RFP 170-4437-25 Attachment J OST Security Questionnaire_DRAFT.docx
DOCX document 58 KB Posted
- Solicitation number
- S-17000-00015408
- Issued by
- Marion County, Oregon
About this file
This is a Security Questionnaire document issued by the Oregon State Treasury (OST) as part of Request for Proposal 170-4437-25 for Oregon Retirement Savings Marketing Services. The questionnaire serves as an assessment tool to evaluate vendors' cybersecurity posture and compliance with baseline security requirements before contract execution. Rather than a comprehensive cybersecurity evaluation, the document provides OST with an understanding of how prospective vendors address cybersecurity risks using frameworks based on the Cloud Security Alliance Consensus Assessments Initiative Questionnaire, ISO/NIST standards, and the American Institute of CPAs System and Organization Controls guidelines.
The questionnaire comprises three main sections addressing vendor security practices, application security requirements, and system security controls for equipment intended to be located on OST's network. Section 1 contains 27 questions covering organizational security governance, risk assessment, employee training, access management, incident response, and disaster recovery. Section 2 addresses application-specific security controls across access management, data security, application development practices, infrastructure protection, activity monitoring, business continuity, and audit compliance. Section 3 focuses on host security requirements for systems deployed on OST infrastructure, including anti-malware protection and patch management timelines. Vendors must complete all applicable sections and provide detailed responses to demonstrate their security capabilities, particularly regarding data protection, encryption standards, vulnerability management, and compliance with industry standards. The completed questionnaire will be incorporated into the final contract agreement between OST and the selected vendor.
View the file
Other files
Show all 17
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Oregon State Treasury Security Questionnaire
VENDOR NAME RESPONDANT’S NAME TITLE
Date
Name (Officer of the Company)
Signature (Officer of the Company)
Oregon State Treasury (OST) is committed to protecting our customer’s and business partner’s confidential information. As part of this commitment, OST reviews all vendors and vendor applications to make sure they meet baseline security requirements. The OST security questionnaire (OSTSQ) is not comprehensive evaluation of cybersecurity controls but provides the evaluators with a “sense” of how the organization views and addresses cybersecurity risks. The OSTSQ is based on the Cloud Security Alliance (CSA) Consensus Assessments Initiative Questionnaire (CAIQ), ISO/NIST frameworks and the American Institute of CPAs (AICPA)’ System and Organization Controls (SOC). Please fill out this form and return it to OST. This document will be included as part of the contract between OST and the vendor.
Section 1: Vendor Security Questions
| QUESTIONS |
| YES |
| NO |
| COMMENTS |
| 1. Has your organization formally appointed a central point of contact for security coordination? |
| |_| |
| |_| |
| To whom? |
2. Does your organization have a documented Information Security Management Program (ISMP)?
CAIQ GRM-04.1-2
| |_| |
| |_| |
| How often is it reviewed? |
3. Does your organization have documented information security policies and procedures aligned with industry standards (ISO-27001, NIST, CoBIT?
CAIQ GRM-06.1, 09.2; SOC2 CC3.2, CC1.2, CC2.3
| |_| |
| |_| |
| Which one? |
| a. Do you have an information classification policy and procedures? |
| |_| |
| |_| |
| b. Do you have an acceptable use policy? |
| |_| |
| |_| |
| c. Do you have a process in place to regularly update your information security policies? |
| |_| |
| |_| |
4. Does your organization have a risk assessment process in place to identify potential security risks and a process to apply mitigation strategies to address the identified risks?
CAIQ GRM-02.2, 11.1; SOC CC3.1
| |_| |
| |_| |
5. Does your organization have a process in place to identify new laws and regulations with IT security implications?
CAIQ AAC3.4; SOC2 CC3.1
| |_| |
| |_| |
| 6. Does your organization work with third parties, such as IT service providers that have access to your information or systems? |
| |_| |
| |_| |
| a. Does your organization have a non-disclosure agreement with these third parties? |
| |_| |
| |_| |
| b. Does your organization conduct security due diligence of each third party? |
| |_| |
| |_| |
| c. Do you have a process to review contracts you have with existing vendors? |
| |_| |
| |_| |
| d. Do you have a process to evaluate and review new and existing vendor’s security posture? |
| |_| |
| |_| |
| e. What controls does your organization have in place to monitor and assess third parties? |
| Please specify: |
7. Have your employees been provided regular information security training?
CAIQ HRS-03.1, 09.1; SOC2 CC2.2, CC2.3
| |_| |
| |_| |
8. Does your organization perform background checks to examine and assess an employee’s or contractor’s work and criminal history?
