Exhibit C - IT Vendor Request Form.xlsx
XLSX spreadsheet 943 KB Posted
- Attached to
- MINES24027 Electronic Ticketing System RFP
- Solicitation number
- MINES24027
- Issued by
- Jefferson County, Colorado
About this file
The document is a Higher Education Community Vendor Assessment Toolkit (HECVAT) Full Version 3.04, a comprehensive security and risk assessment tool used by educational institutions to evaluate vendor information technology products and services. The toolkit is designed to help institutions protect their systems by requiring vendors to provide detailed information about their security practices, data handling, infrastructure, and compliance with various standards and regulations. The assessment covers multiple domains including company background, documentation, accessibility, third-party relationships, application security, authentication, business continuity, change management, data protection, datacenter operations, disaster recovery, network security, incident handling, and vulnerability management.
The HECVAT is structured to gather in-depth information across numerous security dimensions, with vendors required to provide specific details about their systems' capabilities, security controls, compliance with frameworks like HIPAA, PCI DSS, and NIST standards, and their processes for managing potential risks. The toolkit includes extensive questionnaires covering areas such as access controls, encryption practices, incident response plans, authentication mechanisms, and third-party data sharing. Vendors must disclose their security practices, organizational structures, training programs, and technical safeguards, enabling institutions to comprehensively assess potential security risks before engaging with a technology provider.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| MINES24027_Addendum 1.pdf | ||
| MINES24027 Electronic Ticketing RFP (Final).pdf | ||
| Exhibit_Sample Personal Services Agreement_ITS.pdf | ||
| Exhibit_Sample Personal Services Agreement_ITS.docx | DOCX document | |
| Exhibit D Offeror Questionnaire for Software RFPs.xlsx | XLSX spreadsheet |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Vendor Response
| HECVAT - Full | Vendor Response | Version 3.04 | ||
| Vendor Response | |||
| DATE-01 | Date | mm/dd/yyyy | |
| General Information | |||
| In order to protect the Institution and its systems, vendors whose products and/or services will access and/or host institutional data must complete the Higher Education Community Vendor Assessment Toolkit (HECVAT). Throughout this tool, anywhere where the term data is used, this is an all-encompassing term including at least data and metadata. Answers will be reviewed by Institution security analysts upon submittal. This process will assist the institution in preventing breaches of protected information and comply with Institution policy, state, and federal law. This is intended for use by vendors participating in a Third Party Security Assessment and should be completed by a vendor. Review the Instructions tab for further guidance. | |||
| GNRL-01 through GNRL-08; populated by the Vendor | |||
| GNRL-01 | Vendor Name | Vendor Name | |
| GNRL-02 | Product Name | Product Name and Version Information | |
| GNRL-03 | Product Description | Brief Description of the Product | |
| GNRL-04 | Web Link to Product Privacy Notice | https://www.vendor.domain/privacynotice | |
| GNRL-05 | Web Link to Accessibility Statement or VPAT | https://www.vendor.domain/vpat | |
| GNRL-06 | Vendor Contact Name | Vendor Contact Name | |
| GNRL-07 | Vendor Contact Title | Vendor Contact Title | |
| GNRL-08 | Vendor Contact Email | Vendor Contact E-mail Address | |
| GNRL-09 | Vendor Contact Phone Number | 555-555-5555 | |
| GNRL-10 | Vendor Accessibility Contact Name | Vendor Accessibility Contact Name | |
| GNRL-11 | Vendor Accessibility Contact Title | Vendor Accessibility Contact Title | |
| GNRL-12 | Vendor Accessibility Contact Email | Vendor Accessibility Contact E-mail Address | |
| GNRL-13 | Vendor Accessibility Contact Phone Number | 555-555-5555 | |
| GNRL-14 | Vendor Hosting Regions | See Instructions tab for guidance | |
| GNRL-15 | Vendor Work Locations | See Instructions tab for guidance | |
| Instructions | |||
| Step 1: Complete the Qualifiers section first; responses in this section drive dictate question response requirements throughout the HECVAT Full. |
Step 2: Complete each section answering each set of questions in order from top to bottom; the built-in formatting logic relies on this order.
Step 3: Submit the completed Higher Education Community Vendor Assessment Toolkit (HECVAT) to the Institution according to institutional procedures.
