Flagler_County_Third_Party_Security_Questionnaire_(TPSQ).xlsx
XLSX spreadsheet 466 KB Posted
- Attached to
- PENETRATION TESTING, EXTERNAL VULNERABILITY SCANNING - E-RATE PROGRAM FOR NEW LIBRARY LOCATION IN BUNNELL
- Solicitation number
- 25-RFP-071
- Issued by
- Flagler County, Brownsville CDP, Florida
About this file
The document is a Flagler County Third Party Security Questionnaire (TPSQ) developed by the Higher Education Information Security Council (HEISC) Shared Assessments Working Group, designed to assess vendor security practices for on-premise technology solutions. The comprehensive questionnaire is a standardized tool for evaluating vendor security capabilities across multiple domains including documentation, company overview, application security, authentication, change management, database security, datacenter operations, policies and procedures, and network protection. It is structured to help Flagler County ensure that vendor services are appropriately assessed for security and privacy needs, with sections covering technical controls, organizational practices, and risk management strategies.
The questionnaire provides a detailed framework for vendors to disclose their security practices, with scoring mechanisms that align to multiple industry standards including CIS Critical Security Controls, HIPAA, ISO 27002, NIST Cybersecurity Framework, and NIST Special Publications 800-171 and 800-53. Vendors are expected to provide comprehensive responses across areas such as role-based access control, encryption practices, remote access protocols, incident response capabilities, and vulnerability management. The tool allows for nuanced assessment, with sections for vendor self-reporting, additional information, and analyst review, enabling Flagler County to systematically evaluate potential security risks and vendor compliance with established cybersecurity standards.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Introduction Worksheet to introduce the Higher Education Community Vendor Assessment Toolkit (HECVAT) and explain what it is.
Flagler County Third Party Security Questionnaire (TPSQ) - On-Premise
| The Flagler County Third Party Security Questionnaire (TPSQ): |
| ● Helps Flagler County ensure that vendor services are appropriately assessed for security and privacy needs, including some that are unique to small and local government. |
| ● Allows a consistent, easily adopted methodology for organizations wishing to reduce costs through vendor services without increasing risks. |
| ● Reduces the burden that service providers face in responding to requests for security assessments from higher education institutions. |
The The Flagler County Third Party Security Questionnaire (TPSQ) Toolkit is a suite of tools to allow the County to adopt, implement, and maintain a consistent risk/security assessment program. Tools include:
| ● TPSQ - Full: Robust questionnaire used to assess the most critical data-sharing engagements |
| ● TPSQ - Lite: A lightweight questionnaire used to expedite the process |
| ● TPSQ - On-Premise: Unique questionnaire used to evaluate on-premise appliances and software |
| Proceed to the next tab, Instructions. |
| End of worksheet |
Instructions Flagler County Third Party Security Questionnaire - On-Premise | Instructions
| Target Audience |
| These instructions are for vendors interested in providing the County with a software and/or a service and for security assessors assessing the software and/or service. The purpose of this worksheet (i.e., the TPSQ - Lite | Vendor Response tab) is for a vendor to submit robust security safeguard information in regards to the product (software/service) being assessed in the County's assessment process. Consumers do not populate this tool. |
| Document Layout |
| There are five main sections of the Flagler County Third Party Security Questionnaire - On-Premise, all listed below and outlined in more detail. This document is designed to have the first two sections populated first; after the Qualifiers section is completed it can be populated in any order. Within each section, answer each question top-to-bottom. Some questions are nested and may be blocked out via formatting based on previous answers. Populating this document in the correct order improves efficiency. |
Do not overwrite selection values (data validation) in column C of the TPSQ - On-Premise tab.
| General Information | This section is self-explanatory; product specifics and contact information. GNRL-01 through GNRL-10 should be populated by the Vendor. GNRL-11 and GNRL-12 are for County use only. |
| Qualifiers | Populate this section completely before continuing. Answers in this section can determine which sections will be required for this assessment. By answering "No" to Qualifiers, their matched sections become optional and are highlighted in orange. |
| Documentation | Focused on external documentation, the County is interested in the frameworks that guide your security strategy and what has been done to certify these implementations. |
| Company Overview | This section is focused on company background, size, and business area experience. |
| Safeguards | The remainder of the document consists of various safeguards, grouped generally by section. Unless the question says otherwise, assume the scope is your development operations and vended solution. |
| In sections where vendor input is required there are only one or two columns that need modification, Vendor Answers and Additional Information, columns C and D respectively (see Figure 1 below). You will see that sometimes C and D are separate and other times are merged. If they are separate, C will be a selectable, drop-down box and any supporting information should be added to column D. If C and D are merged, the question is looking for the answer to be in narrative form. At the far right is a column titled “Guidance.” After answering questions, check this column to ensure you have submitted information/documentation to sufficiently answer the question. Use the “Additional Information” column to provide any requested details. | |
| Figure 1: | |
| Definitions and Data Zones | |
| County | Any school, college, or university using the Flagler County Third Party Security Questionnairekit |
| County Data Zone | The country/region in which an County is located, including all laws and regulations in-scope within that country/region |
| Vendor Data Zone | The country/region in which a vendor is headquartered and/or serves its products/services, including all laws and regulations in-scope within that country/region |
| Customers from different regions may expect various protections of data (e.g., GDPR); this is the County Data Zone. Vendors may handle data differently depending on the country or region where data is stored; this is the Vendor Data Zone. |
As a vendor, if your security practices vary based on your region of operation, you may want to populate a TPSQ in the context for each security zone (strategy). That said, Countys from different data zones may still use vendor responses from other state data zones. If your security practices are the same across all regions of operations, indicate "All" in your Vendor Data Zone.
