The file's text, extracted by GovTribe without its formatting.
Vendor Accessibility Disclosure Form
Purpose The Colleges of the Colorado Community College System are committed to managing data and systems in conformance to federal mandates. Such mandates include:
· Family Educational Rights and Privacy Act FERPA:
http://familypolicy.ed.gov/ferpa-school-officials
· Gramm-Leach-Bliley Act:
http://business.ftc.gov/privacy-and-security/gramm-leach-bliley-act
· Health Insurance Portability and Accountability Act:
http://www.hhs.gov/ocr/privacy/
· Open Web Application Security Program:
https://www.owasp.org/index.php/Main_Page
· Student and Exchange Visitor Information System:
http://www.ice.gov/sevis/
Form Currency Review the form annually and update the form with new standards. Questions Specifically regarding standards are B-1.2, D-4, D-6, E-3, E-10, F6, G-7, We may send completed forms to vendors annually for changes or verification that the information is still current.
Contents - Service Provider Security Assessment
| A. | Company Information | |
| B. | Site Details | |
| C. | Policies, Standards and Procedures | |
| D. | Architecture | |
| E. | Configuration Controls | |
| F. | Compliance Controls | |
| G. | Access Controls | |
| H. | Monitoring Controls | |
| I. | Physical Security Controls | |
| J. | Contingency Controls | |
| K. | Business Relationships Controls | Service Provider Security Assessment Query |
| L. | Other | |
| M. | College only | |
| N. | College only | |
Note: If you have acceptable alternative practices to any questions, we welcome hearing about those.
| A-1 |
| Name of Service Provider (company name) |
| A-2 |
| Name/Title of Responder |
| A-3 |
| Responder’s Contact Information (e-mail and telephone) |
| A-4 |
| Service Provider’s legal mailing address |
| A-5 |
| URL of Service Provider’s website |
| A-7 |
| How long has Service Provider been in business? |
| A-8 |
| Supply the name and description of service to be delivered by Service Provider. This assessment document will apply to this named service. |
| A-9 |
| Provide references from three organizations that have utilized services similar to those you intend to provide. Include name, contact information and length of time service has been provided. |
| B-1 |
| Where is the Service Provider’s site located? This should be the primary location where College data will be stored. |
| B-1.1 |
| What is the tier rating and applicable standard of this datacenter? |
| B-1.2 |
| Please provide summary results of a third-party external Information Security assessment conducted within the past two years (SAS-70 Type II, SOC 2 / SOC 3, penetration test, vulnerability assessment, etc.) for this location. |
| B-2 |
| If Service Provider has an alternate (backup) site, where is that located? |
| B-2.1 |
| What is the tier rating and applicable standard of this backup datacenter? |
| B-3 |
| Does Service Provider permit any non-U.S. facility to access, process or store Customer’s data? |
| C |
| Policies, Standards and Procedures |
| Yes, Partially, No, N/A, If Partially, please explain |
| C-1 |
| Service Provider has formal written Information Security Policies. |
| C-2 |
| Service Provider maintains policies that protect Customer’s information against unauthorized access. |
| C-3 |
| Service Provider policy prohibits sharing of individual accounts and passwords. |
| C-4 |
| Service Provider conducts routine event monitoring and receives timely notification and implements recommended solutions for security vulnerability alerts (e.g., CERTs). |
| C-5 |
| Service Provider implements AAA (Authentication, Authorization, and Accountability) for all users. Physical access to facilities where data are stored will be limited and controlled. Any damage or unauthorized access to facilities will be reported to the college within 24 hours of occurrence. |
| C-6 |
| Service Provider performs background and reference checks for individuals handling sensitive information. |
| C-7 |
| Vendor will have procedures and solutions implemented to prevent unauthorized access, and the procedures will be documented and available for the College to review on request. Those allowed to send data and receive data to and from the vendor must be identified. |
| C-8 |
| Service Provider has termination or job transfer procedures designed to immediately prevent unauthorized access to information. |
| C-9 |
| Service Provider has a formal Information Security risk management program for risk assessments and risk management. |
| C-10 |
| Conducts an annual security audit and identifies issues to be fixed or mitigated within 90 days of annual report. |
| D |
| Architecture |
| Yes, Partially, No, N/A |
| D-1 |
| Service Provider has implemented and maintains firewall protection for all systems with Internet connectivity. |
| D-2 |
| Service Provider maintains routers and Access Control Lists as appropriate. |
| D-3 |
| Service Provider has implemented and maintains network redundancy. |
| D-4 |
| Service Provider has implemented and maintains IDS/IPS technology |
| D-5 |
| Service Provider has established DMZ architecture for systems accessible via the Internet. (subnet that contains and exposes a portion of the network to untrusted to a larger untrusted network usually the Internet) |
| D-6 |
| Service Provider maintains an infrastructure where Internet and Web-facing applications are on a server different from the one that contains a database or data with sensitive information. Web sites that gather personal information utilize Transport Layer Security (TLS) with a certificate from an independent authority. File transmissions must be done using TLS. |
| D-7 |
| Service Provider maintains an enterprise-class system for antivirus, firewalls, and network and intrusion detections for all computers and systems. |
| D-8 |
| Service Provider maintains an enterprise-class patch management program. |
| D-9 |
| Service Provider maintains an infrastructure that physically or logically segments Customer data. |
| D-10 |
| Service Provider provides remote access to authorized users via secure (encrypted) connections. |
| E |
| Configuration Controls |
| Yes, Partially, No, N/A |
| E-1 |
| All Service Provider’s computers and systems are kept current with security patches and protected from malware. |
| E-2 |
| Service Provider employs encryption for sensitive information (protected health information, student identifiable, personnel information, intellectual property, etc.) for external or Internet transmissions with keys of at least 128 bits in length for symmetric encryption and 1024 bits or greater in length for asymmetric encryption. |
| E-3 |
| Service Provider’s servers have anti-intrusion programs installed (e.g., Tripwire, TippingPoint, etc.). |
| E-4 |
| Service Provider ensures that all vendor-supplied default identifiers and/or passwords or similar “published” access codes for all installed operating systems, database management systems, network devices, application packages, and any other commercially produced IT products have been changed or disabled. |
| E-5 |
| Service Provider ensures that passwords are never stored in clear text and are not easily decipherable. |
| E-6 |
| Service Provider reviews all systems and software to determine whether appropriate security settings are enabled. |
| E-7 |
| Service Provider manages file and directory permissions for “least privilege” and “need-to-know” accesses. |
| E-8 |
| Service Provider has implemented redundancy or high availability features for critical functions. |
| E-9 |
| Service Provider does not use sensitive “live” data for development and/or testing unless the data has been sanitized or redacted. (Yes Confirms that you do NOT use live data.) |
| E-10 |
| Service Provider’s application security follows industry best practices (e.g., OWASP, SANS Critical Security Controls). |
| E-11 |
| Service Provider enforces prohibition on “split tunneling” when Provider’s personnel are connecting to Customer networks. |
| F |
| Compliance Controls |
| Yes, Partially, No, N/A |
| F-1 |
| Where the Service Provider’s system interfaces with portable devices, sensitive information or information requiring protection by law is encrypted when stored on these portable devices and requires password access. |
| F-2 |
| Service Provider ensures that access to sensitive information or information protected by law across a public connection is encrypted with a secured connection and requires user authentication. |
| F-3 |
| Social Security Numbers will be encrypted when stored and transmitted, and masked on display so that only the last 4 digits will display on any display, including reports. The retention period for storage of Social Security Numbers must be approved in advance by the college. |
| F-4 |
| Service Provider’s management of any payment card information is compliant with the Payment Card Industry/Data Security Standards (PCI/DSS). Provide evidence of compliance, e.g., results of assessment or evaluation by 3rd party, copy of Report of Compliance (ROC). |
| F-5 |
| Credit card numbers are not stored in any format. |
| F- 6 |
| Service Provider’s web applications are tested and monitored for common application security vulnerabilities (e.g., OWASP, SANS Critical Security Controls). |
| F-7 |
| Service Provider’s application servers and database software technologies are kept up-to-date with the latest security patches. |
| F-8 |
| Service Provider’s application development and support activities are performed by entities that are solely within the United States. |
| F-9 |
| Where the Service Provider’s product or service manages Student Information, the product or service is FERPA compliant. |
| G |
| Access Controls |
| Yes, Partially, No, N/A |
| G-1 |
| Access to Service Provider’s systems is immediately removed, or modified, when Service Provider’s personnel terminate, transfer, or change job functions. |
| G-2 |
| Service Provider achieves individual accountability by assigning unique IDs and prohibits password sharing. |
| G-3 |
| Service Provider’s critical data or systems are accessible by at least two trusted and authorized individuals. |
| G-4 |
| Access permissions to target systems are reviewed by Service Provider at least monthly for all server files, databases, programs, etc. |
| G-5 |
| Service Provider’s support personnel only have the authority to read or modify those programs or data that are needed to perform assigned duties. |
| G-6 |
| Service Provider employs passwords that have a minimum of 8 characters, expire periodically, and have strength requirements. |
| G-7 |
| Service Provider’s systems require all user access be authenticated (minimally) with a password/PIN, token or biometric device. If Service Provider utilizes two-factor authentication mechanisms (e.g., a password/PIN and a smart card, token, etc.) for access to systems, please note that. |
| H |
| Monitoring Controls |
| Yes, Partially, No, N/A |
| H-1 |
| Access permissions of Service Provider’s support personnel are reviewed at least monthly for all server files, databases, programs, etc. |
| H-2 |
| Service Provider has implemented system event logging on all servers, and records at a minimum “who, what, and when”. |
| H-3 |
| Service Provider records and reviews on a frequent basis (at least weekly) all system activity occurring “after normal business hours”. |
