IT_Security_questionnaire.docx
DOCX document 16 KB Posted
- Solicitation number
- PR8409
- Issued by
- Florida
About this file
The document is an IT Security Questionnaire for Professional Services Vetting, specifically related to the Orlando Utilities Commission (OUC) GIS Utility Network Migration Project in Florida. The questionnaire comprehensively covers seven critical cybersecurity domains: governance and risk management, asset and data protection, access control, detection and monitoring, incident response, recovery planning, and third-party and supply chain security. The questionnaire is designed to assess potential service providers' cybersecurity capabilities and preparedness.
The GIS Utility Network Migration Project aims to modernize OUC's geographic information system from a legacy Esri geometric network platform to Esri's contemporary ArcGIS Utility Network solution. The questionnaire indicates a rigorous vetting process for potential service providers, requiring detailed responses about cybersecurity practices, including formal security policies, risk management processes, data protection strategies, access control mechanisms, incident response plans, and third-party security protocols. While specific pricing, funding sources, and contract terms are not detailed in this document, the comprehensive security assessment suggests a methodical approach to selecting a technology service provider for this critical infrastructure modernization project.
View the file
Other files
Show all 13
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
IT Security Questionnaire for Professional Services Vetting
1. Governance & Risk Management
Do you have a formal information security policy? If yes, when was it last reviewed or updated? How is executive leadership involved in cybersecurity risk decisions?
Is there a documented process for identifying and managing cybersecurity risks associated with third-party services
2. Asset & Data Protection
Can you provide an inventory of critical assets relevant to the services provided? How is sensitive customer data classified and protected throughout its lifecycle? Are encryption methods used for data at rest and in transit?
3. Access Control
How do you manage identity and access for internal and external users?
Are multifactor authentication (MFA) and least-privilege principles enforced?
4. Detection & Monitoring
What tools or processes are used to detect cybersecurity events? How is anomaly detection incorporated into your operations?
5. Incident Response
Is there an incident response plan in place? Can it be shared upon request? Are tabletop exercises or simulations conducted regularly?
6. Recovery Planning
How do you ensure continuity of critical services during and after a cyber incident? Do you have documented disaster recovery and business continuity plans?
7. Third-Party & Supply Chain Security
Do you vet subcontractors or suppliers for cybersecurity risks?
Are SLAs or contracts in place with third parties that define cybersecurity responsibilities?
File details come from the government source that posted it. Updated .