ESBD_File_346846_Appendix I_Cloud Vendor Assessment Tool.xlsx
XLSX spreadsheet 1 MB Posted
- Attached to
- E-Book/Audiobook Content and Mobile Application
- Solicitation number
- 306-24-0143
- Issued by
- Travis County, Austin City, Texas
About this file
This document is a solicitation from the Texas State Library and Archives Commission (TSLAC) for an e-book and audiobook mobile application (app) and related digital content. TSLAC requires a qualified contractor to provide an app suitable for use by a consortium of Texas public libraries, as well as a marketplace of e-book and digital audiobook content from which TSLAC can purchase titles for the shared consortial collection. Respondents must register with TSLAC's eProcurement portal to submit their response. An Intent to Bid is requested prior to submission of the response.
The solicitation does not provide specific details on pricing terms, set asides, incumbents, funding requirements and sources, or other financial information. However, it does indicate that this is a Texas state and local contract opportunity involving multiple jurisdictions, including Travis County and the City of Austin.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| ESBD_File_346846_24-0143_EBook Mobile App_RFO.pdf | ||
| ESBD_File_346846_24-0143_ERT_RFO_FINAL.docx | DOCX document | |
| ESBD_File_346846_HUB Vendors_715-35.xlsx | XLSX spreadsheet | |
| ESBD_File_346846_HUB Vendors_920-45.xlsx | XLSX spreadsheet | |
| ESBD_File_346846_HSP All Forms.pdf | ||
| ESBD_File_346846_HUB Vendors_715-04.xlsx | XLSX spreadsheet | |
| ESBD_File_346846_HUB Vendors_961-75.xlsx | XLSX spreadsheet | |
| ESBD_File_346846_24-0143_Addendum 1_Q&A.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Instructions
| Cloud Vendor Assessment Tool - Instructions |
| Vendor or Respondent |
Remember to check solicitation for additional instructions.
| Document Layout | |
| There are five main sections of the Cloud Vendor Assessment Tool (CVAT), all listed below and outlined in more detail. This document is designed to have the first two sections populated first; after the Qualifiers section is completed it can be populated in any order. Within each section, answer each question top-to-bottom. Some questions are nested and may be blocked out via formatting based on previous answers. Populating this document in the correct order improves efficiency. Do not overwrite selection values (data validation) in column C of the CVAT tab. | |
| General Information | This section is self-explanatory; product specifics and contact information. GNRL-01 through GNRL-10 should be populated by the Vendor. |
GNRL-11 and GNRL-12 are for agency use only.
| Qualifiers | Populate this section completely before continuing. Answers in this section can determine which sections will be required for this assessment. By answering "No" to Qualifiers, their matched sections become optional and are highlighted in orange. |
| Documentation | Focused on external documentation, the agency is interested in the frameworks that guide your security strategy and what has been done to certify these implementations. |
| Company Overview | This section is focused on company background, size, and business area experience. |
| Safeguards | The remainder of the document consists of various safeguards, grouped generally by section. |
| In sections where vendor input is required there are only one or two columns that need modification, Vendor Answers and Additional Information, columns C and D respectively (see Figure 1 below). You will see that sometimes C and D are separate and other times are merged. If they are separate, C will be a selectable, drop-down box and any supporting information should be added to column D. If C and D are merged, the question is looking for the answer to be in narrative form. At the far right is a column titled “Guidance”. After answering questions, check this column to ensure you have submitted information/documentation to sufficiently answer the question. Use the “Additional Information” column to provide any requested details. | |
| Figure 1: | |
| Optional Safeguards Based on Qualifiers | |
| Not all questions are relevant to all vendors. Qualifiers are used to make whole sections optional to vendors depending on the scope of product usage and the data involved in the engagement being assessed. Sections that become optional have the section titles and questions highlighted in orange (see Figure 2). | |
| Figure 2: | |
| Definitions and Data Zones | |
| Agency | The agency will include TSLAC and may include participating libraries throughout the state of Texas or other participating state agencies and universities; entities using the product will be specified in the request or solicitation |
| Agency Data Zone | The country/state on in which an agency is located, including all laws and regulations in-scope within that country/state/region. |
| Vendor Data Zone | The country/region in which a vendor is headquartered and/or serves its products/services, including all laws and regulations in-scope within that country/region. |
| Customers from different regions may expect vary protections of data (e.g. GDPR), this is the Agency Data Zone. Vendors may handle data differently depending on the country or region where data is stored, this is the Vendor Data Zone. |
As a vendor, if your security practices vary based on your region of operation, you may want to populate a CVAT in the context for each security zone (strategy). That said, the agency or libraries from different data zones may still use vendor responses from other state Data Zones. If your security practices are the same across all regions of operations, indicate "All" in your Vendor Data Zone.
Example A: If vendor ABC is headquartered and stores data in Canada, and provides services to only customers in Canada, ABC should state "Canada" in both Data Zone fields.
Example B: If vendor ABC is headquartered and stores data in Canada, and additionally provides services to customers in the United Kingdom, ABC may want to assure customers in the United Kingdom that their data is handled properly for their region. In that case, ABC should state "Canada" in the Vendor Data Zone and "United Kingdom" in the Agency Data Zone.
