The system/solution/service has capability to integrate Yes 8. with the State of Minnesota’s Identity and Access No Management (IAM) system. n/a No data of any kind shall be transmitted, exchanged or otherwise passed to or accessed by other vendors or Yes 9. interested parties except on a case-by-case basis as No specifically agreed to in writing by the State of n/a Minnesota. The system/solution/service will encrypt sensitive data Yes in transit and at rest using industry standard encryption 10. No protocols; encryption keys will be managed at least in n/a part by the State of Minnesota. All data will be stored, processed, and maintained solely on designated servers and that no data at any time will be processed on or transferred to any portable Yes 11. or laptop computing device or any portable storage No medium, unless that storage medium is in use as part of n/a the organization’s designated backup and recovery processes. All Information systems will be configured to industry Yes 12. security best practices (e.g., CIS, NIST, etc.). No n/a Anti-Malware software will be installed, running and Yes 13. maintained on all systems. No n/a All physical access to information systems will be Yes 14. controlled and restricted to only those with a need to No physically access these systems. n/a The system/solution/service will be developed Yes 15. according to secure software development best No practices (e.g., OWASP, etc.). n/a
8. The system/solution/service has capability to integrate with the State of Minnesota’s Identity and Access Management (IAM) system. Yes No n/a 9. No data of any kind shall be transmitted, exchanged or otherwise passed to or accessed by other vendors or interested parties except on a case-by-case basis as specifically agreed to in writing by the State of Minnesota. Yes No n/a 10. The system/solution/service will encrypt sensitive data in transit and at rest using industry standard encryption protocols; encryption keys will be managed at least in part by the State of Minnesota. Yes No n/a 11. All data will be stored, processed, and maintained solely on designated servers and that no data at any time will be processed on or transferred to any portable or laptop computing device or any portable storage medium, unless that storage medium is in use as part of the organization’s designated backup and recovery processes. Yes No n/a 12. All Information systems will be configured to industry security best practices (e.g., CIS, NIST, etc.). Yes No n/a 13. Anti-Malware software will be installed, running and maintained on all systems. Yes No n/a 14. All physical access to information systems will be controlled and restricted to only those with a need to physically access these systems. Yes No n/a 15. The system/solution/service will be developed according to secure software development best practices (e.g., OWASP, etc.). Yes No n/a
submittal-form-m-mnit-vendor-security-compliance-questionnaire-outsource.docx