This page uses extracted PDF text. Text can misread numbers, dates or table columns. Check the PDF before quoting or interpreting it. Redacted areas remain redacted.
RFP Name RFP 20-xxxx-xxxx
C.5 Does the organization test and validate security controls ☒ Yes Please provide additional information below:
implemented within the system/application? Please describe ☐ No Security controls within the system and
methods whether through internal or third-party audits, applications are tested and validated through a
vulnerability assessments, penetration testing, etc.? comprehensive program that includes both internal
and third-party methods. Regular internal and
external vulnerability scans are performed on IT
systems, networks, and code. Annual penetration
tests are conducted by both internal teams and
third-party assessors, with results reviewed by
management and remediation tracked through
resolution. The organization also participates in a
bug bounty program, where security personnel
triage and resolve reported vulnerabilities. Security
Information and Event Management (SIEM) tools
are used to monitor for system events and alerts,
with actionable notifications tracked in a ticketing
system. Dynamic and static application security
testing (DAST/SAST) solutions are deployed to
identify vulnerabilities in code during development
and production. Continuous application security
reviews, quarterly vulnerability scans, and annual
third-party security assessments are part of the
process. The organization adheres to industry
standards such as NIST 800-53, ISO 27001, and SOC
2, and maintains a mature vulnerability
management policy and regular security
assessments.
C.6 Does the organization’s application/system use strong ☒ Yes Please provide additional information below:
cryptography and security protocols (for example, SSL/TLS, ☐ No All data in transit is protected using strong
IPSEC, etc.) to safeguard information data during transmission? cryptography and security protocols, including TLS
1.2 or higher and SSL for user transmissions. Only
strong algorithms, ciphers, and protocols are used,
and industry standards such as FIPS-140/NIST are
met. IPSEC and other secure protocols are also
Page 11 of 19Jump to an indexed page (163 of 163)