CAIQ HRS-02.1; SOC2 CC1.3, CC1.4
| |_| |
| |_| |
| a. Does your organization perform additional periodic background checks for particularly sensitive positions? |
| |_| |
| |_| |
9. Does your organization require employees to sign a non-disclosure agreement on a regular basis?
CAIQ HRS-03.3; SOC2 CC2.2, CC2.3
| |_| |
| |_| |
| 10. Does your organization have baseline security controls in place to protect your network and the devices connected to the network? Baseline security controls include: Firewalls, IPS/IDS, Malware protection, vulnerability scanning, network access control etc. |
| |_| |
| |_| |
| 11. When storing or transmitting sensitive information does your organization use encryption? |
| |_| |
| |_| |
| What type? |
| 12. Does your organization regularly perform vulnerability scans on their IT systems such as servers, workstations/laptops, networks and supporting security systems? |
| |_| |
| |_| |
| How often? |
| 13. Are third party connections to your organization’s network documented, monitored and reviewed periodically? |
| |_| |
| |_| |
| How often? |
14. Does your organization have documented access management processes?
CAIQ IAM; SOC2 CC7.4
| |_| |
| |_| |
| a. Access is approved and documented before it is granted? |
| |_| |
| |_| |
| b. Are user IDs for your systems uniquely identifiable? |
| |_| |
| |_| |
| c. Are systems and applications configured to restrict access only to authorized individuals? |
| |_| |
| |_| |
| d. Is there a list of authorized users with access to operating systems? Admin or privileged access control. |
| |_| |
| |_| |
| e. Are shared accounts tracked, monitored and reviewed on a regular basis? |
| |_| |
| |_| |
| f. Have a documented process for modification of user access? |
| |_| |
| |_| |
g. Have a documented process to manage termination and transfer of employees?
CAIQ IAM 11.1; SOC2 CC5.3
| |_| |
| |_| |
h. Does your organization have a process to review accounts and their related access?
CAIQ IAM 10.1; SOC2 CC5.3
| |_| |
| |_| |
| 15. Does your organization have physical access controls in place to prevent unauthorized access to facilities? |
| |_| |
| |_| |
16. Does your organization restrict physical access to information assets?
CAIQ DCS-09.1; SOC2 CC5.5
| |_| |
| |_| |
17. Are your organization’s systems and networks monitored for security events?
CAIQ IVS-01.5; SOC2 CC6.2
| |_| |
| |_| |
| 18. Does your organization have documented procedures in place to protect documents and computer media from unauthorized access? |
| |_| |
| |_| |
| 19. Does your organization have documented procedures in place for the decommissioning of IT equipment and storage devices? |
| |_| |
| |_| |
| 20. Does your organization have documented procedures in place to destroying or sanitizing data stored on removable media? |
| |_| |
| |_| |
| 21. Does your organization have documented procedures in place to manage and protect mobile devices? |
| |_| |
| |_| |
22. Does your organization have controls in place to restrict and monitor installation of unauthorized software onto your systems?
CAIQ CCC-04.1; SOC2 CC5.5, CC5.8, CC7.4
| |_| |
| |_| |
| 23. Does your organization have documented change management procedures in place for changes made to your production environment? |
| |_| |
| |_| |
| 24. Does your organization have documented procedures for handling breaches and security incidents? |
| |_| |
| |_| |
| a. Are the incident handling procedures tested on a periodic basis? |
| |_| |
| |_| |
| b. Have employees responsible for handling information security incidents been trained? |
| |_| |
| |_| |
| 25. Does your organization have cyber insurance or commercial general liability insurance in the event of an information breach or security incident? |
| |_| |
| |_| |
| 26. Does your organization have documented disaster recovery and business continuity procedures? |
| |_| |
| |_| |
| a. Does your organization test your disaster recovery and business continuity plans on a regular basis? |
| |_| |
| |_| |
| When was the last test? |
| 27. Does your organization harden operating systems to provide only the necessary ports, protocols, and services to meet business needs using technical controls (e.g., antivirus, file integrity monitoring, and logging) as part of their baseline build standard or template? |
| |_| |
| |_| |
Comments:
