No Service Provider has implemented redundancy or high E-9. N/A N/A availability features for critical functions. Yes Yes Partially No E-10. Service Provider deploys change management practices to N/A ensure all system changes are approved, tested and logged. N/A SAMPLE E-11. Service Provider does not use sensitive "live" data for development and/or testing unless the data has been desensitized or redacted. E-12. Service Provider's application security follows industry N/A best practices (e.g., OWASP, SANS Top Twenty). E-13. Service Provider enforces prohibition on tunneling" when Provider's personnel are connecting to Customer networks. Yes Partially by No 3rd N/A party, F. Compliance Controls Yes copy of F-1. Where the Service Provider's system interfaces with Partially Report portable devices, sensitive information or information requiring of No protection by law is encrypted when stored on these portable N/A devices and requires password access. Yes (ROC). F-2. Service Provider ensures that access to sensitive Partially See information or information protected by law across a public No connection is encrypted with a secured connection and requires for user authentication. N/A Yes F-3. Where the Service Provider's product or service manages Partially Protected Health Information (PHI), the product or service is No HIPAA compliant. Partially Provide evidence of compliance, e.g. results of assessment or evaluation by 3rd party. See Request for Documentation. F-4. Service Provider's management of any payment card Response: Comments/Description information is compliant with the Payment Card Industry/Data N/A Security Standards (PCI/DSS). Yes Provide evidence of compliance, e.g., results of assessment or Northwestern University Service Provider Security Assessment Page 8 of 15
E-9. Service Provider has implemented redundancy or high availability features for critical functions. E-10. Service Provider deploys change management practices to ensure all system changes are approved, tested and logged. E-11. Service Provider does not use sensitive "live" data for development and/or testing unless the data has been desensitized or redacted. E-12. Service Provider's application security follows industry best practices (e.g., OWASP, SANS Top Twenty). E-13. Service Provider enforces prohibition on tunneling" N/A Yes N/A N/A No N/A Yes Partially No N/A SAMPLE when Provider's personnel are connecting to Customer networks. Yes F. Compliance Controls F-1. Where the Service Provider's system interfaces with portable devices, sensitive information or information requiring protection by law is encrypted when stored on these portable devices and requires password access. F-2. Service Provider ensures that access to sensitive information or information protected by law across a public connection is encrypted with a secured connection and requires user authentication. F-3. Where the Service Provider's product or service manages Protected Health Information (PHI), the product or service is HIPAA compliant. Provide evidence of compliance, e.g. results of assessment or evaluation by 3rd party. See Request for Documentation. F-4. Service Provider's management of any payment card information is compliant with the Payment Card Industry/Data Security Standards (PCI/DSS). Provide evidence of compliance, e.g., results of assessment or by 3rd party, copy of Report of (ROC). See for Partially Response: N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No N/A Yes Partially No Comments/Description Northwestern University Service Provider Security Assessment Page 8 of 15
Sample_SPSA_Read_Only.docx