OUCITSecurityVendors_112025.xlsx
XLSX spreadsheet 19 KB Posted
- Attached to
- Background Check Services
- Solicitation number
- PR9308
- Issued by
- Florida
About this file
This file is an IT Security Questionnaire Application designed for evaluating the security posture of third-party vendors and application developers seeking to provide services to the Florida Office of Univ ersity Corporate Initiatives (OUCI). The questionnaire serves as a comprehensive security assessment tool rather than a traditional procurement document, containing detailed requirements across eight major security domains: Application Security Practices, Data Security and Privacy, Application Infrastructure and Hosting Security, Incident Management and Monitoring, Compliance and Regulatory Requirements, Risk Assessment and Continuous Improvement, Hardware Security Practices, and Additional Information. The document does not specify traditional procurement elements such as quantities, response dates, due dates, site visits, or bidder conferences, but rather functions as an evaluation rubric for determining vendor eligibility based on security capabilities and certifications.
The questionnaire requires vendors to provide responses across multiple security dimensions, including software development lifecycle practices, vulnerability management procedures, authentication and authorization mechanisms, encryption standards, data retention policies, incident response capabilities, and compliance certifications such as ISO 27001, SOC 2, NIST, and PCI DSS. For hardware vendors, the assessment includes supply chain security, bill of materials documentation, supplier vetting, tamper-evident shipping, secure manufacturing practices, background checks for personnel, firmware update mechanisms, and third-party security audits. Each response section maps to NIST Cybersecurity Framework 2.0 (NIST CSF 2.0) and Cybersecurity Maturity Model Certification (C2M2) standards, with associated risks documented for non-compliance. The questionnaire includes signature requirements acknowledging the accuracy of vendor responses and serves as the basis for security clearance in the vendor selection process rather than a traditional contract vehicle with pricing, terms, or award schedules.
View the file
Other files
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
IT Security Questionnaire
| Application Name: |
| Application Developer / Reseller |
| Aplication version |
| Area | Response Yes/ No /Partial | Partial - Please Explain |
| 1. Application Security Practices |
| 1.1 Development Lifecycle |
| Does the third party follow a secure software development lifecycle (SDLC)? |
| Are security requirements incorporated during the design phase of the SDLC? |
| Are security reviews conducted at each phase of the development process? |
| Is static and dynamic application security testing (SAST/DAST) performed during development? |
| Does the application undergo regular security code reviews? |
| 1.2 Vulnerability Management |
| Does the third party have a vulnerability management program in place? |
| How frequently are security patches and updates applied to the application? |
| What is the process for addressing security vulnerabilities reported by third parties, users, or automated tools? |
| How are software vulnerabilities tracked and remediated (e.g., CVE reporting, timelines)? |
| Is your product penetration tested regularly by internal or third-party professionals? |
| Do you perform cybersecurity due diligence for third-party libraries, APIs, and cloud services used in your software? |
| Are third-party dependencies tracked, evaluated for security risk, and updated regularly? |
| 1.3 Authentication and Authorization |
| Does the application support multi-factor authentication (MFA)? |
| Does the application utilize role-based access control (RBAC) to ensure least-privilege access? |
| Are credentials stored using strong cryptographic algorithms (e.g., salted hashes)? |
| Does the application support Single Sign-On (SSO)? |
| Are password policies enforced (e.g., complexity, expiration)? |
| Is access to the software environment and data governed by role-based access controls and MFA? |
2. Data Security and Privacy
| 2.1 Data Encryption |
| Is sensitive data encrypted at rest and in transit? |
| What encryption standards are used (e.g., AES-256, TLS 1.2+)? |
| Is key management performed according to industry standards (e.g., hardware security modules)? |
| 2.2 Data Retention and Disposal |
| Does the third party have a data retention policy in place? |