Example C: If your security strategy is broad and doesn't fit this statement model, provide a brief summary in each field and the agency's Security Analyst can assess your response.
| Data Reporting |
| To update data in the Report tabs, click Refresh All in the Menu tab. Input provided in the CVAT tab is assessed a preliminary score pending agency's Security Analyst review. |
| Proceed to the next tab, CVAT. |
| For Agency's Security Analysts |
| Raw vendor answers can be viewed in the Cloud Vendor Assessment Tool tab. To begin your assessment, review the Analyst Report tab, ensuring that you select the appropriate security standard used in your agency (cell B7) before you begin. Select complaince states for the outstanding non-compliant or short-answer questions in column G. Once all subjective questions are evaluated and compliance indicated, move to the Summary Report tab. To update the report's data, select Refresh All in the Data menu. Review details in the Summary Report and based on your assessment, follow-up with vendor for clarification(s) or add the Summary Report output to your agency's reporting documents. |
CVAT
| Cloud Vendor Assessment Tool (Form) | Version 2.0 | |||
| Vendor or Respondent <Enter Company Name> | ||||
| Date <Enter Date Completed> | ||||
| General Information | ||||
| In order to protect the agency and its systems, vendors whose products and/or services will access and/or host agency data must complete the Cloud Vendor Assessment Tool (CVAT). Throughout this tool, anywhere where the term data is used, this is an all-encompassing term including at least data and metadata. Answers will be reviewed by agency tech review team upon submittal. This process will assist the agency in preventing breaches of protected information and comply with agency policy, state and federal law. This is intended for use by vendors participating in a Third Party Security Assessment and should be completed by a vendor. Review the Instructions tab for further guidance. | ||||
| GNRL-01 through GNRL-08; populated by the Vendor | ||||
| GNRL-01 | Vendor Name | |||
| GNRL-02 | Product Name | |||
| GNRL-03 | Product Description | |||
| GNRL-04 | Web Link to Product Privacy Notice | |||
| GNRL-05 | Vendor Contact Name | |||
| GNRL-06 | Vendor Contact Title | |||
| GNRL-07 | Vendor Contact Email | |||
| GNRL-08 | Vendor Contact Phone Number | |||
| GNRL-09 | Vendor Data Zone | |||
| GNRL-10 | Agency Data Zone | |||
| GNRL-11 and GNRL-12; populated by the TSLAC | ||||
| GNRL-11 | Agency's Security Analyst/Engineer | Michael Ford, ITS Director | ||
| GNRL-12 | Assessment Contact | purchasing@tsl.texas.gov | ||
| Instructions | ||||
| Step 1: Complete the Qualifiers section first. Step 2: Complete each section answering each set of questions in order from top to bottom; the built-in formatting logic relies on this order. Step 3: Submit the completed Cloud Vendor Assessment Tool (CVAT) to the agency according to solicitation instructions or staff member's request. | ||||
| Qualifiers | Vendor Answers | Additional Information | Guidance | |
| The agency will conduct an assessment of the requested product. As such, not all assessment questions are relevant to each vendor or product. To alleviate complexity, a "qualifier" strategy is implemented and allows for various parties to utilize this common documentation instrument. Responses to the following questions will determine the need to answer additional questions below. | ||||
| QUAL-01 | Does your product process protected health information (PHI) or any data covered by the Health Insurance Portability and Accountability Act? | |||
| QUAL-02 | Does the vended product host/support a mobile application? (e.g. app) | |||
| QUAL-03 | Will agency data be shared with or hosted by any third parties? (e.g. any entity not wholly-owned by your company is considered a third-party) |
Charles Escue: The Institution views hosted solutions such as AWS, Rackspace, Azure, and other PaaS/SaaS offerings as third parties. If services such as these are used in your environment, respond "Yes".
| QUAL-04 | Do you have a Business Continuity Plan (BCP)? | |||
| QUAL-05 | Do you have a Disaster Recovery Plan (DRP)? | |||
| QUAL-06 | Will data regulated by PCI DSS reside in the vended product? | |||
| QUAL-07 | Is your company a consulting firm providing only consultation to the agency? | |||
| Documentation | Vendor Answers | Additional Information | Guidance | |
| DOCU-01 | Have you undergone a SSAE 16 audit? |
: In 2011, Statement on Standards for Attestation Engagements (SSAE) No. 16 took effect and replaced SAS 70 as the authoritative guidance for performing a service auditor's examination. SSAE 16 established a new attestation standard (AT 801) to contain the professional guidance.
You can learn more about SSAE 16 at www.ssae16.com.
DOCU-02 Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ?
: CSA STAR Self Assessment is free and open to all cloud providers and allows them to submit self assessment reports that document compliance to CSA-published best practices.
Website: https://cloudsecurityalliance.org/star/self-assessment/ DOCU-03 Have you received the Cloud Security Alliance STAR certification?
: The CSA STAR Certification is a rigorous third party independent assessment of the security of a cloud service provider. The technology-neutral certification leverages the requirements of the ISO/IEC 27001 management system standard together with the CSA Cloud Controls Matrix, a specified set of criteria that measures the capability levels of the cloud service.
Website: https://cloudsecurityalliance.org/star/certification/
| DOCU-04 | Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.) |
| DOCU-05 | Are you compliant with FISMA standards? |
: The Federal Information Security Management Act (FISMA) is United States legislation that defines a comprehensive framework to protect government information, operations and assets against natural or man-made threats.