Example A: If vendor ABC is headquartered and stores data in Canada and provides services to only customers in Canada, ABC should state "Canada" in both data zone fields.
Example B: If vendor ABC is headquartered and stores data in Canada and additionally provides services to customers in the United Kingdom, ABC may want to assure customers in the United Kingdom that their data is handled properly for their region. In that case, ABC should state "Canada" in the Vendor Data Zone and "United Kingdom" in the County Data Zone.
Example C: If your security strategy is broad and doesn't fit this statement model, provide a brief summary in each field and the County's security analyst can assess your response.
Proceed to the next tab, TPSQ - On-Premise
| For County's Security Analysts |
| 1. Raw vendor answers can be viewed on the TPSQ - On-Premise tab. |
2. To begin your assessment, review the Analyst Report tab, ensuring that you select the appropriate security standard used in your County (cell B7) before you begin.
3. Review the Analyst Reference tab for guidance and question/response interpretation.
4. Select compliance states for the outstanding noncompliant or short-answer questions in column G. Once all subjective questions are evaluated and compliance indicated, move to the Summary Report tab.
TPSQ - On-Premise Flagler County Third Party Security Questionnaire (TPSQ) - On-Premise Version 3.05
| DATE-01 | Date | ||||
| General Information | |||||
| In order to protect the County and its systems, vendors whose products and/or services [further referred to as product] will access and/or host Countyal data must complete the Flagler County Third Party Security Questionnaire. Throughout this tool, anywhere where the term "data" is used, this is an all-encompassing term including at least data and metadata. Answers will be reviewed by County security analysts upon submittal. This process will assist the County in preventing breaches of protected information and comply with County policy, state, and federal law. This is intended for use by vendors participating in a Third Party Security Assessment and should be completed by a vendor. | |||||
| GNRL-01 through GNRL-15; populated by Vendor | |||||
| GNRL-01 | Vendor Name | Vendor Name | |||
| GNRL-02 | Product Name | Product Name and Version Information | |||
| GNRL-03 | Product Description | Brief Description of the Product | |||
| GNRL-04 | Web Link to Product Privacy Notice | http://www.vendor.domain/privacynotice | |||
| GNRL-05 | Vendor Contact Name | Vendor Contact Name | |||
| GNRL-06 | Vendor Contact Title | Vendor Contact Title | |||
| GNRL-07 | Vendor Contact Email | Vendor Contact E-mail Address | |||
| GNRL-08 | Vendor Contact Phone Number | 555-555-5555 | |||
| GNRL-09 | Vendor Data Zone | See Instructions tab for guidance | |||
| GNRL-11 and GNRL-12; populated by County's Security Office | |||||
| GNRL-11 | Campus Security Analyst/Engineer | N/A | |||
| GNRL-12 | Assessment Contact | N/A | |||
| Instructions | |||||
| Step 1: Complete each section answering each set of questions in order from top to bottom; the built-in formatting logic relies on this order. Step 2: Submit the completed Flagler County Third Party Security Questionnaire - OnPrem to the County according to Countyal procedures. | |||||
| Documentation | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| DOCU-01 | Have you undergone a SSAE 18 audit? | ||||
| DOCU-02 | Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.) | ||||
| DOCU-03 | Are you compliant with FISMA standards? | ||||
| DOCU-04 | Does your organization have a data privacy policy? | ||||
| DOCU-05 | Describe or provide a reference to your Business Continuity Plan (BCP). | Provide a valid URL to your current BCP or submit it along with this fully populated HECVAT. | |||
| DOCU-06 | Describe or provide a reference to your Disaster Recovery Plan (DRP). | Provide a valid URL to your current DRP or submit it along with this fully populated HECVAT. | |||
| Company Overview | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| COMP-01 | Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships. | N/A | |||
| COMP-02 | Describe how long your organization has conducted business in this product area. | N/A | |||
| COMP-03 | Do you have existing higher education customers? | ||||
| COMP-04 | Have you had a significant breach in the last 5 years? | ||||
| COMP-05 | Do you have a dedicated Information Security staff or office? | ||||
| COMP-06 | Do you have a dedicated Software and System Development team(s)? (e.g. Customer Support, Implementation, Product Management, etc.) | ||||
| COMP-07 | Use this area to share information about your architecture that will assist those who are assessing your company data security program. | N/A | |||
| Application/Service Security | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| OPAP-01 | Do you support role-based access control (RBAC) for end-users? | ||||
| OPAP-02 | Do you support role-based access control (RBAC) for system administrators? | ||||
| OPAP-03 | Can your employees access customer systems remotely? | ||||
| OPAP-04 | Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system? | ||||
| OPAP-05 | Does the system provide data input validation and error messages? | ||||
| OPAP-06 | Do you require remote management of the system? | ||||
| OPAP-07 | Are your remote actions and changes logged or otherwise visible to the campus? (IF YES to OPAP-06) | ||||
| OPAP-08 | If you maintain remote access to the system, Will you handle data in a FERPA compliant manner? | ||||
