No No N/A Service Provider's support personnel only have the G-5. Yes authority to read or modify those programs or data that are Partially needed to perform assigned duties. No N/A H-4. Service Provider's computers have password-protected G-6. Yes screen savers that activate automatically to prevent Partially unauthorized access when unattended. No Service Provider employs passwords that have a minimum G-7. N/A Yes of 8 characters, expire periodically, and have strength requirements. Service Provider will provide evidence of Partially implementation (e.g., policy statement, screen capture, etc.). No (at See Request for Documentation. least N/A Yes G-8. Service Provider's systems require all user access be Partially all authenticated (minimally) with a password/PIN, token or No biometrics device. Response: N/A G-9. Service Provider utilizes two-factor authentication mechanisms (e.g., a password/PIN and a card, token, logs Yes etc.) for access to systems. for Partially failed No N/A or H. Monitoring Controls failed Yes H-1. Access permissions of Service Provider's support personnel Partially are reviewed at least monthly for all server files, databases, No programs, etc. N/A Yes SAMPLE H-2. Service Provider has implemented system logging on Partially all servers, and records at a minimum "who, what, and when". No N/A N/A Yes Yes H-3. Service Provider records and reviews on a frequent basis Partially Partially (at least weekly) all system activity occurring "after normal Northwestern University Service Provider Security Assessment Page 10 of 15
G-5. Service Provider's support personnel only have the authority to read or modify those programs or data that are needed to perform assigned duties. G-6. Service Provider's computers have password-protected screen savers that activate automatically to prevent unauthorized access when unattended. G-7. Service Provider employs passwords that have a minimum of 8 characters, expire periodically, and have strength requirements. Service Provider will provide evidence of implementation (e.g., policy statement, screen capture, etc.). See Request for Documentation. G-8. Service Provider's systems require all user access be authenticated (minimally) with a password/PIN, token or biometrics device. G-9. Service Provider utilizes two-factor authentication mechanisms (e.g., a password/PIN and a card, token, etc.) for access to systems. H. Monitoring Controls H-1. Access permissions of Service Provider's support personnel are reviewed at least monthly for all server files, databases, programs, etc. H-2. Service Provider has implemented system logging on all servers, and records at a minimum "who, what, and when". H-3. Service Provider records and reviews on a frequent basis (at least weekly) all system activity occurring "after normal H-4. (at least all logs for failed or failed N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No Response: N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No SAMPLE Northwestern University Service Provider Security Assessment Page 10 of 15
Sample_SPSA_Read_Only.docx