technologysecurityassessment_2023_(2).pdf

IM/Chat

Section 1: Vendor Information

City: State: ZIP:

Information Services Department Technology Security Assessment County of San Mateo

Technical Support Contact Methods:

This document is to be completed for new or upgraded technology acquisitions, contracts, and projects including all design changes. Please submit all proposals and agreement terms for review to ISD B-1 Review process according to directives in Administrative Memorandum B-1. All questions must be answered fully.

Submitter’s NameSubmitting Department_______________________________________________ ________________________________________________ Phone_________________________________________

Name:

Address:

Corporate Phone #:

(Select all that apply) Phone:

Email:

Web Portal

Technical Support Coverage Hours: 24x7x365 Business Hours M-F 8-5 Pacific

Does the vendor provide a dedicated account manager or representative for escalating problems or incidents?

If yes, please provide name.

Yes No

Does the vendor maintain any formal security policies & Yes No How often is the vendor’s security posture reviewed?

procedures to comply with industry requirements?

Will the vendor provide a copy of their last two security audit, penetration test, and/or vulnerability assessment? Yes No

Does the vendor have any third-party certifications or attestations for its application, such as FedRamp, FIPS 140 -2, FISMA and DIACAP, HIPAA, ISO 27001, PCI DSS, TRUSTe or SOC 1/SOC 2/ SSAE 16/ISAE 3402? If yes, provide certification or attestations.

If cloud solution, does the vendor use a third-party storage solution?

If yes, does the data storage vendor have any third- party certifications or attestations, such as FedRamp, FIPS 140 -2, FISMA and DIACAP, HIPAA, ISO 27001, PCI-DSS, TRUSTe or SOC 1/SOC 2/ SSAE 16/ISAE 3402? If yes, provide certification or attestations

Section 2: Product Information

Yes No

Product Name: No. of Users:

This is an upgrade or renewal for existing technology currently in use in the County

Does the product have technical constraints to the number of concurrent users it can support?

Yes

Location: On-Premise Hosted (Cloud/Off-site) If hosted,GovCloud? Hybrid (On-Premise/Cloud) If hosted,GovCloud?

Product Description and Purpose: Please include information that will identify the function, business process, and the departments/divisions who will use it.

Integration: Does the product integrate or interface with any other existing or planned products or services used either at the County, or with another third-party County vendor? This would include requirements for integration or use of the County’s email System, ServiceNow, or other systems.

Does the vendor use third-party services, such as help desk, integration services, backup services, that would have access to the County’s data?

Please describe.

Does product use open and published APIs?

List all ports/protocols required for any traffic outbound to the Internet or for the application.

Are APIs tested for potential security exploits?

If no, describe what is used to mitigate exploitations and risks.

No

Other

No

Yes

Yes No

No

Yes

Yes No

Yes No

If yes, provide name of third-party data storage vendor

N/A

Escalation procedure for incidents or problems provided? Yes No

No Yes

No N/A

No

N/A

RTOPercentage

Yes

N/A

Yes

Web Services: Is the product 100% web-based? Is the County’s data exposed through web services?

Does the product provide MFA for public access? Does the administrative console require MFA?

Mobile Devices: Does the application provide mobile capabilities? Is the mobile application a requirement for application?

Section 3: Administrative Controls For details on Data Sensitivity and Data Criticality, please see the Section 7 References of this document

Data Sensitivity: Public Internal Confidential* Restricted * * May require NDA

Data Criticality: Useful Important Essential

Data Type: Data is not confidential PII HIPAA/PHI FTI EDD PCI-DSS CJI *

Is system HIPAA compliant? Is system CJI compliant? System meets regulatory requirements?

Configuration and System Hardening: Does the product offer baseline configuration or system hardening tool(s) that can protect the product against confidential data disclosure or service disruption?

**Please provide system configuration diagram and the transport route of data between systems (Required)

Backup and Restore: Does the product offer features to backup and restore user data, configurations, and application code?

Does the product integrate with Rubrik Storage Services and API (the County’s backup platform)?

Is there is a backup process performed by Vendor: Yes No

How often: Encrypted?

Retention period Where stored?

