Response: evidence N/A (e.g., Provide references from organizations that have A-16. table of Yes utilized services similar to you intend to provide to 2. Partially Northwestern. Include name, contact information and length of will be time service has been provided. No N/A See B. Site Details Request Yes B-1. Where is the Service Provider's primary production site for Partially located? No What is the tier rating and applicable standard of this datacenter? B-2. If Service Provider has an alternate (backup) site, where is that located? What is the tier rating and applicable standard of this datacenter? B-3. Would Service Provider accommodate Customer's request and allow for a site visit for a security audit, given 48 hours notice? of Service Provider has and will provide summary results of a B-4. third- party external Information Security assessment conducted within the past 2 years (SAS-70 Type II, penetration test, vulnerability assessment, SysTrust, WebTrust, etc.). See Request for on Documentation. Does Service Provider user other facilities (e.g., B-5. collocation) to process or Customer's data? Please provide details: name, location, description of this services. What is the tier rating and applicable standard of is this location? by Please provide summary results of a third-party external Information Security assessment conducted within the past two year (SAS-70 Type II, penetration test, vulnerability assessment, etc.) for this location. See Request for Documentation. B-6. Does Service Provider permit any non-U.S. facility to access, process or store Customer's data? C. Policies, Standards and Procedures Service Provider has formal written Information Security C-1. Policies?
A-16. Provide references from organizations that have utilized services similar to you intend to provide to Northwestern. Include name, contact information and length of time service has been provided. B. Site Details B-1. Where is the Service Provider's primary production site located? What is the tier rating and applicable standard of this datacenter? B-2. If Service Provider has an alternate (backup) site, where is that located? What is the tier rating and applicable standard of this datacenter? B-3. Would Service Provider accommodate Customer's request and allow for a site visit for a security audit, given 48 hours notice? B-4. Service Provider has and will provide summary results of a third- party external Information Security assessment conducted within the past 2 years (SAS-70 Type II, penetration test, vulnerability assessment, SysTrust, WebTrust, etc.). See Request for Documentation. B-5. Does Service Provider user other facilities (e.g., collocation) to process or Customer's data? Please provide details: name, location, description of services. What is the tier rating and applicable standard of this location? Please provide summary results of a third-party external Information Security assessment conducted within the past two year (SAS-70 Type II, penetration test, vulnerability assessment, etc.) for this location. See Request for Documentation. B-6. Does Service Provider permit any non-U.S. facility to access, process or store Customer's data? C. Policies, Standards and Procedures C-1. Service Provider has formal written Information Security Policies? of this is by evidence (e.g., table of will be See Request for Response: N/A Yes Partially No N/A Yes Partially No on 2.
Sample_SPSA_Read_Only.docx