2024 Detailed Vendor Compliance Questionnaire

Detailed Vendor Security Questionnaire

All fields are required.

"*" indicates required fields

Step 1 of 12

Your Name*

First Last

Your Email*

Company Name*

Information Security

Formal Information Security Policy*

Do you have a formal information security policy?

Policy Acknowledgement Prior to Access*

Are the policies communicated in a way that requires employees to certify their understanding and compliance before access is granted and at least annually?

Evaluation and Maintenance of Policies*

Is there a documented process for the evaluation and maintenance of all security-related policies?

Annual internal audit*

Do internal auditors audit your security and privacy program at least annually?

Annual external audit*

Do external auditors audit your security and privacy program at least annually?

Information Security Awareness Training*

Do you have a formal information security awareness training program?

Compliance with Privacy Laws*

Are procedures employed to ensure compliance with privacy laws/regulation requirements related to maintaining security, confidentiality, and protection of customer data?

Software Development Lifecycle

Software Development Lifecycle Policy*

Do you have a formal Systems Development Lifecycle (SDLC)?

SDLC Policy - Security Requirements*

Do you identify security requirements in your SDLC?

Secure Software Development Activities

Please select the activities that are documented and implemented as part of your Software Development Lifecycle process:

Threat modeling using a standard similar to STRIDE.

Static application security testing (SAST).

Dynamic Application Security Testing (DAST).

Dependency scanning for vulnerable packages, including open source packages.

System Build Policy*

Are system build and baseline standards formally documented?

SDLC Policy - Code Reviews*

Do you perform code reviews as part of your SDLC?

Dev-Stage-Prod*

Are development, test, and operational facilities logically or physically separated?

Developer Access to Production*

Do programmers have access to production, allowing bypass of change control procedures?

Developer Logs*

Are there processes in place to control, monitor, and log developers’ access and changes to the production environment across all internal and external applications that hold APR data?

Software Change Control*

Are all changes authorized and tested as part of a formal change management process?

Peer review*

Is a peer review process by internal developers in place for all published code?

SLSA Compliance

Do you have a well-documented SLSA Level 1 compliant deployment process?

Access to Source Code*

Is access to source code for applications used to support client services restricted to authorized personnel?

Change Control Policy*

Is there a formal change or project management program used for application architecture changes or enhancements?

Software Development Lifecycle (cont'd)

Pen Testing

Are external penetration tests performed at least annually and after any significant infrastructure or application upgrade or modification (e.g. new applications, new databases or other stores, new servers or network hardware)?

Pen Testing Detail*

If penetration tests are completed annually, do you remediate all issues with a CVSS Score>=7.0 or equivalent within 90 days of discovery?

SDLC Security Requirements*

If internally developed applications are used for client services, does each phase of the system development life cycle include security requirements?

SDLC Coding Practices*

If internally developed applications are used for client services, are secure coding practices and secure coding training (e.g., OWASP, CERT) for all developers in place and applied as part of the systems development lifecycle process?

Authenticated Credentials Stored within Code*

Are authentication credentials or sensitive data stored within code?

Masking of Sensitive Data*

Is sensitive data masked when viewing through the user interface?

Do Cookies Contain Sensitive Data?*

If cookies are used with web applications, do they contain sensitive data and an expiration period?

Encryption Algorithms*

Are proprietary encryption algorithms used for the encryption of data?

Cryptographic Key Protection*

Are controls in place to protect cryptographic keys against unauthorized disclosure, modification, loss, and destruction?

Master Key Protection*

Is there a process for generating, securing, and destroying master keys?

Public Key Certificates from Trusted Organization*

Are public key certificates used by the organization issued from a recognized and trusted certificate authority (CA)?

Production Data in Test Environment*

Does your organization prohibit the use of production data in development and test environments?

Database Logging*

Is logging enabled on the database?

Application log events

Please confirm the log events that you maintain, by checking the appropriate choices below:

Users logging in and out.

Read, write, delete operations on application and system users and objects.

Security settings changes, including disabling logging.

Application owner access to customer data for access transparency.