| Qualifiers | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| The institution conducts Third Party Security Assessments on a variety of third parties. As such, not all assessment questions are relevant to each party. To alleviate complexity, a "qualifier" strategy is implemented and allows for various parties to utilize this common documentation instrument. Responses to the following questions will determine the need to answer additional questions below. | |||||
| QUAL-01 | Does your product process protected health information (PHI) or any data covered by the Health Insurance Portability and Accountability Act? | Standard Guidance | |||
| QUAL-02 | Will institution data be shared with or hosted by any third parties? (e.g. any entity not wholly-owned by your company is considered a third-party) | The Institution views hosted solutions such as AWS, Rackspace, Azure, and other PaaS/SaaS offerings as third parties. If services such as these are used in your environment, respond "Yes". | |||
| QUAL-03 | Do you have a well documented Business Continuity Plan (BCP) that is tested annually? | ||||
| QUAL-04 | Do you have a well documented Disaster Recovery Plan (DRP) that is tested annually? | ||||
| QUAL-05 | Is the vended product designed to process or store Credit Card information? | Answer yes if your product handles PCI (Credit Card) information, either directly or via a third party | |||
| QUAL-06 | Does your company provide professional services pertaining to this product? | Answer yes if you provide consulting | |||
| QUAL-07 | Select your hosting option | 2) Physical Co-location | N/A | ||
| Company Overview | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| COMP-01 | Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships. | N/A | ERROR:#REF! | ||
| COMP-02 | Have you had an unplanned disruption to this product/service in the last 12 months? | ERROR:#REF! | |||
| COMP-03 | Do you have a dedicated Information Security staff or office? | ERROR:#REF! | |||
| COMP-04 | Do you have a dedicated Software and System Development team(s)? (e.g. Customer Support, Implementation, Product Management, etc.) | ERROR:#REF! | |||
| COMP-05 | Use this area to share information about your environment that will assist those who are assessing your company data security program. | N/A | ERROR:#REF! | ||
| Documentation | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| DOCU-01 | Have you undergone a SSAE 18/SOC 2 audit? | ERROR:#REF! | |||
| DOCU-02 | Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ? | ERROR:#REF! | |||
| DOCU-03 | Have you received the Cloud Security Alliance STAR certification? | ERROR:#REF! | |||
| DOCU-04 | Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, CIS Controls, ISO 27001, etc.) | ERROR:#REF! | |||
| DOCU-05 | Can the systems that hold the institution's data be compliant with NIST SP 800-171 and/or CMMC Level 3 standards? | . | ERROR:#REF! | ||
| DOCU-06 | Can you provide overall system and/or application architecture diagrams including a full description of the data flow for all components of the system? | ERROR:#REF! | |||
| DOCU-07 | Does your organization have a data privacy policy? | ERROR:#REF! | |||
| DOCU-08 | Do you have a documented, and currently implemented, employee onboarding and offboarding policy? | ERROR:#REF! | |||
| DOCU-09 | Do you have a documented change management process? | ERROR:#REF! | |||
| DOCU-10 | Has a VPAT or ACR been created or updated for the product and version under consideration within the past year? | If your answer is 'I do not know', select 'No'. If the VPATs/ACR is for an older version of the product or has not been updated, its information does not accurately reflect accessibility of the product under consideration. | ERROR:#REF! | ||
| DOCU-11 | Do you have documentation to support the accessibility features of your product? | ERROR:#REF! | |||
| IT Accessibility | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| ITAC-01 | Has a third party expert conducted an audit of the most recent version of your product? | ERROR:#REF! | |||
| ITAC-02 | Do you have a documented and implemented process for verifying accessibility conformance? | ERROR:#REF! | |||
| ITAC-03 | Have you adopted a technical or legal standard of conformance for the product in question? | ERROR:#REF! | |||
| ITAC-04 | Can you provide a current, detailed accessibility roadmap with delivery timelines? | ERROR:#REF! | |||
| ITAC-05 | Do you expect your staff to maintain a current skill set in IT accessibility? | ERROR:#REF! | |||
| ITAC-06 | Do you have a documented and implemented process for reporting and tracking accessibility issues? | ERROR:#REF! | |||
| ITAC-07 | Do you have documented processes and procedures for implementing accessibility into your development lifecycle? | ERROR:#REF! | |||
| ITAC-08 | Can all functions of the application or service be performed using only the keyboard? | ERROR:#REF! | |||
| ITAC-09 | Does your product rely on activating a special ‘accessibility mode,’ a ‘lite version’ or accessing an alternate interface for accessibility purposes? | ERROR:#REF! | |||
| Assessment of Third Parties | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| THRD-01 | Do you perform security assessments of third party companies with which you share data? (i.e. hosting providers, cloud services, PaaS, IaaS, SaaS, etc.). | ERROR:#REF! | |||
| THRD-02 | Provide a brief description for why each of these third parties will have access to institution data. | List each third party and why institutional data is shared with them. Format example: [Vendor] - Reason | ERROR:#REF! | ||
| THRD-03 | What legal agreements (i.e. contracts) do you have in place with these third parties that address liability in the event of a data breach? | ERROR:#REF! | |||
| THRD-04 | Do you have an implemented third party management strategy? | Robust answers from the vendor improve the quality and efficiency of the security assessment process. | ERROR:#REF! | ||
| THRD-05 | Do you have a process and implemented procedures for managing your hardware supply chain? (e.g., telecommunications equipment, export licensing, computing devices) | Make sure you address any national or regional regulations | ERROR:#REF! | ||
| Consulting | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| CONS-01 | Will the consulting take place on-premises? | ERROR:#REF! | |||
| CONS-02 | Will the consultant require access to Institution's network resources? | ERROR:#REF! | |||
| CONS-03 | Will the consultant require access to hardware in the Institution's data centers? | ERROR:#REF! | |||
| CONS-04 | Will the consultant require an account within the Institution's domain (@*.edu)? | ERROR:#REF! | |||
| CONS-05 | Has the consultant received training on [sensitive, HIPAA, PCI, etc.] data handling? | ERROR:#REF! | |||
| CONS-06 | Will any data be transferred to the consultant's possession? | ERROR:#REF! | |||
| CONS-07 | Is it encrypted (at rest) while in the consultant's possession? | ERROR:#REF! | |||
