RFP_1100_LLM3010_ATT_9_v1.docx

V1.1 Security Posture Questionnaire

Vendor/Solution Name:

Austin Energy:

Austin Energy, a critical infrastructure company, evaluates vendors' security capabilities, including FedRAMP compliance, security practices, Hardware Security Module (HSM) support, personnel policies, data retention policies, and AI governance to ensure alignment with its regulatory and security requirements.

The requirements for how BES Cyber System Information (BCSI) and Critical Energy Infrastructure Information (CEII) should be handled in a cloud environment are not clearly defined under NERC standards, with a lack of specific guidelines available. However, Austin Energy (AE) has taken proactive measures by securing its environments and managing its private keys using its own HSMs to ensure data protection. The industry has not yet widely adopted double-key encryption. If we address these issues, we will also need to implement a method for managing a data classification scheme within the application. Below are some questions to help Austin Energy gain a clear understanding of your security posture.

Questions for Vendors

1. Solutions:

a. Do you have an on-premises server/application option for your software?

2. Compliance Certifications:

a. Does the tenant hosting database information meet the following security programs? FedRAMP, TX-RAMP ramp certification, ISO/IEC 27000, NIST 800 series, specifically NIST 800-53?

3. Government Agency Usage:

a. Do you have a commercial environment that complies with NIST 800-53 security controls for enhanced data security, particularly for government contracts or Government platforms?

b. What other federal or state agencies use your solution/software?

4. Security and Compliance:

a. How often do you have a security audit on your platform/software?

b. Confirm whether your organization currently maintains SOC 2 compliance. If so, could you please provide the type of SOC 2 report available (Type I or Type II), the trust service criteria covered, and the period the report encompasses?

c. Describe the method in which your solution exports audit log data to commercially available SIEM products. Provide any industry standard formats that are used such as CEF, XML, or JSON.

d. Is your solution compatible with customer-deployed Cloud Access Security Broker products such as Microsoft Defender for Cloud Apps?

5. Data Encryption Method:

a. What security management program or cloud service is used to secure the data?

b. AES 256 encryption at rest and AWS Key Management Service (KMS) for key generation and management. How are you encrypting that database on your tenant?

c. Is AES 256, at minimum, encryption used for data at rest?

d. If the database can be encrypted, how is access controlled through administrative and technical controls?

e. AWS KMS provides an additional layer of security. Does your solution provide similar functionality to AWK KMS?

6. Key Management:

a. All encryption keys must be managed within the native cloud hosting platform as a service offering e.g. Azure Key Vault or Amazon Web Services KMS. Are cloud-native key management services implemented by the solution being proposed?

b. Provide documentation outlining the implementation of key management in detail.

c. Does the solution proposed provide a method in which the customer can maintain their own encryption keys so that data is not accessible by the service provider and/or cloud service personnel (CSP)?

d. The proposed solution should support the ability for customer-managed encryption keys or “Bring Your Own Key”(BYOK) using an existing customer-deployed Hardware Security Module (HSM) or a customer managed key vault. Does your solution support customer managed keys?

7. Data Egress Control:

a. How do you prevent service personnel and people from printing, copying, or exporting customer data/content?

b. Are there controls in place or native features within the solution that prevent this?

8. Data Security and Control:

a. Are any systems administrators/employees that manage the solution (service provider) accessing data outside of the US?

9. Asset Administrator Role:

a. Manages access requests for items without owners or admins, controlling sharing and restoring app access. What users have access to your data, and how do you monitor the users who have access?

10. Personnel Location & Access Control:

a. Are all personnel with logical or physical access to customer data located within the continental United States (CONUS)?

b. If personnel are located outside CONUS, please specify the countries and the roles they perform.

c. Do any third‑party contractors have access to customer environments or data? If so, how are they vetted and monitored?

d. What controls are in place to restrict access based on geographic region?

11. Hiring, Screening, and Background Checks:

a. What pre‑employment screening or background check processes do you require for employees and contractors with access to customer systems or data?

b. Are background checks repeated on a recurring schedule? If so, how often?

c. How do you ensure ongoing personnel integrity (e.g., periodic reviews, continuous monitoring, role-based access audits)?

