1. i) Does the maintain any under their care, custody, and control or with an Applicant Confidential Information Information Holder? Yes No If please identify the forms of Confidential Information maintained in either digital or hard ‘Yes’, copy: Forms of Confidential information Maintained by Maintained by Estimated Number of Records Maintained Applicant Information Holder Personal Identifiable Information (PII) 0-25K 1M–3M 25K–100K 3M–5M 100K–1M Over 5M Protected Health Information (PHI) 0-25K 1M–3M 25K–100K 3M–5M 100K–1M Over 5M Financial Account Information 0-25K 1M–3M 25K–100K 3M–5M 100K–1M Over 5M Intellectual Property/Trade Secrets Other: ii) If maintained by Applicant, please check all controls in place to manage access to Confidential Information: An information handling and labeling policy dictating what information may be collected and how information should be stored A data retention policy outlining when data may be disposed of appropriately A policy of least privilege defining who may be granted access to information A process for reviewing user access privileges on a regular basis, including when a user changes positions internally A process for removing access privileges upon termination before the user leaves the premises 2. i) Does the outsource any part of their information handling, network, computer Applicant system, or information security function? Yes No If indicate the name of the vendor providing the service: “Yes”, Data Center Hosting: Managed Security: Data Processing: Log Monitoring: Application Service Provider: Intrusion Detection: ii) Please check all due diligence that applies before engaging with a new vendor: Formal assessment of the security associated with the vendor A means to assess the vendors’ security posture such as SAS70, CICA Section 5970, BITS or otherwise Contractual provision to indemnify the organization in the event of a security failure or loss on confidential information iii) Does the Applicant have a formal process in place to verify that the services are being performed as dictated by the contract? Yes No 3. Check each of the following that apply to the Applicant’s information security program: A formal risk assessment methodology which includes at least an annual review of organizational risks
1. i) Does the Applicant maintain any Confidential Information under their care, custody, and control or with an Information Holder? Yes No If ‘Yes’, please identify the forms of Confidential Information maintained in either digital or hard copy: Forms of Confidential information Maintained Maintained by Applicant Maintained by Information Holder Estimated Number of Records Personal Identifiable Information (PII) 0-25K 25K–100K 100K–1M 1M–3M 3M–5M Over 5M Protected Health Information (PHI) 0-25K 25K–100K 100K–1M 1M–3M 3M–5M Over 5M Financial Account Information 0-25K 25K–100K 100K–1M 1M–3M 3M–5M Over 5M Intellectual Property/Trade Secrets Other: ii) If maintained by Applicant, please check all controls in place to manage access to Confidential Information: An information handling and labeling policy dictating what information may be collected and how information should be stored A data retention policy outlining when data may be disposed of appropriately A policy of least privilege defining who may be granted access to information A process for reviewing user access privileges on a regular basis, including when a user changes positions internally A process for removing access privileges upon termination before the user leaves the premises 2. i) Does the Applicant outsource any part of their information handling, network, computer system, or information security function? Yes No If “Yes”, indicate the name of the vendor providing the service: Data Center Hosting: Managed Security: Data Processing: Log Monitoring: Application Service Provider: Intrusion Detection: ii) Please check all due diligence that applies before engaging with a new vendor: Formal assessment of the security associated with the vendor A means to assess the vendors’ security posture such as SAS70, CICA Section 5970, BITS or otherwise Contractual provision to indemnify the organization in the event of a security failure or loss on confidential information iii) Does the Applicant have a formal process in place to verify that the services are being performed as dictated by the contract? Yes No 3. Check each of the following that apply to the Applicant’s information security program: A formal risk assessment methodology which includes at least an annual review of organizational risks
cyberedge-application.docx