This page uses extracted PDF text. Text can misread numbers, dates or table columns. Check the PDF before quoting or interpreting it. Redacted areas remain redacted.
RFP Name RFP 20-xxxx-xxxx
SECTION B: Please complete the following for proposed CLOUD/HOSTED or HYBRID SERVICES
STANDARDS COMPLIANCE COMMENTS/ADDITIONAL INFORMATION
B.1 Payment Card Industry Data Security Standard (PCI-DSS) ☒ Yes Please provide additional information below:
If applicable, is your organization and the proposed solution ☐ No Flock does not store or process payment card data
compliant with PCI-DSS? Provide evidence of industry ☐ N/A but is compliant with PCI-DSS.
certification of compliance.
B.2 Health Insurance Portability and Accountability Act (HIPAA) ☒ Yes Please provide additional information below:
If applicable, is your organization and the proposed solution ☐ No Flock does not store or process PHI but is compliant
compliant with HIPAA? Provide evidence of industry ☐ N/A with HIPPA.
certification of compliance or other relevant documentation, if
available.
B.3 Personally-Identifiable Information (PII) ☒ Yes Please provide additional information below:
If applicable, is your organization and the proposed solution ☐ No Flock does not collect, store or process PII but we
compliant with requirements to secure PII? Provide evidence ☐ N/A do have a Privacy Policy.
of compliance.
B.4 Does the organization maintain a formal information security ☒ Yes Please provide additional information below:
program that identifies management, operational, and ☐ No Flock maintains a formal Information Security
technical controls to ensure the confidentiality, integrity, and Program based on recognized frameworks (NIST
availability of information systems and data and validates CSF, ISO 27001) and has documented management,
those controls? operational and technical controls. Controls are
validated through regular risk assessments,
self-assessments, audits and continuous
monitoring. The program is overseen by senior
leadership and is regularly reviewed and updated to
ensure effectiveness.
B.5 Does the organization maintain an active vulnerability ☒ Yes Please provide additional information below:
management program to protect systems from known ☐ No Flock maintains a comprehensive vulnerability
vulnerabilities? management program with regular vulnerability
scanning, automated tracking and remediation of
flaws, a formal policy and management oversight.
Critical patches are applied within 15 days and
Page 4 of 19Jump to an indexed page (163 of 163)