Disaster Recovery: Is the location of the server, if hosted, in an area prone to natural disaster?

Is there a disaster recovery plan in place?

What is the guaranteed uptime?

Data at Termination of Agreement: Will the data be returned? Yes No What assurance is provided for secure and complete removal?

Section 4: Security Controls Has the application been subjected to any breaches? If yes, include separately, enacted steps to mitigate including response and escalation processes

Are there known vulnerabilities? List known vulnerabilities

Are these known vulnerabilities currently being addressed?

Does the vendor use an automated/manual source code analysis tool for secure coding?

. Monitoring and Event Management: Describe how the product can be monitored for performance, reliability, and security. Include how the product reacts to events that are raised during normal operations.

Can the product forward events to a central log repository or System Event Yes No and Incident Management (SEIM) platform?

Patching: Describe how the product is patched and updated. Include how frequently the vendor provides security fixes and updates and how cloud servers will be protected.

If the hardware is onsite, can County engineers apply patches?

If hosted, please provide version, service pack, patches, and how will the server be maintained to the lasted patch level?

No Yes

* System may require DOJ compliance and approval

Yes

Please provide location

Yes No

Yes N/A

No Yes

Yes

RPO

No Yes

Yes No

How often is the disaster recovery plan tested?

Yes N/A

Yes

No Yes Yes No

No Yes

Yes

No Yes No

N/A

N/A

No

N/A

N/A

N/A

No

No

N/A How often is software/system tested for vulnerabilities?

Yes

Yes No

N/A

No

Yes No

Yes

Yes

Yes No

Yes No

Yes No

Anti-Virus Protection: Is anti-virus running?

Malware Protection: Is malware protection running?

Will the product be affected by servers or endpoints that run anti-virus/anti-malware protection? If yes, provide details on what exclusions are required for the product to work effectively.

Employees: Have employees undergone a background check process?

Are employees for this project located in the United States?

Are employees provided required training to handle confidential data, such as CJI, for this engagement?

Will the provider use a subcontractor or 3rd party service provider?

If yes, please attach and provide, for each subcontractor, the security and privacy agreement.

Security Incident Response Plan: Immediate notification to impacted parties?

Identity and Authentication Management:

Does the product provide for, or support identity and authentication integration If yes, with via other credentialing systems or protocols? please specify Note: SAML is the preferred choice for integration with San Mateo County systems *SaaS requires OKTA integration and MFA

Password Management:

How are accounts provisioned and managed (include deprovisioning and removal)?

Does the product provide for password management that meets the County password policy for complexity, expiration, reuse, and lockout? See Section 7 References for more information about San Mateo County’s Password Policy

1. All users have a single account with unique account ID?

2. First time password must be unique and changed upon initial login?

3. Password must be changed every 60 days?

4. Password must have at least 8 characters and 1 character from three of the following: lowercase, uppercase, number, special character?

5. Password cannot be re-used; system is configured to remember las 12 passwords

Does the product provide for password self-reset capability?

How are passwords stored?

Access Management: Does the product allow for privileges to be assigned to both individuals and ‘groups’ of individuals to support the use of ‘Roles’ for access permissions? Please describe method used.

Encryption: Identify and describe whether the product encrypts data during Data-in-transit different states – i.e., at rest, in use, and in transit. Also include credentials Data-in-use

(usernames, passwords, etc.). Include encryption methodology used Data-at-rest

Auditing: Does the product provide a mechanism for auditing system activity and/or reporting of that activity? Examples of auditing include user login/logoff, user actions, data export, and permission changes.

Audit Logs: Does vendor provide audit logs upon request? Will vendor work with County to ensure audit logs can be ingested into the County’s SIEM?

How long are the audit logs stored?

Section 5: Cloud/Hosted Services Data Sovereignty: Does the vendor keep all the data within the United States?

Please provide location(s) where San Mateo County’s data will be stored.

Vendor will consult and advise the County of geographical location of data storage if data will be moved to location other than stated in this document.

Does the cloud solution use industry standard devices?

*Background check confirmation may be requiredYes No

Yes

Yes No

No

What is the time frame?