Website: http://www.dhs.gov/FISMA slight wording change -Josh Callahan Charles Escue: The Institution views hosted solutions such as AWS, Rackspace, Azure, and other PaaS/SaaS offerings as third parties. If services such as these are used in your environment, respond "Yes".
| DOCU-06 | Does your organization have a data privacy policy? | |||
| Company Overview | Vendor Answers | Additional Information | Guidance | |
| COMP-01 | Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships. | Include circumstances that may involve off-shoring or multi-national agreements. | ||
| COMP-02 | Describe how long your organization has conducted business in this product area. | Include the number of years and in what capacity. | ||
| COMP-03 | Do you have existing state agency and/or library customers? | |||
| COMP-04 | Have you had a significant breach in the last 5 years? | |||
| COMP-05 | Do you have a dedicated Information Security staff or office? | |||
| COMP-06 | Do you have a dedicated Software and System Development team(s)? (e.g. Customer Support, Implementation, Product Management, etc.) | |||
| COMP-07 | Use this area to share information about your environment that will assist those who are assessing your company data security program. | Share any details that would help information security analysts assess your product. | ||
| Third Parties | Vendor Answers | Additional Information | Guidance | |
| THRD-01 | Describe how you perform security assessments of third party companies with which you share data (i.e. hosting providers, cloud services, PaaS, IaaS, SaaS, etc.). Provide a summary of your practices that assures that the third party will be subject to the appropriate standards regarding security, service recoverability, and confidentiality. | Ensure that all elements of THRD-01 are clearly stated in your response. | ||
| THRD-02 | Provide a brief description for why each of these third parties will have access to agency data. | If more space is needed to sufficiently answer this question, provide reference to the document or add it as an appendix. | ||
| THRD-03 | What legal agreements (i.e. contracts) do you have in place with these third parties that address liability in the event of a data breach? | Provide sufficient detail for each legal agreement in place. | ||
| THRD-04 | Describe or provide references to your third party management strategy or provide additional information that may help analysts better understand your environment and how it relates to third-party solutions. | Robust answers from the vendor improve the quality and efficiency of the security assessment process. | ||
| Consulting | Vendor Answers | Additional Information | Guidance | |
| CONS-01 | Will the consulting take place on-premises? | |||
| CONS-02 | Will the consultant require access to agency's network resources? | |||
| CONS-03 | Will the consultant require access to hardware in the agency's data centers? | |||
| CONS-04 | Will the consultant require an account within the agency's domain (@*.gov)? | |||
| CONS-05 | Has the consultant received training on [sensitive, HIPAA, PCI, etc.] data handling? | |||
| CONS-06 | Will any data be transferred to the consultant's possession? | |||
| CONS-07 | Is it encrypted (at rest) while in the consultant's possession? | |||
| CONS-08 | Will the consultant need remote access to the agency's network or systems? | |||
| CONS-09 | Can we restrict that access based on source IP address? | |||
| Application/Service Security | Vendor Answers | Additional Information | Guidance | |
| APPL-01 | Do you support role-based access control (RBAC) for end-users? | |||
| APPL-02 | Do you support role-based access control (RBAC) for system administrators? | |||
| APPL-03 | Can employees access customer data remotely? | |||
| APPL-04 | Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system? | |||
| APPL-05 | Does the system provide data input validation and error messages? | |||
| APPL-06 | Do you employ a single-tenant environment? | |||
| APPL-07 | What operating system(s) is/are leveraged by the system(s)/application(s) that will have access to agency's data? | List all operating systems and the roles that are fulfilled by each. | ||
| APPL-08 | Have you or any third party you contract with that may have access or allow access to the agency's data experienced a breach? | |||
| APPL-09 | Describe or provide a reference to additional software/products necessary to implement a functional system on either the backend or user-interface side of the system. | Describe the products and how they will be implemented. | ||
| APPL-10 | Describe or provide a reference to the overall system and/or application architecture(s), including appropriate diagrams. Include a full description of the data communications architecture for all components of the system. | Ensure that all parts of APPL-10 are clearly stated in your response. Submit architecture diagrams along with this fully-populated CVAT. | ||
| APPL-11 | Are databases used in the system segregated from front-end systems? (e.g. web and application servers) | |||
| APPL-12 | Describe or provide a reference to all web-enabled features and functionality of the system (i.e. accessed via a web-based interface). | Include both end-user and adminstrative features and functions. | ||
| APPL-13 | Are there any OS and/or web-browser combinations that are not currently supported? | |||
| APPL-14 | Can your system take advantage of mobile and/or GPS enabled mobile devices? | |||
| APPL-15 | Describe or provide a reference to the facilities available in the system to provide separation of duties between security administration and system administration functions. | Include a detailed description of how security administration and system administration authority is separated, controls are verified, and logs are reviewed regularly to ensure appropriate use. | ||
| APPL-16 | Describe or provide a reference that details how administrator access is handled (e.g. provisioning, principle of least privilege, deprovisioning, etc.) | Ensure that all parts of APPL-16 are clearly stated in your response. | ||
| APPL-17 | Does the system provide data input validation and error messages? | |||
| APPL-18 | Describe or provide references explaining how tertiary services are redundant (i.e. DNS, ISP, etc…). | Ensure that all parts of APPL-18 are clearly stated in your response. The examples given are not exhaustive - elaborate as necessary. | ||
| Authentication, Authorization, and Accounting | Vendor Answers | Additional Information | Guidance | |
| AAAI-01 | Can you enforce password/passphrase aging requirements? | |||
