N/A for all Service Provider provides Customer support with C-13. Yes appropriate escalation procedures. Partially with No N/A C-14. Service Provider has documented change control Yes processes. Partially No N/A C-15. Service Provider requires contractors, subcontractors, Yes vendors, outsourcing ventures, external third-party or Partially D-3. downstream contracts to comply with policies and Customer Service No agreements. Provider N/A C-16. Service Provider has policy that requires enforceable Yes compliance with federal, state and local regulatory Partially routers requirements. No and Access Response: Control C-17. Service Provider maintains and executes an Information Lists as N/A Security awareness program. Yes Partially No C-18. Service Provider has a formal Information Security risk management program for risk assessments and risk N/A N/A management. Yes Yes Partially Partially No D. Architecture N/A D-1. Service Provider will provide a network topology diagram/ Yes N/A SAMPLE design. Where Service Provider policy prohibits disclosure of Partially Yes details, a redacted version is acceptable. See Request for No Documentation. Partially Service Provider has implemented and maintains firewall D-2. Northwestern University Service Provider Security Assessment Page 5 of 15
C-13. Service Provider provides Customer support with appropriate escalation procedures. C-14. Service Provider has documented change control processes. C-15. Service Provider requires contractors, subcontractors, vendors, outsourcing ventures, external third-party or downstream contracts to comply with policies and Customer agreements. C-16. Service Provider has policy that requires enforceable compliance with federal, state and local regulatory requirements. C-17. Service Provider maintains and executes an Information Security awareness program. C-18. Service Provider has a formal Information Security risk management program for risk assessments and risk management. D. Architecture D-1. Service Provider will provide a network topology diagram/ design. Where Service Provider policy prohibits disclosure of details, a redacted version is acceptable. See Request for Documentation. D-2. Service Provider has implemented and maintains firewall for all with D-3. Service Provider routers and Access Control Lists as N/A Yes Partially N/A Yes Partially N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No Response: N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No SAMPLE Northwestern University Service Provider Security Assessment Page 5 of 15
Sample_SPSA_Read_Only.docx