Questions and Answers for RFP LB 21-2778.docx

Questions and Answers for RFP LB-21-2778

1. Can you please share DKE Interoperability document electronically? This document was not included in the PDF.

A: Please register your company on the Vendornet website: VendorNet Home (wi.gov), directions are in the bid document (Section 1.9). A copy of this form is attached to the bid document, plus you will receive an email notification for any bid updates.

2. Is insurance certificate due at time of submission or at time of contract award?

A: Contract Award

3. Can you provide more specificity on needs for Award Lot 3 Crowdsourcing Research Tool? Could you provide a scenario for this requirement?

A: We expect to use the tool for microtask assignments, research and innovation. These are examples only and vendors do not have to respond to these scenarios as a part of their RFP response. A researcher may be interested in getting perspectives from a variety of unknown people by sharing a link to the research. Qualifying questions may be asked, then specific research questions could follow if the person is a fit. Another example is there could be a problem to solve at one of our campuses. The tool could be used to collect ideas on the ways to solve the problem and allow participants to rank the ideas or add sub ideas. Another example is there may be a project at a campus to gather and share interesting stories about buildings on campus where sensors ask the person to participate in the stories as they are in close proximity to the campus building.

4. Will there be 13 or 14 separate survey accounts needed? Is the UW System Administration including UW Shared Services and UW Extended Campus considered a separate account?

A: UW System Administration, UW Shared Services and UW Extended Campus will be considered one account.

5. Page 18: 5.5 Question Functionality references “question validity.” Include information on the functionality related to the questions such as question content (rich text editor, embedded files, etc), question scale, question logic (skip, randomization, variables, piped text, etc.), question banks, question blocks, question validation, pagination, end of survey messages and links. Questions:

6. Is the expectation that there will be existing question banks available in the Student Course Evaluation Survey Tool?

A: The ability to create, manage and use question banks is expected.

7. Please describe what is meant by “question validation.”

A: The ability to validate the responses or require a certain set of responses. For example, if the question asks to select 3 from the list, then enforce that the participant selects 3. In an open text field that asks for email address, enforce that the components of an email address are present in the field.

8. Page 18/19: 5.7 Audits: Describe how data audits and open records requests are supported. Question: Please define or provide examples of what is meant by “data audits” and “open records requests?”

A: Open Records Requests Open records are documents in the possession of a governmental entity that are supposed to be made available to members of the public on request. Each of the fifty states has its own set of laws governing which documents are considered public.

A record is any material on which written, drawn, printed, spoken, visual or electromagnetic information is recorded or preserved, regardless of physical form or characteristics, which has been created or is being kept by an authority in connection with official purpose or function of the agency. A record includes handwritten, typed or printed documents; maps and charts; photographs, films and tape recordings; computer tapes and printouts, CDs and optical discs; and electronic records and communications.

Here is a link to Wisconsin’s Open Records Statute, which we expect the vendor must comply with, if an open records request in made to the UW, and that would necessitate in turn, the UW obtain data or information from the vendor, as it relates to the open records request.

https://docs.legis.wisconsin.gov/statutes/statutes/19/II/35 Data Audits A systematic and independent examination to determine whether activities involving the processing of data are carried out in accordance with an organization's and/or the UW’s data protection policies and procedures.

A UW data audit would typically involve 5 steps, listed below.

Defining the UW’s objective, conducting research to better understand the data source, preparation of data for analysis, the actual analysis process, and finally, generating a report on results. The UW would expect that the vendor would comply with our requests for assistance in performing the data audit.

Examples:

The following is a representative (but not exclusive) list of the types of data that may potentially be requested in a data audit:

1. User IDs

1. Date and time of log on and log off, and other key events

1. Successful and failed attempts to access systems, data or applications

1. Files and networks accessed

1. Changes to system configurations

1. Use of system utilities

1. Exceptions and other security-related events, such as alarms triggered

1. Activation of protection systems, such as intrusion detection systems and antimalware

9. Page 19: 5.10 Data Analysis and Analytics: Describe how your solution supports conjoint analysis, such as through the randomization of thousands of possible conditions for a survey experiment. Identify other functions your solution provides such as MaxDiff, TURF, and pricing analysis. Briefly describe user-friendly reports that convey the results of these functions. Question: Is the expectation that the Student Course Evaluation Tool provide these statistical analysis functions?

A: It is expected that the Student Course Evaluation Tool provides some user-friendly reports that are related to the student course evaluation function. Describe the reports appropriate for the student course evaluation functionality in this section.

10. Attachment B: Service Level Agreement. 3. Data Breaches. Vendor shall provide credit monitoring for any student(s) who’s personal data is compromised. Question: Is student email address considered personal data?

A: Student email address is not considered personal data, as it is published to the UW’s publicly accessible whitepages electronic directories. In UW terminology, student email address, on its own, is considered Low Risk data, as defined below.

See UW policies for more information on data classification, here:

https://www.wisconsin.edu/uw-policies/uw-system-administrative-policies/information-security-data-classification-and-protection/

However, it should be noted that email address is classified as FERPA protected information, which could potentially result in associated requests to remove email addresses, along with other FERPA covered data elements from publicly accessible resources, and from sharing with third parties as well. More can be found of FERPA specifics here:

https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html

11. Pg. 49, Attachment A, Section 8.8: Checklist question asks, “Have you provided an insurance certificate?” RFP page 32, Section 8.8 states the Contractor awarded a lot of the Survey Tool award is required to submit a Certificate of Insurance that includes the following components:

The University of Wisconsin System listed on the Certificate of Insurance.

The Contract Number (LB-21-2778) listed on the Certificate of Insurance.

Certificate of Insurance must be current and on file with the University Of Wisconsin System Administration Office Of Procurement at all times during the life of the contract agreement.

Any Certificate of Insurance received missing the above-named components will place the contract in breach and subject for termination.

Since these components are for the awarded contractor, please clarify whether you are requiring the above named components now or the inclusion of a general Certificate of Insurance containing RFP Section 8.7 requirements and not 8.8.

A: Please refer to question #2, upon award from the contacted vendor.

12. Pg. 50, Attachment A, Section 10: Checklist question asks, “Have you completed and provided all the required forms?” with Attachment B – Service Level Agreement listed among the forms. Please clarify whether you are seeking a response to the three items described Attachment B. If so, please also provide the reporting elements required as we do not see a list of these elements in “section 3, Terms and Conditions of the Contract.”

A: Please refer to Section 8 of the bid document not Section 3.

13. Pg. 52, Attachment D: System Interoperability and additional System Information Requirements. The icon is embedded in the RFP document; however, they appear to be images rather than active documents that can be opened. Question: Will you provide a copy of Attachment D or a link to the document?

A: Please refer to question #1 above.

14. In Objectives 1.2 it’s stated vendors may choose to respond to one, two, or all three awards. However in scoring the following breakdown is given:

Evaluation Criteria Each lot contained in each proposal will be scored separately using the following criteria:

Mandatory Requirements (Section 4) Pass / Fail General Requirements Elements Constituting the Company Profile, Technical, and HECVAT responses (Section 5) 35% Evaluation Scenario’s Award Lots (Section 6) Lot#1 Enterprise Survey Tool 15% Lot#2 Student Course Evaluation Survey Tool 10% Lot#3 Crowdsourcing Research Tool 10% Section Sub Total 35% Cost 30% Total 100%

The Evaluation Criteria makes it seem that if a company chooses not to submit for a specific lot they will receive a 0% for that lot affecting their overall ranking scoring. Could you provide some clarity into how the proposal will be evaluated if a vendor only submits to one/two/ or three lots?

A: Each lot will be scored separately. The specific lot score will be added to the General and Technical score and the Cost Score. There will not be a zero score used for any lot not being proposed.

15. Is the intention of the RFP that the system will be moving enterprise wide (with separate accounts) with the selected vendor or vendors(s), procuring at the same time for all UW institutions?

A: Yes

16. Can you define “crowdsourcing research tool,” in the context of how UW would like to utilize this offering?

A: See response to question 3

17. Has UW received survey vendor demonstrations in the last 3 months to 1 year?

A: It is unknown if anyone at UW has received survey vendor demonstrations in the last 3 months to 1 year.

18. Will each institution implement a solution at the same time or will there be a tiered rollout with cohorts?

A: It depends on the solution and the institution deployment plans

19. Regarding question 5.9 Data integration question 5, which LTI standard is preferred?

A: Please refer to question #1

22. Could you share more about the requirements for the crowdsourcing research tool?

See the response to question 3 image1.emf

HECVATFull211 (2).xlsx Introduction

Proceed to the next tab, Instructions.

Shared Assessments Introduction

Campus IT environments are rapidly changing and the speed of cloud service adoption is increasing. Institutions looking for ways to do more with less see cloud services as a good way to save resources. As campuses deploy or identify cloud services, they must ensure the cloud services are appropriately assessed for managing the risks to the confidentiality, integrity and availability of sensitive institutional information and the PII of constituents. Many campuses have established a cloud security assessment methodology and resources to review cloud services for privacy and security controls. Other campuses don’t have sufficient resources to assess their cloud services in this manner. On the vendor side, many cloud services providers spend significant time responding to the individualized security assessment requests made by campus customers, often answering similar questions repeatedly. Both the provider and consumer of cloud services are wasting precious time creating, responding, and reviewing such assessments.

The Higher Education Community Vendor Assessment Toolkit (HECVAT) attempts to generalize higher education information security and data protections and issues for consistency and ease of use. Some institutions may have specific issues that must be addressed in addition to the general questions sets provided in the toolkit. It is anticipated that the HECVAT will be revised over time to account for changes in services provisioning and the information security and data protection needs of higher education institutions.

