Partially Yes Partially No No Service Provider employs an industry standard System F-5. N/A Development Life Cycle (SDLC) methodology. Yes Partially No F-6. Service Provider's web applications are tested and N/A monitored for common application security vulnerabilities (e.g., Yes SANS Top Twenty). Partially to No F-7. Service Provider's application servers and database N/A software technologies are kept up-to-date with the latest Yes security patches. Partially No are F-8. Service Provider's application development and support N/A activities are performed by entities that are solely within the Yes United States. Partially by No Service F-9. Where the Service Provider's product or service manages Response: Student Information, the product or service is FERPA compliant. at N/A Yes Partially for G Access Controls all No server G-1. Access to Service Provider's systems is immediately N/A files, removed, or modified, when Service Provider's personnel Yes terminate, transfer, or change job functions. Partially No G-2. Service Provider achieves individual accountability by N/A etc. assigning unique IDs and prohibits password sharing. Yes SAMPLE Partially No N/A G-3. Service Provider's critical data or systems are accessible by N/A Yes at least two trusted and authorized individuals. Northwestern University Service Provider Security Assessment Page 9 of 15
F-5. Service Provider employs an industry standard System Development Life Cycle (SDLC) methodology. F-6. Service Provider's web applications are tested and monitored for common application security vulnerabilities (e.g., SANS Top Twenty). F-7. Service Provider's application servers and database software technologies are kept up-to-date with the latest security patches. F-8. Service Provider's application development and support activities are performed by entities that are solely within the United States. F-9. Where the Service Provider's product or service manages Student Information, the product or service is FERPA compliant. G Access Controls G-1. Access to Service Provider's systems is immediately removed, or modified, when Service Provider's personnel terminate, transfer, or change job functions. G-2. Service Provider achieves individual accountability by assigning unique IDs and prohibits password sharing. G-3. Service Provider's critical data or systems are accessible by at least two trusted and authorized individuals. to are by Service at for all server files, etc. N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No Response: N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No SAMPLE Northwestern University Service Provider Security Assessment Page 9 of 15
Sample_SPSA_Read_Only.docx