Information_Technology_Security_Assessment_9-23-2026.docx

Information Technology Security Assessment Products name =

Support

1. Please describe your support model and include office location(s), hours of operation, how to submit, track, and escalate tickets, and average response time for tickets.

2. If your support team needs to remote into our systems, are they able to use approved methods: Microsoft Teams, Bomgar (BeyondTrust), or Zoom meeting?

3. Do you offer in-application online help? Please describe.

TECHNOLOGY

1. Please describe the basic system architecture of your application and how it will interact with our company’s IT resources. Provide a diagram if available.

2. What is the minimum system/network requirements to run your application? (Include security white sheet if available)

3. What documentation is provided with each new release of the application?

4. How many concurrent users can your application support? Please provide performance benchmarks if available.

5. Please describe how your application can interface with our existing third-party applications. (If Applicable)

AI USAGE

1. Q: Does this product utilize AI?

2. Q: What is the purpose of AI in the product and how does it operate?

3. Q: Is any data retained by the AI for any learning or replication purposes? (if yes, describe how and why)

4. Q: What processes does your organization take to ensure our data is not abused by AI?

5. Q: How much access is AI given to our systems or network?

6. Q: Does your company capture logging and monitor: prompts, outputs, user activity, AI agent activity and if so, are those logs available upon request?

7. Q: If audited can the decisions of the AI in your product be explained clearly?

8. Q: What controls do you have to ensure quality, fairness, accuracy and safety, while preventing hallucinations, biases, Prompt injection, data exfiltration?

9. Q: Please explain how you audit your AI for quality, fairness, biases, accuracy, hallucinations and safety?

10. Q: Can the AI agent be turned on or off for certain business workflows? Please describe as appropriate.

11. Q: Does the AI transmit data between our network and yours or is it completely cloud or on our network?

ADA COMPLIANCE

1. Q: Does your product support ADA compliance if needed by our employees?

2. Q: If your company has any public-facing web site, documents, and/or mobile applications on behalf of our organization, will it adhere to WCAG title II AA compliance?

3. Q: How do you verify your Web sites, documents, and/or mobile applications are ADA compliant to our standards?

HOSTING

1. Q: Please describe your hosting model (i.e. SaaS, on premise, vendor hosted).

2. Q: Where is your data center(s) located (countries, states, principalities, ETC)?

3. Q: Does any of your hosting sites reside in or belong to any countries that are part of the U.S. banned countries list?

4. Q: Are any of your data centers located in or beholden to any countries(s) that are blacklisted by the United States Government or are countries of particular concern to the United States Government?

5. Q: Do you provide clients with additional environments, in addition to the production environment (i.e. testing, training, configuration, etc.)? Is there an additional cost?

SECURITY

1. Please describe your security architecture. Include physical controls for data centers, any logical controls for data security, and the security framework your company uses. (List the use of Firewalls, web firewalls, intrusion detections/preventions systems/secure API endpoints)

2. What are your organization’s policies and procedures for notifying clients in the event of a security-related incident? What insurance does your organization have in the event of a data breach?

3. How and where does your organization encrypt data at rest and data in transit? (Include encryption methods and encryption key strength)

4. What safeguards do you have in place for personal identifiable information PII, financial data, Criminal Justice Information Data CJIS, Protected Health Information PHI, and other sensitive data?

5. Describe your products life cycle including frequency of releases, patches/hotfixes, and upgrade process. What are the client’s responsibilities with regards to upgrades?

DATA MANAGEMENT

1. How is data backed up and stored? Are backups ever moved offsite? How are backups encrypted and secured?

2. What happens to our data if your organization is purchased by another organization?

3. What is your data retention policy if the contract period ends? How do you securely delete/retrieve our data when it’s no longer needed or upon contract termination?

4. Who owns the data stored or processed by your systems? Will our data be used to train AI models or transferred for any reason to third parties?

5. Describe how our data (Sensitive or regular data) is anonymized or masked?

ACCESS CONTROLS

1. Does your application support integration with any Enterprise Identity Management solution and allow for Single Sign On (SSO)? If yes specify Protocols: [e.g. SAML, OAuth]

2. What criteria does your application enforce for secure user credential creation and does your application allow for multi-factor authentication?

3. Does your application support role-based security and limit access based on the principle of least privilege?

4. Describe your Password Policy Enforcement for your company and how our Users access the environment.

Printed Name of Firm’s Representative

Signature of Firm’s Representative Date

____________________________________ Approved _____________________ Printed Name of County’s IT Representative Disapproved _____________________ Signature of County’s IT Representative Date ___________________________