| AAAI-02 | Can you enforce password/passphrase complexity requirements [provided by the agency]? | |||
| AAAI-03 | Does the system have password complexity or length limitations and/or restrictions? | |||
| AAAI-04 | Do you have documented password/passphrase reset procedures that are currently implemented in the system and/or customer support? | |||
| AAAI-05 | Does your web-based interface support authentication, including standards-based single-sign-on? (e.g. InCommon) | |||
| AAAI-06 | Are there any passwords/passphrases hard coded into your systems or products? | |||
| AAAI-07 | Are user account passwords/passphrases visible in administration modules? | |||
| AAAI-08 | Are user account passwords/passphrases stored encrypted? | |||
| AAAI-09 | Does your application and/or user-frontend/portal support multi-factor authentication? (e.g. Duo, Google Authenticator, OTP, etc.) | |||
| AAAI-10 | Does your application support integration with other authentication and authorization systems? List which ones (such as Active Directory, Kerberos and what version) in Additional Info? | |||
| AAAI-11 | Will any external authentication or authorization system be utilized by an application with access to the agency's data? | |||
| AAAI-12 | Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication? | |||
| AAAI-13 | Does the system operate in a mixed authentication mode (i.e. external and local authentication)? | |||
| AAAI-14 | Will any external authentication or authorization system be utilized by a system with access to agency data? | |||
| AAAI-15 | Are audit logs available that include AT LEAST all of the following; login, logout, actions performed, and source IP address? | |||
| AAAI-16 | Describe or provide a reference to the a) system capability to log security/authorization changes as well as user and administrator security events (i.e. physical or electronic)(e.g. login failures, access denied, changes accepted), and b) all requirements necessary to implement logging and monitoring on the system. Include c) information about SIEM/log collector usage. | Ensure that all elements of AAAI-16 are clearly stated in your response. | ||
| AAAI-17 | Describe or provide a reference to the retention period for those logs, how logs are protected, and whether they are accessible to the customer (and if so, how). | Ensure that all elements of AAAI-17 are clearly stated in your response. | ||
| Business Continuity Plan | Vendor Answers | Additional Information | Guidance | |
| BCPL-01 | Describe or provide a reference to your Business Continuity Plan (BCP). | Provide a valid URL to your current BCP or submit it along with this fully-populated CVAT. | ||
| BCPL-02 | May the agency review your BCP and supporting documentation? | |||
| BCPL-03 | Is an owner assigned who is responsible for the maintenance and review of the Business Continuity Plan? | |||
| BCPL-04 | Is there a defined problem/issue escalation plan in your BCP for impacted clients? | |||
| BCPL-05 | Is there a documented communication plan in your BCP for impacted clients? | |||
| BCPL-06 | Are all components of the BCP reviewed at least annually and updated as needed to reflect change? | |||
| BCPL-07 | Has your BCP been tested in the last year? | |||
| BCPL-08 | Does your organization conduct training and awareness activities to validate its employees understanding of their roles and responsibilities during a crisis? | |||
| BCPL-09 | Are specific crisis management roles and responsibilities defined and documented? | |||
| BCPL-10 | Does your organization have an alternative business site or a contracted Business Recovery provider? | |||
| BCPL-11 | Does your organization conduct an annual test of relocating to an alternate site for business recovery purposes? | |||
| BCPL-12 | Is this product a core service of your organization, and as such, the top priority during business continuity planning? | |||
| Change Management | Vendor Answers | Additional Information | Guidance | |
| CHNG-01 | Do you have a documented and currently followed change management process (CMP)? | |||
| CHNG-02 | Indicate all procedures that are implemented in your CMP. a.) An impact analysis of the upgrade is performed. b.) The change is appropriately authorized. c.) Changes are made first in a test environment. d.) The ability to implement the upgrades/changes in the production environment is limited to appropriate IT personnel. | Ensure that all parts of CHNG-02 are clearly stated in your response. | ||
| CHNG-03 | Will the agency be notified of major changes to your environment that could impact the agency's security posture? | |||
| CHNG-04 | Do clients have the option to not participate in or postpone an upgrade to a new release? | |||
| CHNG-05 | Describe or provide a reference to your solution support strategy in relation to maintaining software currency. (i.e. how many concurrent versions are you willing to run and support?) | Ensure that all relevant details pertaining to CHNG-05 are clearly stated in your response. | ||
| CHNG-06 | Identify the most current version of the software. Detail the percentage of live customers that are utilizing the proposed version of the software as well as each version of the software currently in use. | Ensure that all parts of CHNG-06 are clearly stated in your response. | ||
| CHNG-07 | Does the system support client customizations from one release to another? | |||
| CHNG-08 | Does your organization ensure through policy and procedure (that is currently implemented) that only application software verifiable as authorized, tested, and approved for production, and having met all other requirements and reviews necessary for commissioning, is placed into production? | |||
| CHNG-09 | Do you have a release schedule for product updates? | |||
| CHNG-10 | Do you have a technology roadmap, for the next 2 years, for enhancements and bug fixes for the product/service being assessed? | |||
| CHNG-11 | Is agency involvement (i.e. technically or organizationally) required during product updates? | |||
| CHNG-12 | Do you have policy and procedure, currently implemented, managing how critical patches are applied to all systems and applications? | |||
| CHNG-13 | Do you have policy and procedure, currently implemented, guiding how security risks are mitigated until patches can be applied? | |||
| CHNG-14 | Are upgrades or system changes installed during off-peak hours or in a manner that does not impact the customer? | |||
| CHNG-15 | Do procedures exist to provide that emergency changes are documented and authorized (including after the fact approval)? | |||
| Data | Vendor Answers | Additional Information | Guidance | |
