A-16. Provide references from organizations that have utilized services similar to you intend to provide to Northwestern. Include name, contact information and length of time service has been provided. B. Site Details B-1. Where is the Service Provider's primary production site located? What is the tier rating and applicable standard of this datacenter? B-2. If Service Provider has an alternate (backup) site, where is that located? What is the tier rating and applicable standard of this datacenter? B-3. Would Service Provider accommodate Customer's request and allow for a site visit for a security audit, given 48 hours notice? B-4. Service Provider has and will provide summary results of a third- party external Information Security assessment conducted within the past 2 years (SAS-70 Type II, penetration test, vulnerability assessment, SysTrust, WebTrust, etc.). See Request for Documentation. B-5. Does Service Provider user other facilities (e.g., collocation) to process or Customer's data? Please provide details: name, location, description of services. What is the tier rating and applicable standard of this location? Please provide summary results of a third-party external Information Security assessment conducted within the past two year (SAS-70 Type II, penetration test, vulnerability assessment, etc.) for this location. See Request for Documentation. B-6. Does Service Provider permit any non-U.S. facility to access, process or store Customer's data? C. Policies, Standards and Procedures C-1. Service Provider has formal written Information Security Policies? of this is by evidence (e.g., table of will be See Request for Response: N/A Yes Partially No N/A Yes Partially No on 2.
C-3. Service Provider will provide, if requested, examples of security documents, which Service Provider maintains. C-4. Service Provider maintains formal incident response procedures. Service Provider will provide evidence of these procedures; redacted versions are acceptable. See Request for Documentation. C-5. Service Provider maintains policies that protect Customer's information against unauthorized access. C-6. Service Provider policy prohibits sharing of individual accounts and passwords. C-7. Service Provider policy implements the following Information Security concepts: need to know, privilege, and checks and balances. C-8. Service Provider receives timely notification and implements recommended solutions for security vulnerability alerts (e.g., C-9. Service Provider requires system administrators to be trained and qualified. C-10. Service Provider implements AAA (Authentication, Authorization, Accountability) for all users. C-11. Service Provider performs background and reference checks for individuals handling sensitive information. C-12. Service Provider has termination or job transfer procedures designed to immediately prevent unauthorized N/A Yes N/A N/A N/A Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No SAMPLE Northwestern University Service Provider Security Assessment Page 4 of 15
C-13. Service Provider provides Customer support with appropriate escalation procedures. C-14. Service Provider has documented change control processes. C-15. Service Provider requires contractors, subcontractors, vendors, outsourcing ventures, external third-party or downstream contracts to comply with policies and Customer agreements. C-16. Service Provider has policy that requires enforceable compliance with federal, state and local regulatory requirements. C-17. Service Provider maintains and executes an Information Security awareness program. C-18. Service Provider has a formal Information Security risk management program for risk assessments and risk management. D. Architecture D-1. Service Provider will provide a network topology diagram/ design. Where Service Provider policy prohibits disclosure of details, a redacted version is acceptable. See Request for Documentation. D-2. Service Provider has implemented and maintains firewall for all with D-3. Service Provider routers and Access Control Lists as N/A Yes Partially N/A Yes Partially N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No Response: N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No SAMPLE Northwestern University Service Provider Security Assessment Page 5 of 15
D-14. Service Provider maintains a wireless network with controlled and secure access points. E. Configuration Controls E-1. All Service Provider's computers and systems are kept current with security patches and protected from malware. E-2. Service Provider employs encryption for sensitive information (protected health information, student identifiable, personnel information, intellectual property, etc.) for external or Internet transmissions with keys of at least 128 bits in length for symmetric encryption and 1024 bits or greater in length for asymmetric encryption. E-3. Service Provider removes unnecessary services from computers that are used to access target systems. E-4. Service Provider's servers have anti-intrusion programs installed (e.g., Tripwire, TippingPoint, etc.). E-5. Service Provider ensures that all vendor-supplied default identifiers and/or passwords or similar "published" access codes for all installed operating systems, database management systems, network devices, application packages, and any commercially produced IT products have been changed or disabled. E-6. Service Provider ensures that passwords are never stored in clear text or are easily decipherable. to whether appropriate security settings are enabled. E-8. Service Provider manages file and directory permissions for "least privilege" and accesses. N/A Yes Partially No Response: N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No SAMPLE Northwestern University Service Provider Security Assessment Page 7 of 15
