This page uses extracted PDF text. Text can misread numbers, dates or table columns. Check the PDF before quoting or interpreting it. Redacted areas remain redacted.
RFP Name RFP 20-xxxx-xxxx
SECTION C: Please complete the following for proposed ON-PREMISES SYSTEMS
STANDARDS COMPLIANCE COMMENTS/ADDITIONAL INFORMATION
C.1 Payment Card Industry Data Security Standard (PCI-DSS) ☒ Yes Please provide additional information below:
If applicable, is the solution compliant with PCI-DSS? Please ☐ No Flock does not collect, store or process PCI data,
provide evidence of industry certification of compliance. ☐ N/A however, the solution is compliant with PCI-DSS.
C.2 Health Insurance Portability and Accountability Act (HIPAA) ☒ Yes Please provide additional information below:
If applicable, is the solution compliant with HIPAA? Please ☐ No Flock does not collect, store or process PHI,
provide evidence of industry certification of compliance. ☐ N/A however, the solution is compliant with HIPPA.
C.3 Personally-Identifiable Information (PII) ☒ Yes Please provide additional information below:
If applicable, is the solution compliant with requirements to ☐ No Flock does not collect, store or process PII. Flock
secure PII? Provide evidence of compliance. ☐ N/A Safety has a formal privacy policy, encrypts data at
rest and in transit, restricts access, and is compliant
with CJIS, PCI DSS, ISO 27001, SOC 2, NIST 800-53,
and HIPAA. Evidence includes risk assessments,
privacy policies, and adherence to industry
standards.
C.4 Does the organization maintain an active vulnerability ☒ Yes Please provide additional information below:
management program to identify and remediate vulnerabilities ☐ No The organization maintains a comprehensive
in the system/application which is implicated throughout the vulnerability management program with regular
product lifecycle? vulnerability scanning, risk assessments, and
remediation processes throughout the product
lifecycle. Vulnerabilities are identified using
automated tools, tracked, and remediated within
defined timelines based on severity. The program
includes continuous monitoring, annual
penetration testing, and a documented policy
approved by management.
Page 10 of 19Jump to an indexed page (163 of 163)