Logs contain user ID, IP Address, timestamp, action performed, object of the action.

Sensitive Data*

Do you maintain a list of sensitive data types that the application is expected to process?

Sensitive Data Diagram*

Do you maintain an up-to-date diagram that indicates how sensitive data reaches your systems and where the sensitive data is stored?

Malicious Code Procedures*

Do you have policies and procedures documented to control, prevent, detect, and remove malicious code?

Implementation weaknesses*

Do you use frameworks, template languages, or libraries that systemically address implementation weaknesses by escaping the outputs and sanitizing the inputs. Examples include ORM for database access and UI framework for rendering DOM.

Service Accounts*

Are service accounts prohibited for end users to utilize?

Acceptable Use Message*

Does the application display an appropriate warning message regarding acceptable use upon user logon?

Password Masking*

Are passwords masked when entered?

Application Logging*

Is logging enabled on the application?

Strict Transports Security Headers*

Are Strict-Transport-Security header with the include Subdomains directive required on all web pages?

Content Security Policies*

Do you set a minimally-permissive Content Security Policy that uses mechanisms such as nonces or hashes?

Access Control

Access Control Policies*

Do you have access control policies documented?

Segregation of Duties*

Have procedures been defined to ensure that all areas of the organization have implemented an adequate level of segregation of duties?

Monitoring Privileged Access*

Are privileged use activities monitored on a regular basis?

Access Rights Review*

Are user rights reviewed quarterly?

Separation of Duties*

Is there an adequate separation of duties between those who review access rights and those who grant access to systems?

Background Checks*

Does your organization perform background checks/screening on employees that include criminal, credit, professional/academic, and references on all full-time applicants and contractors prior to hiring?

Password Complexity*

Are all systems and applications able to enforce password construction requirements?

Password Construction Requirements

Please describe your password construction requirements on customer-facing applications.

Default Accounts Disabled*

Are default accounts renamed, disabled or deleted?

Password Reset Validation*

Do you verify a users identity for password resets?

Password Policy*

Do you have a documented password policy?

SSO*

Is single sign-on implemented for your internal applications?

SSO - IDP email address

If Single sign-on is implemented, do you ensure that identity providers (IdPs) cannot assert email addresses that they do not own?

MFA*

Do you require two factor authentication for remote access connections?

Unique Credentials*

Are users assigned unique credentials?

User Access Rights Review*

Do you have a policy and procedure documented for the review of user access rights?

Enhanced Controls for Admin Accounts*

Do enhanced access controls for application account administrators exist?

Need-Know-Basis*

Is access to business systems granted on a need-to-know basis?

Account Deactivation*

Are unused login IDs deactivated or deleted?

New User Registration Policy*

Do you have policies and procedures for new user registration documented?

Temporary Passwords Secured*

Are temporary passwords communicated to users in a secure manner?

Mobile Computing

Mobile Computing Policy*

Do you have mobile computing policies and procedures documented?

Mobile Device Management*

Do you have a formal and documented mobile device policy and utilize a Mobile Device Management (MDM) solution?

Remote Access

Remote Access Policy*

Do you have documented remote access policies and procedures?

Incident Reporting

Incident Reporting*

Do you have a formal security incident reporting process?

Security Event Reporting*

Do you have policies and procedures for reporting security events to clients within 24 hours?

Asset Management

Asset Management Policy*

Do you have a formal asset management policy and procedure?

Asset Disposal Policy*

Do you have a formal process for the removal of property such as production hardware, software, backup tapes, etc. that includes removal of sensitive data?

Return of Assets Procedures*

Do you have documented procedures for termination including procedures for the return of assets and access removal?

Physical and Logical Security

Physical and Logical Security Policy*

Are physical and logical security policies and procedures formally documented?

Third Party Security Requirements*

Do you address security requirements in 3rd party agreements?

Property Pass System*

Is a formal property pass system in place?

Restricted Access to Password Storage*

Is access to password storage files secured and controlled?