| CONS-08 | Will the consultant need remote access to the Institution's network or systems? | ERROR:#REF! | |||
| CONS-09 | Can we restrict that access based on source IP address? | ERROR:#REF! | |||
| Application/Service Security | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| APPL-01 | Are access controls for institutional accounts based on structured rules, such as role-based access control (RBAC), attribute-based access control (ABAC) or policy-based access control (PBAC)? | This includes end-users, administrators, service accounts, etc. PBAC would include various dynamic controls such as conditional access, risk-based access, location-based access, or system activity based access. | ERROR:#REF! | ||
| APPL-02 | Are access controls for staff within your organization based on structured rules, such as RBAC, ABAC, or PBAC? | This includes system administrators and third party personnel with access to the system. PBAC would include various dynamic controls such as conditional access, risk-based access, location-based access, or system activity based access. | ERROR:#REF! | ||
| APPL-03 | Does the system provide data input validation and error messages? | ERROR:#REF! | |||
| APPL-04 | Are you using a web application firewall (WAF)? | ERROR:#REF! | |||
| APPL-05 | Do you have a process and implemented procedures for managing your software supply chain (e.g. libraries, repositories, frameworks, etc) | Include any in-house developed or contract development | ERROR:#REF! | ||
| APPL-06 | Are only currently supported operating system(s), software, and libraries leveraged by the system(s)/application(s) that will have access to institution's data? | If the web application only works with a subset of modern supported browsers, please indicate that here | ERROR:#REF! | ||
| APPL-07 | If mobile, is the application available from a trusted source (e.g., App Store, Google Play Store)? | Select N/A if there is no mobile version of your app | ERROR:#REF! | ||
| APPL-08 | Does your application require access to location or GPS data? | ERROR:#REF! | |||
| APPL-09 | Does your application provide separation of duties between security administration, system administration, and standard user functions? | ERROR:#REF! | |||
| APPL-10 | Do you have a fully implemented policy or procedure that details how your employees obtain administrator access to institutional instance of the application? | ERROR:#REF! | |||
| APPL-11 | Have your developers been trained in secure coding techniques? | ERROR:#REF! | |||
| APPL-12 | Was your application developed using secure coding techniques? | ERROR:#REF! | |||
| APPL-13 | Do you subject your code to static code analysis and/or static application security testing prior to release? | ERROR:#REF! | |||
| APPL-14 | Do you have software testing processes (dynamic or static) that are established and followed? | ERROR:#REF! | |||
| Authentication, Authorization, and Accounting | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| AAAI-01 | Does your solution support single sign-on (SSO) protocols for user and administrator authentication? | Answer 'Yes' only if user AND administrator authentication is supported. If partially supported, answer 'No'. Ensure you respond to any guidance in the Additional Information column. | ERROR:#REF! | ||
| AAAI-02 | Does your solution support local authentication protocols for user and administrator authentication? | ERROR:#REF! | |||
| AAAI-03 | Can you enforce password/passphrase aging requirements? | ERROR:#REF! | |||
| AAAI-04 | Can you enforce password/passphrase complexity requirements [provided by the institution]? | ERROR:#REF! | |||
| AAAI-05 | Does the system have password complexity or length limitations and/or restrictions? | ERROR:#REF! | |||
| AAAI-06 | Do you have documented password/passphrase reset procedures that are currently implemented in the system and/or customer support? | ERROR:#REF! | |||
| AAAI-07 | Does your organization participate in InCommon or another eduGAIN affiliated trust federation? | ERROR:#REF! | |||
| AAAI-08 | Does your application support integration with other authentication and authorization systems? | ERROR:#REF! | |||
| AAAI-09 | Does your solution support any of the following Web SSO standards? [e.g., SAML2 (with redirect flow), OIDC, CAS, or other] | An answer of 'Yes' should be well-supported in the Additional Information column, and all elements of interest should be sufficiently addressed. | ERROR:#REF! | ||
| AAAI-10 | Do you support differentiation between email address and user identifier? | ERROR:#REF! | |||
| AAAI-11 | Do you allow the customer to specify attribute mappings for any needed information beyond a user identifier? [e.g., Reference eduPerson, ePPA/ePPN/ePE ] | ERROR:#REF! | |||
| AAAI-12 | If you don't support SSO, does your application and/or user-frontend/portal support multi-factor authentication? (e.g. Duo, Google Authenticator, OTP, etc.) | ERROR:#REF! | |||
| AAAI-13 | Does your application automatically lock the session or log-out an account after a period of inactivity? | ERROR:#REF! | |||
| AAAI-14 | Are there any passwords/passphrases hard coded into your systems or products? | ERROR:#REF! | |||
| AAAI-15 | Are you storing any passwords in plaintext? | ERROR:#REF! | |||
| AAAI-16 | Does your application support directory integration for user accounts? | ERROR:#REF! | |||
| AAAI-17 | Are audit logs available that include AT LEAST all of the following; login, logout, actions performed, and source IP address? | ERROR:#REF! | |||
| AAAI-18 | Describe or provide a reference to the a) system capability to log security/authorization changes as well as user and administrator security events (i.e. physical or electronic)(e.g. login failures, access denied, changes accepted), and b) all requirements necessary to implement logging and monitoring on the system. Include c) information about SIEM/log collector usage. | Ensure that all elements of AAAI-18 are clearly stated in your response. | ERROR:#REF! | ||
| AAAI-19 | Describe or provide a reference to the retention period for those logs, how logs are protected, and whether they are accessible to the customer (and if so, how). | Ensure that all elements of AAAI-19 are clearly stated in your response. | ERROR:#REF! | ||
| Business Continuity Plan | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| BCPL-01 | Is an owner assigned who is responsible for the maintenance and review of the Business Continuity Plan? | ERROR:#REF! | |||
| BCPL-02 | Is there a defined problem/issue escalation plan in your BCP for impacted clients? | ERROR:#REF! | |||
| BCPL-03 | Is there a documented communication plan in your BCP for impacted clients? | ERROR:#REF! | |||
| BCPL-04 | Are all components of the BCP reviewed at least annually and updated as needed to reflect change? | ERROR:#REF! | |||
| BCPL-05 | Are specific crisis management roles and responsibilities defined and documented? | ERROR:#REF! | |||
