Pre-Contract: Types of Evidence to Collect

Question 1

Types of Evidence to Collect

Answer 1

-Penetration Test Results
-Independent attestation – Includes SOC 2 and Type II reports.
-Policies and procedures
-Proof of key controls to evidence effectiveness
-Vulnerability report/evidence of patching
-Continuous monitoring report
-Financials
-DR/BC plans and testing
-Employee counts – Includes key person dependency and any significant changes that have occurred.
-Network diagram – Includes cloud architecture and a data flow diagram.
-Background checks – Includes policies and samples of actual background checks.
-Employee access review
-Training – Includes broad scale (ex., phishing) and specific/targeted training (ex, developers).
-Model risk – Includes validation of models.
-Fraud
-Negative news

*Don’t take data you’re not going to do anything with. You might not need this from every vendor.

Question 2

Penetration Test Results

Answer 2

-This can be difficult for you to get as this can show significant gaps in security.
-It’s okay if they’re not willing to share results to show that they’ve had a pen test.
-Third party completed pen test, data stamped showing they have results, but not the results
-We want to see that they did a pen test and had a pen test to show they closed the gaps
-Process to do pen test and close gaps of the pen test.
-Evaluate the scope of the pen test.
-E.g. if the pen test is on PHI and you don’t do anything with PHI then it’s irrelevant
-Are they completing pen tests on something that matters to you?

Question 3

Independent Attestation

Answer 3

-Includes SOC2 and Type II reports
-Good for a year, usually being done annually

-FedRemMedium certification
-High trust certification
-Do NOT accept these in lou of a security assessment, they can supplement the security assessment

Question 4

Policies and Procedures

Answer 4

Need to be careful about which ones you ask for

Question 5

Proof of Key Controls to Evidence Effectiveness

Answer 5

E.g. Key control is MFA for privilege access, evidence would be MFA is enabled and process doc to show how it works

Question 6

Vulnerability Report

Answer 6

Redacted document may be provided, looking for the fact that they do this and they fix things

Question 7

Continuous Monitoring Report

Answer 7

Vendor security rating tools, We’ll get into the danger of the report in relation to the score and the evidence

Question 8

Employee Counts

Answer 8

-Includes key person dependency and any significant changes that have occurred
-is there someone in the organization that does the majority of the work?
-E.g. We had someone that had a lot of undocumented knowledge.
-We want to know how many employees are in certain areas so you can ensure there is good coverage and separation of duties.

Question 9

Network Diagram

Answer 9

-Includes cloud architecture and a data flow diagram
-Where does the data flow? L1 or L2?

Question 10

Background Checks

Answer 10

-Includes policies and samples of actual background checks
-Are they doing them? How often?
-Sample of background check redact name so you can see that they are doing them

Question 11

Training

Answer 11

Includes broad scale (ex. phishing) and specific/targeted training (ex/ developers)

Question 12

Model Risk

Answer 12

-Includes validation of models
-If they’re producing a model, ask for validation of how they’re doing the modeling

Question 13

Fraud

Answer 13

-Do they have a fraud program?
-What are they doing?