Secure Remote Management*

Are secure channels used for remote management of the application and supporting systems? (i.e. HTTPS, SSH)

HTTP redirect*

If any applications are designed to run on top of unencrypted connections, such as OCSP, do you redirect traffic from the HTTP protocol (port 80) to HTTPS (port 443)?

Third Party Couriers*

Are 3rd party couriers bonded?

Perimeter Security Controls*

Are perimeter security controls are implemented?

Security Zone Restrictions*

Is traffic restricted between the various security Zones?

Wireless Network Protection*

Do you have specific policies and procedures for wireless communications and wireless networks?

Physical and Logical Security (cont'd)

PII Policies*

Do you have policies that define, document, and implement security measures covering privacy and protection of Personally Identifiable Information (“PII”) to comply with the relevant legislation and regulation.

Access logs to APR Data*

Do you maintain logs for all access to APR data?

Email Protection*

Do you utilize industry standard best practices for email communications, including the following controls: SPF, DKIM, DMARC, and TLS 1.0 or later with cipher suites supporting forward secrecy, such as ECDHE?

Protection Against DoS and DDoS*

Are the controls in place to protect critical, Internet-facing applications (and related infrastructure) against Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks tested annually?

IDS Segregation*

Are management, Intrusion Detection System (IDS), and other out-of-band networks segregated and secured from other critical network segments?

IDS Systems*

Are intrusion detection system devices deployed to monitor critical network segments?

Server Configuration*

Do you configure servers in accordance with an established security standard?

Wireless Encryption*

If wireless technologies are used, are strong industry standard encryption controls in place?

Audit Log Storage*

Are audit logs archived for at least one year?

Audit Log Review*

Are system and network logs reviewed on a regular basis?

Physical And Logical Security (Cont'd)

Network Intrusion Detection*

Have network intrusion detection systems (NIDS) been deployed to monitor critical subnets?

Host-Based Intrusion*

Has host-based intrusion detection system (HIDS) software been deployed on all critical systems?

Logging*

Is logging enabled on the OS, Event Viewer, etc.?

Event Logs*

Do event logs capture key operational events?

Monitoring Policies and Procedures*

Do you have policies and procedures for the monitoring of system event and audit logging documented?

Malware Controles*

Do you have technical controls in place to address anti-virus, malicious code, spyware, etc.?

Patching Policy*

Has application software been maintained at current release levels and patched in a timely manner?

End-of-Life Technology*

Do you have a process for determining Non-Permitted Technology (software and hardware, based on End-of-Life technologies that are unsupported by the original provider, with known unpatched vulnerabilities) and a clear migration path to remove those technologies?

Key Management*

Do policies cover: key generation, key distribution, key storage, updating keys, revoking keys, recovering keys, destroying keys, and archiving keys?

Concurrent User Sessions*

Does your application allow concurrent user sessions?

Encryption at Rest*

Is encryption leveraged to protect sensitive data at rest in: databases, hard disks, and removable media?

Credential Encryption*

Are all authentication credentials encrypted during transmission and protected in a one-way hash in storage?

MFA*

Is multi-factor authentication required to access restricted information?

Account Sharing*

Are there any instances where an employee would share an account?

Desktop Encryption*

Are desktops and laptops required to be encrypted (please indicate what technology or software is used)

Vulnerability Scans*

Do you have a comprehensive and documented vulnerability scanning program covering all relevant implementation layers, such as client machines, platform, infrastructure including networking devices, OS, and application server. And perform authenticated vulnerability scans at least every 90 days?

Device Locking*

Do you define, document, implement and maintain mechanisms to protect equipment when unattended, e.g. through using device locks and password protected screen locks?

Systems patch management*

Does your organization have policies and procedures for systems patch management documented?

Self-Assessments*

Are routine self-assessments performed to ensure compliance with the physical and logical hosting controls in this schedule?

Physical And Logical Security (Cont'd)

Phyisical Security Controls*

Are physical security controls are implemented to prevent unauthorized access to restricted areas? (i.e. key locks, biometrics, key pad, unique electronic badges, sign in-sign out, escorts, etc.)

Data Center Access*

Is access to the data center, computer room/server rooms secured via multi-factor authentication?