| OPAP-09 | Describe or provide a reference to how you monitor for and protect against common web application security vulnerabilities (e.g. SQL injection, XSS, XSRF, etc.). | Ensure that all elements of OPAP-09 are clearly stated in your response. | |||
| OPAP-10 | Describe or provide a reference to how you monitor for and provide patches to protect against application vulnerabilities (privilege escalation, exfiltration, etc.). | Ensure that all elements of OPAP-10 are clearly stated in your response. | |||
| Authentication, Authorization, and Accounting | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| OPAA-01 | Can you enforce password/passphrase aging requirements for administrative and/or system accounts? | 0 | |||
| OPAA-02 | Does your web-based interface support authentication, including standards-based single-sign-on? (e.g. InCommon) | 0 | |||
| OPAA-03 | Does your application support integration with other authentication and authorization systems? List which ones (such as Active Directory, Kerberos and what version) in Additional Info? | 0 | |||
| OPAA-04 | Does the system support role based access control? | 0 | |||
| OPAA-05 | Are audit logs available that include AT LEAST all of the following; login, logout, actions performed, and source IP address? | 0 | |||
| OPAA-06 | Are these logs exportable (to SIEM or other contemporary log ingestion systems) | 0 | |||
| OPAA-07 | Does your application and/or user-frontend/portal support multi-factor authentication? (e.g. Duo, Google Authenticator, OTP, etc.) | 0 | |||
| Change Management | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| OPCH-01 | Do you have a documented and currently followed change management process (CMP)? | 0 | |||
| OPCH-02 | Will the County be notified of major changes to your environment that could impact the County's security posture? | 0 | |||
| OPCH-03 | Do you publish workarounds for how security risks can be mitigated until patches can be applied? | 0 | ` | ||
| OPCH-04 | Do procedures exist to provide that emergency changes are documented and authorized (including after the fact approval)? | 0 | |||
| Database | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| OPDB-01 | Does the database support encryption of specified data elements in storage? | 0 | |||
| OPDB-02 | Do you currently use encryption in your database(s)? | 0 | |||
| Datacenter | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| OPDC-01 | Do you provide your product as a virtual appliance? | 0 | |||
| OPDC-02 | Do you support VA in campus-managed cloud environment (e.g., AWS)? (IF YES on OPDC-01) | 0 | |||
| OPDC-03 | Do you support High Availability/ Redundancy for your Appliances, Virtual Machines or Containers? | 0 | |||
| OPDC-04 | For installable packages, do you perform regression testing against supported host OS systems? | 0 | |||
| OPDC-05 | Is sensitive data encrypted in transport? (e.g. system-to-client) | 0 | |||
| OPDC-06 | Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)? | 0 | |||
| OPDC-07 | Do you employ or allow any cryptographic modules that do not conform to the Federal Information Processing Standards (FIPS PUB 140-2)? | 0 | |||
| OPDC-08 | Does your system employ encryption technologies when transmitting sensitive information over TCP/IP networks (e.g., SSH, SSL/TLS, VPN)? (e.g. system-to-system and system-to-client) | 0 | |||
| OPDC-09 | If your system is delivered as a physical appliance, do you provide a mechanism for County to export and backup configurations and data automatically? | 0 | |||
| Policies, Procedures, and Processes | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| OPPP-01 | Can you share the organization chart, mission statement, and policies for your information security unit? | 0 | |||
| OPPP-02 | Are information security principles designed into the product lifecycle? | 0 | |||
| OPPP-03 | Do you have a formal incident response plan? | 0 | |||
| OPPP-04 | Do you have a documented information security policy? | 0 | |||
| OPPP-05 | Will you comply with the County's IT policies with regards to user privacy and data protection? | 0 | |||
| Firewalls, IDS, IPS, and Networking | Vendor Answers | Additional Information | Guidance | Analyst Notes | |
| OFID-01 | Do you employ host-based intrusion detection? | 0 | |||
| OFID-02 | Are you utilizing a host-based stateful packet inspection (SPI) firewall? | 0 | |||
| OFID-03 | Do you employ host-based intrusion prevention? | 0 | |||
| OFID-04 | Are you employing any next-generation persistent threat (NGPT) monitoring? | 0 | |||
| OFID-05 | Do you support campus status monitoring through SNMPv3 or other means? | 0 | |||
| OFID-06 | Describe or provide a reference to any other safeguards used to monitor for malicious activity. | Please detail your monitoring strategy |
000000 &P
Analyst Report
| Flagler County Third Party Security Questionnaire (TPSQ) - On-Premise | Analyst Report | Version 3.05 | ||||
| HEISC Shared Assessments Working Group | |||||
| Vendor Name | Vendor Name | Product Name | Product Name and Version Information | ||
| Vendor Contact Name | Vendor Contact Name | Product Description | Brief Description of the Product | ||
| Vendor Contact Title | Vendor Contact Title | TPSQ Version | On-Premise | ||
| Vendor Email Address | Vendor Contact E-mail Address | Date Prepared | 0 | ||
| County's Security Framework | < - Select your security framework. |
| Report Sections | Max_Score | Score | Score % |
| Documentation | 105 | 0 | 0% |
| Company | 120 | 0 | 0% |
