OCHCA_Vendor_Questionnaire-_SAAS-Cloud-No_PHI.xlsx

Sheet1 VENDOR: Complete all items on this sheet unless instructed otherwise. Instructions are provided via comments at the top of each column.

ORANGE COUNTY HEALTH CARE AGENCY

IT CYBER SECURITY QUESTIONNAIRE

If you require an application service, is this true for your application?

[OCHCA will provide an account with the appropriate security level to log on as a service, and an account with the appropriate administrative rights to administer the application. The account password must periodically expire per OCHCA IT Security Services Policy & Procedures.]

Please select all forms of removable media where confidential information is always encrypted.

Always Encrypted:

IS.1.33 How long will your organization retain our confidential information? Less than:

If you respond "No," please use the Comment column to explain and put the frequency/conditions under which they are reviewed and approved.

ISA.1.17 Who approves the Information Security policies?

If you select "Other," please put the title in the Comment column.

ISO27001

HITRUST CSF

FedRamp Other - List in next column

SOC 2 TYPE 2 REPORT

AWS Data Center Azure Data Center Iron Mountain Data Center Other - List in next column

NIST 800-53 R4/5

NIST SP 800-66 R1

COBIT 4/5

PCI

OTHER - list in next column

OWASP

ePHI

PII

PCI

PUBLIC

PHI (Paper) Backup Tapes/Devices Writable CD-ROM Disks USB Storage Devices Other Removable Media We do not encrypt removable media 30 days from receipt 90 days from receipt One year from receipt More than one year from receipt Until termination of agreement Until termination of agreement plus 1 year Until termination of agreemnt plus 7 years Returned upon client request Disposed of upon client request Confidential information is retained in perpetuity (forever) Confidential information is not retained Other Per contract terms

CEO

CISO

ISO

Compliance Officer Other Upon hire Upon policy change Annually Every other year Never Host MAC address authenticated Host cryptographically authenticated as under the management of your organization (for example, 802.1x) Current anti-virus verification Current patch-level verification Local firewall configuration verification Other We do not utilize a NAC solution We have an IDS solution that detects but cannot prevent intrusion attempts We have an IPS solution that detects and attempts to prevent instrusion attempts Our IDS or IPS is deployed at our network perimeter Our IDS or IPS is deployed within our DMZs and other Internet-facing and untrusted network-facing sub-nets Our IDS or IPS is deployed on all network segments, including internal network segments Other We do not use an IDS or IPS Encrypted end-user services (HTTPS, IP-SEC, SFTP, FTPS) Expected clear-text services (DNS, SMTP, NTP, HTTP) Encrypted management services (SSH, RDP) Clear-text management services (telnet, SNMP, SMB, RPC) Others N/A - confidential information is not transmitted electronically

IP-SEC VPN

SSL-VPN

Terminal Services (RDP)

SSH

Other remote desktop control applications Other None - remote access is never allowed 7 days or less 21 - 28 days Less quickly than 28 days from publication Within an hour Within a day Within a week Less quickly than one week Other Never - our organization does not update its antivirus definitions SSLv2 SSLv310 TLSv1.0 TLSv1.1 TLSv1.2 N/A - SSL/TLS not in use SSHv1 SSHv2 N/A - SSH not in use

LDAP

Directory Services Kerberos

SSO

Others (Use comments section to list) Certificates Token Biometric

MFA\2FA

Other (List in comments section) Onsite Support Remote access (Explain in detail in comments) Email/Phone Support Non-Sensitive None Other (Use Comment section for details) Google Drive OneDrive List regions in Comments section Yes NO (Use Comments section to list location(s) Yes No Yes No Yes No Yes No Yes No Yes No Yes (Submit or embed policy) No (Use comments section to explain) Yes No Yes No YES (Describe process in Comments section) No Yes No N/A Yes (Submit or embed policy. Or, use comments for details) No (Use comments section to explain) Yes No Yes No N/A See comments section Yes If yes, select type:

No Yes (List roles in comments) No Yes No Yes Yes No N/A due to AD integration or SSO No Yes No Yes No Yes No N/A due to AD integration or SSO N/A due to AD integration or SSO Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes (List the data elements in the comments section) No Yes (List the data elements in the comments section) No Yes (Describe the protections in the comments section) No Yes No Yes No Yes No Yes No Yes (Details in the comments section) No Yes (SLA response times listed in the comments section) No Yes No N/A Yes No N/A Yes No N/A Yes No N/A Yes (Explain in comments) No Yes (Describe security controls in the comments section) No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No N/A Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes No Yes (embed or submit policy) No Yes (embed or submit policy) No Yes (embed or submit policy) No Yes (embed or submit policy) No Yes (embed or submit policy) No We do not use Gen AI for any aspects of support in this contract Policy embeded or submitted Group Box 805 TLSv1.3 Metadata De-identified PHI/PII None

Sheet2 image1.jpeg