Section 2: Application Security Questions
Overview
1. A description of what the application or service does:
2. Who will be the primary users of this product (include estimated number)?
3. Is this a cloud-based application?
If yes, please indicate what type of cloud service:
|_| Public Cloud Service |_| Private Cloud Service |_| Hybrid Cloud Service
4. What are the components that make up the application (Web Server, Server, Database, appliance, etc.)?
|_| 2 tier application – Web or Application Server and DB |_| 3 tier application – Web Server, Application Server and DB |_| Other configuration
5. Will this application store or have the potential to store Protection Level 3 or 4 data (PL3 or PL4) such as:
|_| Financial Information |_| Personally Identifiable Information (PII) |_| Employee Information |_| Information Security Data |_| Sensitive Investment/Trade Data |_| Other sensitive business information
6. Will the vendor host or store customer data?
7. Does the application or service require interface with other applications, system or data feed?
8. Is remote access for application management or support required? (VPN, dialup, etc.)
9. Does the provider acknowledge ownership of the organization’s data, agree to return all data and ensure secure removal of all data from their systems upon contract termination?
10. What is your stated service level agreement (SLA) for this application or service?
| QUESTIONS |
| YES |
| NO |
| N/A |
| COMMENTS |
A. Access Management and Authentication
1. Does the application or service support enterprise authentication services such as LDAP or MS AD?
CAIQ IAM 12.1; SOC2 CC5.3
| |_| |
| |_| |
If not please explain:
2. Does the application or service support identity federation standards (SAML, SPML, FIDO2)?
CAIQ IAM 12.3; SOC2 CC5.3
| |_| |
| |_| |
3. Does the application or service support the ability to enforce password policy and/or complexity requirements (minimum, age, history, complexity) and account lockout policy?
CAIQ IAM 12.8; SOC2 CC5.3
| |_| |
| |_| |
4. Does the application or service support the ability of unlocking accounts that have been locked (e.g. self-service, via email, defined challenge questions, manual unlock)?
CAIQ IAM 12.11; SOC2 CC5.3
| |_| |
| |_| |
5. Does the application or service support the ability force password changes upon first logon?
CAIQ IAM 12.10; SOC2 CC5.3
| |_| |
| |_| |
6. Does the application or service support multi-factor authentication?
CAIQ IAM 12.6; SOC2 CC5.3
| |_| |
| |_| |
Which ones?
| 7. Are usernames and passwords transmitted using encryption? |
| |X| |
| |_| |
State protocol:
| 8. Can the application or service be set to automatically log a user off the application after a predefined period of inactivity? |
| |_| |
| |_| |
| 9. Does the application or service support the use of password reset questions? |
| |_| |
| |_| |
| 10. Does the application or service have role-based access control? |
| |_| |
| |_| |
| 11. Does the application or service require username and password before accessing or accepting data from an external system? |
| |_| |
| |_| |
| |_| |
| Protocol used to transmit User/ password info: |
| 12. Can administrative functions such as command line access, script level access etc., be performed remotely? |
| |_| |
| |_| |
| |_| |
| 13. Can the application or service restrict access to the application based on IP location? |
| |_| |
| |_| |
| |_| |
B. Data Security
1. Do you use an industry standard for data security architecture designed such as (CDSA, CSA Trusted Cloud, FedRAMP etc.)?
CAIQ AIS-04.1; SOC2 CC5.6
| |_| |
| |_| |
| |_| |
| Which one? |
2. Does the application or service use industry standard encryption when transmitted?
CAIQ DSI-03.1, 03.2; SOC2 CC5.7, PI1.5
| |_| |
| |_| |
| |_| |
3. Does the application or service store customer data in an encrypted fashion?
CAIQ EKM-03.1; SOC2 CC5.7, CC5.6
| |_| |
| |_| |
| |_| |
4. Can customers manage their own encryption keys?
CAIQ EKM-02.1-5, 04.1-4; SOC2 CC5.7, CC5.6
| |_| |
| |_| |
5. Will customer data be stored segregated from your other customer data?
CAIQ AAC-03.1; SOC2 CC3.1
| |_| |
| |_| |
| |_| |
6. Can you guarantee that customer data will only be stored in the United States?
CAIQ AAC-03.3 DSI-01.7; SOC2 CC3.1
| |_| |
| |_| |
| |_| |
7. Do you completely delete customer data when a customer deletes it from their web services?
CAIQ DSI-07.2; SOC CC3.1, CC5.6
| |_| |
| |_| |
| |_| |
8. Do you use a secure process to delete data on unusable or unrecoverable media?
CAIQ DSI-07.1; SOC2 CC3.1, CC5.6
| |_| |
| |_| |
| |_| |
9. Do you have the ability to enforce customer data retention requirements?
CAIQ BCR11.1; SOC2 A1.2, A1.3
| |_| |
| |_| |
| |_| |
10. Do you have documented data flow diagrams for your application/service?
CAIQ DSI-02.1
| |_| |
| |_| |
| |_| |
| Please provide a data flow diagram for your application. |
C. Application Security
1. Do you use secure Software Development Life Cycle (SDLC) methodologies?
CAIQ AIS-01.1 AIS-01-4; SOC2 CC7.1
| |_| |
| |_| |
What SDLC framework do you use?