| Application Security | 205 | 0 | 0% |
| Authentication, Authorization, and Accounting | 130 | 0 | 0% |
| Change Management | 80 | 0 | 0% |
| Database | 80 | 0 | 0% |
| Datacenter | 320 | 0 | 0% |
| Policies, Procedures, and Processes | 110 | 0 | 0% |
| Firewalls, IDS, IPS, and Networking | 120 | 0 | 0% |
| Overall Score | 1270 | 0 | 0% |
| Analyst Notes | Step 2: Override/Correct Vendor Responses and Set Weights Per County's Use Case | |||||||
| ID | Question | Vendor Answer | Additional Information | Notes shown in Col F on TPSQ - On-Premise tab) | Preferred Response | Compliant Override | Default Weight | Weight Override |
| The vendor's selected responses are displayed here for easier reference. | The vendor's narrative responses are displayed here for easier reference. | As an analyst/assessor, use the column to make notes of concerns, follow-up questions for the vendor, needed documentation, etc. | The preferred response is that which is scored positively. | Analysts should use this dropdown to override inappropriate/ incorrect vendor answers to affect scoring appropriately. | The default weight of a question is set by the makers of TPSQ tooling and is used to set a baseline. | Countys may weight question responses differently in their assessments, based on their use of the vendor product. Adjust weights to affect final scoring appropriately. | ||
| Documentation | Question | Vendor Answer | Additional Information | Analyst Notes | Preferred Response | Compliant Override | Default Weight | Weight Override |
| DOCU-01 | Have you undergone a SSAE 18 audit? | 0 | Yes | 15 | ||||
| DOCU-02 | Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.) | 0 | Yes | 10 | ||||
| DOCU-03 | Are you compliant with FISMA standards? | 0 | Yes | 15 | ||||
| DOCU-04 | Does your organization have a data privacy policy? | 0 | Yes | 25 | ||||
| DOCU-05 | Describe or provide a reference to your Business Continuity Plan (BCP). | 0 | Yes | 20 | ||||
| DOCU-06 | Describe or provide a reference to your Disaster Recovery Plan (DRP). | 0 | Yes | 20 | ||||
| Company Overview | Vendor Answer | Additional Information | Analyst Notes | Preferred Response | Compliant Override | Default Weight | Weight Override | |
| COMP-01 | Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships. | 0 | 10 | |||||
| COMP-02 | Describe how long your organization has conducted business in this product area. | 0 | 10 | |||||
| COMP-03 | Do you have existing higher education customers? | 0 | Yes | 0 | 10 | |||
| COMP-04 | Have you had a significant breach in the last 5 years? | 0 | No | 0 | 25 | |||
| COMP-05 | Do you have a dedicated Information Security staff or office? | 0 | Yes | 0 | 25 | |||
| COMP-06 | Do you have a dedicated Software and System Development team(s)? (e.g. Customer Support, Implementation, Product Management, etc.) | 0 | Yes | 0 | 15 | |||
| COMP-07 | Use this area to share information about your architecture that will assist those who are assessing your company data security program. | 0 | 0 | 25 | ||||
| Application/Service Security | Vendor Answer | Additional Information | Analyst Notes | Preferred Response | Compliant Override | Default Weight | Weight Override | |
| OPAP-01 | Do you support role-based access control (RBAC) for end-users? | 0 | 0 | Yes | 0 | 25 | ||
| OPAP-02 | Do you support role-based access control (RBAC) for system administrators? | 0 | 0 | Yes | 0 | 20 | ||
| OPAP-03 | Can your employees access customer systems remotely? | 0 | 0 | No | 0 | 20 | ||
| OPAP-04 | Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system? | 0 | 0 | Yes | 0 | 20 | ||
| OPAP-05 | Does the system provide data input validation and error messages? | 0 | 0 | Yes | 20 | |||
| OPAP-06 | Do you require remote management of the system? | 0 | 0 | No | 20 | |||
| OPAP-07 | Are your remote actions and changes logged or otherwise visible to the campus? (IF YES to OPAP-06) | 0 | 0 | Yes | 20 | |||
| OPAP-08 | If you maintain remote access to the system, Will you handle data in a FERPA compliant manner? | 0 | 0 | Yes | 20 | |||
| OPAP-09 | Describe or provide a reference to how you monitor for and protect against common web application security vulnerabilities (e.g. SQL injection, XSS, XSRF, etc.). | 0 | 0 | Yes | 20 | |||
| OPAP-10 | Describe or provide a reference to how you monitor for and provide patches to protect against application vulnerabilities (privilege escalation, exfiltration, etc.). | 0 | 0 | Yes | 20 | |||
| Authentication, Authorization, and Accounting | Vendor Answer | Additional Information | Analyst Notes | Preferred Response | Compliant Override | Default Weight | Weight Override | |
| OPAA-01 | Can you enforce password/passphrase aging requirements for administrative and/or system accounts? | 0 | 0 | Yes | 15 | |||
| OPAA-02 | Does your web-based interface support authentication, including standards-based single-sign-on? (e.g. InCommon) | 0 | 0 | Yes | 40 | |||
| OPAA-03 | Does your application support integration with other authentication and authorization systems? List which ones (such as Active Directory, Kerberos and what version) in Additional Info? | 0 | 0 | Yes | 15 | |||
| OPAA-04 | Does the system support role based access control? | 0 | 0 | Yes | 15 | |||
| OPAA-05 | Are audit logs available that include AT LEAST all of the following; login, logout, actions performed, and source IP address? | 0 | 0 | Yes | 15 | |||
| OPAA-06 | Are these logs exportable (to SIEM or other contemporary log ingestion systems) | 0 | 0 | Yes | 15 | |||