| DATA-01 | Do you physically and logically separate agency's data from that of other customers? | |||
| DATA-02 | Will agency's data be stored on any devices (database servers, file servers, SAN, NAS, …) configured with non-RFC 1918/4193 (i.e. publicly routable) IP addresses? | |||
| DATA-03 | Is sensitive data encrypted in transport? (e.g. system-to-client) | |||
| DATA-04 | Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)? | |||
| DATA-05 | Do you employ or allow any cryptographic modules that do not conform to the Federal Information Processing Standards (FIPS PUB 140-2)? | |||
| DATA-06 | Does your system employ encryption technologies when transmitting sensitive information over TCP/IP networks (e.g., SSH, SSL/TLS, VPN)? (e.g. system-to-system and system-to-client) | |||
| DATA-07 | List all locations (i.e. city + datacenter name) where the agency's data will be stored? | Ensure that all parts of DATA-07 are clearly stated in your response. | ||
| DATA-08 | At the completion of this contract, will data be returned to the agency? | |||
| DATA-09 | Will the agency's data be available within the system for a period of time at the completion of this contract? | |||
| DATA-10 | Can the agency extract a full backup of data? | |||
| DATA-11 | Are ownership rights to all data, inputs, outputs, and metadata retained by the agency? | |||
| DATA-12 | Are these rights retained even through a provider acquisition or bankruptcy event? | |||
| DATA-13 | In the event of imminent bankruptcy, closing of business, or retirement of service, will you provide 90 days for customers to get their data out of the system and migrate applications? | |||
| DATA-14 | Describe or provide a reference to the backup processes for the servers on which the service and/or data resides. | If your strategy uses different processes for services and data, ensure that all strategies are clearly stated and supported. | ||
| DATA-15 | Are backup copies made according to pre-defined schedules and securely stored and protected? | |||
| DATA-16 | How long are data backups stored? | If your backup strategy uses varying periods, ensure that each strategy is clearly stated and supported. | ||
| DATA-17 | Are data backups encrypted? | |||
| DATA-18 | Do you have a cryptographic key management process (generation, exchange, storage, safeguards, use, vetting, and replacement), that is documented and currently implemented, for all system components? (e.g. database, system, web, etc.) | |||
| DATA-19 | Do current backups include all operating system software, utilities, security software, application software, and data files necessary for recovery? | |||
| DATA-20 | Are you performing off site backups? (i.e. digitally moved off site) | |||
| DATA-21 | Are physical backups taken off site? (i.e. physically moved off site) | |||
| DATA-22 | Do backups containing the agency's data ever leave the agency's Data Zone either physically or via network routing? | |||
| DATA-23 | Do you have a media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures? | |||
| DATA-24 | Does the process described in DATA-23 adhere to DoD 5220.22-M and/or NIST SP 800-88 standards? | |||
| DATA-25 | Do procedures exist to ensure that retention and destruction of data meets established business and regulatory requirements? | |||
| DATA-26 | Is media used for long-term retention of business data and archival purposes stored in a secure, environmentally protected area? | |||
| DATA-27 | Will you handle data in a FERPA compliant manner? | |||
| DATA-28 | Is any agency data visible in system administration modules/tools? | |||
| Database | Vendor Answers | Additional Information | Guidance | |
| DBAS-01 | Does the database support encryption of specified data elements in storage? | |||
| DBAS-02 | Do you currently use encryption in your database(s)? | |||
| Datacenter | Vendor Answers | Additional Information | Guidance | |
| DCTR-01 | Does your company own the physical data center where the agency's data will reside? | |||
| DCTR-02 | Does the hosting provider have a SOC 2 Type 2 report available? | |||
| DCTR-03 | Are the data centers staffed 24 hours a day, seven days a week (i.e 24x7x365)? | |||
| DCTR-04 | Do any of your servers reside in a co-located data center? | |||
| DCTR-05 | Are your servers separated from other companies via a physical barrier, such as a cage or hardened walls? | |||
| DCTR-06 | Does a physical barrier fully enclose the physical space preventing unauthorized physical contact with any of your devices? | |||
| DCTR-07 | Select the option that best describes the network segment that servers are connected to. | Provide a general summary of the implemented networking strategy. | ||
| DCTR-08 | Does this data center operate outside of the agency's Data Zone? | |||
| DCTR-09 | Will any agency data leave the agency's Data Zone? | |||
| DCTR-10 | List all datacenters and the cities, states (provinces), and countries where the agency's data will be stored (including within the agency's Data Zone). | Ensure that all parts of DCTR-10 are clearly stated in your response. | ||
| DCTR-11 | Are your primary and secondary data centers geographically diverse? | |||
| DCTR-12 | If outsourced or co-located, is there a contract in place to prevent data from leaving the agency's Data Zone? | |||
| DCTR-13 | What Tier Level is your data center (per levels defined by the Uptime Institute)? |
Charles Escue: https://uptimeinstitute.com/tiers
| Review the Uptime Institute's level/tier direction provided on their website if you need addition information to answer DCTR-13. | ||||
| DCTR-14 | Is the service hosted in a high availability environment? | |||
| DCTR-15 | Is redundant power available for all datacenters where agency data will reside? | |||
| DCTR-16 | Are redundant power strategies tested? | |||
| DCTR-17 | Describe or provide a reference to the availability of cooling and fire suppression systems in all datacenters where agency data will reside. | Ensure that all parts of DCTR-17 are clearly stated in your response. | ||
| DCTR-18 | State how many Internet Service Providers (ISPs) provide connectivity to each datacenter where the agency's data will reside. | State the ISP provider(s) in addition to the number of ISPs that provide connectivity. | ||
| DCTR-19 | Does every datacenter where the agency's data will reside have multiple telephone company or network provider entrances to the facility? | |||
| Disaster Recovery Plan | Vendor Answers | Additional Information | Guidance | |
| DRPL-01 | Describe or provide a reference to your Disaster Recovery Plan (DRP). | Provide a valid URL to your current DRP or submit it along with this fully-populated CVAT. | ||