Monitoring of Restricted Areas*

Are restricted areas monitored?

Viewable Sensitive Information*

Can sensitive information be viewed from non-restricted areas?

Security Guards*

Are security guards available 7x24x365 to your hosting facility?

Access List*

Is the list of persons with access to sensitive areas where client data is stored, transmitted, or processed, reviewed regularly or when there are changes to personnel?

Data Center Access Logs*

Are logs from the physical access control process periodically reviewed for unusual activity (e.g., multiple unsuccessful access attempts)?

Physical And Logical Security (Cont'd)

Malware Containment*

Are malware containment and resolution procedures defined and do they include the isolation of infected systems where deemed appropriate?

SIMS and SOC*

Are all applications, host and network-based events collected into a Security Information and Event Management System and monitored by a Security Operations Center in real time 24X7X365?

Security Alerts Centralized*

Are security alerts sent to a centralized location?

Annual Security Reviews*

Do you conduct third-party security reviews at least annually using a common industry standard, such as ISO 27001?

Inbound Port Firewall Restriction*

Are only inbound ports that have a business need configured on perimeter firewalls?

Firewall Default Deny*

Are firewalls and firewall rule sets been configured to enforce a "default deny" policy?

Firewall Rules Validation Semi-Annual*

Are rules on firewalls validated at least semi-annually?

Network Device Maintenance*

Do you have a process for maintaining network device firmware and software are maintained at a level supported by the supplier (e.g., old version, un-patched, etc.)?

Removal of Unnecessary Services on Network Devices*

Have routers, switches, and other network devices been hardened by removing or disabling any unnecessary services?

Operating System Patching*

Are available operating system security patches installed within required time frames (software patches are applied in a timely fashion to help remove or reduce security weaknesses)?

Malicious Code Protection*

Are malicious code protection mechanisms in place and up-to-date?

Isolated Webservers*

Are webservers isolated or segregated on the network?

Dedicated DMZ*

Are webservers in dedicated DMZs?

Configuration Monitoring*

Do you have configuration monitoring on all critical systems?

File Level Security*

Has file level security been enabled on critical / production systems?

Are Additional Ports Open*

Are any additional ports besides TCP port 80 and TCP port 443 (SSL) opened for internet-facing servers?

Encryption in Transit*

Is data encrypted between all internal and external servers?

Application Session Termination*

Does the application session terminate securely upon logoff and after a predetermined period of inactivity?

Support for Forensic Digital Investigation*

Are there trained staff with knowledge, processes, and tools to handle a forensic digital investigation available (internally or from a 3rd party as needed)?

System Auditing

System Audit Policy*

Do you have a formal information system audit process or policy?

Acceptable Use

Acceptable Use Policy*

Do you have a documented acceptable use policy?

User Manual*

Are users provided documented rules that describe responsibilities, acceptable use, and expected behavior prior to receiving access to information and information systems?

Unauthorized Software Policy*

Do you have a documented policy regarding the use of unauthorized software?

Communication of Security Policies*

Has a comprehensive set of written information security policies, approved by management, published, and communicated to all employees, contractors and relevant external parties been put in place?

Default Passwords*

Are default vendor passwords changed following installation of systems or software?

Information Classification

Information Classification Policy*

Does your organization have a formal information classification scheme defined and documented?

Information Labeling and Handling*

Are information labeling and handling policies defined?

Business Continuity

Business Continuity Policy*

Do you have a BCP or DR plan formally documented?

Business Continuity Scope*

Does the business continuity program encompass all activities related to products, services, and locations used to service the Customer relationship?

Backups*

Are backups taken of all systems and data that are used for the services supplied to APR?

Business Continuity Planning*

Is the Business Continuity Plan (BCP) for the application tested at least annually to validate its effectiveness?

Data Restoration Date*

Have you had a successful data restoration within the last year?

Storage with Third Party*

Are encrypted backups stored offsite or with a 3rd party vendor?

Risk Management

Risk Management Program*

Does your organization’s formal risk assessment program identify internal and external risks to the confidentiality, integrity and availability of customer data processed or stored by your organization, regardless of the media?