Yes

Yes

Yes

No

No

No

Yes No

SAML

OAuth

MFA

Active Directory

LDAP

Other

No Yes

Yes

Yes

No

No

No

Yes No

If no, what country? Yes Yes

No No

Credentials

Encrypted? Yes No

No

Yes No

No Yes

Yes No

Yes N/A

Yes

No

Yes No

No

Yes No Yes No

Yes No

Yes No

Yes No

Yes No

Yes No

Yes No

Yes No

Yes No

Tenancy: Describe how San Mateo County data resides with other customer i.e., is the data co-mingled in a single database, or are there separate customer databases?

data in the hosted environment--

Does vendor have the ability logically segment or encrypt data so that the data can be produced for a single tenant only Yes No both application, database, and/or other layers (e.g., Ruby on Rails, Redis Cache, MongoDB)

Hosted Platform: Please describe the vendor’s technology platform in the hosted environment--

Does vendor provide configuration and optimization of cloud services?

Does the vendor provide space availability to avoid resource exhaustion issues?

Network Defenses: Please describe how the vendor's network perimeter is protected, including whether an IPS/IDS and anti-virus system is activated, and if there is a central logging facility for perimeter events

Does the vendor conduct network penetration tests on cloud service infrastructure regularly? Yes No

Service Levels and Incident Response:

What is the service level for this hosted product, and how does the vendor guarantee that level for its customers? Include how the vendor notifies customers of incidents that do not meet service levels

Forensic Analysis: Who would perform a forensic analysis of a breach if one were to occur at the vendor site

Data Loss Events: Has the vendor experienced any data loss incident which required reporting to regulatory authorities in the past 24 months?

Yes No

IP Restrictions: Does the vendor’s hosted site have the capability restrict access to San Mateo County’s public IP address space?

Yes No

Section 6: Support and Maintenance Does the vendor provide proactive system monitoring tool(s) for health check and latency detection that extends to cloud services, as needed?

Is monitoring 24x7

Does the vendor track performance against SLAs?

Is provided vendor support located in the US? If no, provide location

Will vendor require VPN? * Is site-to-site VPN required? * *Vendor required to fill out request form

Does vendor use own remote access tool? *

* Review required; subject to approval of ISD

Are there ports/protocols required to be open for support or VPN access?

List ports and protocols

Does the vendor provide maintenance procedures?

How often are patches/upgrades/maintenance performed on the system?

Will vendor notify County at least 2 weeks in advance for maintenance?

Is there anticipated downtime related to upgrades or maintenance?

Is there a strategy including methodology for upgrading the infrastructure to ensure technology advances and security?

If not, how often?

If yes, identify tool(s) used

If yes, identify remote access tool used

Section 7: References Password Policy

The County of San Mateo’s Information Security Policy requires new technology implementations that use passwords to adhere to the following password requirements:

County of San Mateo Password Requirements

1. All users must have unique account IDs that identifies a single account owner

2. First time password must be unique to an individual, and require change upon initial login

3. The permanent / long term password requires an enforceable change every 60 days

4. The password must enforce a minimum of at least 8 characters, and contain at least one character from three of the following:

a. Lower Case

b. Upper Case

c. Numbers

d. Special Characters

5. Password may not be reused – system is configured to remember last 12 passwords

Data Classification Standards In order to apply the proper security safeguards to digital assets, the County of San Mateo classifies new technology both to a Sensitivity and Criticality class. The following information defines those classification standards and is added as a resource to answering the questions in Section 2, ‘Product Information’.

Section 8: Non-Compliance Please explain area(s) of non-compliance. Provide information as to the services or systems that would be impacted as well as the proposed remediation/mitigation, if any.

NOTE: All non-compliance must file an Information Security Risk Acceptance Form

Yes No

Section 9: Other Documents

Please include any pertinent documents, diagrams of network, and/or data flow architecture. Please note other documents may be requested.

Documents included? Yes No

Network Diagrams * required

Data flow diagram * required

Other security documents

This assessment was prepared by (Print Name)

Signature

Date

Phone

San Mateo County Information Services Department Technology Security Assessment Version 15 20221101