| DRPL-02 | Is an owner assigned who is responsible for the maintenance and review of the DRP? | |||
| DRPL-03 | Can the agency review your DRP and supporting documentation? | |||
| DRPL-04 | Are any disaster recovery locations outside the agency's Data Zone? | |||
| DRPL-05 | Does your organization have a disaster recovery site or a contracted Disaster Recovery provider? | |||
| DRPL-06 | Does your organization conduct an annual test of relocating to this site for disaster recovery purposes? | |||
| DRPL-07 | Is there a defined problem/issue escalation plan in your DRP for impacted clients? | |||
| DRPL-08 | Is there a documented communication plan in your DRP for impacted clients? | |||
| DRPL-09 | Describe or provide a reference to how your disaster recovery plan is tested? (i.e. scope of DR tests, end-to-end testing, etc.) | Ensure that all elements of DRPL-09 are clearly stated in your response. | ||
| DRPL-10 | Has the Disaster Recovery Plan been tested in the last year? Please provide a summary of the results in Additional Information (including actual recovery time). | |||
| DRPL-11 | Do the documented test results identify your organizations actual recovery time capabilities for technology and facilities? | |||
| DRPL-12 | Are all components of the DRP reviewed at least annually and updated as needed to reflect change? | |||
| DRPL-13 | Do you carry cyber-risk insurance to protect against unforeseen service outages, data that is lost or stolen, and security incidents? | |||
| Firewalls, IDS, IPS, and Networking | Vendor Answers | Additional Information | Guidance | |
| FIDP-01 | Are you utilizing a web application firewall (WAF)? | |||
| FIDP-02 | Are you utilizing a stateful packet inspection (SPI) firewall? | |||
| FIDP-03 | State and describe who has the authority to change firewall rules? | Ensure that all parts of FIDP-03 are clearly stated in your response. | ||
| FIDP-04 | Do you have a documented policy for firewall change requests? | |||
| FIDP-05 | Have you implemented an Intrusion Detection System (network-based)? | |||
| FIDP-06 | Have you implemented an Intrusion Prevention System (network-based)? | |||
| FIDP-07 | Do you employ host-based intrusion detection? | |||
| FIDP-08 | Do you employ host-based intrusion prevention? | |||
| FIDP-09 | Are you employing any next-generation persistent threat (NGPT) monitoring? | |||
| FIDP-10 | Do you monitor for intrusions on a 24x7x365 basis? | |||
| FIDP-11 | Is intrusion monitoring performed internally or by a third-party service? | In addtion to stating your intrusion monitoring strategy, provide a brief summary of its implementation. | ||
| FIDP-12 | Are audit logs available for all changes to the network, firewall, IDS, and IPS systems? | |||
| Mobile Applications | Vendor Answers | Additional Information | Guidance | |
| MAPP-01 | On which mobile operating systems is your software or service supported? | Ensure that all supported operating systems are listed - be sure to provide version number, where relevant. | ||
| MAPP-02 | Describe or provide a reference to the application's architecture and functionality. | Ensure that all elements of MAPP-02 are clearly stated in your response. (i.e. (architecture AND functionality are defined) | ||
| MAPP-03 | Is the application available from a trusted source (e.g., iTunes App Store, Android Market, BB World)? | |||
| MAPP-04 | Does the application store, process, or transmit critical data? | |||
| MAPP-05 | Is agency's data encrypted in transport? | |||
| MAPP-06 | Is agency's data encrypted in storage? (e.g. disk encryption, at-rest) | |||
| MAPP-07 | Does the mobile application support Kerberos, CAS, or Active Directory authentication? | |||
| MAPP-08 | Will any of these systems be implemented on systems hosting the agency's data? | |||
| MAPP-09 | Does the application adhere to secure coding practices (e.g. OWASP, etc.)? | |||
| MAPP-10 | Has the application been tested for vulnerabilities by a third party? | |||
| MAPP-11 | State the party that performed the vulnerability test and the date it was conducted? | Ensure that all elements of MAPP-11 are clearly stated in your response. | ||
| Physical Security | Vendor Answers | Additional Information | Guidance | |
| PHYS-01 | Does your organization have physical security controls and policies in place? | |||
| PHYS-02 | Are employees allowed to take home agency's data in any form? | |||
| PHYS-03 | Are video monitoring feeds retained? | |||
| PHYS-04 | Are video feeds monitored by datacenter staff? | |||
| PHYS-05 | Are individuals required to sign in/out for installation and removal of equipment? | |||
| Policies, Procedures, and Processes | Vendor Answers | Additional Information | Guidance | |
| PPPR-01 | Can you share the organization chart, mission statement, and policies for your information security unit? | |||
| PPPR-02 | Do you have a documented patch management process? | |||
| PPPR-03 | Can you accommodate encryption requirements using open standards? | |||
| PPPR-04 | Have your developers been trained in secure coding techniques? | |||
| PPPR-05 | Was your application developed using secure coding techniques? | |||
| PPPR-06 | Do you subject your code to static code analysis and/or static application security testing prior to release? | |||
| PPPR-07 | Do you have software testing processes (dynamic or static) that are established and followed? | |||
| PPPR-08 | Are information security principles designed into the product lifecycle? | |||
| PPPR-09 | Do you have a documented systems development life cycle (SDLC)? | |||
| PPPR-10 | Do you have a formal incident response plan? | |||
| PPPR-11 | Will you comply with applicable breach notification laws? | |||
| PPPR-12 | Will you comply with the agency's IT policies with regards to user privacy and data protection? | |||
| PPPR-13 | Is your company subject to agency's Data Zone laws and regulations? | |||
| PPPR-14 | Do you perform background screenings or multi-state background checks on all employees prior to their first day of work? | |||
| PPPR-15 | Do you require new employees to fill out agreements and review policies? | |||
| PPPR-16 | Do you have documented information security policy? | |||
| PPPR-17 | Do you have an information security awareness program? | |||
| PPPR-18 | Is security awareness training mandatory for all employees? | |||
| PPPR-19 | Do you have process and procedure(s) documented, and currently followed, that require a review and update of the access-list(s) for privileged accounts? | |||
| PPPR-20 | Do you have documented, and currently implemented, internal audit processes and procedures? | |||