| BCPL-06 | Does your organization conduct training and awareness activities to validate its employees understanding of their roles and responsibilities during a crisis? | ERROR:#REF! | |||
| BCPL-07 | Does your organization have an alternative business site or a contracted Business Recovery provider? | ERROR:#REF! | |||
| BCPL-08 | Does your organization conduct an annual test of relocating to an alternate site for business recovery purposes? | ERROR:#REF! | |||
| BCPL-09 | Is this product a core service of your organization, and as such, the top priority during business continuity planning? | ERROR:#REF! | |||
| BCPL-10 | Are all services that support your product fully redundant? | ERROR:#REF! | |||
| Change Management | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| CHNG-01 | Does your Change Management process minimally include authorization, impact analysis, testing, and validation before moving changes to production? | ERROR:#REF! | |||
| CHNG-02 | Does your Change Management process also verify that all required third party libraries and dependencies are still supported with each major change? | ERROR:#REF! | |||
| CHNG-03 | Will the institution be notified of major changes to your environment that could impact the institution's security posture? | ERROR:#REF! | |||
| CHNG-04 | Do clients have the option to not participate in or postpone an upgrade to a new release? | ERROR:#REF! | |||
| CHNG-05 | Do you have a fully implemented solution support strategy that defines how many concurrent versions you support? | List the current version you support and what percentage of customers are utilizing that version | ERROR:#REF! | ||
| CHNG-06 | Does the system support client customizations from one release to another? | Ensure that all relevant details pertaining to CHNG-06 are clearly stated in your response. | ERROR:#REF! | ||
| CHNG-07 | Do you have a release schedule for product updates? | ERROR:#REF! | |||
| CHNG-08 | Do you have a technology roadmap, for at least the next 2 years, for enhancements and bug fixes for the product/service being assessed? | ERROR:#REF! | |||
| CHNG-09 | Is Institution involvement (i.e. technically or organizationally) required during product updates? | ERROR:#REF! | |||
| CHNG-10 | Do you have policy and procedure, currently implemented, managing how critical patches are applied to all systems and applications? | ERROR:#REF! | |||
| CHNG-11 | Do you have policy and procedure, currently implemented, guiding how security risks are mitigated until patches can be applied? | ERROR:#REF! | |||
| CHNG-12 | Are upgrades or system changes installed during off-peak hours or in a manner that does not impact the customer? | ERROR:#REF! | |||
| CHNG-13 | Do procedures exist to provide that emergency changes are documented and authorized (including after the fact approval)? | ERROR:#REF! | |||
| CHNG-14 | Do you have an implemented system configuration management process? (e.g. secure "gold" images, etc.) | ERROR:#REF! | |||
| CHNG-15 | Do you have a systems management and configuration strategy that encompasses servers, appliances, cloud services, applications, and mobile devices (company and employee owned)? | ERROR:#REF! | |||
| Data | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| DATA-01 | Does the environment provide for dedicated single-tenant capabilities? If not, describe how your product or environment separates data from different customers (e.g., logically, physically, single tenancy, multi-tenancy). | ERROR:#REF! | |||
| DATA-02 | Will Institution's data be stored on any devices (database servers, file servers, SAN, NAS, …) configured with non-RFC 1918/4193 (i.e. publicly routable) IP addresses? | ERROR:#REF! | |||
| DATA-03 | Is sensitive data encrypted, using secure protocols/algorithms, in transport? (e.g. system-to-client) | ERROR:#REF! | |||
| DATA-04 | Is sensitive data encrypted, using secure protocols/algorithms, in storage? (e.g. disk encryption, at-rest, files, and within a running database) | ERROR:#REF! | |||
| DATA-05 | Do all cryptographic modules in use in your product conform to the Federal Information Processing Standards (FIPS PUB 140-3)? | ERROR:#REF! | |||
| DATA-06 | At the completion of this contract, will data be returned to the institution and deleted from all your systems and archives? | ERROR:#REF! | |||
| DATA-07 | Will the institution's data be available within the system for a period of time at the completion of this contract? | ERROR:#REF! | |||
| DATA-08 | Can the Institution extract a full or partial backup of data? | ERROR:#REF! | |||
| DATA-09 | Are ownership rights to all data, inputs, outputs, and metadata retained by the institution? | ERROR:#REF! | |||
| DATA-10 | Are these rights retained even through a provider acquisition or bankruptcy event? | ERROR:#REF! | |||
| DATA-11 | In the event of imminent bankruptcy, closing of business, or retirement of service, will you provide 90 days for customers to get their data out of the system and migrate applications? | ERROR:#REF! | |||
| DATA-12 | Are involatile backup copies made according to pre-defined schedules and securely stored and protected? | Ensure that response addresses involatile storage and lists retention periods | ERROR:#REF! | ||
| DATA-13 | Do current backups include all operating system software, utilities, security software, application software, and data files necessary for recovery? | ERROR:#REF! | |||
| DATA-14 | Are you performing off site backups? (i.e. digitally moved off site) | ERROR:#REF! | |||
| DATA-15 | Are physical backups taken off site? (i.e. physically moved off site) | ERROR:#REF! | |||
| DATA-16 | Do backups containing the institution's data ever leave the Institution's Data Zone either physically or via network routing? | ERROR:#REF! | |||
| DATA-17 | Are data backups encrypted? | ERROR:#REF! | |||
| DATA-18 | Do you have a cryptographic key management process (generation, exchange, storage, safeguards, use, vetting, and replacement), that is documented and currently implemented, for all system components? (e.g. database, system, web, etc.) | ERROR:#REF! | |||
| DATA-19 | Do you have a media handling process, that is documented and currently implemented that meets established business needs and regulatory requirements, including end-of-life, repurposing, and data sanitization procedures? | ERROR:#REF! | |||
| DATA-20 | Does the process described in DATA-19 adhere to DoD 5220.22-M and/or NIST SP 800-88 standards? | ERROR:#REF! | |||
| DATA-21 | Is media used for long-term retention of business data and archival purposes stored in a secure, environmentally protected area? | ERROR:#REF! | |||
| DATA-22 | Will you handle data in a FERPA compliant manner? | ERROR:#REF! | |||
| DATA-23 | Does your staff (or third party) have access to Institutional data (e.g., financial, PHI or other sensitive information) through any means? | ERROR:#REF! | |||