The Higher Education Community Vendor Assessment Toolkit:

● Helps higher education institutions ensure that vendor services are appropriately assessed for security and privacy needs, including some that are unique to higher education

● Allows a consistent, easily-adopted methodology for campuses wishing to reduce costs through vendor services without increasing risks

● Reduces the burden that service providers face in responding to requests for security assessments from higher education institutions

The Higher Education Community Vendor Assessment Toolkit is a suite of tools built around the original HECVAT (known now as HECVAT - Full) to allow institutions to adopt, implement, and maintain a consistent risk/security assessment program. Tools include:

● HECVAT - Triage: Used to initiate risk/security assessment requests - review to determine assessment requirements

● HECVAT - Full: Robust questionnaire used to assess the most critical data sharing engagements

● HECVAT - Lite: A lightweight questionnaire used to expedite process

● HECVAT - On-Premise: Unique questionnaire used to evaluate on-premise appliances and software

The HECVAT (and Toolkit) was created by the Higher Education Information Security Council Shared Assessments Working Group. Its purpose is to provide a starting point for the assessment of vendor provided services and resources. Over time, the Shared Assessments Working Group hopes to create a framework that will establish a community resource where institutions and cloud services providers will share completed Higher Education Cloud Vendor Assessment Tool assessments.

https://www.educause.edu/hecvat https://www.ren-isac.net/hecvat

(C) EDUCAUSE 2019

This work is licensed under a Creative Commons Attribution-Noncommercial-ShareAlike 4.0 International License (CC BY-NC-SA 4.0).

This Higher Education Cloud Vendor Assessment Toolkit is brought to you by the Higher Education Information Security Council, and members from EDUCAUSE, Internet2, and the Research and Education Networking Information Sharing and Analysis Center (REN-ISAC).

Instructions

Higher Education Community Vendor Assessment Tool - Full - Instructions

Target Audience

These instructions are for vendors interested in providing the institution with a software and/or a service.

This worksheet should not be completed by an institution entity. The purpose of this worksheet is for the vendor to submit robust security safeguard information in regards to the product (software/service) being assessed in the institution's assessment process.

Document Layout

There are five main sections of the Higher Education Community Vendor Assessment Tool - Full, all listed below and outlined in more detail. This document is designed to have the first two sections populated first; after the Qualifiers section is completed it can be populated in any order. Within each section, answer each question top-to-bottom. Some questions are nested and may be blocked out via formatting based on previous answers. Populating this document in the correct order improves efficiency.

Do not overwrite selection values (data validation) in column C of the HECVAT - Full tab.

General Information This section is self-explanatory; product specifics and contact information. GNRL-01 through GNRL-10 should be populated by the Vendor. GNRL-11 and GNRL-12 are for institution use only.

Qualifiers Populate this section completely before continuing. Answers in this section can determine which sections will be required for this assessment. By answering "No" to Qualifiers, their matched sections become optional and are highlighted in orange.

Documentation Focused on external documentation, the institution is interested in the frameworks that guide your security strategy and what has been done to certify these implementations.

Company Overview This section is focused on company background, size, and business area experience.

Safeguards The remainder of the document consists of various safeguards, grouped generally by section.

In sections where vendor input is required there are only one or two columns that need modification, Vendor Answers and Additional Information, columns C and D respectively (see Figure 1 below). You will see that sometimes C and D are separate and other times are merged. If they are separate, C will be a selectable, drop-down box and any supporting information should be added to column D. If C and D are merged, the question is looking for the answer to be in narrative form. At the far right is a column titled “Guidance”. After answering questions, check this column to ensure you have submitted information/documentation to sufficiently answer the question. Use the “Additional Information” column to provide any requested details.

Figure 1:

Optional Safeguards Based on Qualifiers

Not all questions are relevant to all vendors. Qualifiers are used to make whole sections optional to vendors depending on the scope of product usage and the data involved in the engagement being assessed. Sections that become optional have the section titles and questions highlighted in orange (see Figure 2).

Figure 2:

Definitions and Data Zones

Institution Any school, college, or university using the Higher Education Community Vendor Assessment Tool - Full.

Institution Data Zone The country/region in which an institution is located, including all laws and regulations in-scope within that country/region.

Vendor Data Zone The country/region in which a vendor is headquartered and/or serves its products/services, including all laws and regulations in-scope within that country/region.

Customers from different regions may expect vary protections of data (e.g. GDPR), this is the institution Data Zone. Vendors may handle data differently depending on the country or region where data is stored, this is the Vendor Data Zone.

As a vendor, if your security practices vary based on your region of operation, you may want to populate a HECVAT in the context for each security zone (strategy). That said, institutions from different data zones may still use vendor responses from other state Data Zones. If your security practices are the same across all regions of operations, indicate "All" in your Vendor Data Zone.

Example A: If vendor ABC is headquartered and stores data in Canada, and provides services to only customers in Canada, ABC should state "Canada" in both Data Zone fields.

Example B: If vendor ABC is headquartered and stores data in Canada, and additionally provides services to customers in the United Kingdom, ABC may want to assure customers in the United Kingdom that their data is handled properly for their region. In that case, ABC should state "Canada" in the Vendor Data Zone and "United Kingdom" in the institution Data Zone.

Example C: If your security strategy is broad and doesn't fit this statement model, provide a brief summary in each field and the institution's Security Analyst can assess your response.

Data Reporting

To update data in the Report tabs, click Refresh All in the Menu tab. Input provided in the HECVAT tab is assessed a preliminary score pending institution's Security Analyst review.

Proceed to the next tab, HECVAT - Full.

For Institution's Security Analysts

1. Raw vendor answers can be viewed on the HECVAT - Full tab.

2. To begin your assessment, review the Analyst Report tab, ensuring that you select the appropriate security standard used in your institution (cell B7) before you begin.

3. Review the Analyst Reference tab for guidance and question/response interpretation.

4. Select compliance states for the outstanding non-compliant or short-answer questions in column G. Once all subjective questions are evaluated and compliance indicated, move to the Summary Report tab.

5. To update the report's data, select Refresh All in the Data menu. Review details in the Summary Report and based on your assessment, follow-up with vendor for clarification(s) or add the Summary Report output to your Institution's reporting documents.

HECVAT - Full

Higher Education Community Vendor Assessment Tool (HECVAT) - Full Version 2.11

HEISC Shared Assessments Working Group

DATE-01 Date mm/dd/yyyy

General Information

In order to protect the Institution and its systems, vendors whose products and/or services will access and/or host institutional data must complete the Higher Education Community Vendor Assessment Toolkit (HECVAT). Throughout this tool, anywhere where the term data is used, this is an all-encompassing term including at least data and metadata. Answers will be reviewed by Institution security analysts upon submittal. This process will assist the institution in preventing breaches of protected information and comply with Institution policy, state, and federal law. This is intended for use by vendors participating in a Third Party Security Assessment and should be completed by a vendor. Review the Instructions tab for further guidance.

GNRL-01 through GNRL-08; populated by the Vendor

GNRL-01 Vendor Name Vendor Name

GNRL-02 Product Name Product Name and Version Information

GNRL-03 Product Description Brief Description of the Product

GNRL-04 Web Link to Product Privacy Notice http://www.vendor.domain/privacynotice

GNRL-05 Vendor Contact Name Vendor Contact Name

GNRL-06 Vendor Contact Title Vendor Contact Title

GNRL-07 Vendor Contact Email Vendor Contact E-mail Address

GNRL-08 Vendor Contact Phone Number 555-555-5555

GNRL-09 Vendor Data Zone See Instructions tab for guidance

GNRL-10 Institution Data Zone See Instructions tab for guidance

GNRL-11 and GNRL-12; populated by the Institution's Security Office

GNRL-11 Institution's Security Analyst/Engineer Institution's Security Analyst/Engineer Name

GNRL-12 Assessment Contact ticket#@yourdomain.edu

Instructions

Step 1: Complete the Qualifiers section first. Step 2: Complete each section answering each set of questions in order from top to bottom; the built-in formatting logic relies on this order. Step 3: Submit the completed Higher Education Community Vendor Assessment Toolkit (HECVAT) to the Institution according to institutional procedures.

Qualifiers Vendor Answers Additional Information Guidance

The institution conducts Third Party Security Assessments on a variety of third parties. As such, not all assessment questions are relevant to each party. To alleviate complexity, a "qualifier" strategy is implemented and allows for various parties to utilize this common documentation instrument. Responses to the following questions will determine the need to answer additional questions below.

QUAL-01 Does your product process protected health information (PHI) or any data covered by the Health Insurance Portability and Accountability Act?

QUAL-02 Does the vended product host/support a mobile application? (e.g. app)

QUAL-03 Will institution data be shared with or hosted by any third parties? (e.g. any entity not wholly-owned by your company is considered a third-party)

Charles Escue: The Institution views hosted solutions such as AWS, Rackspace, Azure, and other PaaS/SaaS offerings as third parties. If services such as these are used in your environment, respond "Yes".

QUAL-04 Do you have a Business Continuity Plan (BCP)?

QUAL-05 Do you have a Disaster Recovery Plan (DRP)?

QUAL-06 Will data regulated by PCI DSS reside in the vended product?

QUAL-07 Is your company a consulting firm providing only consultation to the Institution?

Documentation Vendor Answers Additional Information Guidance

DOCU-01 Have you undergone a SSAE 18 audit?

: In 2011, Statement on Standards for Attestation Engagements (SSAE) No. 16 took effect and replaced SAS 70 as the authoritative guidance for performing a service auditor's examination. SSAE 16 established a new attestation standard (AT 801) to contain the professional guidance.

You can learn more about SSAE 16 at www.ssae16.com.

DOCU-02 Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ?

: CSA STAR Self Assessment is free and open to all cloud providers and allows them to submit self assessment reports that document compliance to CSA-published best practices.

Website: https://cloudsecurityalliance.org/star/self-assessment/

DOCU-03 Have you received the Cloud Security Alliance STAR certification?

: The CSA STAR Certification is a rigorous third party independent assessment of the security of a cloud service provider. The technology-neutral certification leverages the requirements of the ISO/IEC 27001 management system standard together with the CSA Cloud Controls Matrix, a specified set of criteria that measures the capability levels of the cloud service.

Website: https://cloudsecurityalliance.org/star/certification/

DOCU-04 Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO 27001, etc.)

DOCU-05 Are you compliant with FISMA standards?

: The Federal Information Security Management Act (FISMA) is United States legislation that defines a comprehensive framework to protect government information, operations and assets against natural or man-made threats.

Website: http://www.dhs.gov/FISMA slight wording change -Josh Callahan

Charles Escue: The Institution views hosted solutions such as AWS, Rackspace, Azure, and other PaaS/SaaS offerings as third parties. If services such as these are used in your environment, respond "Yes".

DOCU-06 Does your organization have a data privacy policy?

Company Overview Vendor Answers Additional Information Guidance

COMP-01 Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships. Include circumstances that may involve off-shoring or multi-national agreements.

COMP-02 Describe how long your organization has conducted business in this product area. Include the number of years and in what capacity.

COMP-03 Do you have existing higher education customers?

COMP-04 Have you had a significant breach in the last 5 years?

COMP-05 Do you have a dedicated Information Security staff or office?

COMP-06 Do you have a dedicated Software and System Development team(s)? (e.g. Customer Support, Implementation, Product Management, etc.)

COMP-07 Use this area to share information about your environment that will assist those who are assessing your company data security program. Share any details that would help information security analysts assess your product.

Third Parties Vendor Answers Additional Information Guidance

THRD-01 Describe how you perform security assessments of third party companies with which you share data (i.e. hosting providers, cloud services, PaaS, IaaS, SaaS, etc.). Provide a summary of your practices that assures that the third party will be subject to the appropriate standards regarding security, service recoverability, and confidentiality. Ensure that all elements of THRD-01 are clearly stated in your response.

THRD-02 Provide a brief description for why each of these third parties will have access to institution data. If more space is needed to sufficiently answer this question, provide reference to the document or add it as an appendix.

THRD-03 What legal agreements (i.e. contracts) do you have in place with these third parties that address liability in the event of a data breach? Provide sufficient detail for each legal agreement in place.

THRD-04 Describe or provide references to your third party management strategy or provide additional information that may help analysts better understand your environment and how it relates to third-party solutions. Robust answers from the vendor improve the quality and efficiency of the security assessment process.

Consulting Vendor Answers Additional Information Guidance

CONS-01 Will the consulting take place on-premises?

CONS-02 Will the consultant require access to Institution's network resources?

CONS-03 Will the consultant require access to hardware in the Institution's data centers?

CONS-04 Will the consultant require an account within the Institution's domain (@*.edu)?

CONS-05 Has the consultant received training on [sensitive, HIPAA, PCI, etc.] data handling?

CONS-06 Will any data be transferred to the consultant's possession?

CONS-07 Is it encrypted (at rest) while in the consultant's possession?

CONS-08 Will the consultant need remote access to the Institution's network or systems?

CONS-09 Can we restrict that access based on source IP address?

Application/Service Security Vendor Answers Additional Information Guidance

APPL-01 Do you support role-based access control (RBAC) for end-users?

APPL-02 Do you support role-based access control (RBAC) for system administrators?

APPL-03 Can employees access customer data remotely?

APPL-04 Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system?

APPL-05 Does the system provide data input validation and error messages?

APPL-06 Do you employ a single-tenant environment?

APPL-07 What operating system(s) is/are leveraged by the system(s)/application(s) that will have access to institution's data? List all operating systems and the roles that are fulfilled by each.

APPL-08 Have you or any third party you contract with that may have access or allow access to the institution's data experienced a breach?

APPL-09 Describe or provide a reference to additional software/products necessary to implement a functional system on either the backend or user-interface side of the system. Describe the products and how they will be implemented.

APPL-10 Describe or provide a reference to the overall system and/or application architecture(s), including appropriate diagrams. Include a full description of the data communications architecture for all components of the system. Ensure that all parts of APPL-10 are clearly stated in your response. Submit architecture diagrams along with this fully-populated HECVAT.

APPL-11 Are databases used in the system segregated from front-end systems? (e.g. web and application servers)

APPL-12 Describe or provide a reference to all web-enabled features and functionality of the system (i.e. accessed via a web-based interface). Include both end-user and administrative features and functions.

APPL-13 Are there any OS and/or web-browser combinations that are not currently supported?

APPL-14 Can your system take advantage of mobile and/or GPS enabled mobile devices?

APPL-15 Describe or provide a reference to the facilities available in the system to provide separation of duties between security administration and system administration functions. Include a detailed description of how security administration and system administration authority is separated, controls are verified, and logs are reviewed regularly to ensure appropriate use.

APPL-16 Describe or provide a reference that details how administrator access is handled (e.g. provisioning, principle of least privilege, deprovisioning, etc.) Ensure that all parts of APPL-16 are clearly stated in your response.

APPL-17 Describe or provide references explaining how tertiary services are redundant (i.e. DNS, ISP, etc.). Ensure that all parts of APPL-18 are clearly stated in your response. The examples given are not exhaustive - elaborate as necessary.

Authentication, Authorization, and Accounting Vendor Answers Additional Information Guidance

AAAI-01 Can you enforce password/passphrase aging requirements?

AAAI-02 Can you enforce password/passphrase complexity requirements [provided by the institution]?

AAAI-03 Does the system have password complexity or length limitations and/or restrictions?

AAAI-04 Do you have documented password/passphrase reset procedures that are currently implemented in the system and/or customer support?

AAAI-05 Does your web-based interface support authentication, including standards-based single-sign-on? (e.g. InCommon)

AAAI-06 Are there any passwords/passphrases hard coded into your systems or products?

AAAI-07 Are user account passwords/passphrases visible in administration modules?

AAAI-08 Are user account passwords/passphrases stored encrypted?

AAAI-09 Does your application and/or user-frontend/portal support multi-factor authentication? (e.g. Duo, Google Authenticator, OTP, etc.)

AAAI-10 Does your application support integration with other authentication and authorization systems? List which ones (such as Active Directory, Kerberos and what version) in Additional Info?

AAAI-11 Will any external authentication or authorization system be utilized by an application with access to the institution's data?

AAAI-12 Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication?

AAAI-13 Does the system operate in a mixed authentication mode (i.e. external and local authentication)?

AAAI-14 Will any external authentication or authorization system be utilized by a system with access to institution data?

AAAI-15 Are audit logs available that include AT LEAST all of the following; login, logout, actions performed, and source IP address?

AAAI-16 Describe or provide a reference to the a) system capability to log security/authorization changes as well as user and administrator security events (i.e. physical or electronic)(e.g. login failures, access denied, changes accepted), and b) all requirements necessary to implement logging and monitoring on the system. Include c) information about SIEM/log collector usage. Ensure that all elements of AAAI-16 are clearly stated in your response.

AAAI-17 Describe or provide a reference to the retention period for those logs, how logs are protected, and whether they are accessible to the customer (and if so, how). Ensure that all elements of AAAI-17 are clearly stated in your response.

Business Continuity Plan Vendor Answers Additional Information Guidance

BCPL-01 Describe or provide a reference to your Business Continuity Plan (BCP). Provide a valid URL to your current BCP or submit it along with this fully-populated HECVAT.

BCPL-02 May the Institution review your BCP and supporting documentation?

BCPL-03 Is an owner assigned who is responsible for the maintenance and review of the Business Continuity Plan?

BCPL-04 Is there a defined problem/issue escalation plan in your BCP for impacted clients?

BCPL-05 Is there a documented communication plan in your BCP for impacted clients?

BCPL-06 Are all components of the BCP reviewed at least annually and updated as needed to reflect change?

BCPL-07 Has your BCP been tested in the last year?

BCPL-08 Does your organization conduct training and awareness activities to validate its employees understanding of their roles and responsibilities during a crisis?

BCPL-09 Are specific crisis management roles and responsibilities defined and documented?

BCPL-10 Does your organization have an alternative business site or a contracted Business Recovery provider?

BCPL-11 Does your organization conduct an annual test of relocating to an alternate site for business recovery purposes?

BCPL-12 Is this product a core service of your organization, and as such, the top priority during business continuity planning?

Change Management Vendor Answers Additional Information Guidance

CHNG-01 Do you have a documented and currently followed change management process (CMP)?

CHNG-02 Indicate all procedures that are implemented in your CMP. a.) An impact analysis of the upgrade is performed. b.) The change is appropriately authorized. c.) Changes are made first in a test environment. d.) The ability to implement the upgrades/changes in the production environment is limited to appropriate IT personnel. Ensure that all parts of CHNG-02 are clearly stated in your response.

CHNG-03 Will the Institution be notified of major changes to your environment that could impact the Institution's security posture?

CHNG-04 Do clients have the option to not participate in or postpone an upgrade to a new release?

CHNG-05 Describe or provide a reference to your solution support strategy in relation to maintaining software currency. (i.e. how many concurrent versions are you willing to run and support?) Ensure that all relevant details pertaining to CHNG-05 are clearly stated in your response.

CHNG-06 Identify the most current version of the software. Detail the percentage of live customers that are utilizing the proposed version of the software as well as each version of the software currently in use. Ensure that all parts of CHNG-06 are clearly stated in your response.

CHNG-07 Does the system support client customizations from one release to another?

CHNG-08 Does your organization ensure through policy and procedure (that is currently implemented) that only application software verifiable as authorized, tested, and approved for production, and having met all other requirements and reviews necessary for commissioning, is placed into production?

CHNG-09 Do you have a release schedule for product updates?

CHNG-10 Do you have a technology roadmap, for the next 2 years, for enhancements and bug fixes for the product/service being assessed?

CHNG-11 Is Institution involvement (i.e. technically or organizationally) required during product updates?

CHNG-12 Do you have policy and procedure, currently implemented, managing how critical patches are applied to all systems and applications?

CHNG-13 Do you have policy and procedure, currently implemented, guiding how security risks are mitigated until patches can be applied?

CHNG-14 Are upgrades or system changes installed during off-peak hours or in a manner that does not impact the customer?

CHNG-15 Do procedures exist to provide that emergency changes are documented and authorized (including after the fact approval)?

Data Vendor Answers Additional Information Guidance

DATA-01 Do you physically and logically separate Institution's data from that of other customers?

DATA-02 Will Institution's data be stored on any devices (database servers, file servers, SAN, NAS, …) configured with non-RFC 1918/4193 (i.e. publicly routable) IP addresses?

DATA-03 Is sensitive data encrypted in transport? (e.g. system-to-client)

DATA-04 Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)?

DATA-05 Do you employ or allow any cryptographic modules that do not conform to the Federal Information Processing Standards (FIPS PUB 140-2)?

DATA-06 Does your system employ encryption technologies when transmitting sensitive information over TCP/IP networks (e.g., SSH, SSL/TLS, VPN)? (e.g. system-to-system and system-to-client)

DATA-07 List all locations (i.e. city + datacenter name) where the institution's data will be stored? Ensure that all parts of DATA-07 are clearly stated in your response.

DATA-08 At the completion of this contract, will data be returned to the institution?

DATA-09 Will the institution's data be available within the system for a period of time at the completion of this contract?

DATA-10 Can the institution extract a full backup of data?

DATA-11 Are ownership rights to all data, inputs, outputs, and metadata retained by the institution?

DATA-12 Are these rights retained even through a provider acquisition or bankruptcy event?

DATA-13 In the event of imminent bankruptcy, closing of business, or retirement of service, will you provide 90 days for customers to get their data out of the system and migrate applications?

DATA-14 Describe or provide a reference to the backup processes for the servers on which the service and/or data resides. If your strategy uses different processes for services and data, ensure that all strategies are clearly stated and supported.

DATA-15 Are backup copies made according to pre-defined schedules and securely stored and protected?

DATA-16 How long are data backups stored? If your backup strategy uses varying periods, ensure that each strategy is clearly stated and supported.

DATA-17 Are data backups encrypted?

DATA-18 Do you have a cryptographic key management process (generation, exchange, storage, safeguards, use, vetting, and replacement), that is documented and currently implemented, for all system components? (e.g. database, system, web, etc.)

DATA-19 Do current backups include all operating system software, utilities, security software, application software, and data files necessary for recovery?

DATA-20 Are you performing off site backups? (i.e. digitally moved off site)

DATA-21 Are physical backups taken off site? (i.e. physically moved off site)

DATA-22 Do backups containing the institution's data ever leave the Institution's Data Zone either physically or via network routing?

DATA-23 Do you have a media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures?

DATA-24 Does the process described in DATA-23 adhere to DoD 5220.22-M and/or NIST SP 800-88 standards?

DATA-25 Do procedures exist to ensure that retention and destruction of data meets established business and regulatory requirements?

DATA-26 Is media used for long-term retention of business data and archival purposes stored in a secure, environmentally protected area?

DATA-27 Will you handle data in a FERPA compliant manner?

DATA-28 Is any institution data visible in system administration modules/tools?

Database Vendor Answers Additional Information Guidance

DBAS-01 Does the database support encryption of specified data elements in storage?

DBAS-02 Do you currently use encryption in your database(s)?

Datacenter Vendor Answers Additional Information Guidance

DCTR-01 Does your company own the physical data center where the Institution's data will reside?

DCTR-02 Does the hosting provider have a SOC 2 Type 2 report available?

DCTR-03 Are the data centers staffed 24 hours a day, seven days a week (i.e., 24x7x365)?

DCTR-04 Do any of your servers reside in a co-located data center?

DCTR-05 Are your servers separated from other companies via a physical barrier, such as a cage or hardened walls?

DCTR-06 Does a physical barrier fully enclose the physical space preventing unauthorized physical contact with any of your devices?

DCTR-07 Select the option that best describes the network segment that servers are connected to. Provide a general summary of the implemented networking strategy.

DCTR-08 Does this data center operate outside of the Institution's Data Zone?

DCTR-09 Will any institution data leave the Institution's Data Zone?

DCTR-10 List all datacenters and the cities, states (provinces), and countries where the Institution's data will be stored (including within the Institution's Data Zone). Ensure that all parts of DCTR-10 are clearly stated in your response.

DCTR-11 Are your primary and secondary data centers geographically diverse?

DCTR-12 If outsourced or co-located, is there a contract in place to prevent data from leaving the Institution's Data Zone?

DCTR-13 What Tier Level is your data center (per levels defined by the Uptime Institute)?

Charles Escue: https://uptimeinstitute.com/tiers Review the Uptime Institute's level/tier direction provided on their website if you need addition information to answer DCTR-13.

DCTR-14 Is the service hosted in a high availability environment?

DCTR-15 Is redundant power available for all datacenters where institution data will reside?

DCTR-16 Are redundant power strategies tested?

DCTR-17 Describe or provide a reference to the availability of cooling and fire suppression systems in all datacenters where institution data will reside. Ensure that all parts of DCTR-17 are clearly stated in your response.

DCTR-18 State how many Internet Service Providers (ISPs) provide connectivity to each datacenter where the institution's data will reside. State the ISP provider(s) in addition to the number of ISPs that provide connectivity.

DCTR-19 Does every datacenter where the Institution's data will reside have multiple telephone company or network provider entrances to the facility?