E-9. Service Provider has implemented redundancy or high availability features for critical functions. E-10. Service Provider deploys change management practices to ensure all system changes are approved, tested and logged. E-11. Service Provider does not use sensitive "live" data for development and/or testing unless the data has been desensitized or redacted. E-12. Service Provider's application security follows industry best practices (e.g., OWASP, SANS Top Twenty). E-13. Service Provider enforces prohibition on tunneling" N/A Yes N/A N/A No N/A Yes Partially No N/A SAMPLE when Provider's personnel are connecting to Customer networks. Yes F. Compliance Controls F-1. Where the Service Provider's system interfaces with portable devices, sensitive information or information requiring protection by law is encrypted when stored on these portable devices and requires password access. F-2. Service Provider ensures that access to sensitive information or information protected by law across a public connection is encrypted with a secured connection and requires user authentication. F-3. Where the Service Provider's product or service manages Protected Health Information (PHI), the product or service is HIPAA compliant. Provide evidence of compliance, e.g. results of assessment or evaluation by 3rd party. See Request for Documentation. F-4. Service Provider's management of any payment card information is compliant with the Payment Card Industry/Data Security Standards (PCI/DSS). Provide evidence of compliance, e.g., results of assessment or by 3rd party, copy of Report of (ROC). See for Partially Response: N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No Comments/Description Northwestern University Service Provider Security Assessment Page 8 of 15
F-5. Service Provider employs an industry standard System Development Life Cycle (SDLC) methodology. F-6. Service Provider's web applications are tested and monitored for common application security vulnerabilities (e.g., SANS Top Twenty). F-7. Service Provider's application servers and database software technologies are kept up-to-date with the latest security patches. F-8. Service Provider's application development and support activities are performed by entities that are solely within the United States. F-9. Where the Service Provider's product or service manages Student Information, the product or service is FERPA compliant. G Access Controls G-1. Access to Service Provider's systems is immediately removed, or modified, when Service Provider's personnel terminate, transfer, or change job functions. G-2. Service Provider achieves individual accountability by assigning unique IDs and prohibits password sharing. G-3. Service Provider's critical data or systems are accessible by at least two trusted and authorized individuals. to are by Service at for all server files, etc. N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No Response: N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No SAMPLE Northwestern University Service Provider Security Assessment Page 9 of 15
G-5. Service Provider's support personnel only have the authority to read or modify those programs or data that are needed to perform assigned duties. G-6. Service Provider's computers have password-protected screen savers that activate automatically to prevent unauthorized access when unattended. G-7. Service Provider employs passwords that have a minimum of 8 characters, expire periodically, and have strength requirements. Service Provider will provide evidence of implementation (e.g., policy statement, screen capture, etc.). See Request for Documentation. G-8. Service Provider's systems require all user access be authenticated (minimally) with a password/PIN, token or biometrics device. G-9. Service Provider utilizes two-factor authentication mechanisms (e.g., a password/PIN and a card, token, etc.) for access to systems. H. Monitoring Controls H-1. Access permissions of Service Provider's support personnel are reviewed at least monthly for all server files, databases, programs, etc. H-2. Service Provider has implemented system logging on all servers, and records at a minimum "who, what, and when". H-3. Service Provider records and reviews on a frequent basis (at least weekly) all system activity occurring "after normal H-4. (at least all logs for failed or failed N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No Response: N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No SAMPLE Northwestern University Service Provider Security Assessment Page 10 of 15