| Product Evaluation | Vendor Answers | Additional Information | Guidance | |
| PROD-01 | Do you incorporate customer feedback into security feature requests? | |||
| PROD-02 | Can you provide an evaluation site to the agency for testing? | |||
| Quality Assurance | Vendor Answers | Additional Information | Guidance | |
| QLAS-01 | Provide a general summary of your Quality Assurance program. | Provide a valid URL to your Quality Assurance program or submit it along with this fully-populated CVAT. | ||
| QLAS-02 | Do you comply with ISO 9001? | |||
| QLAS-03 | Will your company provide quality and performance metrics in relation to the scope of services and performance expectations for the services you are offering? | |||
| QLAS-04 | Have you supplied products and/or services to the agency (or its Campuses) in the last five years? | |||
| QLAS-05 | Do you have a program to keep your customers abreast of state agency and/or industry issues? | |||
| Systems Management & Configuration | Vendor Answers | Additional Information | Guidance | |
| SYST-01 | Are systems that support this service managed via a separate management network? | |||
| SYST-02 | Do you have an implemented system configuration management process? (e.g. secure "gold" images, etc.) | |||
| SYST-03 | Are employee mobile devices managed by your company's Mobile Device Management (MDM) platform? | |||
| SYST-04 | Do you have a systems management and configuration strategy that encompasses servers, appliances, and mobile devices (company and employee owned)? | |||
| Vulnerability Scanning | Vendor Answers | Additional Information | Guidance | |
| VULN-01 | Are your applications scanned externally for vulnerabilities? | |||
| VULN-02 | Have your applications had an external vulnerability assessment in the last year? | |||
| VULN-03 | Are your applications scanned for vulnerabilities prior to new releases? | |||
| VULN-04 | Are your systems scanned externally for vulnerabilities? | |||
| VULN-05 | Have your systems had an external vulnerability assessment in the last year? | |||
| VULN-06 | Describe or provide a reference to the tool(s) used to scan for vulnerabilities in your applications and systems. | Ensure that all elements of VULN-06 are clearly stated in your response. | ||
| VULN-07 | Will you provide results of security scans to the agency? | |||
| VULN-08 | Describe or provide a reference to how you monitor for and protect against common web application security vulnerabilities (e.g. SQL injection, XSS, XSRF, etc.). | Ensure that all elements of VULN-08 are clearly stated in your response. | ||
| VULN-09 | Will you allow the agency to perform its own security testing of your systems and/or application provided that testing is performed at a mutually agreed upon time and date? | |||
| HIPAA | Vendor Answers | Additional Information | Guidance | |
| HIPA-01 | Do your workforce members receive regular training related to the HIPAA Privacy and Security Rules and the HITECH Act? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-02 | Do you monitor or receive information regarding changes in HIPAA regulations? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-03 | Has your organization designated HIPAA Privacy and Security officers as required by the Rules? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-04 | Do you comply with the requirements of the Health Information Technology for Economic and Clinical Health Act (HITECH)? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-05 | Do you have an incident response process and reporting in place to investigate any potential incidents and report actual incidents? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-06 | Do you have a plan to comply with the Breach Notification requirements if there is a breach of data? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-07 | Have you conducted a risk analysis as required under the Security Rule? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-08 | Have you identified areas of risks? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-09 | Have you taken actions to mitigate the identified risks? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-10 | Does your application require user and system administrator password changes at a frequency no greater than 90 days? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-11 | Does your application require a user to set their own password after an administrator reset or on first use of the account? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-12 | Does your application lock-out an account after a number of failed login attempts? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-13 | Does your application automatically lock or log-out an account after a period of inactivity? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-14 | Are passwords visible in plain text, whether when stored or entered, including service level accounts (i.e. database accounts, etc.)? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-15 | If the application is agency-hosted, can all service level and administrative account passwords be changed by the agency? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-16 | Does your application provide the ability to define user access levels? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-17 | Does your application support varying levels of access to administrative tasks defined individually per user? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-18 | Does your application support varying levels of access to records based on user ID? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-19 | Is there a limit to the number of groups a user can be assigned? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-20 | Do accounts used for vendor supplied remote support abide by the same authentication policies and access logging as the rest of the system? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-21 | Does the application log record access including specific user, date/time of access, and originating IP or device? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-22 | Does the application log administrative activity, such user account access changes and password changes, including specific user, date/time of changes, and originating IP or device? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-23 | How long does the application keep access/change logs? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-24 | Can the application logs be archived? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-25 | Can the application logs be saved externally? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-26 | Does your data backup and retention policies and practices meet HIPAA requirements? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-27 | Do you have a disaster recovery plan and emergency mode operation plan? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-28 | Have the policies/plans mentioned above been tested? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-29 | Can you provide a HIPAA compliance attestation document? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-30 | Are you willing to enter into a Business Associate Agreement (BAA)? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| HIPA-31 | Have you entered into a BAA with all subcontractors who may have access to protected health information (PHI)? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ||