| How is sensitive data securely disposed of when no longer required? |
| 2.3 Third-Party Data Sharing |
| Does the application share data with any external third parties? |
| If yes, is data sharing governed by contracts or data protection agreements (e.g., GDPR, CCPA)? |
| Are sensitive data exchanges encrypted? |
3. Application Infrastructure and Hosting Security
| 3.1 Environment Security |
| Where is the application development hosted (e.g., cloud, on-premise, hybrid)? |
| Is the hosting environment hardened according to industry best practices? |
| Are servers regularly patched and updated? |
| Is the application development hosted in a segregated network or isolated from other systems? |
| 3.2 Backup and Recovery |
| Are regular backups taken of critical application data and configurations? |
| Are backups encrypted and stored in a secure location? |
| Does the application have a documented disaster recovery plan (DRP)? |
| Has the application undergone disaster recovery testing in the last 12 months? |
4. Incident Management and Monitoring
| 4.1 Security Incident Management |
| Does the third party have a formal incident response plan (IRP) in place? |
| Are security incidents regularly reported and tracked? |
| In the event of a security breach, how quickly will the third party notify affected customers? |
| Is there a documented, tested incident response plan specific to the software you deliver? |
| 4.2 Logging and Monitoring |
| Are security logs generated for critical application events (e.g., login attempts, data access)? |
| Are logs monitored and reviewed regularly for suspicious activities? |
| Are logs retained for a minimum of 90 days? |
| Are security logs protected from unauthorized access or modification? |
| Do you monitor your product and infrastructure for anomalous or unauthorized behavior? |
5. Compliance and Regulatory Requirements
| 5.1 Compliance Standards |
| Does the application meet any industry security standards or frameworks? (e.g., ISO 27001, SOC 2, NIST, PCI DSS) |
| Please list the relevant compliance certifications the application holds: |
| 5.2 Data Protection Laws |
| Is the application compliant with data protection regulations such as GDPR, CCPA, HIPAA, etc.? |
| Does the third party provide a data processing agreement (DPA) or similar legal document? |
6. Risk Assessment and Continuous Improvement
| 6.1 Risk Assessment |
| Does the third party conduct regular security risk assessments of the application? |
| Are third-party security assessments, such as penetration testing or external audits, conducted periodically? |
| When were the last third-party security assessments performed? |
| 6.2 Security Training and Awareness |
| Do employees involved in the development and operation of the application receive regular security training? |
| Are third-party developers and contractors required to undergo security awareness training? |
7. Additional Information
| Are there any known security issues, vulnerabilities, or challenges with the application? |
| Are there any additional security measures or protocols that the third party employs? |
| Do you maintain a documented information security program endorsed by executive leadership? |
| How often do you perform formal risk assessments related to your software product and delivery? |
| How often do you perform formal penetration testing to your software product? |
8. Hardware Security Practices
| 8.1 Asset Integrity & Supply Chain |
| Do you maintain a bill of materials (BOM) for all hardware components, including sub-tier suppliers? |
| Do you perform security vetting of your suppliers and subcontractors? |
| Are hardware components inspected for tampering or unauthorized modifications before shipment? |
| Do you provide a chain-of-custody record for critical hardware components? |
| 8.2 Hardware Security Features |
| Do your products support hardware-based security features (e.g., TPM, Secure Boot, UEFI protections)? |
| Are firmware and BIOS updates cryptographically signed and verified before installation? |
| Do your devices support hardware-based encryption (e.g., self-encrypting drives)? |
| 8.3 Secure Manufacturing & Physical Security |
| Are your manufacturing facilities protected by physical access controls and surveillance? |
| Do you conduct background checks on personnel with access to sensitive hardware or manufacturing processes? |
| Is tamper-evident packaging used for shipping hardware? |
| 8.4 Maintenance, Updates & End-of-Life |
| Do you provide secure firmware and hardware update mechanisms post-deployment? |
