used to provide the services/solution are conducted at least annually. Audits are performed in accordance to SSAE16 SOC 2 or equivalent (e.g. FedRAMP) industry n/a security standards. Contracted vendor will provide the most recent independent physical and logical audit results to the Minnesota Judicial Branch. The organization has the capability to coordinate Yes 25. disaster recovery and business continuity processes and No plans with the Minnesota Judicial Branch. n/a The organization will provide the Minnesota Judicial Yes 26. Branch with an example of a detailed disaster recovery No continuity of operations plan as part of their response. n/a Plan that is similar to our size and capacity. The proposal must provide a detailed explanation of the security features that are built into the proposed Yes 27. system/solution/service. Note: A diagram of the No system/solution/service with the security feature would n/a be helpful as well. The vendor and system/solution/product/ service/proposal will comply with the requirements of Yes 28. the Minnesota Judicial Branch Rules of Public Access to No Records of the Judicial Branch and applicable state and n/a federal laws/regulations (e.g., HIPAA, FERPA, IRS Publication 1075, FBI/CJIS, and PCI DSS). If Federal, state or industry compliance requirements Yes 29.. pertain to the data (e.g. CJI, IRS 1075, PHI (HIPAA), SSA, No PCI DSS, Etc.) the system/solution/service will comply n/a with the said security policy and industry best practice. All data received from the Minnesota Judicial Branch or created, collected or otherwise obtained as part of this Yes 30.. agreement will be owned solely by the Minnesota No Judicial Branch and all access, use and disclosure of the n/a data shall be restricted to only that which is required to
used to provide the services/solution are conducted at least annually. Audits are performed in accordance to SSAE16 SOC 2 or equivalent (e.g. FedRAMP) industry security standards. Contracted vendor will provide the most recent independent physical and logical audit results to the Minnesota Judicial Branch. n/a 25. The organization has the capability to coordinate disaster recovery and business continuity processes and plans with the Minnesota Judicial Branch. Yes No n/a 26. The organization will provide the Minnesota Judicial Branch with an example of a detailed disaster recovery continuity of operations plan as part of their response. Plan that is similar to our size and capacity. Yes No n/a 27. The proposal must provide a detailed explanation of the security features that are built into the proposed system/solution/service. Note: A diagram of the system/solution/service with the security feature would be helpful as well. Yes No n/a 28. The vendor and system/solution/product/ service/proposal will comply with the requirements of the Minnesota Judicial Branch Rules of Public Access to Records of the Judicial Branch and applicable state and federal laws/regulations (e.g., HIPAA, FERPA, IRS Publication 1075, FBI/CJIS, and PCI DSS). Yes No n/a 29.. If Federal, state or industry compliance requirements pertain to the data (e.g. CJI, IRS 1075, PHI (HIPAA), SSA, PCI DSS, Etc.) the system/solution/service will comply with the said security policy and industry best practice. Yes No n/a 30.. All data received from the Minnesota Judicial Branch or created, collected or otherwise obtained as part of this agreement will be owned solely by the Minnesota Judicial Branch and all access, use and disclosure of the data shall be restricted to only that which is required to Yes No n/a
Appendix-IX-Security-Questionnaire.docx