| H-4 |
| Service Provider reviews frequently (at least weekly) all target system logs for failed logins or failed access attempts. |
| H-5 |
| Service Provider reviews systems frequently (at least monthly) for dormant accounts; dormant accounts are immediately disabled and scheduled for removal. |
| H-6 |
| Service Provider reviews system logs frequently (at least weekly) for possible intrusion attempts. |
| H-7 |
| Service Provider reviews network and firewall logs frequently (at least weekly) for unusual or anomalous activity. |
| H-8 |
| Service Provider reviews wireless network access frequently (at least weekly) for unauthorized access attempts and anomalous activity. |
| H-9 |
| Service Provider performs routine (at least monthly) scanning for rogue wireless access points. |
| H-10 |
| Service Provider’s IDS/IPS systems are actively managed and alert notifications have been implemented. (detection vs prevention) |
| H-11 |
| Service Provider performs routine scanning (at least monthly) of Provider’s networks for potential vulnerabilities. |
| I |
| Physical Security Controls |
| Yes, Partially, No, N/A |
| I-1 |
| Access to Service Provider’s premises is controlled through management of key distribution, review of paper/electronic logs, surveillance cameras, and/or security personnel. |
| I-2 |
| Service Provider’s computer rooms have safeguards in place (e.g., cipher locks, restricted access, room access log, etc.) to control access. |
| I-3 |
| Service Provider employs secure disposal methods to render sensitive data unrecoverable (e.g., paper/tapes are shredded, CDs/DVDs are crushed, hard drives are drilled, etc.). |
| I-4 |
| Service Provider prohibits Customer information from being loaded to portable devices (e.g., laptops, CD/DVD, USB drives, etc.) unless the data is encrypted. |
| I-5 |
| Service Provider utilizes full disk encryption on laptops and desktops where sensitive data is processed or stored. |
| I-6 |
| Service Provider requires that all visitors to computer and server rooms, and areas where Customer data is accessible, be escorted while on Provider’s premises. |
| I-7 |
| Service Provider has implemented appropriate environmental controls to manage risks to equipment and facilities (e.g., raised flooring, temperature alarms, fire suppression, cooling, heating, smoke/fire detection, battery backup, etc.). |
| I-8 |
| Service Provider does not permit signage indicating the location of the data center, the content or value of any server room, or any room containing sensitive information. |
| J |
| Contingency Controls ( Disaster Recovery and Business Continuity) |
| Yes, Partially, No, N/A |
| J-1 |
| Service Provider maintains documented and tested disaster recovery and business continuity plans. Service Provider has a documented contingency plan for mission critical computing operations. |
| J-2 |
| Service Provider has documented emergency procedures and responsibilities that are stored securely at multiple sites. |
| J-3 |
| Service Provider’s cross-functional dependencies have been identified so as to determine how the failure in one system may impact another. System uptime is guaranteed to be 99.9%. |
| J-4 |
| Service Provider has documented backup and restoration procedures and processes. Plan to include daily system backups so that any restore will result in no more 24 hours of data loss. |
| J-5 |
| Service Provider periodically (at least annually) tests the integrity of backup media. |
| J-6 |
| Service Provider stores backup media in a secure manner, with appropriate access controls following “need-to-know” and “least privilege” concepts. |
| J-7 |
| Service Provide has secured off-site storage and documented retrieval procedures for backups. College retains the right to reject the location and to recommend another location. |
| J-8 |
| Service Provider has access to backup data permitting rapid restoration of systems. |
| J-9 |
| Service Provider appropriately labels backup media to help avoid errors or data exposures. |
| K |
| Business Relationships Controls |
| Yes, Partially, No, N/A |
| K-1 |
| Service Provider requires signed non-disclosure agreements before proprietary and/or sensitive information is disclosed. |
| K-2 |
| Accidental exposures of data to unauthorized persons will result in the vendor notifying the College within 4 hours of discovery, and no notification to those whose data have been exposed will occur without prior discussion with the College. |
| K-3 |
| Service Provider has business associate contracts or agreements that appropriately manage risk to Customer data. |
| K-4 |
| Service Provider’s business associates are aware of and acknowledge security policies addressing Customer data. |
| K-5 |
| Service Provider’s business associates agreements document the agreed upon retention periods, transfer or destruction of Customer's data when the business relationship terminates. |
| L-1 |
| Is there anything else you would like to tell us? If you have acceptable alternative practices to any questions, we welcome hearing about those, either in the pertinent section or here. |
Occasionally, follow up discussion may be required to clarify questions. Enter the follow up questions and the responses here:
| Section Number |
| Follow up Questions |
| Vendor Responses |
Certification
I certify that the information set forth in or attached to this Vendor Disclosure Form is true to the best of my knowledge. I further understand that the making of any false statements in the form or any attachments may negatively impact our company from being awarded pursuant to the procurement process.
Signature
| N |
| Review and Approval – For College Use |