| PCI DSS | Vendor Answers | Additional Information | Guidance | |
| PCID-01 | Do your systems or products store, process, or transmit cardholder (payment/credit/debt card) data? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-02 | Are you compliant with the Payment Card Industry Data Security Standard (PCI DSS)? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-03 | Do you have a current, executed within the past year, Attestation of Compliance (AoC) or Report on Compliance (RoC)? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-04 | Are you classified as a service provider? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-05 | Are you on the list of VISA approved service providers? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-06 | Are you classified as a merchant? If so, what level (1, 2, 3, 4)? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-07 | Describe the architecture employed by the system to verify and authorize credit card transactions. | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-08 | What payment processors/gateways does the system support? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-09 | Can the application be installed in a PCI DSS compliant manner ? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-10 | Is the application listed as an approved PA-DSS application? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ||
| PCID-11 | Does the system or products use a third party to collect, store, process, or transmit cardholder (payment/credit/debt card) data? | |||
| PCID-12 | Include documentation describing the systems' abilities to comply with the PCI DSS and any features or capabilities of the system that must be added or changed in order to operate in compliance with the standards. | Refer to PCI DSS Security Standards for supplemental guidance in this section |
&"Helvetica,Regular"&12&K000000 &P mailto:purchasing@tsl.texas.gov Standards Crosswalk
| Cloud Vendor Assessment Tool - Standards Crosswalk |
| Vendor or Respondent <Enter Company Name> |
| Qualifiers | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | PCI DSS | ||
| QUAL-01 | Does your product process protected health information (PHI) or any data covered by the Health Insurance Portability and Accountability Act? | CSC 13 | Discovery | 18.1.1 | ID.GV-3 | ID.GV-3 | RA-2 | ||
| QUAL-02 | Does the vended product host/support a mobile application? (e.g. app) | CSC 18 | IA-2, IA-3, CM-3, SI-2 | ||||||
| QUAL-03 | Will agency data be shared with or hosted by any third parties? (e.g. any entity not wholly-owned by your company is considered a third-party) | ||||||||
| Charles Escue: The Institution views hosted solutions such as AWS, Rackspace, Azure, and other PaaS/SaaS offerings as third parties. If services such as these are used in your environment, respond "Yes". | CSC 13 | ID.AM-6, PR.AT-3 | ID.AM-6, PR.AT-3 | 12.8 | |||||
| QUAL-04 | Do you have a Business Continuity Plan (BCP)? | CSC 10 | 17.1.2 | PR.IP-9 | PR.IP-9 | AU-7, AU-9, IR-4 | 12.1 | ||
| QUAL-05 | Do you have a Disaster Recovery Plan (DRP)? | CSC 10 | 17.1.2 | PR.IP-9 | PR.IP-9 | CA-5, PL-2 | 12.1 | ||
| QUAL-06 | Will data regulated by PCI DSS reside in the vended product? | CSC 13 | 18.1.1 | ID.GV-3 | ID.GV-3 | RA-2 | PCI Scope, Discovery | ||
| QUAL-07 | Is your company a consulting firm providing only consultation to the agency? | CSC 14 | PCI Scope | ||||||
| Documentation | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | PCI DSS | ||
| DOCU-01 | Have you undergone a SSAE 16 audit? |
: In 2011, Statement on Standards for Attestation Engagements (SSAE) No. 16 took effect and replaced SAS 70 as the authoritative guidance for performing a service auditor's examination. SSAE 16 established a new attestation standard (AT 801) to contain the professional guidance.
| You can learn more about SSAE 16 at www.ssae16.com. | 15.2.1 | SA-9 | ||
| DOCU-02 | Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ? |
: CSA STAR Self Assessment is free and open to all cloud providers and allows them to submit self assessment reports that document compliance to CSA-published best practices.
| Website: https://cloudsecurityalliance.org/star/self-assessment/ | 15.2.1 | PE-2, PE-3, PE-5, PE-11, PE-13, PE-14, SA-9 | ||
| DOCU-03 | Have you received the Cloud Security Alliance STAR certification? |
: The CSA STAR Certification is a rigorous third party independent assessment of the security of a cloud service provider. The technology-neutral certification leverages the requirements of the ISO/IEC 27001 management system standard together with the CSA Cloud Controls Matrix, a specified set of criteria that measures the capability levels of the cloud service.
| Website: https://cloudsecurityalliance.org/star/certification/ | 15.2.1 | PE-2, PE-3, PE-5, PE-11, PE-13, PE-14, SA-9 | |||||
| DOCU-04 | Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.) | 18.1.1 | SA-9 | 12.1, Scope | |||
| DOCU-05 | Are you compliant with FISMA standards? |
: The Federal Information Security Management Act (FISMA) is United States legislation that defines a comprehensive framework to protect government information, operations and assets against natural or man-made threats.
Website: http://www.dhs.gov/FISMA slight wording change
| -Josh Callahan | |||||||||
| Charles Escue: The Institution views hosted solutions such as AWS, Rackspace, Azure, and other PaaS/SaaS offerings as third parties. If services such as these are used in your environment, respond "Yes". | 18.1.1 | SA-9 | |||||||
| DOCU-06 | Does your organization have a data privacy policy? | §164.308(a)(1)(i) | 18.1.4 | ID.GV-3 | ID.GV-3 | SA-9 | |||
| Company Overview | CIS Critical Security Controls v6.1 | HIPAA | ISO 27002:2013 | NIST Cybersecurity Framework | NIST SP 800-171r1 | NIST SP 800-53r4 | PCI DSS |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .