Partially No C-3. Service Provider will provide, if requested, examples of N/A security documents, which Service Provider maintains. Yes Partially No C-4. Service Provider maintains formal incident response procedures. Service Provider will provide evidence of these N/A procedures; redacted versions are acceptable. See Request for Yes Documentation. Partially No C-5. Service Provider maintains policies that protect Customer's information against unauthorized access. N/A Yes Partially No C-6. Service Provider policy prohibits sharing of individual accounts and passwords. N/A Yes Partially No C-7. Service Provider policy implements the following N/A Information Security concepts: need to know, privilege, N/A Yes and checks and balances. Yes Partially No C-8. Service Provider receives timely notification and implements recommended solutions for security vulnerability N/A alerts (e.g., N/A Yes Partially No C-9. Service Provider requires system administrators to be trained and qualified. SAMPLE C-10. Service Provider implements AAA (Authentication, N/A Authorization, Accountability) for all users. Service Provider performs background and reference C-11. checks for individuals handling sensitive information. N/A C-12. Service Provider has termination or job transfer procedures designed to immediately prevent unauthorized Northwestern University Service Provider Security Assessment Page 4 of 15
C-3. Service Provider will provide, if requested, examples of security documents, which Service Provider maintains. C-4. Service Provider maintains formal incident response procedures. Service Provider will provide evidence of these procedures; redacted versions are acceptable. See Request for Documentation. C-5. Service Provider maintains policies that protect Customer's information against unauthorized access. C-6. Service Provider policy prohibits sharing of individual accounts and passwords. C-7. Service Provider policy implements the following Information Security concepts: need to know, privilege, and checks and balances. C-8. Service Provider receives timely notification and implements recommended solutions for security vulnerability alerts (e.g., C-9. Service Provider requires system administrators to be trained and qualified. C-10. Service Provider implements AAA (Authentication, Authorization, Accountability) for all users. C-11. Service Provider performs background and reference checks for individuals handling sensitive information. C-12. Service Provider has termination or job transfer procedures designed to immediately prevent unauthorized N/A Yes N/A N/A N/A Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No SAMPLE Northwestern University Service Provider Security Assessment Page 4 of 15
Sample_SPSA_Read_Only.docx