| OPAA-07 | Does your application and/or user-frontend/portal support multi-factor authentication? (e.g. Duo, Google Authenticator, OTP, etc.) | 0 | 0 | Yes | 15 | |||
| Change Management | Vendor Answer | Additional Information | Analyst Notes | Preferred Response | Compliant Override | Default Weight | Weight Override | |
| OPCH-01 | Do you have a documented and currently followed change management process (CMP)? | 0 | 0 | Yes | 25 | |||
| OPCH-02 | Will the County be notified of major changes to your environment that could impact the County's security posture? | 0 | 0 | Yes | 20 | |||
| OPCH-03 | Do you publish workarounds for how security risks can be mitigated until patches can be applied? | 0 | 0 | Yes | 20 | |||
| OPCH-04 | Do procedures exist to provide that emergency changes are documented and authorized (including after the fact approval)? | 0 | 0 | Yes | 15 | |||
| Database | Vendor Answer | Additional Information | Analyst Notes | Preferred Response | Compliant Override | Default Weight | Weight Override | |
| OPDB-01 | Does the database support encryption of specified data elements in storage? | 0 | 0 | Yes | 40 | |||
| OPDB-02 | Do you currently use encryption in your database(s)? | 0 | 0 | Yes | 40 | |||
| Datacenter | Vendor Answer | Additional Information | Analyst Notes | Preferred Response | Compliant Override | Default Weight | Weight Override | |
| OPDC-01 | Do you provide your product as a virtual appliance? | 0 | 0 | Yes | 20 | |||
| OPDC-02 | Do you support VA in campus-managed cloud environment (e.g., AWS)? (IF YES on OPDC-01) | 0 | 0 | Yes | 40 | |||
| OPDC-03 | Do you support High Availability/ Redundancy for your Appliances, Virtual Machines or Containers? | 0 | 0 | Yes | 40 | |||
| OPDC-04 | For installable packages, do you perform regression testing against supported host OS systems? | 0 | 0 | Yes | 40 | |||
| OPDC-05 | Is sensitive data encrypted in transport? (e.g. system-to-client) | 0 | 0 | Yes | 40 | |||
| OPDC-06 | Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)? | 0 | 0 | Yes | 40 | |||
| OPDC-07 | Do you employ or allow any cryptographic modules that do not conform to the Federal Information Processing Standards (FIPS PUB 140-2)? | 0 | 0 | No | 40 | |||
| OPDC-08 | Does your system employ encryption technologies when transmitting sensitive information over TCP/IP networks (e.g., SSH, SSL/TLS, VPN)? (e.g. system-to-system and system-to-client) | 0 | 0 | Yes | 40 | |||
| OPDC-09 | If your system is delivered as a physical appliance, do you provide a mechanism for County to export and backup configurations and data automatically? | 0 | 0 | Yes | 20 | |||
| Policies, Procedures, and Processes | Vendor Answer | Additional Information | Analyst Notes | Preferred Response | Compliant Override | Default Weight | Weight Override | |
| OPPP-01 | Can you share the organization chart, mission statement, and policies for your information security unit? | 0 | 0 | Yes | 20 | |||
| OPPP-02 | Are information security principles designed into the product lifecycle? | 0 | 0 | Yes | 25 | |||
| OPPP-03 | Do you have a formal incident response plan? | 0 | 0 | Yes | 25 | |||
| OPPP-04 | Do you have a documented information security policy? | 0 | 0 | Yes | 20 | |||
| OPPP-05 | Will you comply with the County's IT policies with regards to user privacy and data protection? | 0 | 0 | Yes | 20 | |||
| Firewalls, IDS, IPS, and Networking | Vendor Answer | Additional Information | Analyst Notes | Preferred Response | Compliant Override | Default Weight | Weight Override | |
| OFID-01 | Do you employ host-based intrusion detection? | 0 | 0 | Yes | 20 | |||
| OFID-02 | Are you utilizing a host-based stateful packet inspection (SPI) firewall? | 0 | 0 | Yes | 20 | |||
| OFID-03 | Do you employ host-based intrusion prevention? | 0 | 0 | Yes | 20 | |||
| OFID-04 | Are you employing any next-generation persistent threat (NGPT) monitoring? | 0 | 0 | Yes | 20 | |||
| OFID-05 | Do you support campus status monitoring through SNMPv3 or other means? | 0 | 0 | Yes | 20 | |||
| OFID-06 | Describe or provide a reference to any other safeguards used to monitor for malicious activity. | 0 | 0 | Yes | 20 |
Analyst Reference Flagler County Third Party Security Questionnaire (TPSQ) - On-Premise | Analyst Reference
| Instructions |
| Use this reference guide to assess vendor responses in relation to your County's environment. The context of TPSQ questions can change, depending on implementation specifics so these recommendations and follow-up response are not exhaustive and are meant to improve assessment and report capabilities within your County's security/risk assessment program. |
Analyst tip #1: For any answer that is deemed "non-compliant" by your County, ask the vendor if there is a timeline for implementation, a sincere commitment to customer development engagement, and/or possible implementation of compensating control(s) that offsite the risks of another component.
Analyst tip #2: If a vendor's response to a follow-up inquiry is vague or seems off-point or dismissive, respond to the vendor contact with clear expectations for a response. Responses that fail to meet expectations thereafter should be negatively assessed based on your County's risk tolerance and the criticality of the data involved.
Analyst tip #3: The most important tip. Reject a TPSQ from a vendor if the vendor provides the County with a insufficiently populated TPSQ; if the vendor responses are vague and/or do not answer questions directly; or if significant discrepancies are found, making the TPSQ difficult to assess.