Disaster Recovery Plan Vendor Answers Additional Information Guidance

DRPL-01 Describe or provide a reference to your Disaster Recovery Plan (DRP). Provide a valid URL to your current DRP or submit it along with this fully-populated HECVAT.

DRPL-02 Is an owner assigned who is responsible for the maintenance and review of the DRP?

DRPL-03 Can the Institution review your DRP and supporting documentation?

DRPL-04 Are any disaster recovery locations outside the Institution's Data Zone?

DRPL-05 Does your organization have a disaster recovery site or a contracted Disaster Recovery provider?

DRPL-06 Does your organization conduct an annual test of relocating to this site for disaster recovery purposes?

DRPL-07 Is there a defined problem/issue escalation plan in your DRP for impacted clients?

DRPL-08 Is there a documented communication plan in your DRP for impacted clients?

DRPL-09 Describe or provide a reference to how your disaster recovery plan is tested? (i.e. scope of DR tests, end-to-end testing, etc.) Ensure that all elements of DRPL-09 are clearly stated in your response.

DRPL-10 Has the Disaster Recovery Plan been tested in the last year? Please provide a summary of the results in Additional Information (including actual recovery time).

DRPL-11 Do the documented test results identify your organizations actual recovery time capabilities for technology and facilities?

DRPL-12 Are all components of the DRP reviewed at least annually and updated as needed to reflect change?

DRPL-13 Do you carry cyber-risk insurance to protect against unforeseen service outages, data that is lost or stolen, and security incidents?

Firewalls, IDS, IPS, and Networking Vendor Answers Additional Information Guidance

FIDP-01 Are you utilizing a web application firewall (WAF)?

FIDP-02 Are you utilizing a stateful packet inspection (SPI) firewall?

FIDP-03 State and describe who has the authority to change firewall rules? Ensure that all parts of FIDP-03 are clearly stated in your response.

FIDP-04 Do you have a documented policy for firewall change requests?

FIDP-05 Have you implemented an Intrusion Detection System (network-based)?

FIDP-06 Have you implemented an Intrusion Prevention System (network-based)?

FIDP-07 Do you employ host-based intrusion detection?

FIDP-08 Do you employ host-based intrusion prevention?

FIDP-09 Are you employing any next-generation persistent threat (NGPT) monitoring?

FIDP-10 Do you monitor for intrusions on a 24x7x365 basis?

FIDP-11 Is intrusion monitoring performed internally or by a third-party service? In addition to stating your intrusion monitoring strategy, provide a brief summary of its implementation.

FIDP-12 Are audit logs available for all changes to the network, firewall, IDS, and IPS systems?

Mobile Applications Vendor Answers Additional Information Guidance

MAPP-01 On which mobile operating systems is your software or service supported? Ensure that all supported operating systems are listed - be sure to provide version number, where relevant.

MAPP-02 Describe or provide a reference to the application's architecture and functionality. Ensure that all elements of MAPP-02 are clearly stated in your response. (i.e. (architecture AND functionality are defined)

MAPP-03 Is the application available from a trusted source (e.g., iTunes App Store, Android Market, BB World)?

MAPP-04 Does the application store, process, or transmit critical data?

MAPP-05 Is Institution's data encrypted in transport?

MAPP-06 Is Institution's data encrypted in storage? (e.g. disk encryption, at-rest)

MAPP-07 Does the mobile application support Kerberos, CAS, or Active Directory authentication?

MAPP-08 Will any of these systems be implemented on systems hosting the Institution's data?

MAPP-09 Does the application adhere to secure coding practices (e.g. OWASP, etc.)?

MAPP-10 Has the application been tested for vulnerabilities by a third party?

MAPP-11 State the party that performed the vulnerability test and the date it was conducted? Ensure that all elements of MAPP-11 are clearly stated in your response.

Physical Security Vendor Answers Additional Information Guidance

PHYS-01 Does your organization have physical security controls and policies in place?

PHYS-02 Are employees allowed to take home Institution's data in any form?

PHYS-03 Are video monitoring feeds retained?

PHYS-04 Are video feeds monitored by datacenter staff?

PHYS-05 Are individuals required to sign in/out for installation and removal of equipment?

Policies, Procedures, and Processes Vendor Answers Additional Information Guidance

PPPR-01 Can you share the organization chart, mission statement, and policies for your information security unit?

PPPR-02 Do you have a documented patch management process?

PPPR-03 Can you accommodate encryption requirements using open standards?

PPPR-04 Have your developers been trained in secure coding techniques?

PPPR-05 Was your application developed using secure coding techniques?

PPPR-06 Do you subject your code to static code analysis and/or static application security testing prior to release?

PPPR-07 Do you have software testing processes (dynamic or static) that are established and followed?

PPPR-08 Are information security principles designed into the product lifecycle?

PPPR-09 Do you have a documented systems development life cycle (SDLC)?

PPPR-10 Do you have a formal incident response plan?

PPPR-11 Will you comply with applicable breach notification laws?

PPPR-12 Will you comply with the Institution's IT policies with regards to user privacy and data protection?

PPPR-13…