTY
Information Technology 2300 Bloomdale Road Suite 3198 McKinney, Texas 75071 www.collincountytx.gov
ATTACHMENT B-SaaS QUESTIONNAIRE
Company Name:______________________________________
In the event of a cybersecurity incident, who should we contact?
Governance & Security Controls
| Do you offer the capability to export your logs to the county's on-premise SEIM? If yes, select all that apply. |
| Yes No |
| Authentication Logs |
| Changelogs |
| Traffic logs |
For other logs, please specify. ____________________________________________________________________________________
How do you secure logins to the cloud application?
| Username/Password |
| MFA |
| SSO |
| Source IP Restriction |
Other methods, please specify. ____________________________________________________________________________________
| Do you integrate with Okta for single sign-on (SSO)? |
| Yes No |
| Do you support Cisco Duo 2FA to secure access? |
| Yes No |
| Do you provide the capability to geoblock access to the cloud application? |
| Yes No |
| Does your solution support role-based access? |
| Yes No |
| Does your solution store any personally identifiable information, personal health data, payment card information (PII, PHI, or PCI data), or secure/confidential information? |
| Yes No |
| PII |
| PHI |
| PCI |
| Secure/Confidential |
Who owns the county’s data in your cloud solution? _________________________________________________
| Do you encrypt the data stored at rest? |
| Yes No |
| Do you encrypt the data in transit? |
| Yes No |
| Does your solution comply with the FedRAMP requirements? |
| Yes No |
| Do you have traffic analysis tools for your solution? |
| Yes No |
| Can the county's data in your cloud solution be stored in another country besides the United States? |
| Yes No |
If yes, what other countries may store the county's data?
If yes, can Collin County restrict data storage to US locations only?
| Is your solution behind a firewall? |
| Yes No |
Backups
How do you back up the county's data, and how long do you keep the backups? ___________________________________________________________________________________________
| Can you export the backup to the county’s data center? |
| Yes No |
If yes, what data format will be used to transfer the data to the county?
Policies & Procedures
What is your record retention policy for the county's data?
What is your data retention policy after the end of service?
· For example, do you securely remove all of our data at the end of service, and how long will you keep it?
What is your application patch policy?
· For example, how long does it take you to patch a critical vulnerability once notified?
| Do you run a bug bounty program to identify vulnerabilities in your application? |
| Yes No |
What is your breach notification policy for your customers if you suffer a cybersecurity breach?
If you determine an outsider has breached the county's data, what is your notification policy to the county? ____________________________________________________________________________________________
Explain your notification policy if a misconfiguration is identified that may have put your customer at risk (for example, exposing RDP to the internet).
What is your notification policy if you determine the county has misconfigured your cloud solution and put itself at risk?
Who is responsible for providing notifications regarding system outages, and what is your expected timeframe for delivering these notifications?
Additional Comments
Submitter’s Information
Printed Name:______________________________ Signature:___________________________________
Position:___________________________________ E-Mail Address:_______________________________
Date:___________________
2 | Page image1.png
File details come from the government source that posted it. Updated .