2. Do you perform source-code analysis to detect security defects in code?
CAIQ AIS-01.2, AIS-01.3, CC-02.2; SOC2 CC7.1
| |_| |
| |_| |
| |_| |
| |_| Manual |
|_| Automated If automated, what tool do you use?
3. Do you review your applications for security vulnerabilities and address any issues prior to deployment to production?
CAIQ AIS-01.5; SOC2 CC7.1
| |_| |
| |_| |
| |_| |
4. Are all security, contractual, and regulatory requirements contractually addressed and established before granting customers access to data?
CAIQ AIS-02.1; SOC2 CC5.1
| |_| |
| |_| |
| |_| |
5. Are all requirements and trust levels for customers’ access defined and documented?
CAIQ AIS-02.2; SOC2 CC5.1
| |_| |
| |_| |
| |_| |
6. Do third parties conduct security assessments on your application or service?
CAIQ AIS-02.5; SOC2 CC4.1
| |_| |
| |_| |
By whom?
| 7. Does the application or service support the latest version of the HTTPS protocol (TLS)? |
| |_| |
| |_| |
| |_| |
| Which version of TLS: |
| 8. Do you have certified web programmers on staff? (ex. GSSP Secure Software Programmer) |
| |_| |
| |_| |
| |_| |
9. Are all web applications (internal and external, and including web administrative access to application) developed based on secure coding guidelines such as the Open Web Application Security Project guide (OWASP), WASC Threat Classification or CIS Top 20? If yes, then skip to next section
CAIQ AIS-03.1; SOC2 PI1.2, PI1.3, PI1.5
| |_| |
| |_| |
| |_| |
| a. Does your application check for injection flaws, such as SQL, OS, and LDAP injection when untrusted is sent to interpreter as part of a command query? |
| |_| |
| |_| |
| |_| |
| b. Does the application properly and securely handle account credentials and session tokens? |
| |_| |
| |_| |
| |_| |
| c. Does the application verify all the parameters in the application are validated or encoded before being included on a web page (XSS)? |
| |_| |
| |_| |
| |_| |
| d. Does your application perform an access control check for any internal object reference such as a file, directory or database key? |
| |_| |
| |_| |
| |_| |
| e. Have you validated security misconfigurations at the application, web server and OS level have been eliminated? |
| |_| |
| |_| |
| |_| |
| f. Does your application/service protect against sensitive data exposure? |
| |_| |
| |_| |
| |_| |
| g. Does your application/service verify function level access rights both in the application and at the server level when each function is accessed? |
| |_| |
| |_| |
| |_| |
| h. Does the application check and require some type of authorization token that is not automatically submitted by the browser (CSRF)? |
| |_| |
| |_| |
| |_| |
| i. Have you verified that your application/services does not use components, such as libraries, frameworks or other software modules that have known vulnerabilities? |
| |_| |
| |_| |
| |_| |
| j. Does your application/service validate redirects and forwards when sending users to other pages and websites? |
| |_| |
| |_| |
| |_| |
| k. Has the application been reviewed and tested to make sure information is not leaked via error messages or other means? |
| |_| |
| |_| |
| |_| |
| l. Does the application protect against account enumeration? |
| |_| |
| |_| |
| |_| |
D. Infrastructure Security
1. Are system and network environments protected by a firewall or virtual firewall to ensure business and customer security requirements?
CAIQ IVS-09.1; SOC2 CC5.6
| |_| |
| |_| |
| |_| |
2. Does your application or service run on operating systems hardened to provide only the necessary ports, protocols, and services to meet business needs using technical controls (e.g., antivirus, file integrity monitoring, and logging) as part of their baseline build standard or template?
CAIQ IVS-07.1; SOC2 CC5.6
| |_| |
| |_| |
| |_| |
3. Do you logically and physically segregate production and non-production environments?
CAIQ IVS-08.3; SOC2 CC5.6
| |_| |
| |_| |
| |_| |
4. Do you have anti-malware programs that support or connect to your application or service install on all systems?
CAIQ TVM-01.1; SOC2 CC5.8
| |_| |
| |_| |
| |_| |
5. Do you conduct network-layer and system-layer vulnerability scans regularly?
CAIQ TVM-02.1, 02.3; SOC2 CC7.1
| |_| |
| |_| |
| |_| |
6. Do you have the capability to rapidly patch vulnerabilities across all your computing devices, applications, and systems?
