This page uses extracted PDF text. Text can misread numbers, dates or table columns. Check the PDF before quoting or interpreting it. Redacted areas remain redacted.
RFP Name RFP 20-xxxx-xxxx
annual penetration tests are conducted. The
program includes continuous monitoring, risk
assessments, and public vulnerability reporting
channel.
B.6 Does organization validate and test implemented security ☒ Yes Please provide additional information below:
controls? Please describe methods whether through internal ☐ No Security controls are validated and tested through
or third-party audits, vulnerability assessments, penetration regular internal and external vulnerability scans,
testing, etc.? annual third-party and internal penetration tests,
bug bounty programs, SIEM monitoring, and
security assessments.
B.7 Does the organization’s solution use strong cryptography and ☒ Yes Please provide additional information below:
security protocols (for example, SSL/TLS, IPSEC, etc.) to ☐ No Data in transit is protected using strong
safeguard information data during transmission between cryptography, including TLS 1.2 or higher and SSL
networks? for user transmissions. Secure protocols such as
HTTPS, SFTP, and VPN are used, and cryptographic
mechanisms like TLS and IPSec are implemented to
ensure confidentiality and integrity during
transmission between networks.
B.8 Does the organization’s proposed solution maintain a ☒ Yes Please provide additional information below:
defense-in-depth security architecture incorporating intrusion ☐ No The solution employs a defense-in-depth security
detection, firewalls, and other network security monitoring architecture with AWS WAF firewalls, AWS
and access control mechanisms? GuardDuty for intrusion detection and prevention,
continuous network monitoring, access controls,
endpoint protection, DDoS mitigation, and regular
vulnerability scanning.
B.9 Does the organization provide adequate controls to protect ☒ Yes Please describe controls below:
against malicious code in hosted environment? ☐ No Adequate controls are in place, including
signature-based and heuristic malicious code
protection, automatic updates, real-time and
periodic scans, blocking/quarantining threats,
endpoint security, and continuous monitoring.
Access controls, secure coding, vulnerability
management, and incident response procedures
Page 5 of 19Jump to an indexed page (163 of 163)