12. Training & Security Awareness:

a. What security training is required for personnel with access to customer data?

b. How often is cybersecurity awareness training refreshed?

c. Are privileged administrators required to complete enhanced training (e.g., secure operations, insider threat awareness)?

13. Support & Operations Model:

a. Does your support model operate on a “follow‑the‑sun” model? If yes, which regions participate in support coverage, and what access (if any) each region has to customer data or systems?

b. Are after-hours or on-call support services outsourced to any external provider?

c. Do support personnel have direct access to customer data, or is access mediated through a privileged access management (PAM) system?

14. Personnel Offboarding:

a. What is your process for immediately revoking access when an employee or contractor leaves the organization or changes roles?

b. How quickly are credentials, authentication tokens, and system permissions disabled upon termination or role change?

15. On-Premises Option and Record Retention:

a. What administrative controls policy do you have if you get subpoenaed?

b. Austin Energy does business as the City of Austin, and because it’s a Municipality, it enforces a record retention policy. We want to cover your record retention policy for the database at a high level, i.e., data classification, dispositioning, disposal, evidence, etc. What is your records retention policy?

16. Audit & Security Logging

a. What types of audit and security logs do you collect (e.g., access logs, authentication events, privilege changes, system activity, network traffic, API calls)?

b. Are all administrative and privileged actions logged?

c. Are customer-facing and backend system logs captured consistently across all environments (production, staging, DR)?

d. What is your standard log retention period for security-relevant events?

e. Are logs stored in a tamper-resistant or write-once environment?

f. What safeguards exist to ensure log integrity and prevent unauthorized modification or deletion?

g. Who within your organization has access to audit and security logs?

h. How is access controlled and monitored?

i. Are customers able to access logs relevant to their own environments or tenants?

j. Do you actively monitor logs for suspicious activity or security events?

k. What security information and event management (SIEM) or monitoring tools do you use?

l. What is your process for generating alerts, triaging events, and escalating potential incidents?

m. Are logs encrypted both in transit and at rest?

n. Are logs segregated by tenant or customer to prevent cross‑contamination?

o. Do you use any third‑party logging or analytics services, and if so, what data is shared with them?

p. Are your logging and monitoring practices assessed as part of your SOC 2, ISO 27001, or similar audits?

q. Can you provide evidence or documentation describing your logging controls and monitoring processes?

r. Do logs support incident investigations to meet regulatory or contractual requirements?

s. What is your process for notifying customers when logs indicate a potential security incident affecting them?

17. AI Usage & Governance Questions:

a. Do you use AI or machine learning technologies in the delivery or operation of your services?

b. Do you leverage third-party AI services through APIs (e.g., for analytics, anomaly detection, automation)? If so, please list the AI service providers and describe the type of data exchanged with those services.

c. Are any AI models embedded into your platform provided by external vendors or hosted externally?

d. Is any customer data, metadata, or telemetry used to train internal or external AI/ML models?

e. If customer data is used for training or fine‑tuning, what mechanisms ensure anonymization, minimization, and data segregation?

f. Do external AI vendors receive or process customer data in any way?

g. Can you certify that customer data is not used for model training unless explicitly permitted by contract?

h. What controls are in place to ensure AI systems only access the minimum required customer data?

i. How do you manage authentication and authorization for AI systems or automated agents?

j. Do any AI-assisted tools (e.g., automated support bots, internal productivity tools) have the ability to view or interact with customer data?

k. How do you monitor AI system outputs for leakage of sensitive information?

l. What governance framework do you use to manage AI model lifecycle (development, deployment, and retirement)?

m. How do you evaluate AI models for accuracy, bias, reliability, and security vulnerabilities?

n. Are model updates reviewed through a formal change management process?

o. What safeguards exist to prevent unintended decisions or automated actions from affecting customer environments?

p. Can you provide documentation describing where and how AI is used within your services?

q. Do you offer transparency reports on AI data flows, training inputs, and third-party model integrations?

r. Are customers given configuration options to disable AI-driven features, automated insights, or data sharing with AI systems?

s. How do your AI practices align with SOC 2 requirements and other relevant standards (e.g., ISO 27001, NIST AI RMF)?

t. Are your AI-related data handling practices included in your latest SOC 2 or independent audit reports?

u. Does your contract explicitly define how customer data may or may not be used in relation to AI?

image1.png