CAIQ TVM-02.5; SOC2 CC7.1
| |_| |
| |_| |
| |_| |
E. Activity Monitoring
| 1. Does the application or service write activity and events logs to a common log format? |
| |_| |
| |_| |
Format:
| a. Does the application or service log authentication success and failure? |
| |_| |
| |_| |
| b. Does the application or service log record configuration changes to system and/or application? |
| |_| |
| |_| |
| c. Does the application or service track administrator activity? |
| |_| |
| |_| |
| d. Does the application or service log data transmissions to external systems? |
| |_| |
| |_| |
2. Does your application or service support sending activity and audit logs to a customer’s central log management location?
CAIQ IVS 01.4, SEF-03.1; SOC2 CC2.3, CC2.5, CC6.2
| |_| |
| |_| |
3. Can your application or service be configured to retain activity and event logs for at least 180 days?
CAIQ IVS 01.4; SOC2 CC6.2
| |_| |
| |_| |
4. Do you have a process in place to review activity logs on a regular basis?
CAIQ IVS 01.5; SOC2 CC6.2
| |_| |
| |_| |
5. Does the application or service protect audit logs from tampering?
CAIQ IVS 01.2; SOC2 CC6.2
| |_| |
| |_| |
F. Business Continuity (For cloud-based or hosted applications)
1. Do you have a disaster recovery and business continuity plan?
CAIQ BCR-02.1; SOC2 A1.2
| |_| |
| |_| |
| |_| |
| How often are they tested? |
2. Do you offer backup and replication services?
CAIQ BCR-07.1, BCR-07.2; SOC2 A1.1, A1.2
| |_| |
| |_| |
| |_| |
3. Do you test backup or redundancy mechanisms at least annually?
CAIQ BCR-11.5; SOC2 I3.21
| |_| |
| |_| |
| |_| |
4. Do you have multiple data centers, in geographically diverse locations?
CAIQ BCR-01.1; SOC2 CC3.1
| |_| |
| |_| |
5. What is your guaranteed uptime?
CAIQ BCR-09.1, 09.3; SOC2 CC3.1, A1.2, A1.3
Uptime:
6. Do you have a recovery SLA in case of a business interruption?
CAIQ AAC-03.2; SOC2 CC3.1
| |_| |
| |_| |
| |_| |
7. Do you provide infrastructure service failover capabilities to other providers?
CAIQ BCR-01.2; SOC2 A1.2, A1.3
| |_| |
| |_| |
8. Are information systems documented and made available to authorized personnel?
CAIQ BCR-04.1; SOC2 CC1.3, CC1.4, CC2.1
| |_| |
| |_| |
G. Audit and Compliance
| 1. Will customer be notified when a security breach/incident occurs associated with your application or service? |
| |_| |
| |_| |
2. Will customer be notified when updates to your application or service occurs?
CAIQ CCC-05.1; SOC2 CC7.4
| |_| |
| |_| |
3. Do you conduct network penetration tests of your service infrastructure?
CAIQ AAC-02.2; SOC2 CC4.1
| |_| |
| |_| |
4. Have your security program and technical controls been audited or certified against industry standards for example SOC2/ISO 27001?
CAIQ AAC-01.1; SOC2 CC4.1
| |_| |
| |_| |
5. Are the results of your latest assessments, audits and penetration tests available for review?
CAIQ AAC-02.6 – 02.8; SOC2 CC4.1
| |_| |
| |_| |
| 6. Can you confirm that security policies and controls are applied to their third party providers? |
| |_| |
| |_| |
| |_| |
| If no, please explain: |
H. Other
| 1. Do you provide US-based technical support? |
| |_| |
| |_| |
| 2. Can customer data easily be exported from your service? |
| |_| |
| |_| |
If no, please explain
Section 3: System Security Questions (For vendor servers and systems intended to be located on OST’s network)
F. Host Security
| 1. Will enterprise anti-malware protection and host intrusion prevention software be installed and running on server? |
| |_| |
| |_| |
| |_| |
| 2. Will critical OS, browser and database security patches within 7 days of release? |
| |_| |
| |_| |
| |_| |
| If no, state expectations in comments field |
| 3. Can/does the application or service run without requiring the user to have local administrator level rights? |
| |_| |
| |_| |
| |_| |
Comments:
Version: 2.0 Date: 4/4/2019 Owner: InfoSec
File details come from the government source that posted it. Updated .