This page uses extracted PDF text. Text can misread numbers, dates or table columns. Check the PDF before quoting or interpreting it. Redacted areas remain redacted.
RFP Name RFP 20-xxxx-xxxx
SECTION D: Offerors must complete the following section for both CLOUD, HYBRID, and ON-PREMISES SOLUTIONS
GENERAL FUNCTIONAL SECURITY COMPLIANCE COMMENTS/ADDITIONAL INFORMATION
Password Controls
D.1 Does the system enforce strong passwords to include ☒ Yes Current Minimum: 12 characters
minimum length and combination of alpha and numeric ☐ No Current Maximum:
characters?
D.2 Can user passwords be automatically changed or account ☒ Yes Current Change Interval:
disabled after a period of inactivity has passed? ☐ No User accounts are automatically disabled after 90
consecutive days of inactivity. However, passwords
are not automatically changed due to inactivity;
password resets are enforced annually, and users
can reset their passwords at any time if needed.
D.3 Can system force users to change default passwords following ☒ Yes Please provide additional information below:
the initial set up or resetting of the password? ☐ No Users are required to change their password prior
to first use, and a password change is enforced
upon account recovery or reset. Default passwords
are changed or disabled before devices are put into
production.
D.4 Can the system prevent auto logon, application remembering, ☒ Yes Please provide additional information below:
embedded scripts, and hard-coded passwords in software? ☐ No The system enforces strong password policies,
prohibits password sharing, and discourages the
use of "Remember Password" features. Controls are
in place to prevent unauthorized code execution,
restrict program execution, and monitor for
embedded or malicious code. Passwords and
secrets are securely managed to prevent
hard-coded credentials. Application security
controls and code reviews help prevent embedded
scripts and hard-coded passwords.
Page 13 of 19Jump to an indexed page (163 of 163)