6.16 Are tests and examinations of key controls routinely made, i.e., network scans, analyses of router and switch settings, penetration testing? 7.0 INCIDENT RESPONSE YES NO Does the service provider have a documented process for reporting security incidents involving systems used to 7.1 hosted WMU data to the WMU Unit contact or, if appropriate, law enforcement? 7.2 Are security incidents monitored and tracked until resolved? Is incident information and common vulnerabilities or threats 7.3 shared with owners of interconnected systems or data hosting customers? Will a third party ever have access to the service provider's hardware or systems that store WMU Restricted/Confidential 7.4 Data? Are the service provider's database and Web server access and 7.5 error logs regularly reviewed for anomalies that could indicate a compromise? 7.6 What process does the service provider have in place to identify security breaches on vendor managed systems (e.g. file integrity checks)? In the case of a security breach or unexpected exposure of WMU 7.7 Restricted/Confidential Data, what are the hosting service provider’s incident response procedures? 7.8 What is the service provider's process for disclosing to WMU any data requests, such as subpoenas or warrants, from a third party? 8.0 APPLICATION SECURITY YES NO Does the software development life-cycle model used by the hosting service provider in the development of their software, incorporate features from any standards based framework 8.1 models (e.g. TSP-Secure, SAMM, Microsoft SDL, OWASP, NIST SP800-64 rev 2, )? If so, please specify. Are security components identified and represented 8.1.1 during each phase of the software development life Does the service provider have change management policies in 8.2 place? Is a pre-determined maintenance window used to apply 8.2.1 changes? 8.2.2 How much lead-time will the service provider give WMU of upcoming changes? 8.2.3 How are customers notified of changes?
6.16 Are tests and examinations of key controls routinely made, i.e., network scans, analyses of router and switch settings, penetration testing? 7.0 INCIDENT RESPONSE YES NO 7.1 Does the service provider have a documented process for reporting security incidents involving systems used to hosted WMU data to the WMU Unit contact or, if appropriate, law enforcement? 7.2 Are security incidents monitored and tracked until resolved? 7.3 Is incident information and common vulnerabilities or threats shared with owners of interconnected systems or data hosting customers? 7.4 Will a third party ever have access to the service provider's hardware or systems that store WMU Restricted/Confidential Data? 7.5 Are the service provider's database and Web server access and error logs regularly reviewed for anomalies that could indicate a compromise? 7.6 What process does the service provider have in place to identify security breaches on vendor managed systems (e.g. file integrity checks)? 7.7 In the case of a security breach or unexpected exposure of WMU Restricted/Confidential Data, what are the hosting service provider’s incident response procedures? 7.8 What is the service provider's process for disclosing to WMU any data requests, such as subpoenas or warrants, from a third party? 8.0 APPLICATION SECURITY YES NO 8.1 Does the software development life-cycle model used by the hosting service provider in the development of their software, incorporate features from any standards based framework models (e.g. TSP-Secure, SAMM, Microsoft SDL, OWASP, NIST SP800-64 rev 2, )? If so, please specify. 8.1.1 Are security components identified and represented during each phase of the software development life 8.2 Does the service provider have change management policies in place? 8.2.1 Is a pre-determined maintenance window used to apply changes? 8.2.2 How much lead-time will the service provider give WMU of upcoming changes? 8.2.3 How are customers notified of changes?