| DATA-24 | Do you have a documented and currently implemented strategy for securing employee workstations when they work remotely? (i.e. not in a trusted computing environment) | ERROR:#REF! | |||
| Datacenter | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| DCTR-01 | Does the hosting provider have a SOC 2 Type 2 report available? | ERROR:#REF! | |||
| DCTR-02 | Are you generally able to accommodate storing each institution's data within their geographic region? | Please indicate which geographic regions you can provide storage in the Additional Info column. | ERROR:#REF! | ||
| DCTR-03 | Are the data centers staffed 24 hours a day, seven days a week (i.e., 24x7x365)? | ERROR:#REF! | |||
| DCTR-04 | Are your servers separated from other companies via a physical barrier, such as a cage or hardened walls? | ERROR:#REF! | |||
| DCTR-05 | Does a physical barrier fully enclose the physical space preventing unauthorized physical contact with any of your devices? | ERROR:#REF! | |||
| DCTR-06 | Are your primary and secondary data centers geographically diverse? | ERROR:#REF! | |||
| DCTR-07 | If outsourced or co-located, is there a contract in place to prevent data from leaving the Institution's Data Zone? | ERROR:#REF! | |||
| DCTR-08 | What Tier Level is your data center (per levels defined by the Uptime Institute)? | Review the Uptime Institute's level/tier direction provided on their website if you need addition information | ERROR:#REF! | ||
| DCTR-09 | Is the service hosted in a high availability environment? | ERROR:#REF! | |||
| DCTR-10 | Is redundant power available for all datacenters where institution data will reside? | ERROR:#REF! | |||
| DCTR-11 | Are redundant power strategies tested? | ERROR:#REF! | |||
| DCTR-12 | Describe or provide a reference to the availability of cooling and fire suppression systems in all datacenters where institution data will reside. | Ensure that all parts of DCTR-12 are clearly stated in your response. | ERROR:#REF! | ||
| DCTR-13 | Do you have Internet Service Provider (ISP) Redundancy? | State the ISP provider(s) in addition to the number of ISPs that provide connectivity. | ERROR:#REF! | ||
| DCTR-14 | Does every datacenter where the Institution's data will reside have multiple telephone company or network provider entrances to the facility? | ERROR:#REF! | |||
| DCTR-15 | Are you requiring multi-factor authentication for administrators of your cloud environment? | ERROR:#REF! | |||
| DCTR-16 | Are you using your cloud providers available hardening tools or pre-hardened images? | ERROR:#REF! | |||
| DCTR-17 | Does your cloud vendor have access to your encryption keys? | Describe your key management practices. | ERROR:#REF! | ||
| Disaster Recovery Plan | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| DRPL-01 | Describe or provide a reference to your Disaster Recovery Plan (DRP). | Provide a valid URL to your current DRP or submit it along with this fully-populated HECVAT. | ERROR:#REF! | ||
| DRPL-02 | Is an owner assigned who is responsible for the maintenance and review of the DRP? | ERROR:#REF! | |||
| DRPL-03 | Can the Institution review your DRP and supporting documentation? | ERROR:#REF! | |||
| DRPL-04 | Are any disaster recovery locations outside the Institution's geographic region? | ERROR:#REF! | |||
| DRPL-05 | Does your organization have a disaster recovery site or a contracted Disaster Recovery provider? | ERROR:#REF! | |||
| DRPL-06 | Does your organization conduct an annual test of relocating to this site for disaster recovery purposes? | ERROR:#REF! | |||
| DRPL-07 | Is there a defined problem/issue escalation plan in your DRP for impacted clients? | ERROR:#REF! | |||
| DRPL-08 | Is there a documented communication plan in your DRP for impacted clients? | ERROR:#REF! | |||
| DRPL-09 | Describe or provide a reference to how your disaster recovery plan is tested? (i.e. scope of DR tests, end-to-end testing, etc.) | Ensure that all elements of DRPL-09 are clearly stated in your response. | ERROR:#REF! | ||
| DRPL-10 | Has the Disaster Recovery Plan been tested in the last year? | ERROR:#REF! | |||
| DRPL-11 | Are all components of the DRP reviewed at least annually and updated as needed to reflect change? | ERROR:#REF! | |||
| Firewalls, IDS, IPS, and Networking | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| FIDP-01 | Are you utilizing a stateful packet inspection (SPI) firewall? | ERROR:#REF! | |||
| FIDP-02 | Is authority for firewall change approval documented? Please list approver names or titles in Additional Info | ERROR:#REF! | |||
| FIDP-03 | Do you have a documented policy for firewall change requests? | ERROR:#REF! | |||
| FIDP-04 | Have you implemented an Intrusion Detection System (network-based)? | ERROR:#REF! | |||
| FIDP-05 | Have you implemented an Intrusion Prevention System (network-based)? | ERROR:#REF! | |||
| FIDP-06 | Do you employ host-based intrusion detection? | ERROR:#REF! | |||
| FIDP-07 | Do you employ host-based intrusion prevention? | ERROR:#REF! | |||
| FIDP-08 | Are you employing any next-generation persistent threat (NGPT) monitoring? | ERROR:#REF! | |||
| FIDP-09 | Do you monitor for intrusions on a 24x7x365 basis? | ERROR:#REF! | |||
| FIDP-10 | Is intrusion monitoring performed internally or by a third-party service? | In addition to stating your intrusion monitoring strategy, provide a brief summary of its implementation. | ERROR:#REF! | ||
| FIDP-11 | Are audit logs available for all changes to the network, firewall, IDS, and IPS systems? | ERROR:#REF! | |||
| Policies, Procedures, and Processes | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| PPPR-01 | Can you share the organization chart, mission statement, and policies for your information security unit? | ERROR:#REF! | |||
| PPPR-02 | Do you have a documented patch management process? | ERROR:#REF! | |||
| PPPR-03 | Can you accommodate encryption requirements using open standards? | ERROR:#REF! | |||
| PPPR-04 | Are information security principles designed into the product lifecycle? | ERROR:#REF! | |||
| PPPR-05 | Do you have a documented systems development life cycle (SDLC)? | ERROR:#REF! | |||
| PPPR-06 | Will you comply with applicable breach notification laws? | ERROR:#REF! | |||
| PPPR-07 | Will you comply with the Institution's IT policies with regards to user privacy and data protection? | ERROR:#REF! | |||
| PPPR-08 | Is your company subject to Institution's geographic region's laws and regulations? | State the country that governs and regulates your company | ERROR:#REF! | ||
| PPPR-09 | Do you perform background screenings or multi-state background checks on all employees prior to their first day of work? | ERROR:#REF! | |||
| PPPR-10 | Do you require new employees to fill out agreements and review policies? | ERROR:#REF! | |||
| PPPR-11 | Do you have a documented information security policy? | ERROR:#REF! | |||
| PPPR-12 | Do you have an information security awareness program? | ERROR:#REF! | |||
| PPPR-13 | Is security awareness training mandatory for all employees? | ERROR:#REF! | |||
| PPPR-14 | Do you have process and procedure(s) documented, and currently followed, that require a review and update of the access-list(s) for privileged accounts? | ERROR:#REF! | |||
| PPPR-15 | Do you have documented, and currently implemented, internal audit processes and procedures? | ERROR:#REF! | |||
| PPPR-16 | Does your organization have physical security controls and policies in place? | ERROR:#REF! | |||
| Incident Handling | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| HFIH-01 | Do you have a formal incident response plan? | ERROR:#REF! | |||
| HFIH-02 | Do you have either an internal incident response team or retain an external team? | ERROR:#REF! | |||
| HFIH-03 | Do you have the capability to respond to incidents on a 24x7x365 basis? | ERROR:#REF! | |||
| HFIH-04 | Do you carry cyber-risk insurance to protect against unforeseen service outages, data that is lost or stolen, and security incidents? | ERROR:#REF! | |||
| Quality Assurance | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| QLAS-01 | Do you have a documented and currently implemented Quality Assurance program? | Provide a valid URL to your Quality Assurance program or submit it along with this fully-populated HECVAT. | ERROR:#REF! | ||
| QLAS-02 | Do you comply with ISO 9001? | ERROR:#REF! | |||
| QLAS-03 | Will your company provide quality and performance metrics in relation to the scope of services and performance expectations for the services you are offering? | ERROR:#REF! | |||
| QLAS-04 | Do you incorporate customer feedback into security feature requests? | ERROR:#REF! | |||
| QLAS-05 | Can you provide an evaluation site to the institution for testing? | ERROR:#REF! | |||
| Vulnerability Scanning | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| VULN-01 | Are your systems and applications regularly scanned externally for vulnerabilities? | ERROR:#REF! | |||
| VULN-02 | Have your systems and applications had a third party security assessment completed in the last year? | ERROR:#REF! | |||
| VULN-03 | Are your systems and applications scanned with an authenticated user account for vulnerabilities [that are remediated] prior to new releases? | ERROR:#REF! | |||
| VULN-04 | Will you provide results of application and system vulnerability scans to the Institution? | ERROR:#REF! | |||
| VULN-05 | Describe or provide a reference to how you monitor for and protect against common web application security vulnerabilities (e.g. SQL injection, XSS, XSRF, etc.). | Ensure that all elements of VULN-05 are clearly stated in your response. | ERROR:#REF! | ||
| VULN-06 | Will you allow the institution to perform its own vulnerability testing and/or scanning of your systems and/or application provided that testing is performed at a mutually agreed upon time and date? | ERROR:#REF! | |||
| HIPAA | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| HIPA-01 | Do your workforce members receive regular training related to the HIPAA Privacy and Security Rules and the HITECH Act? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-02 | Do you monitor or receive information regarding changes in HIPAA regulations? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-03 | Has your organization designated HIPAA Privacy and Security officers as required by the Rules? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-04 | Do you comply with the requirements of the Health Information Technology for Economic and Clinical Health Act (HITECH)? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-05 | Have you conducted a risk analysis as required under the Security Rule? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-06 | Have you identified areas of risks? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-07 | Have you taken actions to mitigate the identified risks? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-08 | Does your application require user and system administrator password changes at a frequency no greater than 90 days? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-09 | Does your application require a user to set their own password after an administrator reset or on first use of the account? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-10 | Does your application lock-out an account after a number of failed login attempts? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-11 | Does your application automatically lock or log-out an account after a period of inactivity? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-12 | Are passwords visible in plain text, whether when stored or entered, including service level accounts (i.e. database accounts, etc.)? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-13 | If the application is institution-hosted, can all service level and administrative account passwords be changed by the institution? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-14 | Does your application provide the ability to define user access levels? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-15 | Does your application support varying levels of access to administrative tasks defined individually per user? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-16 | Does your application support varying levels of access to records based on user ID? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-17 | Is there a limit to the number of groups a user can be assigned? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-18 | Do accounts used for vendor supplied remote support abide by the same authentication policies and access logging as the rest of the system? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-19 | Does the application log record access including specific user, date/time of access, and originating IP or device? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-20 | Does the application log administrative activity, such user account access changes and password changes, including specific user, date/time of changes, and originating IP or device? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-21 | How long does the application keep access/change logs? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-22 | Can the application logs be archived? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-23 | Can the application logs be saved externally? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-24 | Does your data backup and retention policies and practices meet HIPAA requirements? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-25 | Do you have a disaster recovery plan and emergency mode operation plan? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-26 | Have the policies/plans mentioned above been tested? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-27 | Can you provide a HIPAA compliance attestation document? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-28 | Are you willing to enter into a Business Associate Agreement (BAA)? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| HIPA-29 | Have you entered into a BAA with all subcontractors who may have access to protected health information (PHI)? | Refer to HIPAA regulations documentation for supplemental guidance in this section. | ERROR:#REF! | ||
| PCI DSS | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| PCID-01 | Do your systems or products store, process, or transmit cardholder (payment/credit/debt card) data? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ERROR:#REF! | ||
| PCID-02 | Are you compliant with the Payment Card Industry Data Security Standard (PCI DSS)? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ERROR:#REF! | ||
| PCID-03 | Do you have a current, executed within the past year, Attestation of Compliance (AoC) or Report on Compliance (RoC)? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ERROR:#REF! | ||
| PCID-04 | Are you classified as a service provider? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ERROR:#REF! | ||
| PCID-05 | Are you on the list of VISA approved service providers? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ERROR:#REF! | ||
| PCID-06 | Are you classified as a merchant? If so, what level (1, 2, 3, 4)? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ERROR:#REF! | ||
| PCID-07 | Describe the architecture employed by the system to verify and authorize credit card transactions. | Refer to PCI DSS Security Standards for supplemental guidance in this section | ERROR:#REF! | ||
| PCID-08 | What payment processors/gateways does the system support? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ERROR:#REF! | ||
| PCID-09 | Can the application be installed in a PCI DSS compliant manner ? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ERROR:#REF! | ||
| PCID-10 | Is the application listed as an approved PA-DSS application? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ERROR:#REF! | ||
| PCID-11 | Does the system or products use a third party to collect, store, process, or transmit cardholder (payment/credit/debt card) data? | Refer to PCI DSS Security Standards for supplemental guidance in this section | ERROR:#REF! | ||
| PCID-12 | Include documentation describing the systems' abilities to comply with the PCI DSS and any features or capabilities of the system that must be added or changed in order to operate in compliance with the standards. | Refer to PCI DSS Security Standards for supplemental guidance in this section | ERROR:#REF! |
&"Helvetica,Regular"&12&K000000 &P
Crosswalk Detail
| 5.1.1 | Policies for information security |
| 5.1.2 | Review of the policies for information security |
| 6.1.1 | Information security roles and responsibilities |
| 6.1.2 | Segregation of duties |
| 6.1.3 | Contact with authorities |
| 6.1.4 | Contact with special interest groups |
| 6.1.5 | Information security in project management |
| 6.2.1 | Mobile device policy |
| 6.2.2 | Teleworking |
| 7.1.1 | Screening |
| 7.1.2 | Terms and conditions of employment |
| 7.2.1 | Management responsibilities |
| 7.2.2 | Information security awareness, education and training |
| 7.2.3 | Disciplinary process |
| 7.3.1 | Termination or change of employment responsibilities |
| 8.1.1 | Inventory of assets |
| 8.1.2 | Ownership of assets |
| 8.1.3 | Acceptable use of assets |
| 8.1.4 | Return of assets |
| 8.2.1 | Classification of information |
| 8.2.2 | Labelling of information |
| 8.2.3 | Handling of assets |
| 8.3.1 | Management of removable media |
| 8.3.2 | Disposal of media |
| 8.3.3 | Physical media transfer |
| 9.1.1 | Access control policy |
| 9.1.2 | Access to networks and network services |
| 9.2.1 | User registration and de-registration |
| 9.2.2 | User access provisioning |
| 9.2.3 | Management of privileged access rights |
| 9.2.4 | Management of secret authentication information of users |
| 9.2.5 | Review of user access rights |
| 9.2.6 | Removal or adjustment of access rights |
| 9.3.1 | Use of secret authentication information |
| 9.4.1 | Information access restriction |
| 9.4.2 | Secure log-on procedures |
| 9.4.3 | Password management system |
| 9.4.4 | Use of privileged utility programs |
| 9.4.5 | Access control to program source code |
| 10.1.1 | Policy on the use of cryptographic controls |
| 10.1.2 | Key management |
| 11.1.1 | Physical security perimeter |
| 11.1.2 | Physical entry controls |
| 11.1.3 | Securing offices, rooms and facilities |
| 11.1.4 | Protecting against external and environmental threats |
| 11.1.5 | Working in secure areas |
| 11.1.6 | Delivery and loading areas |
| 11.2.1 | Equipment siting and protection |
| 11.2.2 | Supporting utilities |
| 11.2.3 | Cabling security |
| 11.2.4 | Equipment maintenance |
| 11.2.5 | Removal of assets |
| 11.2.6 | Security of equipment and assets off-premises |
| 11.2.7 | Secure disposal or re-use of equipment |
| 11.2.8 | Unattended user equipment |
| 11.2.9 | Clear desk and clear screen policy |
| 12.1.1 | Documented operating procedures |
| 12.1.2 | Change management |
| 12.1.3 | Capacity management |
| 12.1.4 | Separation of development, testing and operational environments |
| 12.2.1 | Controls against malware |
| 12.3.1 | Information backup |
| 12.4.1 | Event logging |
| 12.4.2 | Protection of log information |
| 12.4.3 | Administrator and operator logs |
| 12.4.4 | Clock synchronisation |
| 12.5.1 | Installation of software on operational systems |
| 12.6.1 | Management of technical vulnerabilities |
| 12.6.2 | Restrictions on software installation |
| 12.7.1 | Information systems audit controls |
| 13.1.1 | Network controls |
| 13.1.2 | Security of network services |
| 13.1.3 | Segregation in networks |
| 13.2.1 | Information transfer policies and procedures |
| 13.2.2 | Agreements on information transfer |
| 13.2.3 | Electronic messaging |
| 13.2.4 | Confidentiality or non-disclosure agreements |
| 14.1.1 | Information Security requirements analysis and specification |
| 14.1.2 | Securing application services on public networks |
| 14.1.3 | Protecting application services transactions |
| 14.2.1 | Secure development policy |
| 14.2.2 | System change control procedures |
| 14.2.3 | Technical review of applications after operating platform changes |
| 14.2.4 | Restrictions on changes to software packages |
| 14.2.5 | Secure system engineering principles |
| 14.2.6 | Secure development environment |
| 14.2.7 | Outsourced development |
| 14.2.8 | System security testing |
| 14.2.9 | System acceptance testing |
| 14.3.1 | Protection of test data |
| 15.1.1 | Information security policy for supplier relationships |
| 15.1.2 | Addressing security within supplier agreements |
| 15.1.3 | Information and communication technology supply chain |
| 15.2.1 | Monitoring and review of supplier services |
| 15.2.2 | Managing changes to supplier services |
| 16.1.1 | Responsibilities and procedures |
| 16.1.2 | Reporting information security events |
| 16.1.3 | Reporting information security weaknesses |
| 16.1.4 | Assessment of and decision on information security events |
| 16.1.5 | Response to information security incidents |
| 16.1.6 | Learning from information security incidents |
| 16.1.7 | Collection of evidence |
| 17.1.1 | Planning information security continuity |
| 17.1.2 | Implementing information security continuity |
| 17.1.3 | Verify, review and evaluate information security continuity |
| 17.2.1 | Availability of information processing facilities |
| 18.1.1 | Identification of applicable legislation and contractual requirements |
| 18.1.2 | Intellectual property rights |
| 18.1.3 | Protection of records |
| 18.1.4 | Privacy and protection of personally identifiable information |
| 18.1.5 | Regulation of cryptographic controls |
| 18.2.1 | Independent review of information security |
| 18.2.2 | Compliance with security policies and standards |
| 18.2.3 | Technical compliance review |
| 8.2.3, 10.1.1 | Handling of assets; Policy on the use of cryptographic controls |
| 11.1.1,11.1.2 | Physical security perimeter; Physical entry controls |
| 9.2.3, 9.3.1, 9.4.3 | Management of privileged access rights; Use of secret authentication information; Password management system |
| 9.1.1, 9.2.3, 9.3.1, 9.4.3 | Access control policy; Management of privileged access rights; Use of secret authentication information; Password management system |
| CSC 1 | Inventory of Authorized and Unauthorized Devices |
| CSC 2 | Inventory of Authorized and Unauthorized Software |
| CSC 3 | Secure Configurations for Hardware and Software |
| CSC 4 | Continuous Vulnerability Assessment and Remediation |
| CSC 5 | Malware Defenses |
| CSC 6 | Application Software Security |
| CSC 7 | Wireless Access Control |
| CSC 8 | Data Recovery Capability |
| CSC 9 | Security Skills Assessment and Appropriate Training to Fill Gaps |
| CSC 10 | Secure Configurations for Network Devices |
| CSC 11 | Limitation and Control of Network Ports |
| CSC 12 | Controlled Use of Administrative Privileges |
| CSC 13 | Boundary Defense |
| CSC 14 | Maintenance, Monitoring, and Analysis of Audit Logs |
| CSC 15 | Controlled Access Based on the Need to Know |
| CSC 16 | Account Monitoring and Control |
| CSC 17 | Data Protection |
| CSC 18 | Incident Response and Management |
| CSC 19 | Secure Network Engineering |
| CSC 20 | Penetration Tests and Red Team Exercises |
| ID.AM-1 | Physical devices and systems within the organization are inventoried |
| ID.AM-2 | Software platforms and applications within the organization are inventoried |
| ID.AM-3 | Organizational communication and data flows are mapped |
| ID.AM-4 | External information systems are catalogued |
| ID.AM-5 | Resources (e.g., hardware, devices, data, and software) are prioritized based on their classification, criticality, and business value |
| ID.AM-6 | Cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, partners) are established |
| ID.BE-1 | The organization’s role in the supply chain is identified and communicated |
| ID.BE-2 | The organization’s place in critical infrastructure and its industry sector is identified and communicated |
| ID.BE-3 | Priorities for organizational mission, objectives, and activities are established and communicated |
| ID.BE-4 | Dependencies and critical functions for delivery of critical services are established |
| ID.BE-5 | Resilience requirements to support delivery of critical services are established |
| ID.GV-1 | Organizational information security policy is established |
| ID.GV-2 | Information security roles & responsibilities are coordinated and aligned with internal roles and external partners |
| ID.GV-3 | Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed |
| ID.GV-4 | Governance and risk management processes address cybersecurity risks |
| ID.RA-1 | Asset vulnerabilities are identified and documented |
| ID.RA-2 | Threat and vulnerability information is received from information sharing forums and sources |
| ID.RA-3 | Threats, both internal and external, are identified and documented |
| ID.RA-4 | Potential business impacts and likelihoods are identified |
| ID.RA-5 | Threats, vulnerabilities, likelihoods, and impacts are used to determine risk |
| ID.RA-6 | Risk responses are identified and prioritized |
| ID.RM-1 | Risk management processes are established, managed, and agreed to by organizational stakeholders |
| ID.RM-2 | Organizational risk tolerance is determined and clearly expressed |
| ID.RM-3 | The organization’s determination of risk tolerance is informed by its role in critical infrastructure and sector specific risk analysis |
| PR.AC-1 | Identities and credentials are managed for authorized devices and users |
| PR.AC-2 | Physical access to assets is managed and protected |
| PR.AC-3 | Remote access is managed |
| PR.AC-4 | Access permissions are managed, incorporating the principles of least privilege and separation of duties |
| PR.AC-5 | Network integrity is protected, incorporating network segregation where appropriate |
| PR.AT-1 | All users are informed and trained |
| PR.AT-2 | Privileged users understand roles & responsibilities |
| PR.AT-3 | Third-party stakeholders (e.g., suppliers, customers, partners) understand roles & responsibilities |
| PR.AT-4 | Senior executives understand roles & responsibilities |
| PR.AT-5 | Physical and information security personnel understand roles & responsibilities |
| PR.DS-1 | Data-at-rest is protected |
| PR.DS-2 | Data-in-transit is protected |
| PR.DS-3 | Assets are formally managed throughout removal, transfers, and disposition |
| PR.DS-4 | Adequate capacity to ensure availability is maintained |
| PR.DS-5 | Protections against data leaks are implemented |
| PR.DS-6 | Integrity checking mechanisms are used to verify software, firmware, and information integrity |
| PR.DS-7 | The development and testing environment(s) are separate from the production environment |
| PR.IP-1 | A baseline configuration of information technology/industrial control systems is created and maintained |
| PR.IP-2 | A System Development Life Cycle to manage systems is implemented |
| PR.IP-3 | Configuration change control processes are in place |
| PR.IP-4 | Backups of information are conducted, maintained, and tested periodically |
| PR.IP-5 | Policy and regulations regarding the physical operating environment for organizational assets are met |
| PR.IP-6 | Data is destroyed according to policy |
| PR.IP-7 | Protection processes are continuously improved |
| PR.IP-8 | Effectiveness of protection technologies is shared with appropriate parties |
| PR.IP-9 | Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are in place and managed |
| PR.IP-10 | Response and recovery plans are tested |
| PR.IP-11 | Cybersecurity is included in human resources practices (e.g., deprovisioning, personnel screening) |
| PR.IP-12 | A vulnerability management plan is developed and implemented |
| PR.MA-1 | Maintenance and repair of organizational assets is performed and logged in a timely manner, with approved and controlled tools |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .