Special Purpose Questionnaire.pdf

Pre-Implementation Questionnaire Risk Assessment Number:

Question Risk Assessment Questionnaire Answer / Response Additional Information

1.01 Device/System Type

1.02 Device/System Manufacturer

1.03 Device/System Model

1.04 Application Name and Software Version #

1.05 VISN

1.06 Facility Name

1.07 Facility Number

1.08 Manufacturer Point of Contact

Phone Number

E-Mail Address

1.09 Device Administrator

Phone Number

E-Mail Address

1.10 VA Business Owner

Phone Number

Special Purpose System (SPS) Questionnaire

To be completed for all procurements of network-connected Special Purpose Systems.

E-Mail Address

1.11 Facility ISSO

Phone Number

E-Mail Address

1.12 Area Manager

Phone Number

E-Mail Address

1.13 Equipment Description (i.e. equipment function and systems it communicates with).

1.14 SDIA VLAN Number for Installation (if known).

1.15 Installation Location (Room, Building, Division)

1.16 Is there an existing Risk Analysis (RA) for this device/system?

if Yes, what is the Risk Analysis number?

Device Operating System (OS)

Can the OS be automatically patched?

If patching is not automated, what is the patching process and/or limitations?

**Note that the RA must be for the same Make/Model and application software version to apply to the requested system. A new RA is required for major software or operating system updates (e.g. version 2.0 to 3.0) but is not required for minor updates (e.g. version 2.0 to 2.1).

If a RA exists for the requested system, further completion of this form is not required beyond this point. Please sign to certify that an existing RA is available for the requested system and forward the document to either the Area Manager or ISSO for signature.

2.01

2.02 Does the system support the installation of anti-virus? To include antivirus updates?

2.03 Does the system use a supported database application?

If yes, what is the database version?

2.04 Will the system be utilizing VA Active Directory?

2.05 Will the system be hosted on VA Virtual Machine?

2.06 Does the system utilize wireless connection?

If yes, provide FIPS 140-2 certification number?

2.07 Is connectivity external to the VA required for system operation?

Please provide MOU/ISA number?

2.08 Will the device be interconnected to other systems that connect to the VA Network in order to send, process, or store data?

2.09 Does the device have the ability to be managed remotely, i.e., without a person being physically at the device?

If yes, provide detail.

2.10 Identify the data types processed, stored, or transmitted on the device

2.11 Will the device provide the capability to have unique user logon account for each user?

2.12 Does the system support multi-factor authentication?

2.13 Does the system protect data-at-rest with whole disk encryption?

2.14 Will VA data be stored outside of the VA Network (e.g. cloud-based service provider)?

If yes, include cloud approval.

2.15 Does the device require integration or connectivity with

CERNER/MEDCOI?

SPS Questionnaire