| Documentation | Reason for Question | Follow-up Inquiries/Responses | |
| DOCU-01 | Have you undergone a SSAE 18 audit? | Standard documentation, relevant to institutions requiring a vendor to undergo SSAE 18 audits. | Follow-up inquiries for SSAE 18 content will be institution/implementation specific. |
| DOCU-02 | Do you conform with a specific industry standard security framework? (e.g., NIST Cybersecurity Framework, ISO 27001, etc.) | Many vendors have populated a CAIQ or at least a self-assessment. Although lacking in some areas important to higher education, these documents are useful for supplemental assessment. | Follow-up inquiries for CSA content will be institution/implementation specific. |
| DOCU-03 | Are you compliant with FISMA standards? | If a vendor is STAR certified, vendor responses can theoretically be more trusted since CSA has verified their responses. Trust, but verify for yourself, as needed. | If STAR certification is important to your institution you may have specific follow-up details for documentation purposes. |
| DOCU-04 | Does your organization have a data privacy policy? | The details of the standard are not the focus here: it is the fact that a vendor builds their environment around a standard and that they continually evaluate and assess their security programs. | In an ideal world, a vendor will conform to an industry framework that is adopted by an institution. When this synergy does not exist, the interpretation of the vendor's responses must be interpreted in the context of the institution's environment. Follow-up inquires for industry frameworks (and levels of adoption) will be institution/implementation specific. |
| DOCU-05 | Describe or provide a reference to your Business Continuity Plan (BCP). | For institutions that collaborate with the United States government, FISMA compliance may be required. | Follow-up inquiries for FISMA compliance will be institution/implementation specific. |
| DOCU-06 | Describe or provide a reference to your Disaster Recovery Plan (DRP). | Managing and protecting institution data is the reason organizations perform security and risk assessments. Privacy policies outline how vendors will obtain, use, share, and protect institutional data and as such, should be robust in its language. Beware of vaguely worded privacy policies. | Inquire about any privacy language the vendor may have. It may not be ideal but there may be something available to assess or enough to have your legal counsel or policy/privacy professionals review. |
| Company Overview | Reason for Question | Follow-up Inquiries/Responses | |
| COMP-01 | Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships. | Define scale of company (support, resources, skillsets), general information about the organization that may be concerning. | Follow-up responses to this one are normally unique to their response. Vague answers here usually result in some footprinting of a vendor to determine their "reputation." |
| COMP-02 | Describe how long your organization has conducted business in this product area. | We want to establish longevity of a solution and whether or not a vendor is new to the HE space. | Normally a vendor will state their overall longevity but not talk about the software/service/product under evaluation. Follow-ups includes specific questions about the origins of the software/service/product and references will be requested. |
| COMP-03 | Do you have existing higher education customers? | Higher education is a unique vertical. A vendor's response to this question can help an analyst set the context for all vendor responses. Established and/or mature software/product/services are more likely to have current higher education customers, and therefore understand the environment that we operate in. | A simple "Yes" without any references or supporting information should be questioned. Question the size of institutions that are using the software/product/service and the scope of their implementations. |
| COMP-04 | Have you had a significant breach in the past five years? | We want transparency from the vendor, and an honest answer to this question, regardless of the response, is a good step in building trust. | If a vendor says "No," it is taken at face value. If you organization is capable of conducting reconnaissance, it is encouraged. If a vendor has experienced a breach, evaluate the circumstance of the incident and what the vendor has done in response to the breach. |
| COMP-05 | Do you have a dedicated Information Security staff or office? | Understanding the security program size (and capabilities) of a vendor has a significant impact on their ability to respond effectively to a security incident. The size of a vendor will determine their SO size, or lack thereof. Use the knowledge of this response when evaluating other vendor statements. | Vague responses to this question should be investigated further. Vendors without dedicated security personnel commonly have no security or security is embedded or dual-homed within operations (administrators). Ask about separation of duties, principle of least privilege, etc. There are many ways to get additional program state information from the vendor. |
| COMP-06 | Do you have a dedicated Software and System Development team(s)? (e.g., Customer Support, Implementation, Product Management, etc.) | Understanding the development team size (and capabilities) of a vendor has a significant impact on their ability to produce and maintain code, adhering to secure coding best practices. The size of a vendor will determine their use of dedicated development teams, or lack thereof. Use the knowledge of this response when evaluating other vendor statements. | Follow-up inquiries for vendor team strategies will be unique to your institution and may depend on the underlying infrastructures needed to support a system for your specific use case. |
| COMP-07 | Use this area to share information about your architecture that will assist those who are assessing your company data security program. | For the 20% that HECVAT may not cover, this gives the vendor a chance to support their other responses. Beware when this area is populated with sales hype or other non-relevant information. Thorough documentation, supporting evidence, and/or robust responses go a long way in building trust in this assessment process. | This is a freebie to help the vendor state their "case." If a vendor does not add anything here (or it is just sales stuff), we can assume it was filled out by a sales engineer and questions will be evaluated with higher scrutiny. |
| Application/Service Security | Reason for Question | Follow-up Inquiries/Responses | |
| OPAP-01 | Do you support role-based access control (RBAC) for end users? | Understanding access control capabilities allows an institution to estimate the type of maintenance efforts will be involved to manage a system. Depending on the users, concerns may or not be elevated. The value of this question is largely determined by the deployment strategy and use case of the software/product/service under review. This question is specific to end users. | Ask the vendor to summarize the best practices to restrict/control the access given to the institution's end users without the use of RBAC. Make sure to understand the administrative requirements/overhead introduced in the vendor's environment. |
| OPAP-02 | Do you support role-based access control (RBAC) for system administrators? | Managing a software/product/service may rely on various professionals to administer a system. This question is focused on how administration, and the segregation of functions, can be implemented within the system. Securing the administration portion of a system has additional implications (e.g., logging, administration, etc.) beyond that of end users. | Ask the vendor to summarize the best practices for securing their system(s) administratively without the use of RBAC. Make sure to understand the administrative requirements/overhead introduced in the vendor's environment. |