| Do you have a documented process for secure decommissioning and disposal of hardware? |
| Do you notify customers of known hardware vulnerabilities and provide mitigation guidance? |
| 8.5 Compliance & Certifications |
| Are your hardware products certified under any security standards (e.g., FIPS 140-3, Common Criteria, TAA compliance)? |
| Do you conduct third-party security audits or assessments of your hardware security practices? |
| Signature: |
| By completing this questionnaire, you acknowledge that the information provided is accurate to the best of your knowledge and will be used to assess the security posture of the third-party application. |
| Name: |
| Position: |
| Date: |
Sheet2
| Section | Question | Response Options | NIST CSF 2.0 Mapping | C2M2 Mapping | Associated Risk if Not Met |
| Asset Integrity & Supply Chain | Do you maintain a bill of materials (BOM) for all hardware components, including sub-tier suppliers? | Yes / No / Partial | ID.SC-01, ID.SC-04 | RM MIL2+ | Lack of BOM increases risk of counterfeit or malicious components entering the supply chain. |
| Asset Integrity & Supply Chain | Do you perform security vetting of your suppliers and subcontractors? | Yes / No / Partial | ID.SC-02 | RM-2a, RM-2b | Unvetted suppliers may introduce vulnerabilities or compromise product integrity. |
| Asset Integrity & Supply Chain | Are hardware components inspected for tampering or unauthorized modifications before shipment? | Yes / No / Partial | ID.SC-04 | TVM | Tampered hardware can lead to embedded malware or backdoors. |
| Asset Integrity & Supply Chain | Do you provide a chain-of-custody record for critical hardware components? | Yes / No / Partial | ID.SC-05 | RM-3a | Lack of traceability increases risk of undetected tampering during transit. |
| Hardware Security Features | Do your products support hardware-based security features (e.g., TPM, Secure Boot, UEFI protections)? | Yes / No / Partial | PR.PT-01, PR.PT-03 | CM | Absence of hardware protections weakens device integrity and trust. |
| Hardware Security Features | Are firmware and BIOS updates cryptographically signed and verified before installation? | Yes / No / Partial | PR.IP-12 | CM-2b | Unsigned updates can be exploited to install malicious firmware. |
| Hardware Security Features | Do your devices support hardware-based encryption (e.g., self-encrypting drives)? | Yes / No / Partial | PR.DS-01 | DP | Data at rest may be exposed if devices are lost or stolen. |
| Secure Manufacturing & Physical Security | Are your manufacturing facilities protected by physical access controls and surveillance? | Yes / No / Partial | PR.PH-01 to PR.PH-05 | SA | Unauthorized access to manufacturing can lead to hardware tampering. |
| Secure Manufacturing & Physical Security | Do you conduct background checks on personnel with access to sensitive hardware or manufacturing processes? | Yes / No / Partial | PR.AT-01 | WM | Insider threats may go undetected, increasing risk of sabotage. |
| Secure Manufacturing & Physical Security | Is tamper-evident packaging used for shipping hardware? | Yes / No / Partial | PR.PH-03 | RM-2a | Tampering during transit may go unnoticed, compromising device integrity. |
| Maintenance, Updates & End-of-Life | Do you provide secure firmware and hardware update mechanisms post-deployment? | Yes / No / Partial | PR.IP-12 | CM-2a | Insecure update channels can be hijacked to deliver malicious code. |
| Maintenance, Updates & End-of-Life | Do you have a documented process for secure decommissioning and disposal of hardware? | Yes / No / Partial | PR.IP-06 | DP-3a | Improper disposal may lead to data leakage or hardware reuse by adversaries. |
| Maintenance, Updates & End-of-Life | Do you notify customers of known hardware vulnerabilities and provide mitigation guidance? | Yes / No / Partial | DE.CM-08, RS.AN-01 | IR-2a | Delayed disclosure can leave customers exposed to known threats. |
| Compliance & Certifications | Are your hardware products certified under any security standards (e.g., FIPS 140-3, Common Criteria, TAA compliance)? | Yes / No / Partial | ID.GV-03 | RM | Lack of certification may indicate non-compliance with industry best practices. |
| Compliance & Certifications | Do you conduct third-party security audits or assessments of your hardware security practices? | Yes / No / Partial | ID.RA-03 | RM-3b | Absence of independent validation reduces confidence in vendor security claims. |
File details come from the government source that posted it. Updated .