| OPAP-03 | Can your employees access customer systems remotely? | Telecommuting in the IT world is common. An institution should know that proper safeguards are in place if remote access is allowed. Vendor responses vary greatly on this so confirm the context of the response if it is not clear. Many cloud services can only be managed remotely, so there is often a gray area to interpret for this response. | Ask the vendor to summarize the reasoning behind this business process and request additional documentation that outlines the security controls implemented to safeguard institutional data. |
| OPAP-04 | Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system? | Many systems can be used a variety of ways. We want these implementation type diagrams so that we can understand the "real" use of the product. | Additional requests for documentation are made when other parts of the HECVAT are insufficient. Although helpful, many vendors do not provide supporting documentation. We try to be specific with our follow-up questions so that vendors understand we are not looking for 20-50 page whitepapers (sales documentation). |
| OPAP-05 | Does the system provide data input validation and error messages? | Input validation is a secure coding best practice, so confirming its implementation is normally a high priority. Error messages (to the system and user) can be used to detect abnormal use and to better protect institutional data. Depending on the criticality of data and the flow of said data, an institution's risk tolerance will be unique to their environment. | Inquire about any planned improvements to these capabilities. Ask about their product(s) roadmap and try to understand how they prioritize security concerns in their environment. |
| OPAP-06 | Do you require remote management of the system? | Telecommuting in the IT world is common. An institution should know that proper safeguards are in place, if remote access is allowed. Vendor responses vary greatly on this, so confirm the context of the response if it is not clear. Many cloud services can only be managed remotely, so there is often a gray area to interpret for this response. | Ask the vendor to summarize the reasoning behind this business process and request additional documentation that outlines the security controls implemented to safeguard institutional data. |
| OPAP-07 | Are your remote actions and changes logged or otherwise visible to the campus? (IF YES to OPAP-06) | Strong logging capabilities are vital to the proper management of a system. Implementing an immature system that lacks sufficient logging capabilities exposes an institution to great risk. Depending on your risk tolerance and the use case, your institution may or may not be concerned. The focus of this question is remote access logging. | If a weak response is given to this answer, it is appropriate to ask directed answers to get specific information. Ensure that questions are targeted to ensure responses will come from the appropriate party within the vendor. |
| OPAP-08 | If you maintain remote access to the system, Will you handle data in a FERPA compliant manner? | Standard documentation, relevant to institution implementations requiring FERPA compliance. | Follow-up inquiries for FERPA compliance details will be institution/implementation specific. |
| OPAP-09 | Describe or provide a reference to how you monitor for and protect against common web application security vulnerabilities (e.g., SQL injection, XSS, XSRF, etc.). | The adherence to secure coding best practices better positions a vendor to maintain the CIA triad. Use the knowledge of this response when evaluating other vendor statements, particularly those focused on development and the protection of communications. Vendors should be monitoring for and addressing these issues in their products. | If information security principles are not designed into the product life cycle, point the vendor to OWASP's Secure Coding Practices - Quick Reference Guide at https://www.owasp.org/index.php/OWASP_Secure_Coding_Practices_-_Quick_Reference_Guide |
Inquire about the tools a vendor uses, the interval at which systems are monitored/mitigated, and who is responsible for the process/procedure in place for this monitoring.
| OPAP-10 | Describe or provide a reference to how you monitor for and provide patches to protect against application vulnerabilities (privilege escalation, exfiltration, etc.). | Answers to this question will reveal the vendor’s knowledge of their IT assets and their ability to respond to notifications about their systems and software. | Follow-up inquiries for the vendor’s patching practices will be institution/implementation specific. | |
| Authentication, Authorization, and Accounting | Reason for Question | Follow-up Inquiries/Responses | ||
| OPAA-01 | Can you enforce password/passphrase aging requirements for administrative and/or system accounts? | This question is primarily focused on account management capabilities that are built into a system. Although aging is not always required, a system that lacks commodity functionality may be lacking in other areas as well. Use the vendor's response to this question as a way to pivot to other questions, as needed. | The value of this question depends on your institution's policy on passwords, its use of 2FA, or any number of factors. Follow-ups for this question are unique to the institution. | |
| OPAA-02 | Does your web-based interface support authentication, including standards-based single-sign-on (e.g., InCommon)? | This question is to set account management expectations for the institution. A system that can integrate with existing, vetted solutions has its advantages and may have less administrative overhead. Also, adherence to standards here gives credit to other standards-oriented questions/responses. | If a vendor indicates that a system is stand-alone and cannot integrate with community standards, follow up with maturity questions and ask about other commodity type functions or other system requirements your institution may have. | |
| OPAA-03 | Does your application support integration with other authentication and authorization systems? List which ones (such as Active Directory, Kerberos and what version) in Additional Info. | This question is to set account management expectations for the institution. A system that can integrate with existing, vetted solutions has its advantages and may have less administrative overhead. Also, adherence to standards here gives credit to other standards-oriented questions/responses. | If a vendor indicates that a system is stand-alone and cannot integrate with the institution's infrastructure, follow up with maturity questions and ask about other commodity type functions or other system requirements your institution may have. | |
| OPAA-04 | Does the system support role based access control? | Understanding access control capabilities allows an institution to estimate the type of maintenance efforts will be involved to manage a system. Depending on the users, concerns may or not be elevated. The value of this question is largely determined by the deployment strategy and use case of the software/product/service under review. This question is specific to end users. | Ask the vendor to summarize the best practices to restrict/control the access given to the institution's end-users without the use of RBAC. Make sure to understand the administrative requirements/overhead introduced in the vendor's environment. | * |
| OPAA-05 | Are audit logs available that include AT LEAST all of the following; login, logout, actions performed, and source IP address? | Strong logging capabilities are vital to the proper management of a system. Implementing an immature system that lacks sufficient logging capabilities exposes an institution to great risk. Depending on your risk tolerance and the use case, your institution may or may not be concerned. The focus of this question is end-user logs. | If a weak response is given to this answer, it is appropriate to ask directed answers to get specific information. Ensure that questions are targeted to ensure responses will come from the appropriate party within the vendor. | |
| OPAA-06 | Are these logs exportable (to SIEM or other contemporary log ingestion systems)? | Strong logging capabilities are vital to the proper management of a system. Implementing an immature system that lacks sufficient logging capabilities exposes an institution to great risk. Depending on your risk tolerance and the use case, your institution may or may not be concerned. The focus of this question is system-related logs (e.g., including but not limited to - events, state changes, control modification, etc.). | If a weak response is given to this answer, it is appropriate to ask directed answers to get specific information. Ensure that questions are targeted to ensure responses will come from the appropriate party within the vendor. | |
| OPAA-07 | Does your application and/or user-frontend/portal support multifactor authentication (e.g., Duo, Google Authenticator, OTP, etc.)? | 2FA/MFA, implemented correctly, strengthens the security state of a system. 2FA/MFA is commonly implemented and in many use cases, a requirement for account protection purposes. | Ask the vendor about hardware and software options, future roadmap for implementations and support, etc. | |
| Change Management | Reason for Question | Follow-up Inquiries/Responses | ||
| OPCH-01 | Do you have a documented and currently followed change management process (CMP)? | The lack of a change management program is indicative of immature program processes. Snswers to this question can provide insight into how well their responses (on the HECVAT) represent their actual environment(s). | If a weak response is given to this answer, response scrutiny should be increased. Questions about configuration management, system authority, and documentation are appropriate. | |
| OPCH-02 | Will the institution be notified of major changes to your environment that could impact the institution's security posture? | Notification expectations should be set earlier in the contract/assessment process. Timelines, correspondence medium, and playbook details are all aspects to keep in mind when assessing this response. | If the vendor's response does not cover the details outlined in the reasoning, follow up and get specific responses for each, as needed. | |
| OPCH-03 | Do you publish workarounds for how security risks can be mitigated until patches can be applied? | New vulnerabilities are published every day and vendors have a responsibility to maintain their software(s). The fundamental nature of operation will expose some risks to the system, but it is crucial that a vendor recognize their responsibilities and have a plan to implement them, when this time arrives. | Follow-up inquiries for the vendors patching practices will be institution/implementation specific. | |
| OPCH-04 | Do procedures exist to provide that emergency changes are documented and authorized (including after-the-fact approval)? | In the context of the CIA triad, this question is focused on system integrity, ensuring that system changes are only executed by authorized users. In the event of emergency changes, accountability and post-action review is expected. | Follow up with a robust question set if a vendor cannot clearly state full control of the integrity of their system(s). | |
| Database | Reason for Question | Follow-up Inquiries/Responses | ||
| OPDB-01 | Does the database support encryption of specified data elements in storage? | Depending on the use case, full database encryption may not always be required or ideal. The ability to encrypt specific fields (data elements) can be advantageous to a system. Performance is sometimes an issue, based on the use case, and this granular approach to encryption provides an institution more options. | Follow-up inquiries for database field encryption will be institution/implementation specific. Questions may include a timeline for this capability, performance metrics, and/or architectures that compensate for this level of encryption granularity. | |
| OPDB-02 | Do you currently use encryption in your database(s)? | Confidentiality is the focus of this question. Vendor responses to this question should be well-supported. Ensure that the vendor provides sufficient supporting documentation, as needed, to ensure that the vendor properly implements encryption in their database(s). | Dismissive or vague responses should be met with concern. Follow-up questions can include the reasoning behind not using encryption, recommendations for best-practice implementation (i.e., think diagrams), and/or any timeline for implementing this capability in the software/product/service. | |
| Datacenter | Reason for Question | Follow-up Inquiries/Responses | ||
| OPDC-01 | Do you provide your product as a virtual appliance? | Standard architecture questions to better understand the requirements of the institution's on-premise infrastructure. | If available as a VA, deployment on- and off-premise (i.e., institution-managed IaaS) should be possible. Ask the vendor is there are any restrictions or architecture requirements. Ask about the VA format, integrity, deployment strategies, etc. | |
| OPDC-02 | Do you support VA in campus-managed cloud environment (e.g., AWS)? (IF YES on OPDC-01) | Standard architecture questions to better understand the requirements of the institution's on-premise infrastructure. | If available as a VA, deployment on- and off-premise (i.e., institution-managed IaaS) should be possible. Ask the vendor is there are any restrictions or architecture requirements. Ask about the VA format, integrity, deployment strategies, etc. | |
| OPDC-03 | Do you support high availability/redundancy for your appliances, virtual machines, or containers? | The focus of this question is availability. Institutions that have invested in their technology infrastructure may want to leverage it instead of commercial cloud resources. Understanding a system's high-availability capabilities and the form in which it is deployed on-premise is important in assessment system feasibility in the institution's environment. | Follow-up inquiries concerning high-availability capabilities will be institution/implementation specific. | |
| OPDC-04 | For installable packages, do you perform regression testing against supported host OS systems? | Vendors will provide software packages/services (at times "blackbox") that are hosted on-premise. With limited access to patching, compensating controls, and/or the underlying operating system, a vendor must be clear on their coding, testing, and deployment strategies, as this strategy can introduce unforeseen risk with the institution. | Follow-up inquiries for regression testing will be institution/implementation specific. | |
| OPDC-05 | Is sensitive data encrypted in transport (e.g., system to client)? | The need for encryption in transport is unique to your institution's implementation of a system. In particular, system components, architectures, and data flows all factor into the need for this control. | Follow-up inquiries for data encryption in transport will be institution/implementation specific. | |
| OPDC-06 | Is sensitive data encrypted in storage (e.g., disk encryption, at rest)? | The need for encryption at rest is unique to your institution's implementation of a system. In particular, system components, architectures, and data flows all factor into the need for this control. | Follow-up inquiries for data encryption at-rest will be institution/implementation specific. |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .